6

HD wallets create a series of addresses, and then when one address has received an input it will give you a new address that hasn't received inputs yet

So in the idea of you sending yourself bitcoin from an exchange, and having different addresses all the time on the exchange, and different addresses in your wallets, then an observer wouldn't be able to track the sum of all your funds.

But isn't this all undermined when you move a large amount of bitcoin and the transaction combines bitcoin from all of the addresses in that wallet?

How is that part avoided while retaining the ability to realistically send funds quickly and conveniently? I understand that it is possible to form a transaction to only use a certain address for sending, but ultimately there is still a third party with one address that I want to send bitcoin to. So I will have to use several of my addresses to get the appropriate balance.

This seems to completely undo my privacy. Not necessarily from blockchain analysis but by having records of a single address (such as from the exchange).

For instance, lets say an exchange gave over the user names to a government. The government then looks at all the addresses that user sent bitcoin to from the exchange. Then they simply look in the blockchain for that address and look to see where it was used again to combine bitcoin with other addresses, as this reveals that one person had the private keys to all those addresses used. Privacy undermined.

Solution? I can imagine a scenario where I could do one transaction at a time back to a different exchange, generating new addresses in my exchange wallet. Cumbersome. But for something like a bitpay payment, I don't see how this is practical, unless third parties also let me choose how many addresses they would generate for me.

4
+100

As mentioned, I don't believe HD Wallets are relevant to this problem. Even with simple wallets combining inputs from multiple addresses proves that a single person owned all the addresses included. I'm not sure if this would meet your specific privacy needs, but it is at least a straightforward way of avoiding that problem:

Assume you have 4 addresses, A, B, C, and D. You want to send a transaction that requires funds from all 4 without proving that they were owned by the same person. You could generate a 4th address E and over the course of several days combine all the address values at a new address.

While the blockchain would show that the funds in E came from A-D, there wouldn't be any proof that A-D were owned by the same person, as they were never in a single transaction together, and it is feasible that 4 different people all transferred value to E, instead of the same person transferring value to E.

It seems feasible to write a client that follows that policy of never combining inputs from multiple addresses in a single transaction, which would at least allow plausible deniability. The user would be able to manage timeframes depending on their needs, so that the combination could occur over the period of an hour or a year, depending how soon they need the transaction. You could also add some intermediary steps to split things up a bit more and pass through a few extra addresses to make it slightly harder to follow.

Since it is a public ledger it really isn't a very anonymous system, and achieving anonymity is difficult without a mixer, but the biggest compromise to anonymity is connecting multiple addresses in a single input, so simply avoiding doing that will be helpful, but at the expense of convenience.

  • hm yes, an algorithm to never combine inputs – CQM Oct 12 '14 at 15:02
  • Is there a way to eject an address out of an HD wallet? remove an existing address from the sequence of addresses? – CQM Oct 13 '14 at 18:41
  • Unfortunately I cannot conceive of a way that would be possible. The purpose of a HD wallet is that a single seed is capable of generating all the addresses under it in a deterministic fashion. So if a wallet falls under your seed's space you would need to undo laws of math to get rid of it. Your best bet would be generating a new seed and sending your coins there. – Andy Groff Oct 13 '14 at 19:50
  • interesting, I think BIP32, BIP39 and BIP44 needs to come with best practices. I see a variety of problems with it that may not be apparent. What it can do and what it can't do for you. – CQM Oct 13 '14 at 19:52
1

Privacy is one of the most common myths about Bitcoin. By default, it does not provide anonymity, for many reasons, including the ones you have mentioned. Applying graph theory on the transactions can reveal a lot of information, connect seemingly independent addresses and thus compromise them. Bitcoin was never meant to provide anonymity out-of-the-box, so it's hard to blame it.

However, this does not mean the anonymity is impossible to achieve. There are many 3rd party services specializing at this, mixing your coins with other people's coins, for example bitmixer.io. You can find more such services and use them in chain for even better anonymity, just search the Internet for bitcoin mixer or bitcoin laundry.

Note: the problem of connecting addresses to the same owner is not specific to HD wallets, but concerns also simple wallets that generate all the addresses randomly. For the outside observer, there's no way to tell if you're using one or another, but this information is not necessary to connect the addresses once you've made a transaction combining their inputs.

  • mixers are inconvenient, expensive, centralized, not trustless, contain records, the user nor the admin would never know if the mixer has been compromised for years, and ultimately it greatly increases the transaction cost. secondly, if this isn't done before one is seeking to make an unlinkable payment, for example - to a bitpay address - then they won't be able to mix within the 15 minute window that bitpay gives. – CQM Oct 8 '14 at 12:57
  • yep, it is essentially true what you're saying, yet Bitcoin mixins play a significant role especially in the black markets, where coin anonymization is essential. It is a common practice to always keep some "mixed coins" in your wallet, so that you can use them (immediately) whenever needed. You can increase the anonymity by using multiple mixins in a row, but obviously you can never be 100% sure. Well, guess Bitcoin would have a much harder time getting legal recognition if it was anonymous :-) – Jozef Oct 8 '14 at 17:15
0

Whatever the answer is today, it probably won't matter in the not-too-distant future. The blockchain is a public and permanent record of everyone's transactions.

Besides the fact that one would have to be 100% anonymous for each and every transaction, 100% of the time to remain anonymous (whatever that solution is)... There's that permanent public record of every one of your transactions. If somebody wants to they will eventually connect the dots from enough public and private databases. Not to mention quantum computing or other future advancements.

If I were a tax collector and wanted to prevent cheating, I would create a foolproof system to maintain a permanent record of every transaction. Then we could make it easy, troll the blockchain and submit monthly tax invoices to my minions. Don't pay it? Your transactions will not confirm. Can't spend. Kinda hard to refute then.

  • pure conjecture, John, the exchange operator, cannot prove that Alice, an account holder on the exchange, is in possession of a private key by the mere existence of Alice sending bitcoin from one address to the next. if Alice uses different addresses for every transaction, there are simply no dots to connect. Your answer suggests you have no idea what the actual "threat" from quantum computers is. – CQM Oct 6 '14 at 21:53
  • Yes, conjecture. Hence the 'probably'. My point is whatever happens in the future, there's this blockchain permanent record that will be used to retroactively nab people. One vector we currently know if is quantum computing and the potential to hack our keys (not to mention SSL etc.). Another vector would be mixing your banking info with your bitcoins by buying coins from someone like Coinbase. Coinbase could easily be forced to give up info tracing the purchase of my coins, connecting the dots. – siliconsys Oct 6 '14 at 22:27
  • You are missing the point. The entire scenario already considers that this is already happening, consider the exchange already having this information, best practices from satoshi's 2008 whitepaper still counteract this. you are just writing random gibberish for the sake of it, this is about unlinking transactions, where unlinking is unlinking. There would be no correlations to make, no encryption to bust. – CQM Oct 7 '14 at 3:07
0

I'll fill in the technical aspects where I can later today, but in principle what's happening is a private key is being altered in such a way so that HD public keys can be created and traced up the family tree, that we both know.

But here's a few thing to consider:

  1. Can a pubkey be isolated as being your key? Most likely not, but assuming so, it's still only the hash160 shared publicly. What's to say you haven't changed wallet seeds, for example?
  2. Assuming 1 to be true, reversing the SHA256 AND ripemd160 for your public key x/y coordinates is ~impossible ie

    pubkey <==A==> hash <=====B===== 0x04 X + Y

          A = base58,     B = SHA256/RIPEMD160
    

    .

  3. The only probably way a link between the public key and the private key can be found is by having at minimum the private key, and ideally for an attacker, a set of privatekeys

  • yes, but lets say I have 3 pubKeys, with 1 btc each. I then encounter a bitpay pubKey and to acquire the good/service I must send that bitpay address 2.5 btc. Any thing I think of will combine the transactions from pubkey A, B and C, whether I do it in one transaction or 3+ transactions, within the 15 minute time period that bitpay allows. – CQM Oct 7 '14 at 3:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.