Perhaps a button to delete old addresses? A verification prompt will say "Are you sure you want to delete all of your old addresses? You must be sure to not send any money to these addresses from now on. Use only new addresses."
Yep, that's pretty much how it works today.
casascius, your idea sounds interesting. I don't know about implementing the whole thing you have described, but the idea of having only one payout/transaction every week, and combine all deposits and payouts in it is definitely worth something. It eliminates all sorts of timing analysis, as long as there are enough users every week.
It's good that you're not always sending with full precision, but it would be better to choose the amount of precision based on probabilities observed in the block chain. Looking at the last 10,000 blocks or so, the probability of an output having a certain number of decimals after the decimal point was:
- One decimal: 5%
- Two decimals: 21%
- Three decimals: 6%
- Four decimals: 8%
- Five decimals: 1%
- Six decimals: 1%
- Seven decimals: 5%
- Eight decimals: 47%
Right now the precision of each payout is randomized as well. If course, if there are only 2 or 3 payouts (which there are if amounts are small, due to tx fees), then most of them will always have the same precision, because the sum of them must still add up to the amount the user wants to withdraw.
It would be interesting to implement the distribution you have provided instead of blind randomizing. However, I don't see that it does much for anonymization, since the fact that the money came from our service will be visible anyways (as of now, all payouts are mostly done from the same address), and analysis of precision does not do much for identifying the deposit associated with this withdrawal, since they all are randomized. Or am I missing something?