How you will not uncover Satoshi

https://bitslog.wordpress.com/2014/06/19/how-you-will-not-uncover-satoshi/

by wslh • 12 years ago

165 69 12 years ago

bitslog.wordpress.com

mcherm2• 12 years ago

Note to self:

If I need to publish something and have it remain completely anonymous, convert it to ASCII TEXT. That is one of the few formats I understand well enough to be CERTAIN that it is free of metadata.

Now all I have to worry about is how I can anonymously publish it, text style analysis, and how to include diagrams without resorting to ASCII drawings.

supergauntlet• 12 years ago

You could always just release the raw LaTeX source and let people compile it themselves or something.

lallysingh• 12 years ago

Or build the latex in a clean VM

VMG• 12 years ago

I'd imagine you reveal too much information with your personal latex writing style.

chaos0• 12 years ago

I wonder if there is a tool to obfuscate text to prevent analysis. one way I could think of is to use any online translation tool to translate to a foreign language and then back to english. and then fix the grammar slightly. the structure of the text should hopefully be different enough for any tool/human to recognize it's your style. is there an easier way to do this?

graedus• 12 years ago

Yeah, some work has been done in this area, but I only know about it in passing via a mention in one of Jacob Appelbaum's talks. This seems like it might be a decent place to start: https://www.youtube.com/watch?v=-b0Ta9h62_E

bumblebeard• 12 years ago

There was an interesting talk about this (adversarial stylometry) at 28C3:

https://www.youtube.com/watch?v=C9SgAOcCm0I

One of the methods they mentioned is machine translation, but they found that it wasn't terribly useful. It's a really neat talk and I highly recommend it. They also wrote some software to anonymize texts (Anonymouth) and their stylometry software (JStylo) is also freely available:

http://events.ccc.de/congress/2011/Fahrplan/events/4781.en.h...

privong• 12 years ago

There is some free software available[0] to do stylometry analysis. And some software which purports to assist in anonymizing writings[1]. I've not really played around with either, so I can't speak to their ease of use and/or effectiveness. But it's at least somewhere to start.

[0] http://evllabs.com/jgaap/w/index.php/Main_Page

[1] https://github.com/psal/anonymouth

TeMPOraL2• 12 years ago

Reminds me of a concept of "google translate fixed point", i.e. you translate between english and an foreign language back and forth until the translation stops changing.

a3_nm• 12 years ago

A pretty neat idea, but of course if you use an online tool you would still be disclosing the original text to an untrusted third party...

kruczek• 12 years ago

Don't be too sure about ASCII text file either, it may still contain a bit of metadata like the BOM (although then technically it's not pure ASCII, but rather UTF, but still it means you have to check the encoding used by your favourite text editor).

mcherm2• 12 years ago

The BOM isn't exactly identifying information, but it's things like that (and encodings) that made me specify ASCII.

slashdotaccount2• 12 years ago

http://www.darkside.com.au/snow/ https://mat.boum.org/ https://psal.cs.drexel.edu/index.php/JStylo-Anonymouth

solomania9• 12 years ago

And that's why I created Bitcoin Megaphone! http://bitcoinmegaphone.com

rwallace• 12 years ago

I think you'd be okay with any format, such as HTML, that you can eyeball in a plain text editor; you just need to eschew binary formats. So diagrams in SVG in preference to PNG?

userbinator• 12 years ago

Although the PDF spec says that the ID field is "optional", a lot of PDF-producing apps put it in anyway, and the way OoO calculates the ID is basically what the spec recommends, although it does say "Note that the calculation of the file IDs need not be reproducible. All that matters is that the file IDs are likely to be unique." This means that a CSPRNG would be a better choice, or even omitting the ID entirely.

The Author/CreationDate/Creator/Producer/etc. fields are also completely optional despite, once again, the insistence of applications to put them in. There are "PDF anonymisers" out there, and I've written one myself too, but not all of them remove all this information.

Interestingly enough there's a PDF from the NSA about removing metadata, which itself has most of the metadata removed, but not the ID nor creation/modification dates:

http://www.nsa.gov/ia/_files/app/pdf_risks.pdf

vijayboyapati3• 12 years ago

The author of the blog post makes the claim that Satoshi used Tor. I'm interested in what evidence there is for that. I googled and found a few people mentioning it, but no direct quote from Satoshi himself. I also searched the archives of his posts: https://www.google.com/webhp?sourceid=chrome-instant&ion=1&e...

Suppose that claim is not true, or that he was not fastidious in his use of Tor, it seems to me the email service provider would have logs on where his emails were originating from. From his original paper his email is satoshin@gmx.com

I'm not sure who owns gmx.com, but I think it likely that if a sovereign state went after them, they would probably divulge the information. Not that I want this to happen, of course. I hope he's never uncovered and his legend grows with the success of Bitcoin. I hope he did use Tor. I'm just not certain there is evidence for it.

Edit: I am not Satoshi Nakamoto, although I wish I was

octotoad• 12 years ago

I've been using GMX for a few years. It's owned by German ISP 'United Internet'.

Taek• 12 years ago

gmx is very popular among tor users because you can create an account with no strings attached. No other emails are needed, no other phone numbers are needed, and signup takes only a few webpage loads (important when dealing with latencies of up to 45 seconds).

This of course doesn't mean that Satoshi is a tor user, but a gmx account is consistent with typical tor behavior.

mahouse• 12 years ago

Last time I tried to create a gmx account under Tor, it told me I could not do it because my IP address was blacklisted.

vijayboyapati3• 12 years ago

Anyone have evidence of Satoshi's use of Tor? This seems like a crucial claim made by the blog post author, yet I cannot find any evidence of it.

wslh• 12 years ago

I just sent a message to him about this HN thread but you are always free to contact the author on their own site. He is one of the top cryptocurrencies experts right now and is engaged in many different threads/sites at the same time.

callesgg• 12 years ago

If someone finds Satoshi and publishes Satoshi's identity and Satoshi is a regular person. It would probably led to the destruction of Satoshi's life and not that unlikely Satoshi's death.

With that in mind, i think it is kind of stupid to look for Satoshi.

bruceb2• 12 years ago

How would it lead to his death? Would his life change? Yes but there is no reason to think he would die.

hellodevnull• 12 years ago

This is funny, a couple of months ago everybody was saying how publishing the identity of a man who holds millions in an anonymous virtual currency would most likely lead to somebody attempting to extort him and put his life great danger.

Now this comment is getting downvoted.

kordless• 12 years ago

Proving he/she is who they say they are is difficult and could be countered. Satoshi is not a regular person, but that really doesn't matter in this argument. Why would being 'non regular' make a difference here?

The rest of your statement is an ad hominem argument. You state it is stupid to look for him because finding him would result in his death. That's a blaming statement of epic proportions, and is probably a result of your own emotions around Satoshi and Bitcoin, not a reality of this world. We don't know what we'd do if we found him.

erikb• 12 years ago

Wasn't there some article some time ago that Satoshi has been discovered? Was it shown to have been fake? At least on FB/G+ it went quite viral and I haven't seen anything since.

damian2000• 12 years ago

Wrong guy ... from wikipedia ...

The most high-profile speculation to date came in a March 6, 2014, article in the magazine Newsweek,[30] when journalist Leah McGrath Goodman identified Dorian Prentice Satoshi Nakamoto, a Japanese American man living in California, whose birth name is Satoshi Nakamoto.

http://en.wikipedia.org/wiki/Satoshi_Nakamoto#Dorian_Nakamot...

MrBuddyCasino2• 12 years ago

Still seems fishy to me. The real Satoshi could have proved that he couldn't be that guy (using the blockchain or something else), but he didn't.

meowface2• 12 years ago

What's funny is, most of HN and most of the Bitcoin subreddit posters were saying that it seemed like the article was legit in the first 2-4 days of its release. And yet as I was reading the article, the day it came out, I seriously thought their correlations sounded way off and that they had the wrong guy.

I made a bunch of HN and reddit posts and even threads saying the Newsweek piece was very probably wrong, and was told to stop being a conspiracy nut. I even went into the official Bitcoin IRC to debate it with people, and found only 1 person agreeing with me and about 10 people against me.

It's scary to think that terrible journalism can be published and believed so easily.

nebulous1• 12 years ago

I would have thought he'd use a computer solely for his Satoshi identity, in which case his username probably is satoshi. This is the best way to ensure your computer doesn't leak anything you don't want it to: don't give it the information in the first place.

tomjen3• 12 years ago

Then somebody stumbles over the computer and you are outed.

nikcub• 12 years ago

It is somewhat good news for online anonymity that we don't know who Satoshi is. The amount of resources that have been poured into trying to uncover his identity is the equivalent of a medium-sized open source project. He has survived the army of geeks.

The state of user-user or user-corporation anonymity is good. If you want to stay anonymous from other users or a corporation then you can gain anonymity by spending a few hours reading tutorials/guides online and then installing Tails or Whonix (both which solve the metadata problem in OP and a variety of other attacks) or an alternative homebrew solution (machine isolation/snapshots) and apply a level of discipline to isolate your identity.

Last best OPSEC move Nakamoto made was to disappear - removes so many options in tracking him down. Hanging around and living off the credibility you've built with your anonymous persona is likely only going to breed complacency and the odds of slipping up increase each day (you see this in many cases)

I doubt he'll ever be tracked down. I doubt even a gov investigation starting today (for whatever reason) with all the power it has would achieve it (unless more than one person knows the secret, in which case a US investigation has a broad range of legal methods to compel testimony and reveal it).

I know a lot of people are sick of talking about Nakamoto and prefer to focus on what he produced (you can't even google his name anymore without 50% of the hits being about the Newsweek article), but being able to invent such an important piece of transformative technology and remain anonymous for so long, possible forever - is a brilliant accomplishment worthy of its own attention.

coldpie• 12 years ago

installing Tails or Whonix (both which solve the metadata problem in OP and a variety of other attacks)

I was surprised the article claims he was using Windows XP. There's a surprising number of leaks when using Windows software. These leaks are functional and can provide cool features, sure, but they're leaks nonetheless.

For example, if you embed a file in a Powerpoint presentation, the PPTX file includes the original full path to the file. "C:\Users\JLewis\SecretWorkForTheNSA\FormattedForPublicRelease.txt". Obviously this isn't exclusive to Windows operating systems, but I feel other OS environments generally don't encourage oversharing like Windows does.

superuser2• 12 years ago

I doubt even a gov investigation starting today (for whatever reason) with all the power it has would achieve it (unless more than one person knows the secret, in which case a US investigation has a broad range of legal methods to compel testimony and reveal it).

As much as members of the Bitcoin community like to think of themselves as agitators, there were very clearly no laws broken here.

eric_bullington• 12 years ago

As much as members of the Bitcoin community like to think of themselves as agitators, there were very clearly no laws broken here.

Yeah, that's all clear now, but 4 years ago the legal situation was much murkier. This was all very new ground and we had no idea how the U.S. government would react, particularly given some of the other things going on at the time (particularly the prosecution of E-Gold, which was centralized but shared some features with Bitcoin).

gwern2• 12 years ago

It is somewhat good news for online anonymity that we don't know who Satoshi is.

Only if you believe that none of the identified candidates are him. Personally, I think not as much real effort has been spent as you think; I've found some pretty breathtaking stuff which no one has posted about publicly.

Last best OPSEC move Nakamoto made was to disappear - removes so many options in tracking him down. Hanging around and living off the credibility you've built with your anonymous persona is likely only going to breed complacency and the odds of slipping up increase each day (you see this in many cases)

Yes, DPR comes to mind as an example of what happens when you don't know when to quit.

I doubt even a gov investigation starting today (for whatever reason) with all the power it has would achieve it (unless more than one person knows the secret, in which case a US investigation has a broad range of legal methods to compel testimony and reveal it).

I disagree. Given what the Snowden leaks have revealed, I think the NSA, and possibly lower-level entities, could find him even now. They can attack gmx.com, AnonymousSpeech, Digirock, the Californian IP & Freenode, & the P2P Foundation looking for direct IP leaks or other information, either through penetration, legal demands, or their extensive databases of metadata; governments are the main sponsors of stylometric research (either code or writing), which are another excellent attack vector; and of course, they can simply do tailored attacks on major suspects, in the same way they've already individually gone after security researchers. For all we know, they've already done any of this - Snowden's info is dated.

hotpockets• 12 years ago

According to I believe mike hearn, the whitepaper was not originally published as a pdf by satoshi. Someone else made the pdf.

gwern2• 12 years ago

Link? I've never heard that, and the very first draft of the whitepaper (hosted on a now dead filesharing website) was also a PDF.

Relys• 12 years ago

Why does everyone assume that Satoshi is a singular entity? What if Satoshi is legion? :/ Given that initial assumption, which large/government entities would be most likely to start such a project?

How you will not uncover Satoshi

Related Stories