GNU Taler – Electronic payments for a liberal society

As I understand the scheme, I inform the mint I will have, say $200, wired to it. It gives me a code which I give to my bank when they do the transfer, so that the mint knows the money I told it would be arriving did actually arrive from me. I then get a cryptographic assertion that I have $200 in my wallet. Anonymous purchases work, as when I go to buy something all the information I need to give the seller is the assertion I have the available amount of money, and essentially the seller bills the mint for the cost of the game, which the mint transfers to the seller's bank. The first question is how is bookkeeping done so that money can't be spent twice? One option would be that when I go to buy, say a $60 video game the system cryptographically bounds the purchase to my wallet, so if I go to another retailer it says that I have spent $60 of the original $200 in the wallet, and therefore have $140 left. The other option would be that any transfer into my wallet can only be used once and in full. The discussion does say the wallet holds a transaction history, but that doesn't delinate which of the two previous modes of operation is the case.

There are a few issues with this if using the "wallet-bookeeping option" where proofs-of-purchase are bound to the wallet. One, it doesn't protect against dishonest sellers. Say a customer comes in with a wallet that originally held $200 but they've spent $80. The seller can still bill the mint for $150, and there is no way for the mint to confirm that the customer didn't have that much still left over from their transfer to the mint. Secondly, presumably the proof-of-purchase is cryptographically bound to the wallet, else the buyer will simply discard it. With it bound, discarding the proof-of-purchase discards the remaining money on it. However, for this to work, there must be no recourse for the buyer to recoup the money in a lost wallet. But the user can do this by backing up (which the discussion of Taler notes can be done), which would allow the user to simply discard the version of the wallet with a payment and simply return to the one without it.

Because of this, it seems likely that Taler would make any transfers one-use only, to prevent against this issues. In such a case, the user would then transfer the exact amount of funds needed (or something close, hoping to get change in cash, which wouldn't be sustainable for the sellers if all their buyers are using Taler) as needed right before making their purchase. In that case, it is fully reasonable for the mint to be able to link purchases to bank transfers, since there will only be so many $273.67 transfers (remember, the mint knows who the transfers are from) followed within the next five minutes by $273.67 purchases (and the mint will know the name of the seller).

Fundementally, the issue with all these schemes is that for the mint to not be able to track the purchase, it needs to be able to decouple the processes of taking deposits and paying out purchases among the folks who have money in the mint. It can do this either by making the money holder responsible for the bookkeeping, opening the door to fraud, or to make (as Chaum's Digicash did) each certification a one-time use only, which incentivizes buyers to transfer funds as needed, which allows for at least partial linkability, probably not something which would standup in court in and of itself, but would probably be sufficent circumstantial evidence in a number of cases.

I'm wondering if I'm misunderstanding something, since these issues have all been pointed out with previous anonymized e-cash attempts, and it seems unlikely GNU would go to build a scheme that has these well-known weaknesses. Hopefully I'm wrong, and there is some additional information here that I'm misunderstanding or has yet to be presented. Also, for a useful read on this type of thing see Brands' criticism of Chaum's pseudonym approach in "Building in Privacy: Rethinking Public Key Infrastructrures and Digital Certificates" (pgs. 25-32, although the whole intro is very useful).

EDIT: Making my points more clear, got pretty jumbled in my original post...

From the description it seems like "GNU PayPal" or "XMPP for Stripe".

To me it seems quite desirable: a decentralized protocol for sending government-backed money in a way that is legal (strong crypto isn't protection from being arrested for money laundering), and yet offers better privacy and is more open to competition than existing networks of banks/credit cards/PayPal.

You know, back in the current universe, 3% of LA's streets are already private, yet they don't charge poor Joe to drive on them. Maybe we should look into how those are funded before making assumptions?

I would guess because Taler's tagline is "Electronic payments for a liberal society!"

Is it just me - I cannot understand how it works? There are diagrams and explanations about banks and wallets but no actual "how"?