Blind Bitcoin Transfers

[duncant]

As several of you have already found out, I'm currently running a cryptographically anonymous bitcoin mixer at https://blindbitcoin.com. I was planning on keeping this whole thing under wraps for a bit longer, but since people have already discovered it, I may as well make this announcement.

The site is still a "beta" service, so please be patient while I get all the kinks worked out.
None of the existing functionality is going to go away, nor am I going to break compatibility with the way the site currently runs. Most of what I'm going to be doing over the next few weeks is bug-fixing, and cleaning up the code. I'll release my source via the link on my site tomorrow (6/7/2011) morning around 9AM EST.

Right now the site charges a 0.02BTC commission. This is how much it costs my system to transfer bitcoins internally paying a transaction fee of 0.01BTC per KB. Once I've got all the bugs worked out, I plan to charge a 0.75% commission on new transfers. Transfers already made and tokens already issued will not be subject to this new charge.

A few people have emailed me about my use of the OpenCoin protocol. I don't actually use the OpenCoin protocol as it is written. I found their paper to be very interesting and I used a few modifications that they suggested to Chaum's original protocol.

Who am I?: My name is Duncan Townsend. I am a student at the Massachusetts Institute of Technology. I started writing my website because I found David Chaum's blind signing protocol absolutely fascinating and I saw its application to bitcoin. I don't consider myself particularly well-qualified to implement crypto, so I haven't actually implemented any cryptography in the course of writing my site. All the cryptography (with the exceptions of what I mention here: https://blindbitcoin.com/security.html) was taken from someone else's published cryptography library.

I'd like to hear from the community what they would like to see in the way of explanation or features. I'll be checking this thread all day, so post anything you've got here.

[marcus_of_augustus]

Following this thread.

Nice clean looking site btw.

[Sottilde]

Loving the site.  Great job, it looks great and I'm sure there are some users with a need for this service.

[Oldminer]

Nice. Do you intend to make it Android friendly too? BTW I hate the captcha - I find the 1+1 challenges much easier.

[Findeton]

I'm sure people will find this service useful. 

[duncant]

@mother_of_another: Thanks! I put a lot of work into that. Do you have any comments on usability/aesthetics?

@Oldtimer: Yes I do plan to make the site mobile friendly. I was unaware that it did not work on Android phones, but that is now on my TODO list. Thank you! Sorry about the captcha, I'm seriously considering replacing it with a different part of my API, but right now my number 1 priority is getting my code into a state that I can release tomorrow morning.

[TiagoTiago]

I hope this time the tumbler implementation gets the approval of the people that understand the stuff, from what i've read previous attempts had severe flaws that made them not all that helpful with anonnymizing coins

[duncant]

@TiagoTiago: Do you have a link to a discussion on how to best anonymize bitcoins? I've been sending all the bitcoins in my service to a single address (address, not account) from where they are eventually sent out when they are needed. I assumed that this was the "correct" way to do it because the address is the finest granularity one could observe. Thanks!

[gongcheng]

Mark this, I believe it will be useful.

However, right now the source code is not available, so I can't trust you.

[duncant]

@gongcheng: Thank you for your healthy skepticism. You can examine the client-side code in your browser and verify its correctness. The full source will be available by tomorrow (6/7/11) at 9AM EST.

[duncant]

I have posted my source code here: https://blindbitcoin.com/blind-bitcoin.tar.gz the detached signature is here: https://blindbitcoin.com/blind-bitcoin.tar.gz.asc

Enjoy!

[tehcodez]

+1 to duncant and his service. I had a problem getting at a blinded token, and he worked with me and restored my btc. Looking forward to his progress.

[bitlotto]

Fantastic! I've been wondering how long till something like this comes about.
Most of it was over my head though.
Could the user wait a long time to redeem the coins? Or do you normally do it right away? If I say, kept the token somewhere safe I could redeem it sometime in the future or would it expire eventually?

[matonis]

+1 to duncant.  Nice planned implementation. I think I'm the one who found it over the weekend and tweeted it. Sorry to blow your cover, secret squirrel, but things are starting to move fast now. I also posted it to mikegogulski on the Bitcoin Laundry thread where it is being discussed here,  http://forum.bitcoin.org/index.php?topic=6891.0

[duncant]

@tehcodez: sorry you had a problem. As of this morning, I believe that I've fixed the problem that people were running into. Also, I implemented the session-recovery feature, so everything should be very robust. I'm glad I could be of service.

@bitlotto: Yes, right now the way the system is configured, you can wait up to 53 days to redeem the coins. You can also redeem them right away. I'm going to increase the amount of time that you can hold onto your tokens once I fix the last of the bugs. You should protect your tokens just like your bitcoin wallet. Anyone who gets that token can redeem it, and tokens can only be redeemed once.

@matonis: No hard feelings, everything is mostly ready to go. I'd have liked to get a little more of the explanation finished, but I'll just push out those changes as I finish them. Thanks for the kind words and the publicity!

I just read how Bitcoin Laundry's payout works. This seems like a very useful system. I'm going to look into the possibility of paying out for tokens over a period of time in random payments instead of all at once.

Once everything is stable, I'll make an announcement for anyone who's interested.

[TiagoTiago]

@TiagoTiago: Do you have a link to a discussion on how to best anonymize bitcoins? I've been sending all the bitcoins in my service to a single address (address, not account) from where they are eventually sent out when they are needed. I assumed that this was the "correct" way to do it because the address is the finest granularity one could observe. Thanks!

There was some discussion on the topic in that thread about Bitcoin safety for illegal trading and stuff for example, i think i was called somthing along the lines of "how safe is Bitcoin for illegal busyness" or somthing, not sure exactly; lemme know if you can't find it on the forum and i'll see if i find it in my inbox (been following that discussion)

[winnetou]

+1

I can confirm that it is working, tried it with a 3-number sum of coins.

[fergalish]

Nice site. Nice service.

You should consider allowing people to conduct transaction with the mixer of only a single size, e.g. 5BTC.  Otherwise an attacker could try some statistical analysis to identify coins in with coins out.  With a single transfer size, there will be no way to associate input size with output size.

Next, you really should check out the legalities of this.  If you offered such a service with paper money, your most obvious clients would be organised crime and you'd probably be classified as a money launderer.  I had been thinking of setting up a bitcoin mixer, but got turned off once I thought of this issue.

[bittersweet]

I didn't try it out, but the service looks promising. Nice work.

[Bezza]

Great work Duncan.