Internal FBI risk assessment of Bitcoin network [pdf]

http://www.wired.com/images_blogs/threatlevel/2012/05/Bitcoin-FBI.pdf

by p3drosola • 14 years ago

192 150 14 years ago

willvarfar• 14 years ago

I like the presentation style.

The particular phrasing of "assesses with low confidence" took a bit of twisting to understand, though. Its just a convention you have to get use to in these kind of reports, I guess.

pirateking• 14 years ago

Impressively crafted document. Found it to be very concise and educational.

bencoder• 14 years ago

This was leaked quite some time ago and determined to be genuine. Wired's original article: http://www.wired.com/threatlevel/2012/05/fbi-fears-bitcoin/

piokoch2• 14 years ago

Nice document. It shows well the way of thinking of our governments.

"detecting suspicious activity, identifying users, and obtaining transaction records is problematic for law enforcement." - That must deeply hurts FBI people :)

"Despite the virtual nature of Bitcoin, users value the currency for many of the same reasons people trust Federal Reserve notes: they believe they can exchange the currency for goods, services, or a national currency at a later date."

People do not trust "Federal Reserve notes" (or any other official currency) - they are forced to use it, since they must pay taxes in it.

But it is good, that at least some people realize that there is no such a thing like US dollar, only those "notes" printed by Ben Bernanke and his pals.

If one day Bitcoin gets truly popular governments will be in trouble. How to tax that beast? I wonder if there is any other solution then poll tax.

wintersFright3• 14 years ago

People arguably trust FRN's since the majority continue to save in FRN's/bank credits (I agree the trust is misplaced).

Uchikoma2• 14 years ago

With so few people - in Germany at least - having their assets in Gold etc. but in bank accounts in $,EUR,... I assume most people trust the currency.

Tyrant5052• 14 years ago

Doesn't Germany hold a huge amount of gold? Additionally, the only euro country not collapsing on itself?

peteretep2• 14 years ago

> People do not trust "Federal Reserve notes"

Really? There I was thinking foreign governments liked holding their reserves in US dollars...

> that at least some people realize that there is no such a thing like US dollar, only those "notes" printed by Ben Bernanke and his pals

Wake up, SHEEPLE!

piokoch2• 14 years ago

"foreign governments liked holding their reserves in US dollars"

Yes every government has to keep dolar reserve because this is the only currency you can buy oil with. USA managed to force oil suppliers to accept only US dollars.

This is the source of the dollar power and enable FED to print as much dollars as they want. People all over the World must purchase dollars.

cynoclast• 14 years ago

You really do not have a clue how our monetary system works, do you?

TeMPOraL• 14 years ago

> Wake up, SHEEPLE!

Obligatory XKCD ref: http://xkcd.com/1013/.

vectorbunny3• 14 years ago

>People do not trust "Federal Reserve notes"

I trust Federal Reserve notes. US currency has high barriers to counterfeiting and can be exchanged for goods and/or services with actual rather than virtual anonymity. I may be a cave man, but I'm not alone. US banknotes are the 'gold standard' of black and grey markets around the world.

noarchy• 14 years ago

Governments are cracking down on the use of cash in ways that will only help the promotion of Bitcoin. http://www.forbes.com/sites/jonmatonis/2012/10/17/large-cash...

caf• 14 years ago

People do not trust "Federal Reserve notes" (or any other official currency) - they are forced to use it, since they must pay taxes in it.

That doesn't explain why people continue to accept official currency in excess of their anticipated tax bill, or why criminals who aren't expecting to pay tax at all still deal in official currency.

tsahyt• 14 years ago

Because it's easy to spend since others accept it. Money itself has absolutely no value at all. It's more a promise that somebody will accept it when you want to buy something with it.

Daniel_Newby2• 14 years ago

> That doesn't explain why people continue to accept official currency in excess of their anticipated tax bill, ...

It is legal tender for debts. Offering currency to a creditor extinguishes the debt, whether or not they accept it.

Nursie5• 14 years ago

LOL.

Most people do trust cash, within certain limits, because they're not crazy libertarians. The value of bitcoin is every bit as illusory and consensual as paper money.

That it's not under central control and has a fixed supply is interesting, but doesn't give it intrinsic value.

sturadnidge3• 14 years ago

Actually the fixed supply is part of what does give it intrinsic value. Value is fundamentally anything that has utility _and_ scarcity. If the supply of BTC was infinite, it would have essentially no value (or at least it's value would diminish at such a rate that it would be useless for anything).

dia80• 14 years ago

There are two obvious ways in which expanding the money supply can go wrong.

1) Bernake et al. are feckless idiots and will leave the money presses running long after inflation rears its head, a la Zimbabwe, causing hyper inflation and the destruction of the world economy

2) The economy picks up a bit and they stop printing. However, that huge pool of money they have created is enough to drive inflation so high that they are either faced with allowing a period of high inflation 70's style or breaking the economy again with restrictive monetary policy.

Outside wild conspiracy theories I don't think 1 is plausible and 2 is hardly likely to lead to the huddled masses attempting to warm themselves around a pile of burning trillion dollar notes. So I think confidence in the dollar is safe for the interim.

jerguismi• 14 years ago

1) is not plausible unless it happens. Hyperinflations tend to happen only once in a history of a fiat currency.

It sounds a little bit crazy to propose that hyperinflation would happen to one of the really big world currencies (euro, dollar, yen...). But I don't see any technical reasons why it couldn't happen at some point in the future.

OldSchool• 14 years ago

IMO true hyperinflation is extremely unlikely since the US can also "unprint" money at will due to it being mostly digital debt. They will however continue to inflate as much as they think they can.

Related, "gold bugs" may have had a good decade but I also believe that gold's value comes from nothing more than tradition: you can't eat it and you can't defend yourself with it.

nhaehnle5• 14 years ago

If one day Bitcoin gets truly popular governments will be in trouble. How to tax that beast? I wonder if there is any other solution then poll tax.

You would tax Bitcoins in the same way you tax transactions in USD, EUR, and so on. There really is no difference, once you stop to think about it.

Even with the USD, taxation does not work by the government subpoenaing your bank's records. Instead, it is your (or your employer's) responsibility to report your income and related data according to the legal requirements. The same applies to Bitcoin transactions.

Obviously there are some differences in the investigation of tax evasion. But there will still be records somewhere, and prosecution is used to deal with similar problems when transactions are cash-only.

njharman• 14 years ago

> they are forced to use it, since they must pay taxes in it.

Last I checked, people use US Dollars for a fuck load more than paying taxes.

> How to tax the beast.

Cash is and was even more so in the past harder to track than bitcoin and yet somehow the "hooligans" managed to collect taxes.

Ingaz• 14 years ago

I am Russian. Years ago I had strange experience: my friend invited me as unofficial expert.

I was amazed: the guys whom I talked were "right guys". One of them told me: "From the call log I can tell more than a guy think himself" (Excuse me for bad English) M

sliverstorm5• 14 years ago

Nice document. It shows well the way of thinking of our governments.

Yea, it sure does reveal how silly the FBI is. I mean, why would the organization tasked with domestic security & stability analyze the potential threats of Bitcoin? Bitcoin is made of lollipops and rainbows; it could never be used maliciously.

Seriously, analyzing it critically doesn't mean they are afraid of it. It just means it is an unknown that they want to understand.

wintersFright3• 14 years ago

Interesting that they don't address whether there are concerns about it eroding tax revenue or if it is a threat to federal reserve notes.

saraid2162• 14 years ago

I'm guessing it's because that's not something the FBI cares about. The FBI is just a police force; it ain't the Federal Reserve.

wintersFright3• 14 years ago

but you need a police force to enforce fiat :)

johnyzee• 14 years ago

> FBI assesses with high confidence that [...] malicious actors can [...] use botnets to generate bitcoins.

As far as I understand bitcoin (which isn't too far, admittedly), the generation of bitcoins is actually encouraged, and only possible within some well-defined boundaries which basically just ensures that bitcoins are put into circulation up until it hits the fixed limit. Maybe someone could clear that up for me? In that case the "malicious actors" would actually be performing a useful service for the bitcoin ecosystem.

Scaevolus• 14 years ago

It's malicious in the sense that infected machine resources are being used to directly turn a profit for the controller.

Other ways of profiting off botnets include renting out DDoS and spam capabilities.

sliverstorm5• 14 years ago

Not just turn a profit for the controller, but incur a cost for the victim. I measured my computer the other day; when I start mining, my power draw jumps 160 watts, and I have a fairly efficient machine.

ewillbefull• 14 years ago

Interestingly botnets are probably a month away from being unprofitable for mining Bitcoins, in fact GPUs will be unprofitable for mining Bitcoins all-together. ASIC devices are being shipped over the next six months which will increase the mining difficulty substantially.

LaRakel• 14 years ago

The benefit is that the electricity bill goes to the owners of the infected computers.

What does a botnet cost?

Nursie5• 14 years ago

Yes they would be performing a useful function for the bitcoin ecosystem.

No, it's not acceptable to hijack thousands of computers through malware and use their processing power and electricity to mine bitcoin for you. That's why they're malicious, the computers they're using aren't theirs.

rmc3• 14 years ago

The malicious part is because the resources to mine the computers (physical hardware and electricity costs) are born by someone else (the owner of the infected computer).

pdog• 14 years ago

If an attacker controls more than 50% of the Bitcoin network's computing power, they can manipulate transactions. Also, an attacker can fill the network with clients controlled by him, which might be helpful in the execution of other attacks.

mazsa• 14 years ago

pdf: http://www.wired.com/images_blogs/threatlevel/2012/05/Bitcoi...

BUGHUNTER2• 14 years ago

Thank you very much for the direct pdf link, I hate does sites that try to simulate ell established office tools like a pdf viewer in a browser, fail with this and still want to collect your data like email address to give you the real thing. Unfortunately too many people out there are using this crap sites.

p3drosola• 14 years ago

Yeah, sorry about that. I submitted the actual link to the pdf, but HN turned it into a scribd link.

sneak• 14 years ago

> Since Bitcoin does not have a centralized authority, law enforcement faces difficulties detecting suspicious activity, identifying users, and obtaining transaction records

Yeah. Difficulty obtaining bitcoin transaction records. Good on you, FBI.

kybernetikos2• 14 years ago

Hang on, aren't the transaction records public and stored by the whole network?

fredsted• 14 years ago

Yep.

Munksgaard• 14 years ago

I think that's the point.

jarman• 14 years ago

Difficulty obtaining meaningful transaction records. Transaction are public, but often obfuscated.

delinka• 14 years ago

By "difficult" the FBI certainly means "we'd have to perform some amount of manual reconciliation because the meaningful data won't just fall into our laps." Pretty standard for the last 15 years.

As for "obfuscation," I was under the impression that the system doesn't attempt to obfuscate what payment addresses are involved in a transaction. It's not pertinent to the network which physical person controls which addresses.

JulianMorrison4• 14 years ago

Given that Bitcoin records all transactions for posterity, and given the ongoing rise of "big data" analytics, I'd say Bitcoin is likely to be harder, in the long run, to use for shenanigans. A government currency has forms in which transactions create no paper trail. Bitcoin does not.

Really the big disruption Bitcoin could cause if it becomes well established, is to act as a stable reference frame against which the other currencies can be compared (versus now, where they all float against each other). No government owns the Bitcoin printing press. It cannot be used as an instrument of fiscal policy, and it weakens the ability to use government currency as an instrument of fiscal policy.

feral3• 14 years ago

>Given that Bitcoin records all transactions for posterity, and given the ongoing rise of "big data" analytics, I'd say Bitcoin is likely to be harder, in the long run, to use for shenanigans. A government currency has forms in which transactions create no paper trail. Bitcoin does not.

I did some research on anonymity (mentioned in that document); I find it hard to project how private Bitcoin will be in future.

Our impression was that currently many users were careless, and that many identities (in the form of publicly disclosed Bitcoin address ownerships) were linked to meaningful transactions; such that with basic network analysis it was possible to passively observe semantically meaningful transactions, like "the person who owns this twitter account, which seems to be a real person, donated to wikileaks" or "this account which is a public organisation donation address is linked to an address that transferred bitcoins to that other organisation".

We speculated that if Bitcoin became widely used, without changes in usage patterns, then a large e-commerce site (someone like Amazon accepting payments in Bitcoin - leaving questions of scalability aside) could passively observe much of what was going on on the network, because they had so many known identity-address pairs to start with (e.g. shipping addresses).

But the other argument is that its probably relatively easy for usage patterns to change.

I think you have to assume that end-users will always be careless. We see this in almost every security setting. So it doesn't matter whether its possible for sophisticated users to guard their privacy, if you don't get privacy by default.

But people could build overlay systems which are backed onto Bitcoin. A lot of the wallet services are like this already, and are not readily amenable to the blockchain level analysis (although of course you then you are trusting your wallet service with your privacy and money). Alternatively core or client developers could add protocol-level or low-level Bitcoin mixing (again, with an overhead cost, so there might be scalability concerns), or develop client interfaces which encourage more privacy by default.

Its too early to tell how observable/analyzable it'll be in steady state, if it builds traction. I think its possible the system will end up much more observable, for casual users, than cash or even credit cards currently are, but I don't think that's inevitable.

api• 14 years ago

It seems that to do shenanigans with Bitcoin would require the same care to avoid information leakage that would be required to do similar things with global digital payment networks and banks.

The key would be to begin by considering any address linked to an identity that is you or related to you "dirty," and to be careful about avoiding linkage to any of those dirty addresses. To really be careful I think you'd have to delve into graph theory and data mining a bit yourself, or follow the precautions of someone who knows what they're talking about. You'd also have to take care to pay attention to network addresses under the protocol, using Tor or similar proxying systems and considering any address that's been used from an IP that can be linked to you similarly "dirty." Use of VPSes that accept anonymous payment would also be an option, though again... don't SSH to them from your house! Use Tor or smurf the data around by way of proxies and drop sites and such.

Laundering money would require extreme caution to avoid such contamination, and would present many of the same challenges as money laundering in the fiat currency world. BTC/fiat conversions would be very risky. In-person BTC/fiat conversions are vulnerable to old fashioned gumshoe police work: "hey, that BTC you exchanged on localbitcoin... you happen to remember what that guy looked like?" These are also only feasible for small quantities. Large quantities would present a huge challenge.

What this really means is that Bitcoin is not intrinsically an instrument for villainy as some lazy press articles make it out to be. In fact, criminal use of Bitcoin requires orders of magnitude more technical sophistication, which the vast majority of criminals do not have. A highly educated or sophisticated criminal or intelligence network could surely pull off shenanigans with Bitcoin, but I doubt your average thug or child porn wanker is going to even comprehend the stuff I wrote above. So at the very least, Bitcoin is only a criminal tool for very geeky high-IQ criminals.

dmix2• 14 years ago

What about bitcoin tumbling services?

They obscure transactions quickly and cheaply.

Breakthrough2• 14 years ago

Totally agreed, but I think it's worth pointing out that you could technically "own" the Bitcoin "printing press" if the $BTC distribution is skewed drastically to a particular majority (who could then corrupt the protocol/subsequent block chains). This is why initially, many people were told to use different mining pools or exchanges, as I recall there were a few majority cases a year or so ago (even Mt. Gox still handles > 50% of trading volume every day [1]).

That being said, assuming that everyone plays fair, uses common sense, and keeps the Bitcoins distributed fairly evenly, there shouldn't be a problem (after all, that is how Bitcoins were designed).

[1] Bitcoin Charts, "Exchange volume distribution." http://bitcoincharts.com/charts/volumepie/

jeremyjh• 14 years ago

I've seen estimates that you could execute a continuous 51% attack for as little as 80 million in hardware. That's quite affordable to any central bank that feels threatened. I think a couple weeks of this would destroy all confidence in BTC.

theorique• 14 years ago

assuming that everyone plays fair, uses common sense

Big assumption.

mtgx• 14 years ago

EU has released a report on digital currencies recently where they talk about Bitcoin as well, and they worry it would threaten the central banks (an obvious one):

http://www.dgcmagazine.com/bitcoin-the-european-central-bank...

http://www.ecb.europa.eu/pub/pdf/other/virtualcurrencyscheme...

tbrownaw• 14 years ago

Really the big disruption Bitcoin could cause if it becomes well established, is to act as a stable reference frame against which the other currencies can be compared

What would make it any more (or less) stable than the traditional reference currencies of gold, ammo, and canned baked beans?

JulianMorrison4• 14 years ago

I do wonder if governments will be forced to stockpile heaps of BTC like they stockpile vaults full of gold, to try and manipulate the exchange rate.

PaulAJ2• 14 years ago

Bitcoin prices will be no more stable than conventional currencies, because money supply is a rate (BTC / sec) rather than a total volume (BTC). As commerce using BTC slows down so the money supply decreases. As commerce speeds up so the money supply increases. The exact relationship between the money supply and inflation complicated and somewhat controversial (see Wikipedia for more info), but there is no doubt that if, for instance, all the people currently holding Bitcoins as an investment were to sell them then the value of Bitcoins would drop, because the money supply would increase.

oillio• 14 years ago

The supply of bitcoins used as currency is fixed while the supply to all other reference currencies are variable in some way or another.

Fiat is obviously variable on the whims of the issuing government.

Gold may be taken out of circulation to make jewelry or electronics (or another use not yet discovered). Ammo and baked beans can be consumed. Bitcoin has no utility value and cannot be used for anything other than as a currency.

Similarly, the supply of these other items can be expanded. An asteroid full of gold could be mined, a new ammunition factory built, or a bean farm planted. Bitcoin has no physical identity, it cannot be reproduced, counterfeited, or grown outside of the well defined properties laid down in the original protocol.

Bitcoin is truly the first pure reference currency. Manipulative games can still be played with bitcoin markets, but the risk of external non-economic events affecting your money supply is removed. A political party can't decide the world needs more bitcoins, a new vein of bitcoins cannot be discovered, and nor can a new use for bulk bitcoins be invented.

conroe64• 14 years ago

This would only be true if the owner of every address within the bitcoin network could be determined by a government entity. Since bitcoin is international, this is impractical if not impossible depending on the relationship between the nation of the owners where the coins have gone through and the nation trying to determine the source/destination of the funds.

Daniel_Newby2• 14 years ago

> It cannot be used as an instrument of fiscal policy, ...

Other than reserve requirements for lending bitcoins, accounting regulations for considering earned bitcoins as either cash income or accrued income, underwriting requirements for bitcoin-denominated loans, excise taxes on bitcoin transactions, and so forth.

Issuing currency is not the goverment's major control on the money supply.

BUGHUNTER2• 14 years ago

Another part of the global anti-cybermoney-publicity-campagne that we can see right now starting is a study of the European Central Bank on "Virtual Currency Schemes", Oct. 2012.

Read it: http://www.ecb.int/pub/pdf/other/virtualcurrencyschemes20121...

Edit: BTW, if you are interested in international monetary policy you can find many important publications on the ECB site:

http://www.ecb.int/pub/html/index.en.html

nhaehnle5• 14 years ago

I suspect you may be overreacting with the tinfoil-hattery. Obviously those institutions like the ECB and the FBI are interested in virtual and new currencies. That's part of their job!

But if you actually read those publications, you'll notice that they aren't very urgent at all. Their stance is basically that they want to keep up with the development, but don't see a reason to act right now.

sturadnidge3• 14 years ago

s/Bitcoin/cash/ and all the negative arguments about propensity for criminal activity are quite amusing.

Nursie5• 14 years ago

It's a bit harder for someone to take over your computer to create cash.

It's pretty hard for someone to hijack your wallet with a Trojan and if they do get into your bank account that way then the police and the bank might take an interest.

I know this is a meme in the BTC community - any criticism of BTC as a payment method is met with the claim that "it's just like cash" and any criticism of weaknesses of BTC as a currency is met with the claim that "it's a payment method and a commodity". To me it pretty much fails at all of the above.

There's no doubting it's good for purchasing contraband though.

PeterisP• 14 years ago

Bitcoin does share some those properties with cash. That's the whole point.

Cash (in volume) is currently treated with suspicion for criminal activity, and is the center of attention for policing crime/drug money, financial fraud and money laundering. So bitcoin should be as well.

And it can be regulated in the same way as cash - you can ask financial institutions to report any bitcoin deals above $xxx (as they do for cash), you can regulate any intermediaries/payment services to follow the existing money laundering laws also for bitcoin - a core provision is know-your-customer, i.e., no anonymous customers allowed.

Tyr42• 14 years ago

What does the "(U/FOUO)" that keeps showing up mean?

ecito• 14 years ago

Unclassified / for official use only

natep• 14 years ago

Unclassified/For Official Use Only. Basically means that it's not Secret, but still can't be distributed without permission. Different organizations have different discipline structures around leaking FOUO material, but I don't think there are any legal implications.

count• 14 years ago

http://en.wikipedia.org/wiki/Sensitive_but_unclassified

Monotoko• 14 years ago

"For instance, child pornography and Internet gambling" - So, me playing the UK National Lottery online is illegal? o.o

ninetax3• 14 years ago

I would love to participate in this discussion, but I feel like I don't know enough about the economics of currency to make any real contribution.

Does anyone know of some good resources (online courses, books, etc)?

theycallmemorty• 14 years ago

I'm no expert either, but http://www.khanacademy.org/ has a lot of great videos on economics.

ninetax3• 14 years ago

Thanks, I saw those but none seems specific enough. I've taken courses in macro and micro economics so I'm looking for something deeper, just on currency. I did also see khanacademy's lectures on currency relating to china, but it would be cool to find a reputable book.

nhaehnle5• 14 years ago

This is always a contested subject because economics has so many competing branches, many of them with more or less overt ideological overtones.

IMHO, you should listen to economists that (a) emphasize looking at the operational realities of what actually happens in the monetary system, and (b) tell you that banks matter for what happens in the economy.

(If you find it hard to believe that a majority of economists ignore banks in their models of the economy, good for you and your common sense!)

This means you should read what Steve Keen writes and listen to what he says (he blogs at http://www.debtdeflation.com/blogs/), and what the Modern Monetary Theory crowd write, as they explain such basic things as what role reserves and bonds play, from first principles (start here: http://neweconomicperspectives.org/p/modern-monetary-theory-...).

More generally, "endogenous money" is an important keyword to look out for, because our monetary systems are endogenous in the sense that money is mostly created by banks, not by the government.

If you venture into online economics resources, you will run into a lot of (economic) Austrians. I believe this is mostly because of the Mises institute, which is well funded by people with an ideological ax to grind. It's good to reflect on their messages occasionally, but they should be taken with a grain of salt. (And since they are hardcore gold bugs, they don't get endogenous money, which means that much of what they say simply doesn't apply to our current economic framework.)

ninetax3• 14 years ago

Thanks, I'll take a look. I am definitely more interested in case study, and reality than an idealogical system.

yafujifide• 14 years ago

I felt the same way when I discovered bitcoin last year. Here are some books that I read that helped:

* "End the Fed" by Ron Paul

* "Economics in One Lesson" by Henry Hazlitt

* "The Mystery of Banking" by Murray Rothbard

* "What has government done with our money?" by Murray Rothbard

* "Debt: The First 5000 Years" by David Graeber

TDL2• 14 years ago

It would also be beneficial to read what pro-central bank arguments are. The Regional Reserve Banks maintain extensive research & documents to learn how the Fed operates and the underlying argument as to why it should exist.

This wikipedia link could be a good start in addition to the selection of books above: http://en.wikipedia.org/wiki/Federal_Reserve_System

politician2• 14 years ago

"All Bitcoin transactions are published online and Internet Protocol (IP) addresses are linked to the public Bitcoin transactions."

How are IP addresses linked to the block chain?

TazeTSchnitzel2• 14 years ago

Well, presumably if you infiltrate the P2P network, you can catch the transaction at its source?

politician2• 14 years ago

Sure, but surely the block chain doesn't contain Source IP Address fields.

cwkoss• 14 years ago

Nodes can see which IP address sent them the transaction. Usually, this is a "supernode" connected to hundreds of others which received the transaction from someone else.

However, if you have your own supernodes and can see which node first broadcast that transaction, and you know either they sent it or are more connected to the original sender than you are.

Groxx9• 14 years ago

Unless I misunderstand Bitcoin more than I think I do, this is flat-out wrong (~1/3 of the way through the document):

  (U) What Users Can Do To Increase Anonymity
  ...
  • (U) Combine the balance of old Bitcoin addresses
        into a new address to make new payments.

Combining balances just means you have a bunch of disparate nodes in the network which may not be related, and you are intentionally connecting them. So if you combined anonymous nodes A-Y with Z which was linked to you, A-Y are now logically linked to you because Z tainted the whole pool. (edit: or at the very least, all the money in A-Y)

Yeah, there are ways to make it true/er, but I'm arguing against the principle of the suggestion. And I have doubts that combining (only your) addresses will ever increase anonymity.

sp3324• 14 years ago

It makes it a little harder to prove. If you do something sketchy and get bitcoins in wallet 1, and then buy something from wallet 1, people will see that the same wallet that did something sketchy also bought something.

On the other hand, if you move bitcoins from wallet 1 to wallet 2, then do the buying from wallet 2, there's some separation and people aren't sure if it's the same person.

Groxx9• 14 years ago

This is suggesting doing something sketchy with 1 and then moving it and 2 and 3 to 4. You can improve your odds of evading detection by moving things around a bit, yes, but most applications I'm aware of will simply move them all in a single transaction. There have also been some fairly large-scale network analysis papers showing linked accounts and the flow of e.g. one big theft a while back - unless you run it through a mixer, you're only mixing with yourself, which runs the risk of revealing everything if you leak a little too much.

And regardless, if you then use 4 to do anything that's linked to you, it's further evidence that you are linked to all the accounts - in no way better than before, and possibly worse. You also can't use the money from 2 or 3 to do things linked to you, because now they're linked to you and the sketchy 1. If you had left them isolated, observers would only have information on 1, nothing would have changed, and you could use 2 and 3 without leaking any information about 1.

feral3• 14 years ago

Actually, I think the suggestion in the report is correct.

I think that what they are getting at here, is the following scenario:

Imagine that you have several addresses, with different balances, in the same wallet. If you do a payment using the normal client, which requires the total balance from all those addresses, this will create a transaction with all those addresses as inputs. In the Bitcoin protocol this provides unambiguous proof that the input addresses are all controlled by the same user. (With some provisos: obviously wallet services overlaid on the network complicate this; as do some other more sophisticated uses of the protocol; but in general, at a protocol level, this is true).

So, that then shows any passively listening third party that all those addresses were under control of a single user. This knowledge can then be applied transitively, to consolidate ownership of large quantities of accounts. (We tried explain this in our paper: http://arxiv.org/pdf/1107.4524v2.pdf Fig 1.6)

What the report is probably getting at, is that an alternative thing to do, would be to instead send all the payments to a new account, in separate transactions. This would introduce a lot more ambiguity for a passive attacker - passive ownership assumptions become a lot less clearcut. You can still try make deductions, but its going to be much larger to do at large scale, and require more statistical assumptions.

Its not completely obvious that this is what the paper is suggesting, but thats my reading of it, and I think that makes sense.

Groxx9• 14 years ago

Yeah, it's not a clear-cut connection if you do it in multiple steps. Hence the caveat that there are ways to make it (more) true. But what improvement in anonymity does it provide over leaving them separate? If they can't infer that X belongs to you, then if you don't send it to account Y (linked to you) you certainly don't leak that X belongs to you. If you do, it's not proof, but it certainly doesn't improve matters.

Don't take it to extremes - this can clearly be stretched to include running the whole process through mixers and back to a single address while improving anonymity. It doesn't say that. In principle, is combining addresses better for anonymity than not?

gscott• 14 years ago

"In July 2011 FinCEN revised the definition of money transmission service to mean the acceptance of currency, funds, or other value that substitutes for currency from one person and the transmission of currency, funds or other value to another location or person by any means."

Sounds like if you make a market for gift cards you need to be a licensed money transmitter FYI.

Internal FBI risk assessment of Bitcoin network [pdf]

Related Stories