Hacker News new | ask | show | jobs
by feral 4961 days ago
Actually, I think the suggestion in the report is correct.

I think that what they are getting at here, is the following scenario:

Imagine that you have several addresses, with different balances, in the same wallet. If you do a payment using the normal client, which requires the total balance from all those addresses, this will create a transaction with all those addresses as inputs. In the Bitcoin protocol this provides unambiguous proof that the input addresses are all controlled by the same user. (With some provisos: obviously wallet services overlaid on the network complicate this; as do some other more sophisticated uses of the protocol; but in general, at a protocol level, this is true).

So, that then shows any passively listening third party that all those addresses were under control of a single user. This knowledge can then be applied transitively, to consolidate ownership of large quantities of accounts. (We tried explain this in our paper: http://arxiv.org/pdf/1107.4524v2.pdf Fig 1.6)

What the report is probably getting at, is that an alternative thing to do, would be to instead send all the payments to a new account, in separate transactions. This would introduce a lot more ambiguity for a passive attacker - passive ownership assumptions become a lot less clearcut. You can still try make deductions, but its going to be much larger to do at large scale, and require more statistical assumptions.

Its not completely obvious that this is what the paper is suggesting, but thats my reading of it, and I think that makes sense.

1 comments

Yeah, it's not a clear-cut connection if you do it in multiple steps. Hence the caveat that there are ways to make it (more) true. But what improvement in anonymity does it provide over leaving them separate? If they can't infer that X belongs to you, then if you don't send it to account Y (linked to you) you certainly don't leak that X belongs to you. If you do, it's not proof, but it certainly doesn't improve matters.

Don't take it to extremes - this can clearly be stretched to include running the whole process through mixers and back to a single address while improving anonymity. It doesn't say that. In principle, is combining addresses better for anonymity than not?

I think what you're looking at is something more like, if someone employs this tactic, they can't identify that addresses X, Y, and Z belong to the same person, whether or not they know who that person is.

Linking together abstract pieces like that can be one of the first steps to figuring out a very anonymous network.

I can't tell if you're agreeing with me or disagreeing...

And yes, those links are basically all you can use in an anonymous network to deanonymize actions. So how is linking things better than not?

Now I think I'm just confused by the way you're describing things. I'll hope someone else is better able to understand.
Hah, sorry if I am :) Not sure how I can significantly improve things without writing a blog post or something :|

Anyway. Thanks for chiming in :)