Quote from: kjj on September 01, 2011, 02:33:41 AM

Quote from: fergalr on August 31, 2011, 11:19:13 PM

1) Active attacks on anonymity, on the bitcion network.
There's some people using mixers. But how do you know your coins are really mixed?
Lets say you trust the mixer.

But what if your coin is mixed with a bunch of other coins, all of which belong to an adversary?
If I was interested in actively attacking Bitcoin, I'd be flooding mixers all the time.

I could make it appear to another user that their coins were mixed, when in actual fact, I controlled all of the coins they were mixed with, and could tell for sure what the incoming and outgoing coins were.
Obviously, as the mixer takes a fee, there's a cost, in Bitcoins, to doing this.

But, while I've seen a lot of talk on mixers out there, I haven't seen this sort of threat mentioned (maybe I'm missing something - this is something to consider, not something I've thought about in depth.

If the mixer is designed well, and if the operator of the mixer is trustworthy, then it doesn't matter much what coins you get back, the same ones, or different ones.

Is this definitely true, though?
Like, imagine if you go and use a mixer - and, from what I read, they currently have a fairly low volume - and I'm there, flooding the mixer with bitcoins, from lots of different addresses. You come away with some of my Bitcoins. I know you got them from the mixer. I come away with the address that the mixer gave me, which I know belongs to someone else that just used the mixer. If its just you and me using the mixer, you might think your coins have been mixed, when they really haven't.

I guess a lot depends on the design of the mixer, the time lags it supports, etc - but there's no real way of telling, with an attacker that's really willing to flood the mixer, if all the other bitcoins your bitcoins were 'mixed' with, are controlled by a single party.

I've not really thought about this - I imagine someone has done the math - but I guess its pretty important that lots of people are using mixers, for them to be secure -- and you can't really measure that simply by coin throughput.

It'd surely be better if mixing was built into the protocol - but thats easy to say...

Quote from: kjj on September 01, 2011, 02:33:41 AM

The crypto community probably already has a pretty good idea of which properties the mixer needs to have. I bet that the cypherpunks list probably even had detailed discussions on how to create a distributed system that didn't rely on the trustworthiness of any particular subset of mixer operators. We just don't know which thread to look in, because they didn't know they were talking about bitcoin at the time, they thought they were talking about an email mixer, or how to protect an onion router from traffic analysis attacks, or something.

Yeah, great point - this stuff is probably well trodden ground, in different contexts; probably makes more sense to read up on it, than to just speculate.

Quote from: kjj on September 01, 2011, 02:33:41 AM

I liked the paper, by the way.

I always consider claims of anonymity to be false until shown true. And even then I'm still cautious. I remember well that the first few things I had read about bitcoin made claims about anonymity that (surprise!) later turned out to be less than true. I tend to blame journalists for bad journalism, but in this case I might be willing to cut them some slack. Bitcoin is hard.

I would say that by now, most people in the community (at least in the threads that I read) have a fairly good idea of the level of privacy actually available for various types of transactions. Of course, an attacker with the ability to aggregate data from a lot of places can overcome casual efforts at partitioning and end up knowing a hell of a lot.

Some day, there will be a simple web based tool, like blockexplorer, but much more sinister. You'll be able to punch in an address, and it will track things forwards, backwards and sideways. It will magically divine every address in your wallet that you have ever received money from, and if you've ever used or sent to a static address, it will be able to tell you a lot about yourself and what you like to spend your coins on.

The good news is that places that generate new addresses for every transaction will make it much less accurate. And hopefully a network of decent mixmasters will provide hard edges, or at least plausible ones.

Most people don't know how serious white collar investigations work, so they don't realize just how much effort it will be for someone to keep those edges solid. Real investigations cast a wide net. They look at someone, then they look at everyone around that person, and then everyone around all of them, and so forth. They look for coincidences first, and then patterns, and then evidence. Honestly, if you let it get to the evidence stage, you've already lost.

I see a lot of people on these forums that say things like "well, they can't prove ". It doesn't matter. They don't need to prove that step, they just need to see the pattern, and then find some other step that they can prove. Where there is a pattern, there will also be evidence of something, something that they can use. They are professionals, and you are an amateur. They are much better at finding evidence than you are at hiding it.

For anyone seriously considering hiding some crime behind bitcoins, I offer this advice. Don't. And if you ignore that part, try to avoid coincidences, and make damn sure you don't leave patterns. Be many different people, with different personalities, different habits, different patterns. And if you must transfer money from a wallet that can be linked to you (and this is any wallet that you haven't taken great pains to keep apart from yourself), to an illicit wallet, make sure it is for something legitimate, with paperwork, and hopefully eyewitnesses that really think that they saw you buy or sell something. Don't try to launder funds more than once, unless you have a legitimate, documented, witnessed sequence of transactions that will look completely normal and mundane. And finally, make damn sure that you lose a hell of a lot of money along the way. If 50,000 bitcoins leaves one side, 50,000 bitcoins had better not pop up on the other side, not even months or years apart and from totally different directions.

Sorry. This is long, rambling, and I think I veered offtopic a bit. Fun though.

Great stuff - I think your points about anonymity are spot on - there are just so many different channels and patterns to look at.