Quote from: Big Time Coin on August 31, 2011, 02:04:03 AM

Thank you for the study. Nice chart porn! You're right about the definition of "anonymous" being the key.

No one has yet volunteered to be an expert witness for the plaintiffs in any court for the allinvain larceny or the mybitcoin class action, despite this being worth tens of thousands of dollars. Gavin has even said in these forums that he doesn't want to be involved in helping the police or private investigators find or target individual users of the bitcoin client. Thinks it would be unethical.

That's a position I have a lot of sympathy for - I can see why you'd have to think about the ethics before actually going and deanonymising individual users - I guess a lot would depend on the context.

Quote from: Big Time Coin on August 31, 2011, 02:04:03 AM

In my experience it always kills these "bitcoin is not anonymous" discussion to point out that despite what Garzik, Gavin, and dan kaminsky claim about the lack of anonymity, not one of them has been able to solve a single stolen bitcoin case. Tens of thousands of dollars just sitting there for the taking if they do, not to mention justice for the victims!

Maybe you can do better ferglar, but I doubt you can do anything beyond expound theory in obtuse academic language either. If you really can link the mybitcoin coins to forum user names, then out with it!

Well, first off, just to be clear, the theft in question wasn't of the mybitcoin coins - it was a separate alleged theft, as reported by the forum user allinvain, on this forum.
Although, there was an indication of a link between the two events.

There are a couple of 'nodes' (addresses which are bound together, using the 'linking' information leakage) which receive Bitcoins, which we believe it looks extremely likely came from the alleged theft, which we can identify as forum users.

This doesn't mean those users had anything to do with the theft - in fact, I'd say its considerably more likely that they didn't and that they either received just donations, or sold goods/services. But I don't know.
We chose not to publish those usernames on our blog.

There wasn't a huge case either way for this decision - the data was all public, and the analysis not *that* hard to re-create; but its not really our role to be doing this sort of thing.
Its not that important to us, analyzing privacy in bitcoin, who the users are - what's important is that we could find them.

Quote from: Big Time Coin on August 31, 2011, 02:04:03 AM

Do you know who the thieves are, or not.

We don't know who the thieves are.
Its probably fair to say that we don't even really want to know who the thieves are.

If the thieves were very careful, and kept all the bitcoin activity at arms length from themselves - e.g. they did all their bad stuff though TOR, (assuming a secure exit node) or through a computer that cannot be traced to them; and if they didn't use any of the Bitcoins they stole to buy or sell anything that could be traced to them (e.g. they left no traceable IP on any webserver of anyone they paid in bitcoins), and if they have no connection to any of the users the transferred accounts to, and if they used the myBitcoin service completely anonymously, and left no logs or payment details or IPs on it, then I believe they are completely anonymous, and won't be found.
I've no idea how they planned on getting the Bitcoins out - maybe there's a service out there where someone will leave $500K in a dead drop box, in exchange for bitcoins - I don't know.

But, if on the other hand, they believed that Bitcoin was sufficiently inherently anonymous, that their transactions would get lost in all that goes on in the Bitcoin network (a reasonable belief), or if they did things like bought traceable goods or services from the users that they sent bitcoins to, or if they left any traces of payment trail on myBitcoin - which we can see that it looks like they sent BTC to - that could be subpoena'd, then they are probably not anonymous.

Our point is that their actions in the Bitcoin network are not getting lost in the noise, and there are links there that people could investigate.

Our point is further, that if Bitcoin grows in adoption, in future, like a lot of the people on this forum want, then as things currently stand, with current software, casual users of Bitcoin will leak a lot of information, and leave large traces of their activity behind them, which it'll be possible to follow in an automated fashion.

Currently, a large exchange could probably label an awful lot of bitcoin transactions and flows, with whatever account details the exchange has access to.

Quote from: Big Time Coin on August 31, 2011, 02:04:03 AM

What is your % degree of certainty and can you be an expert witness?

I'm pretty certain of what I just said.

As I said, I couldn't directly provide the identity of the thieves, because I don't know it, and couldn't know it without other pieces of information, such as logs of various services, or information from other users.
Maybe even then it's not available; or maybe it is; thats a question for someone working on solving the theft to worry about. I'm not working on solving thefts, so I'm not likely to be an expert witness for anyone, any time soon.