4 ms·

A year ago I was doing a very similar analysis using both the 2011 and 2014 leaked databases. They are publicly available (won't post a link, but I'm sure you c

by remcob 9y ago

A year ago I was doing a very similar analysis using both the 2011 and 2014 leaked databases. They are publicly available (won't post a link, but I'm sure you can find it). My interest was in the privacy aspects of bitcoin. Besides recovering user wallets using the exact same procedure as mentioned there, it was also possible to connect wallets to user email addresses. It only works for accounts in the 2011 leak, as the latter doesn't contain email addresses. So if you were using Mt. Gox at some point, especially before 2012, you should assume your Bitcoin addresses can be linked back to your identity. Assume this includes all your addresses, not just the Mt. Gox one, as it is often possible to link addresses from the same user together. In another experiment, I did a simple clustering on WikiLeak's public donation address. There's a button there to generate a 'unique anonymous donation address'. The clustering found about 200 of these supposedly anonymous donation addresses. At this point I had email addresses linked to 'anonymous' Wikileaks donations — Bitcoin doesn't offer privacy. These are just two examples out of a list of discoveries. I decided not to commercialize this work on moral grounds, but other companies do offer 'blockchain intelligence' services.

3pt14159 9y ago
Bitcoin does offer privacy, you just don't need to take the offer. I personally choose not to take the offer because I don't do anything illegal and I pay my capital gains dutifully. But if you ever want to set up a challenge I'll pay for something anonymously to prove my point. It's not impossible, it's just annoying.
- erikb 9y ago
  A.) Privacy and legality are not strongly connected or related. Privacy is self-preservation. It is very common that you want something that someone else doesn't want. For instance, while you work at company X you may want to see if you can get a job at company Y. You don't want your current boss to know this, before you actually are sure about company Y. B.) If you look closely the privacy here is not just defined by using the right tools. It's also usage patterns. For instance drawing money from two accounts for the same transaction gives people high confidence that the same person controls both accounts. So it's a lot tougher than "just taking the offer".
- remcob 9y ago
  > It's not impossible, it's just annoying. Indeed it is not impossible. It does requires a tremendous amount of expert knowledge. (And people with such knowledge usually have successful careers not requiring this sort of privacy). The Bitcoin client got a lot better over the years as more privacy-enhancing features were added, but it's still far from perfect. For example, traffic analysis on the peer-to-peer network will still give you IP addresses. Creating an anonymous wallet is easy: Create a wallet on an air-gapped computer, send any transaction from a public computer over TOR to https://blockchain.info/pushtx https://blockchain.info/pushtx. Make sure your transactions look average and uncorrelated in all dimensions. Now you need to fund this account without revealing your identity. This is much harder. Mining your own block would be the most anonymous way.
  - zionic 9y ago
    I mean, they can be purchased with cash for one. There are private sites that let you meet up with sellers and transfer completely off the "grid" so to speak.
    - remcob 9y ago
      This approach is propably fine for small one-off transactions, but: * Anonymous cash is difficult and illegal to scale. * 'private sites' can not be trusted (they will be subpoenaed, hacked, wiretapped, etc.). * Sellers will learn your identity, and can not be trusted. * You or the seller may be followed.
  - 3pt14159 9y ago
    Well I don't understand why I'm being downvoted then. I very much agree with you, although for some amounts it isn't too hard to get a wallet funded without resorting to block mining. For example, meet up in person and buy with cash. Not tenable for hundreds of thousands or millions of dollars in a hurry, but certainly possible for tens of thousands, which is what most unaffiliated low level drug dealers want (so they can buy drugs via Tor and resell them in person for cash). The thing is, most people fail to appreciate that security and privacy is a continuum. Just because the NSA could figure out who you are if they were highly motivated to do so, doesn't mean that Immigration Germany can, and when you have prostitutes getting human trafficked through employment visa programs, Bitcoin is a whole lot more private than banking. And if you know you are on the other side of an NSA level attacker, then it is still possible to maintain privacy, it's just exceptionally unpleasant and slow. But once you have the private nodes set up, it's the easiest way of moving hundreds of millions of dollars across boarders. This is why I think it's going to be made illegal. Big gangs have some smart enough cyber guys and they'll use Bitcoin as a shadow banking system. But right now what gives Bitcoin its intrinsic value is greed: People think it might be the currency of the future and they rightly deduce that it will dramatically increase in value if it is. If governments uniformly ban transactions with cryptocurrencies this will collapse like beanie babies. This is what I think will probably happen, although it is possible that governments try to get in and semi-regulate it enough to stop its usefulness by organized crime.
- EthanHeilman 9y ago
  As someone that does research into Bitcoin privacy I can tell you that strong privacy guarantees are extremely hard to achieve in Bitcoin. 1. Your IP address can often be associated with the Bitcoin transactions you create. 2. TOR can make this harder, but fingerprinting a particular Bitcoin wallet between TOR and clearnet is very possible. 3. Almost all tumblers in current use must be trusted not to violate your privacy, that is they know who is who and must be trusted to not tell third parties. I would suspect that some tumblers are run by LEOs. Even if a tumbler is keeping your secrets they may not offer that much protection against blockchain analysis. It is hard to tell that a tumbler is actually providing any on-blockchain privacy. Bitcoin and cryptocurrency privacy is likely to dramatically improve over the next five years, but right now there isn't much actually deployed.

by remcob 9y ago

3pt14159 9y ago

Bitcoin does offer privacy, you just don't need to take the offer. I personally choose not to take the offer because I don't do anything illegal and I pay my capital gains dutifully. But if you ever want to set up a challenge I'll pay for something anonymously to prove my point. It's not impossible, it's just annoying.

erikb 9y ago
A.) Privacy and legality are not strongly connected or related. Privacy is self-preservation. It is very common that you want something that someone else doesn't want. For instance, while you work at company X you may want to see if you can get a job at company Y. You don't want your current boss to know this, before you actually are sure about company Y. B.) If you look closely the privacy here is not just defined by using the right tools. It's also usage patterns. For instance drawing money from two accounts for the same transaction gives people high confidence that the same person controls both accounts. So it's a lot tougher than "just taking the offer".
remcob 9y ago
> It's not impossible, it's just annoying. Indeed it is not impossible. It does requires a tremendous amount of expert knowledge. (And people with such knowledge usually have successful careers not requiring this sort of privacy). The Bitcoin client got a lot better over the years as more privacy-enhancing features were added, but it's still far from perfect. For example, traffic analysis on the peer-to-peer network will still give you IP addresses. Creating an anonymous wallet is easy: Create a wallet on an air-gapped computer, send any transaction from a public computer over TOR to https://blockchain.info/pushtx https://blockchain.info/pushtx. Make sure your transactions look average and uncorrelated in all dimensions. Now you need to fund this account without revealing your identity. This is much harder. Mining your own block would be the most anonymous way.
- zionic 9y ago
  I mean, they can be purchased with cash for one. There are private sites that let you meet up with sellers and transfer completely off the "grid" so to speak.
  - remcob 9y ago
    This approach is propably fine for small one-off transactions, but: * Anonymous cash is difficult and illegal to scale. * 'private sites' can not be trusted (they will be subpoenaed, hacked, wiretapped, etc.). * Sellers will learn your identity, and can not be trusted. * You or the seller may be followed.
- 3pt14159 9y ago
  Well I don't understand why I'm being downvoted then. I very much agree with you, although for some amounts it isn't too hard to get a wallet funded without resorting to block mining. For example, meet up in person and buy with cash. Not tenable for hundreds of thousands or millions of dollars in a hurry, but certainly possible for tens of thousands, which is what most unaffiliated low level drug dealers want (so they can buy drugs via Tor and resell them in person for cash). The thing is, most people fail to appreciate that security and privacy is a continuum. Just because the NSA could figure out who you are if they were highly motivated to do so, doesn't mean that Immigration Germany can, and when you have prostitutes getting human trafficked through employment visa programs, Bitcoin is a whole lot more private than banking. And if you know you are on the other side of an NSA level attacker, then it is still possible to maintain privacy, it's just exceptionally unpleasant and slow. But once you have the private nodes set up, it's the easiest way of moving hundreds of millions of dollars across boarders. This is why I think it's going to be made illegal. Big gangs have some smart enough cyber guys and they'll use Bitcoin as a shadow banking system. But right now what gives Bitcoin its intrinsic value is greed: People think it might be the currency of the future and they rightly deduce that it will dramatically increase in value if it is. If governments uniformly ban transactions with cryptocurrencies this will collapse like beanie babies. This is what I think will probably happen, although it is possible that governments try to get in and semi-regulate it enough to stop its usefulness by organized crime.
EthanHeilman 9y ago
As someone that does research into Bitcoin privacy I can tell you that strong privacy guarantees are extremely hard to achieve in Bitcoin. 1. Your IP address can often be associated with the Bitcoin transactions you create. 2. TOR can make this harder, but fingerprinting a particular Bitcoin wallet between TOR and clearnet is very possible. 3. Almost all tumblers in current use must be trusted not to violate your privacy, that is they know who is who and must be trusted to not tell third parties. I would suspect that some tumblers are run by LEOs. Even if a tumbler is keeping your secrets they may not offer that much protection against blockchain analysis. It is hard to tell that a tumbler is actually providing any on-blockchain privacy. Bitcoin and cryptocurrency privacy is likely to dramatically improve over the next five years, but right now there isn't much actually deployed.