What do you mean by the page is out of date? The process of generating legacy addresses from private keys hasn't changed. How can it be out of date?

They are. You can find them here: https://github.com/ThePiachu/GoBitTest/tree/master/app. The code specific to that Addresses page is here: https://github.com/ThePiachu/GoBitTest/blob/master/app/AddressTest.go. They are written in golang.

Yeah, this is also true. Even if you are forced to use a centralized exchange, complete KYC, or otherwise link your personal details to a trade or transaction, it is still possible to break the link between that transaction and future ones. Given how much centralized exchanges spy on their users, and even go so far as to freeze accounts if you deposit or withdraw coins to a service they don't like such as a casino, then trying to reclaim some semblance of privacy is even more important in these cases.

Yes, you absolutely can. See my previous post here - https://bitcointalk.org/index.php?topic=5260157.msg54743635#msg54743635

It's worth pointing out that real decentralized exchanges such as Bisq, while they do provide an escrow between buyer and seller, do not have control over your funds while they are in escrow. The escrow is a multi-sig wallet between buyer and seller. Bisq can aid in mediating disputes, but they never control your coins or private keys as happens with centralized exchanges.

Most criminals aren't stupid enough to take stolen funds and transfer them directly to an exchange or some other online account registered under their own name. Once the attacker passes coins through a good mixer or coinjoin transaction then it can become very difficult to trace.

Although this data is visible to other nodes at the time that you make a transaction, neither your IP address nor the server you connect to is permanently stored on the blockchain.

So out of interest, I read in to it a bit more. Looks like the yprv/zprv scheme was originally proposed by Thomas Voegtlin and he implemented it in to Electrum first, and then it was adopted by the wider community and integrated in to the above BIPs. The original discussion regarding it is viewable here: https://bitcoin-development.narkive.com/c7doYh54/proposal-bip32-version-bytes-for-segwit-scripts

TIL.

You can also use watch only wallets to create, but not sign, a transaction. You can then move these unsigned transactions to an airgapped wallet to sign them, and then back to your watch only wallet to broadcast.

Correct.

Yes. If you import an already signed transaction in to a watch only wallet, then it cannot be changed in a way that would result in your coins being stolen.

No of course not, and that's exactly my point. No centralized exchange is going to care more about your privacy than they do about anything which could hurt their bottom line. This is an extreme case involving a subpoena, but many exchanges will hand over your data for far less. Coinbase are the worst for it since they are quite literally working with the DEA and IRS, but anything that you do on any centralized exchange is fair game. Anyone who expects anything in the way of privacy or protection from a centralized exchange is fooling themselves.

You see people on this forum and elsewhere not infrequently suggest using centralized exchanges like Coinbase as "free mixers", since your deposits and withdrawals go to/come from different addresses. I would suggest any coins you pass through centralized exchanges become less private, not more.

His argument wasn't that the transactions themselves were private - obviously this is not the case since every transaction is publicly recorded on the blockchain. His argument was that his Coinbase account history was private.

This guy is currently in prison, which is obviously where he belongs, but the case does highlight the fact that centralized exchanges are anything but private. It is so utterly naive to think that Coinbase, the exchange which hands over their customers' data to the IRS to harass for taxes, the exchange which employs software developers who aided dictators in torturing and murdering citizens to help spy on their users, the exchange which sells their customers' data to third parties, the exchange which has a partnership with the DEA and other three letter agencies to help them analyze blockchain transactions, would do anything other than immediately hand over all the relevant data. Coinbase are anti-privacy. Anything and everything you do involving Coinbase should be assumed to be public knowledge.

Nonsense. As someone who only ever buys and sells bitcoin without linking the trades to my real identity, and refuses to use centralized exchanges or complete KYC at all, it is much easier to trade privately than it was a few years ago. There are more options for buying bitcoin privately than there ever have been before, such as Bisq, Hodl Hodl, LocalCryptos, this forum, direct peer-to-peer trades, some ATMs which don't require KYC, physical shops and vendors, and so on. These kind of services are only becoming more popular as time goes on, as more people wake up and start to realize why their privacy is important. As long as bitcoin exists, there will exist decentralized trading options which cannot be shut down by governments or third parties.

Can you explain what you mean by this? yprv is explained in BIP49 and zprv is explained in BIP84.


They are both also registered in SLIP0132, along with their multi-sig equivalents: https://github.com/satoshilabs/slips/blob/master/slip-0132.md

Do you mean that they didn't originally come from a BIP?

CEX.io, like most centralized exchanges, demand invasive KYC from all their users. See the two links and quote below. It's pretty scummy that they would let OP deposit fiat and trade that fiat, and then only demand KYC when he tries to withdraw, essentially stealing his coins if he isn't willing to compromise his privacy, but they certainly aren't the only exchange to pull this crap.

https://cex.io/aml-kyc
https://blog.cex.io/news/verification-requirements-17071

No, they aren't. The coins never leave the blockchain. The only thing stored in his wallet (or any other wallet, for that matter) are the relevant private keys.

OP is referring to the specific exchange CEX.io, not the generic term for centralized exchanges.

This is the wrong attitude. Once you've let your privacy slip, it is very difficult if not impossible reclaim it. Further, privacy in bitcoin is about a lot more than worrying about someone stealing from you. It's about the freedom to do what you want with your own money without a government or third party sticking their nose in, deciding you aren't allowed, and dictating what you can and cannot do. Everyone should care about their privacy from their first satoshi.

The "nothing to hide" argument is complete nonsense. If you haven't done anything illegal and have nothing to hide, then please post your real name, real address, social media profiles, email addresses, passwords, and all your bitcoin and altcoin addresses. After all, you've got nothing to hide, right?

You can use most hardware wallets with a completely airgapped computer if you want. For example, pair a Ledger device with Electrum on an airgapped computer, and use a watch only Electrum wallet on a live computer to monitor addresses and generate transactions.

To the best of our knowledge this is true for Ledger devices, but there could easily exist a yet undiscovered security flaw. I don't think saying you don't need to take care of your device is the best advice. We also know this isn't true at all for Trezor and KeepKey devices. If an attacker has physical access to these wallets, then they can extract your private keys.

It proves ownership of an address, and since addresses rarely change hands, it also goes a little way to proving identity as well.

You can use it to prove that you are in possession of funds that you say you are, such as if you are offering a trade, escrowing a deal, or funding a campaign. You can use it to prove that you own an address which has been historically linked to an account or person. For example, if I lost control of my account I could sign a message from an address used by this account many years ago, which would help to prove I am the real owner. If we were about to make a trade, but you wanted to confirm you were trading with the real o_e_l_e_o, you could ask me to sign a message from an old address to  help prove that the account hasn't changed hands. CSW's constant and repeated failure to sign a message from an early bitcoin address helps to prove he is categorically not Satoshi.

For the nth+1 time, VPNs do not make you anonymous. Your VPN provider can see your real IP address, your real name and address if you have paid using fiat, and all your internet traffic.

Simply using a decentralized exchange isn't enough. If you pay using a bank transfer or PayPal, for example, then the other party can link your bitcoin to your real identity.

What? Why would privacy not be encouraged?

Correct.

Without getting too complicated and keeping things relatively simple, your coins never leave the blockchain. They are simply moved around between addresses. What your Ledger device holds is the private key to "unlock" your addresses. Once coins are sent to an address generated by your Ledger device, everyone can see that that is where they are, but only you can spend them, by utilizing the private key that is stored inside your Ledger device.

No. Once you have obtained an address to send coins to, you can safely disconnect your wallet, turn your computer off, and never turn on or connect either of them again if you like. Coins can still be received by that address, and will simply remain on that address until such a time as you choose to spend them.

As above. Your private keys.

Ledger actually wrote a couple of good blog post explaining this:
https://www.ledger.com/back-to-basics-part-1where-are-my-coins
https://www.ledger.com/back-to-basics-part-2-an-infinite-number-of-keys/

We need to be clear on terminology here. What you are referring to here is best called a stale or extinct block - a block which was once part of the main chain, but a longer chain took over. It's a misnomer to call these blocks "orphan" because their parent blocks are fully known.

Orphan blocks were blocks which had no parent. These were seen locally by individual nodes which had not yet received details of their parent blocks. These no longer exist since "headers-first synchronization" was implemented in Bitcoin Core 0.10.0.

That page hasn't been kept up to date in a couple of years.

In terms of keeping track of actual stale blocks - using the definition of stale blocks I provided above - then the best resource I found to do so is here: https://forkmonitor.info/feeds/stale_candidates/btc.rss. They also have RSS feeds for both BCH and BSV - just change the three letters at the end up the link.

Your main question has been answered above, but there are a few inaccuracies in the other things you wrote which it would be worth clearing up to avoid any confusion you may have in the future.

There is no such thing as a single "master key". There are "master private keys" and "master public keys". The master public key can generate all the individual public keys and all the individual addresses in your wallet. Going up a level, the master private key can generate all this as well as all the individual private keys in your wallet. The master private key is also used to generate the master public key. Further, it is not accurate to say that an address is a "portion" of the public key. An address is calculated from the public key using hash functions, specifically SHA256 followed by RIPEMD160.

In the case of a watch only wallet which is generated from a master public key, you will be unable to sign a message.
If you were to create a full wallet using your master private key, you then would be able to sign a message.

Markets stabilizing does not mean the economy has recovered - at the moment it is simply an indication of the insane amount of fiat the Fed and other central banks are pumping in to the system. I mean, the Fed are now directly buying corporate bonds. Meanwhile, we are on track for record unemployment levels. How are things going to look in a couple of months' time when millions of people are claiming unemployment and other benefits, have run out of savings, default on their loans, default on their mortgages, etc. Consumer spending will be way down even once everything has reopened, and many of the businesses which haven't already been bankrupted by COVID will struggle to stay afloat. Expect more downsizing, more branch closures, more unemployment.

This is on the back of the fact that in the US we are setting a new record for the number of new daily cases each and every day. We barely had this contained during lockdown. Lockdown is now over in many places, and cases are skyrocketing. We are long way off from recovery yet.

There are multiple big business offering blockchain analysis and transaction tracing/de-anonymizing services. Chainalysis, Elliptic, IdentityMind, CipherTrace, Crystal, Elementus, to name just a few. The majority of the work these companies do is not in illegal or cybercrime cases, though. The majority is for exchanges which like to spy on their customers and freeze your account if you are deemed to be doing something they don't like despite being perfectly legal, such as using a bitcoin casino or sportsbook. Some exchanges like Coinbase even have their own in-house blockchain analysis department in the form of Coinbase Analytics (rebranded from Neutrino).

Although KYC is obviously a massive no-go, if you are interested in privacy then you should not be touching centralized exchanges at all.

VPNs do not provide anonymity. Your VPN provider can see all your traffic and link it to your real IP address. This is even worse if you pay for your VPN with fiat, in which case they can link all your traffic to your real name and address. If you are looking for anonymity, then you need to use Tor.

There's also a lot more to staying anonymous than simply using Tor and thinking "that's that". Tor isn't foolproof for starters. Many people use Tor in de-anonymizing ways, such as logging in to accounts which have been set up or accessed via non-Tor methods, linking them back to their real identity. Even having the same browsing habits and constantly visiting the same sites as you do outside of Tor can be enough to de-anonymize you. You definitely can't use a mainstream operating system which will be phoning home constantly and filled with other software which will access the internet outside of Tor. You'll need to use something like Qubes or Whonix. You'll definitely need to run your own full node. You'll need to buy bitcoin with non-traceable methods, and you'll need to use mixers or CoinJoin if you don't want your transactions to be tracked. The list goes on and on. You can certainly make it very difficult to be de-anonymized or to have your transactions tracked, but if you ever think you are completely anonymous, you aren't.