On Sat, Aug 9, 2014 at 6:10 AM, Sergio Lerner <sergiolerner@certimix.com>
wrote:

>  Hi Tim,
>  It's clear from the paper that the second party in the protocol can
> de-anonymize the first party. So it's seems that dishonest shufflers would
> prefer to be in that position in the queue.
>

That's not clear to me. The 2nd party doesn't know how the 3rd, 4th, 5th,
etc. parties shuffled the outputs, since it doesn't have their decryption
keys.