Slashdot Mirror
Bitcoin Is Not Anonymous After All
Taco Cowboy points out a new study that shows it is possible to figure out the IP address of someone who pays for transactions anonymously online using bitcoins. "The Bitcoin system is not managed by a central authority, but relies on a peer-to-peer network on the Internet. Anyone can join the network as a user or provide computing capacity to process the transactions. In the network, the user's identity is hidden behind a cryptographic pseudonym, which can be changed as often as is wanted. Transactions are signed with this pseudonym and broadcast to the public network to verify their authenticity and attribute the Bitcoins to the new owner. In their new study, researchers at the Laboratory of Algorithmics, Cryptology and Security of the University of Luxembourg have shown that Bitcoin does not protect user's IP address and that it can be linked to the user's transactions in real-time. To find this out, a hacker would need only a few computers and about €1500 per month for server and traffic costs. Moreover, the popular anonymization network "Tor" can do little to guarantee Bitcoin user's anonymity, since it can be blocked easily."
Now that hitman I hired to kill my bookie's drug dealer is going to be able to hire a hacker to find me.
Only idiots thought it was anonymous.
Anonymity was never a feature. Whoever thought that didn't read the bitcoin summary. ;) You not only know where it came from, you know where it has been, too.
The only reason it is popular is that governments didn't have tracking in place so it gained popularity as a currency for drug purchases. They do now have that tracking in place, however, so that ship sailed.
I think the paranoid anti-government crowd are just not good enough at comprehension to know what they're saying or why. They heard that bitcoin was anti-government, so they decided it must be full of magical anonymous unicorns with anonymous rainbow farts.
Bitcoin was NEVER meant to be anonymous. EVER.
And you can absolutely guarantee that the three letter agencies remember every one of them. They can look at who you've made transactions with and usually get a very good idea just from that who you are. I imagine they get more from fronts and hacked/infiltrated organizations. If they need more and you've ever transacted with a commercial entity within their jurisdiction, you are a National Security Letter or local equivalent away from being identified.
This IP address thing is like discovering that the back door is unlocked and open when the front door is secured by a piece of string.
Quattuor res in hoc mundo sanctae sunt: libri, liberi, libertas et liberalitas.
Apart from the whole "bitcoin is only pseudo-anonymous" anyway, the article is wrong.
The IP you can trace a transaction back to is only the IP of the person that told you about the transaction. So unless you're connected directly to the person that made the transaction on the p2p network you're just getting the IP of the client that told you about it. Even then, you don't know if that is the person making the transaction or someone telling you that the transaction was made.
Bad research by people who should know better.
I find it hillarious that they so easily conclude tor doesn't fill these gaps because they deem it too easy to break. That right there is some pretty extraordinary claim, I would want to see them do it if its so easy.
I don't think there is any evidence that tor, in this particular use case, is actually so easy to break. So far all evidence is that weaknesses lie in the services behind hidden services, in browsers used to use web based services in particular, and potentially in hidden services themselves.
A bitcoin node transmitting transactions really should be pretty safe, and if they have any evidence to the contrary, that would be much more interesting than their hand waving clickbait claims.
"I opened my eyes, and everything went dark again"
" Moreover, the popular anonymization network "Tor" can do little to guarantee Bitcoin user's anonymity, since it can be blocked easily"....
What does this sentence even mean?
Bitcoin (Litecoin, Maxcoin, *coin (ok, most) ) can use a proxy. This proxy can go through TOR, I2P, 55 VPNs zig-zagging over the globe.
Bitcoin is Anonymous as you don't need to provide your identity. All transactions are however public: visible in the blockchain. It is like imagining a big mess of encrypted emails that everyone hosts on their machines, but you can only read the ones (spend bitcoins from) you have the key for.
Did I mention: you don't need to run a full node, and you can also use an on-line wallet.
Simple recipe:
1. mine some bitcoins
2. get a VPN
3. Use the VPN to get a free email address (google, riseup or else)
4. Use the VPN to get a VPS hosting
5. set up TOR on VPS hosting (hidden service)
6. and/or set up I2P on VPS hosting (eepsite)
7. Install Bitcoin, Litecoin, *Coin on the machine and run a full node through the VPN, TOR, I2P or combination of them
8. Use the VPN, TOR, I2P (or a combination of them) to access the machine where
9. Use the command line interface to send funds
10. Use any of the libraries to write your own web service to talk to the daemons to manage your funds
There ... find the IP where it came from.... found it ?
Rinse, repeat:
1. buy raspberry PI ...
2. buy throw-away anonymous SIM online (through VPN, I2P, TOR, with bitcoins)
3. install TOR, VPN, I2P, solar panel, gsm modem, Bitcoind, *coind on raspberry PI
4. Take a long ride from home where there is still reception, climb a tree/rock/old building/tower. Install it there
Found my IP ?
and so on ...
Or did they mean: if you just run a full node from home and accidentally connect to one of their servers they propagate, they can see where the transaction was coming from the first time ?
bitcoind --printtoconsole
To be perfectly fair, computer science has a lot of things that "any student can tell you are true" that have not been proven to be true, and the difference is a really big deal in academia (where a significant portion of your job is proving things and publishing the paper explaining the proof).
For example P!=NP is widely believed, highly intuitive, and the bases for some high profile algorithms (cryptography) but has never been proven.
As a big holder and long-time user of bitcoins, I'm in favor of the price not being pushed down. That said, TFS is inflammatory. TFA, which is open access, is actually an interesting read, and it's a clever attack. They also discuss possible mitigations. It's worth a read if you're into bitcoin.
Error 404 - Sig Not Found
It's even simpler than that... the IPs are in a limited pool, and are used for all your network transactions during the period. All there needs to be is an IP correlation between the transaction and that check of your GMail account during the same time period, and the IP links the two, flagging who you are. No need to track back through the ISP who was supposed to have that IP at that time (although that's trivial with a warrant too).
Who thought bitcoin was anonymous? It is a detailed, immutable list of transactions... it is downright transparent...