Hacker News Reader

Comment by Natsu | Hacker News Reader

"Furthermore, honest participants will have picked their addresses uniformly at random, so the process of sorting automatically constructs a random permutation between these participants (dishonest participants must be excluded, since they can generate addresses from a skewed probability distributions)."

Wait... how do we exclude dishonest participants? We're trying to exchange bitcoins with random strangers on the internet here.

View on HN

The sentence is a little unclear, but it is a little clearer if you consider things from the perspective of an organized attacker who controls some number of parties in the transaction. Even if the attacker messes around with the addresses of his keys, he doesn't learn anything about the addresses of the other participants: he can control the order of their keys relative to his, but not the relative order of keys among themselves.

Right. If you think you're dealing with 100 people, but it's actually 1 person with 100 addresses, then they can determine which output address is yours because it is the only one that isn't theirs.

Correct, the usual problems with Sybil attacks still apply: the point is that the attacker doesn't gain anything from faking addresses.

So can you counter that by having everyone make multiple addresses explicitly (and only using some of them)?

Then you could have everyone ante 1/16th bitcoin or whatever minimum is sensible and dispense with the power of two thing, because everybody would have hundreds of wallets in the transaction.

Or does that just create a lot of correlations when those coins get consolidated?

Are we still talking about Sybil attacks?

It would seem harder to flood out the real traders if each person had to make tons of wallets. That would multiply the work required to have enough identities that you would end up trading only with them.

Reply on news.ycombinator.com