Should we disable bip32derivs in PSBT?

Been testing PSBT with testnet coins. Created a watch-only wallet and moved some funds. Saw someone say to disable bip32derivs. But honestly, from what I've read, it seems super important. Like, it ensures the change address exists in both wallets. Makes me kinda nervous thinking about losing funds without that check.

Yeah, bip32derivs shows the derivation path for a key. Some signers need it while others don’t. It really depends on the software or hardware you're using to sign. But here's the kicker: if you share that PSBT, the derivation paths are visible to whoever you share it with.

I’m using Bitcoin Knots for my wallet and node. So, is it a good idea to turn this off? I mean, I’m not sharing it with anyone, but it’s online for signing. Thoughts?

If that's your worry, you can just double-check the transaction before signing. I brought it up in another thread that Knots/Core shows if an output is yours. Tested it both ways with and without bip32derivs.

Wait, so if I disable it, do I need to make a new watch-only wallet? Do I have to use that command or is there a way without RPC? I have RPC off. I’m guessing it doesn’t matter if I’m sticking to Bitcoin Core/Knots for everything, right? Is it safe to turn off? Heard it was off by default until 0.22. Why the change?

When you have bip32derivs enabled, your xpub is included in the PSBT. Anyone can derive the parent descriptor's addresses from that. It's a privacy issue because they could compute private keys only if you’ve leaked one. But if you haven’t leaked any, it’s mostly about privacy. Just imagine if a quantum computer becomes fast enough to do that. Yikes.