Hacker News Reader

Comment by randomwalker | Hacker News Reader

I'm a co-author of this paper. It's available here: https://arxiv.org/pdf/1708.04748.pdf

The surprise here isn't that Bitcoin isn't perfectly anonymous. There are two new findings. The first is the extent to which your Bitcoin payment details get leaked to third party trackers. I've been writing about the excesses of third party tracking for years [1], and I'm pretty jaded, but the extent of the leaks surprised me.

The second main finding is that CoinJoin isn't enough to protect yourself. We tested this on our own transactions, but also by coming up with a way to identity essentially all existing CoinJoins on the blockchain and analyzing their anonymity.

[1] http://randomwalker.info/web-privacy/

View on HN

thanks for sharing the paper, do you have any plans for a similar study on Monero transactions?

I'd also like to know this

Seems like a good business opportunity to develop and offer a privacy shield service for customers who care.

Is that already what a Tumbler does?

or just use cryptocurrencies that support anonymous transactions?

Yeah, that is what I keep saying every time these "bitcoin is not anonymous" stories pop up. Ditch it and use a cryptocurrency that was designed, engineered and built with anonymity and privacy in mind, like Monero.

That is not the point.

Even if you have a 100% anonymous cryptocurrency, you are spending it on a site that has information about you and your activities on that site. If you are dealing with physical items, it has your address.

If you want "100% anonymity", you make sure that sites have no information about your meatspace identity. You certainly don't share your address. If you're leasing a VPS or whatever, you invent some persona for the account, and SSH via chained VPN services and Tor.

And connect that through a quadracopter mesh network to your local starbucks ISP. Also make sure you don't pick up your delivery until a month after it's shipped, just in case it's being watched.

The point is you can take as many precautions as you want, but you'll never attain 100% anonymity. You get diminishing returns after a while.

The main point is that having stuff delivered is the major risk. Using Tor through nested VPN chains is easy. I can't imagine "quadracopter mesh network". That would attract too much attention, I think.

Doesn't matter, nobody would know where you are, just the quadracopters. You could use dozens of drones if you want obscurity and to strengthen the mesh network. I was also joking.

You pay a runner to make collections, make sure they don't know anything about you. Add runners like you add VPNs.

Definitely use an open WiFi, definitely not your local Starbucks.

What you shifting to make all that subterfuge worthwhile? Other people are likely going to be your weak link.

The idea of using runners seems iffy. Too many people to trust. As you say, "Other people are likely going to be your weak link."

Agreed. However, if someone is leaking your physical address, they really don't need bitcoin addresses at all. They can just join on your address :)

This made me curious about the feasability of an anonymous postal service. One which you pay for with x-coin, with no identity attached, and you get physical deliveries at that address (placed into a box only you can access, maybe with some sort of private key).

With the security cams and all it might be hard, but probably not impossible if enough people are using it.

Thoughts?

dang, would be nice to change title/link to the paper (https://arxiv.org/abs/1708.04748 for non-PDF link). Too much commentary here is reacting to the article title.

(By dang I of course mean https://news.ycombinator.com/user?id=dang)

The article seems ok so perhaps we'll try changing the title to the subtitle instead.

It's been clear for years that Bitcoin transactions aren't anonymous, and that web tracking is pervasive. To use Bitcoin anonymously, one must use mixers, such as Bitcoin Fog. CoinJoin just doesn't cut it.[0] With mixers, you get totally unrelated Bitcoin. Also, one must use VPN services and/or Tor, to avoid tracking. It's rather misleading to write a paper like this without letting users know how to do it right.

0) https://www.reddit.com/r/joinmarket/comments/6d60f0/coinjoin...

Reply on news.ycombinator.com