Slashdot Mirror
Third Party Trackers On Web Shops Can Identify Users Behind Bitcoin Transactions (helpnetsecurity.com)
An anonymous reader quotes a report from Help Net Security: More and more shopping websites accept cryptocurrencies as a method of payment, but users should be aware that these transactions can be used to deanonymize them -- even if they are using blockchain anonymity techniques such as CoinJoin. Independent researcher Dillon Reisman and Steven Goldfeder, Harry Kalodner and Arvind Narayanan from Princeton University have demonstrated that third-party online tracking provides enough information to identify a transaction on the blockchain, link it to the user's cookie and, ultimately, to the user's real identity. "Based on tracking cookies, the transaction can be linked to the user's activities across the web. And based on well-known Bitcoin address clustering techniques, it can be linked to their other Bitcoin transactions," they noted. "We show that a small amount of additional information, namely that two (or more) transactions were made by the same entity, is sufficient to undo the effect of mixing. While such auxiliary information is available to many potential entities -- merchants, other counterparties such as websites that accept donations, intermediaries such as payment processors, and potentially network eavesdroppers -- web trackers are in the ideal position to carry out this attack," they pointed out.
The only benefit of Bitcoin is that it's a pyramid scheme.
And they've really got you when you enter your name and shipping address.
If you care about anonymity, one of the first things you do is find a way to deal with cookies.
There are a lot of nice extensions that auto-delete when you leave a page. Not hard to install at all.
Unless you're buying illicit drugs or something, who cares? And if you are, shame on you! You should have been more discreet.
We are just seeing a few of the cases here; eventually bitcoin usage will be individually identifiable in all cases, and governments and big corporations will be happy to look at your block chain and see all you have done.
From what I read in "Chaos Monkeys: Obscene Fortune and Random Failure in Silicon Valley" by Antonio Garcia Martinez, Facebook takes its own data and combines it with third-party data to create profiles on every user, whether logged in or browsing anonymously. If Facebook can do that, everyone else can do the same thing.
Just pair with a couple of exchanges between crypto-currencies, like bcoin to ether to zcash and to whatever crypto-currency on the up and up at the time and then purchase what you want with the final wallet you transferred? Will be harder to go forensics on the blockchain if it's spread between several.
...this seems a lot like saying "If someone sees your face when you buy things with cash, they might be able to identify you".
If you think you're being clever and using anonymous cryptocurrency, and you're too goddamned fucking stupid to not be blocking 3rd party tracking shit, then you're too fucking stupid to deserve privacy or anonymity.
Having web browsers trust any asshole of a 3rd party site to set cookies or run scripts is the dumbest fucking in terms of security.
Sorry, but this is just self inflicted fucking idiocy.
The average website calls out to a slew of companies who do nothing but track you and sell you ads ... if you don't know how to block this shit, don't whine when you learn that being tracked by dozens of sites wherever you go pretty much invalidates any form of privacy you think you have.
like the title says..
Bitcoin was never intended to be anonymous. That's the only part you have wrong.
Will they be able to use this to track down the authors of the DAO hack that prompted the split of Ether into Classic/Not Classic, or of any of the other recent mediatized multi-million dollar thefts?
...it's completely not a feature. Quite the opposite. Everything is tracked, anyone can see what anyone else is doing. Associating wallets with real life people is not especially difficult.
Exactly, which is why knowledgeable users of Bitcoin do not claim anonymity as a feature of Bitcoin. Moreover, Bitcoin itself cannot claim anonymity, it simply has not the property of being anonymous. A red car has the property of being red; it cannot claim that it is blue or red.
A red car has the property of being red; it cannot claim that it is blue or red.
But it can claim to be green, unless it's a Volkswagen...
Anonymity has never been a target for bitcoins.
In fact it's even the contrary, by design.
The whole point of bitcoin is having no central authority. There's no single central "BitCoin Inc." company that handles the transactions and decide which are valid or not (as opposed to PayPal and all the controversies surrounding block funds and transactions - which were among the reasons of some of bitcoins popularity).
The bitcoin protocol achieves that by distributing the "ledger of all transaction" - the blockchain - among all node on the network, and on counting on the agreement of the network majority to decide the validity of transaction.
That means that every single node on the network, by design to achieve this distributed control, must imperatively have a local copy of all transactions on the network.
The only thing is that bitcoin is *pseudonymous* - the transaction aren't signed with your Real Identity, they are signed with cryptographic key pairs on which you control the private part.
Meaning that mapping which transaction is done by whom isn't necessarily obvious.
But of course, if one of the dozens of tracker present in the shops (ad tracker, content optimizer, strategic clients managers, etc.) detects you when you do your buying, chances are high that even these 3rd party will be able to map transaction in blockchain (done with a certain public key) with your detected identy.
(Of course the shop themselves need to do that by design - they need to know you paid and they need to have an address where to send your goods to).
Of course a government has even more means to achieve this kind of unmasking.
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
This has ALWAYS been possible with bitcoin because it has a LEDGER of every transactions you make. That is exactly why it specifically says on the BitCoin web site that it's NOT anonymous.