1

This question already has an answer here:

Why over complicate things with additional private and public keys that are hidden from the user and make it possible for backed up wallets to go out of date? Why can't the change address just be the address that started the transaction?

marked as duplicate by Murch, Salvador Dali, Stéphane Gimenez, dchapes, Greg Hewgill Feb 9 '14 at 21:05

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

3

The reason for not sending back to (one of the) previous addresses, is privacy. Not just your privacy - perhaps you don't care - but the privacy of everyone using the system. Reusing addresses this way makes it blatantly obvious which of the output is the real output and which is change, meaning that transaction graph analysis becomes a lot easier.

Wallet backups going out of date is a very good counter-argument to this. Security and privacy are often hard to combine. It's also the reason why for example Multibit and Bitcoin Wallet for Android up to now do reuse addresses for change.

However, a solution that has the advantages of both exists. Deterministic wallets (in particular BIP32) allow generation of new change addresses (including the ability to detect them when recovering from a backup), without revealing this to everyone in the world. In addition, they do support selective disclosure to people with whom you want to share your wallet's history.

Not the answer you're looking for? Browse other questions tagged or ask your own question.