distinguish change address from real origin<->destination

Question

a lot of bitcoin clients now send change address balances back to the origin address, by default, to make it easier for people to keep track of their balances.

with this in mind, those transactions are easy to reveal which address is the origin, the destination and the change address.

Also this singles out transactions that do not behave this way, where the origin address splits the transaction into a real destination and a new change address and coins sit in both. Just from looking at the blockchain, how would one decide which address was the real destination and which one was the new change address. Would it be the timestamp each address was created or similarly when it was first revealed to have a transaction?

Answer 1

There is no way to know for sure which address is which. This is part of the reason why some clients use a new address for change, for privacy; an observer will not be sure which coins now belong to whom.

There is no public timestamp recording when an address was created. If one of the addresses has been used before and the other has not, this might suggest that the new one is for the change; but it could also be that both outputs are going to two different people, or that the sender is sending coins to herself and both addresses are "change".