This is the part which confuses me about Bitcoin the most. It's meant to be anonymous, yet with some diligent data mining, it can become pretty clear who's who from their spending patterns by observing the ledger. How is that remotely anonymous?
> The traditional banking model achieves a level of privacy by limiting access to information to the parties involved and the trusted third party. The necessity to announce all transactions publicly precludes this method, but privacy can still be maintained by breaking the flow of information in another place: by keeping public keys anonymous. The public can see that someone is sending an amount to someone else, but without information linking the transaction to anyone. This is similar to the level of information released by stock exchanges, where the time and size of individual trades, the "tape", is made public, but without telling who the parties were.
> As an additional firewall, a new key pair should be used for each transaction to keep them from being linked to a common owner. Some linking is still unavoidable with multi-input transactions, which necessarily reveal that their inputs were owned by the same owner. The risk is that if the owner of a key is revealed, linking could reveal other transactions that belonged to the same owner.
Recently there are newer cryptocurrencies like Monero and ZCash that focus specifically on anonymity/privacy.
There’s the IP record of the user hitting the server that processes their request (it might be your own box if you’re storing the whole chain yourself but most people use thin clients). Then there’s the list of inputs (cryptonote based currencies like monero use ring signatures which provide obfuscation but not binary privacy). Then there’s the list of outputs, which may be able to be linked to inputs revealing the transaction graph (zcash helps solve this with their circuit proving technology, but it’s limited in temporal scope by the fact that there’s a transition between transparent and hidden addresses). Then there’s the amounts of a given transaction (modern cryptocurrencies use range proofs to conceal the amounts but older currencies don’t).
To recap, there’s access information like IP, transaction information that can be used to reassemble the transaction graph, and balance information which, again, can be used to reassemble the transaction graph. The broad point is that if you can assemble the transaction graph, any additional information, like a list of known addresses, will severely deprecate the privacy of the entire system.
There are potentially ways around this, but they all involve breaking transaction linkability, which is fraught with peril for a variety of reasons (such that no currency has actually achieved this in a meaningful way so far).
There's also zero knowledge proof contracts on Ethereum that provide privacy, like the mixer tornado.cash
Unfortunately, Bitcoin (BTC) is not anonymous, as you pointed out. It never was; and with tax laws requiring copious transaction information, it is particularly easily traceable.
That's the idea behind Monero & Co., which tries to mix things up a bit (literally). The anonymity is still not perfect, especially against state-level actors.
But it can be used anonymously and probably in some industries is still used anonymously. A counterparty that is willing to swap anonymously acquired and sent altcoins for Bitcoin can provide a privacy conscious individual with anonymous Bitcoins.
If using proxy-chains, Tor, or a real person in another country to broadcast your trade isn't your cup-of-tea because you don't trust them, there is still another less practical way. If you secretly give someone your Bitcoin private key (for example: written on a small piece of paper), you can give or trade those Bitcoins to someone without the network knowing about the transaction.
>so most likely it is the same entity, or a transaction partner.
Conceivably, the transaction could be broadcasted from an important individual's hacked phone or computer without a trace. This is where being innocent until proven guilty becomes important.
Not if amounts are tracked, rather than addresses. "oh look, this gal X just lost 5.3876BTC and gained 3.76549ALTCOIN, and this other dude Y just gained 5.3876BTC and lost 3.76549ALTCOIN. Geeze, I wonder if they traded."
And with the proper graph theory tools, much more complex interactions could be tracked.
It's still not immune to tracing, obviously, but it's a much harder problem than just looking for symmetric transactions.
The simplest system, though, is probably just to spend some BTC renting time on a mining rig. It doesn't have to be profitable, just break even. Newly mined bitcoins have no official history to show who paid for the mining.
"And with the proper graph theory tools, much more complex interactions could be tracked."
> The simplest system, though, is probably just to spend some BTC renting time on a mining rig. It doesn't have to be profitable, just break even. Newly mined bitcoins have no official history to show who paid for the mining.
That is a good idea.
So you've said, and I already agreed that it isn't impossible. But do you have any real-world examples where someone followed reasonable OPSEC (fixed denominations, mixers, randomized timing) and still had their transactions successfully traced via these "proper graph theory tools"?
Typically that would be either the academic researcher attempting to prove that their investigation technique works, or the prosecutor looking to use the results of such an investigation as evidence in a trial.
> When we deal with opsec, we have to consider what is possible...
Anything is possible. Even ideal encryption algorithms—other than one-time pads—have some non-zero probability of being broken within a reasonable timeframe by a brute-force search, but that doesn't make them useless. As long as it's not cost-effective to trace the transfer, that's enough. It doesn't need to be mathematically impossible.
> or the prosecutor looking to use the results of such an investigation as evidence in a trial
I'm inclined to believe in the possibility of parallel constructions being used to cover up the best sources of intel.
> Anything is possible.[...] As long as it's not cost-effective to trace the transfer, that's enough. It doesn't need to be mathematically impossible.
And here, I think it is probably cost-effective to come up with that technology, because it would allow tracing people and transactions that might otherwise be impenetrable. And, if that were the case, I don't have a hard time imagining that it would be of utmost importance to keep such technology under wraps.
But again, at this point it seems like we're comparing pessimism to optimism.
So am I, to a point, but even if they prefer not to disclose their actual methods (and are willing to commit perjury) they can't exactly hide the results. And others wouldn't have any incentive to keep their successes hidden.
> ...I think it is probably cost-effective to come up with that technology...
This isn't a matter of "technology" where some R&D spending up front is likely to lead to a method of cheaply tracing funds. If such a method existed then the system would indeed be broken; it would be akin to finding a critical weakness in an encryption scheme. Barring design flaws, however, the idea is to make all the transactions look the same so that even using your best graph theory tools you can't narrow down the possibilities enough to reasonably investigate all of them. That's what I meant by "not cost-effective": When there are 50 transfers that fit the parameters then you can investigate them all, but if there are 50,000 plausible trails to investigate then that effort would only be worthwhile in very high-profile cases.
Yes, I think that is the fundamental problem with depending on 'mixers' against state-level actors. We both agreed earlier that the tech is theoretically possible. It seems like we're disagreeing about whether someone exists who is motivated enough to build the tech, and whether that person is also motivated to keep their tech under wraps.
> they can't exactly hide the results
It's a known method that US law enforcement has done in the past. Parallel construction is absolutely a thing. https://en.wikipedia.org/wiki/Parallel_construction
> the idea is to make all the transactions look the same so that even using your best graph theory tools you can't narrow down the possibilities enough to reasonably investigate all of them
I just don't get the impression that it's successful. There's a lot of 'metadata' that could be used to narrow the candidates down: geography, time, transaction amount, method of accessing the exchange (API / browser / desktop app ), age of wallets - I don't know which is specifically relevant here, but there's a lot of similar information which could be used to narrow the possibilities down, and most of it could probably involve 'fuzzy logic'. I just don't think that a threat model which includes state-level actors should ignore the possibility that transactions could be traced through mixers.
By the way, I'm really enjoying this discussion. Thanks for playing. :)
With PirateChain it is, but true anonymity brings with it other technical challenges.
If most people report their PirateChain transactions, amount in, amount out, then the problem is that unreported transactions would stick out and would probably be associable with wallets. Am I getting this wrong?
I know it's necessary to report transactions which establish the cost basis for capital gains, but doesn't mandate report of all transactions.
https://www.investopedia.com/articles/investing/040515/are-t...
If you bought a Bitcoin when it was $5000 and you spend 0.2 Bitcoin today (now they're ~$10000 a piece) you would need to report $1000 of capital gains.
You could argue that would make your 0.2 Bitcoin / $2000 purchase cost more, because you have to add the tax. On the other hand, if you sell those Bitcoin later, you would have to pay those capital gains tax anyway.
The story does become a bit more complex when you factor in long-term vs short-term capital gains tax.
If you want an anonymous currency check out something like Zcash or monero. They use some fancier crypto to obscure transaction inputs and outputs, which gets you a bit farther towards being anonymous.
Bitcoin has and always will be a way to cut down transaction costs, cutting out the middle man ie cutting out the banks. To do that, everyone has to be able to audit every transaction and verify authenticity of a transaction. In this way bitcoin is anti anonymous, always has and always will be.
The entire history of every transaction between every wallet is visible. This means if someone knows your wallet ID (i.e. you bought something from them and shipped it) they know exactly how much bitcoin you have in that wallet.
Some people try to be anonymous on it, but as some of the drug dealers on Wall Street Market found out, that's pretty hard to do. Law enforcement was able to track down some of them by tracing their bitcoin transactions.
It's not anonymous anymore. Transactions are being tracked to the ip addresses they originated from. This tracking has been going on since 2014[0]
From the article:
>But there is no top-down coordination of the Bitcoin network, and its flow is far from perfect. The Koshys noticed that sometimes a computer sent out information about only one transaction, meaning that the person at that IP address was the owner of that Bitcoin address. And sometimes a surge of transactions came from a single IP address—probably when the user was upgrading his or her Bitcoin client software. Those transactions held the key to a whole backlog of their Bitcoin addresses. Like unraveling a ball of string, once the Koshys isolated some of the addresses, others followed. >
>Ultimately, they were able to map IP addresses to more than 1000 Bitcoin addresses; they published their findings in the proceedings of an obscure cryptography conference. ....
[0] https://www.sciencemag.org/news/2016/03/why-criminals-cant-h...
Today Monero or maybe ZCash is leading the privacy department and they do offer the anonymity you're after (with some weaknesses of course).
Monero, and to a lesser extent, Zcash are coins that were designed to be anonymous (Although Zcash has opt-in privacy, whereas Monero is default)
Having a public transaction record makes it possible, even easy to identify and track behaviors of anyone.
Everyone you give money to knows exactly where all of that money has been and presumably who you are.
You can make it more anonymous by doing some things, but then it's just ordinary money laundering, but honestly, more difficult.
it's when you connect the transaction to some bank (like, when you transfer from the wallet on your computer to Coinbase where they have your tax ID number, then withdraw to your real-world bank) that it can be so easily traced.
but if you just keep some btc in a wallet and do business out of that it's effectively cash. even if you bought bitcoins on Coinbase then transferred to your local wallet, once it leaves Coinbase the wallet ID itself doesn't have anything tying it to the laptop in your friend's basement in Brazil. from there who knows where it goes, I just bought pizza with it officer idk what the guy who sold me the pizza spent it on
a transaction ledger itself isn't inherently identifiable. otherwise we would know who just transferred $1B+ in this article and not have a bunch of comments wondering who it is lol
Now, there true anonymous cryptocurrency but bitcoin isn’t one of them.
Or in other words, what makes that sentence more true than sentences replacing the word Bitcoin with the words phone/email/pigeon carrier/etc?
Genuine question, not rhetorical - I don't really follow bitcoin.
Bitcoin can be used with novel targets (receiving addresses) for each uniquely received transaction: i.e. instead of having one bank account with all your transactions, each transaction is in its own anonymous bank account. By doing this, outsiders cannot know that two transactions are owned by the same person without that owner otherwise revealing the association via co-mingling funds or revealing ownership off-network (ex. sending to exchange that does KYC+AML).
Also, I can't imagine it's very convenient to manage a large number of separate keys.
You can have one secret master key and then derive many keys from that [1]. Without the master key you cannot tell that they are linked. [1] https://en.m.wikipedia.org/wiki/Key_derivation_function
A computer can do that for you.
...what is a "system administrator" anyway, and why is my computer telling me to ask them for help?
The person "Paying" the other person could have backed up the private key and simply recovered it at a later date to send to another wallet.
Bitcoin is not gold, so don't think of it like gold.
The recipient would be wise to immediately spend the coins to an address only they know, unless they have absolute trust in the giver.
As they say: not your keys, not your bitcoin...