Annotating the blockchain

[ThomasV]

The recent allinvain and mybitcoin thefts have been terrible news, and the latter has strongly eroded confidence in Bitcoin. In addition, the SEPA bank accounts of at least two exchanges have been closed, not because banks are trying to destroy bitcoin, but because they are concerned by money laundering. I think we should try to stop this as soon as possible, before it gets too bad. We need to build collective tools that would allow us to detect and prevent laundering.

What I have in mind is an improved version of the blockexplorer website, where users would have the possibility to annotate their own transactions. Users would be allowed to annotate an address or transaction only if they can sign their message with the private key corresponding to the bitcoin address they want to annotate.

The site would allow users to report a transaction as fraudulent. In order to prevent abuses, a police report would be requested by the operator of the website in order to flag a transaction as fraud. Then, the website would allow all users to check if the bitcoins they receive have been involved in a fraudulent transaction. This could take the form of a webpage where users upload a list of bitcoin addresses, or it could be integrated directly to the bitcoin client with an API. A user receiving a positive answer could get in touch with the person who reported the theft, and the police would be able to start an investigation of the chain of intermediaries.

If such a tool was available, it would be easy for exchanges to detect and report thieves cashing out, because they know their real identities. If an exchange was unwilling to do so, its users would know quickly, because they would receive dirty money directly from that exchange.

What do you think ? If we, as a community, were able to unmask a bitcoin thief, I think the current lack of confidence could be reversed.

[elggawf]

So you accept Bitcoins from someone, and because their inability to choose the inputs for the transaction they send to you, you end up with some coins that were "unclean" a few transactions ago. Or maybe you don't realize this, because you don't happen to subscribe to the arbitrary group watchdog that monitors this shit - until you go to spend those coins and someone who is subscribed calls you a scammer.

[ThomasV]

Bitcoin was intentionally designed in order to make it difficult to regulate in the fashion you suggest. Any such regulation would run the risk that it could later be used to facilitate greater abuses.

The "confidence" in Bitcoin which has been "eroded" as you mention was foolish and unjustifiable. I do not lament its loss.

ByteCoin

AFAICT, Bitcoin was intentionally designed in order to make it impossible to double spend bitcoins, or create more than 21 million of them. Satoshi's paper does not say anything about favoring money laundering.

And I do not suggest any "regulation" of Bitcoin. I suggest a voluntary tool that would facilitate the tracking of fraudulent transactions.
If there is misplaced confidence, it is the confidence that Bitcoin is anonymous.

[CydeWeys]

Wouldn't this be very vulnerable to scamming in itself though?  It's trivial to, say, parse the top 10,000 receiving addresses from the blockchain that hold the most value at this moment.  What's to stop a scammer from taking a coin that's marked as "stolen" and transferring a single satoshi to each of these top 10,000 mostly valid addresses?  Wouldn't everyone just be marked bad at that point?

Remember, there's no way to "deny" a transaction.  Anyone in possession of coins that had been annotated as bad could go on to cause lots of trouble for other people very easily.

[jackjack]

recent allinvain theft

Wat?

[ThomasV]

So you accept Bitcoins from someone, and because their inability to choose the inputs for the transaction they send to you, you end up with some coins that were "unclean" a few transactions ago. Or maybe you don't realize this, because you don't happen to subscribe to the arbitrary group watchdog that monitors this shit - until you go to spend those coins and someone who is subscribed calls you a scammer.

The fact that you have unclean coins does not mean that you are a scammer, it means that the scammer is somewhere between you and the victim. If you end up with unclean coins, the website will allow you to get in touch with the victim of the scam/theft.

[payb.tc]

The recent allinvain and mybitcoin thefts have been terrible news, and the latter has strongly eroded confidence in Bitcoin. In addition, the SEPA bank accounts of at least two exchanges have been closed, not because banks are trying to destroy bitcoin, but because they are concerned by money laundering. I think we should try to stop this as soon as possible, before it gets too bad. We need to build collective tools that would allow us to detect and prevent laundering.

What I have in mind is an improved version of the blockexplorer website, where users would have the possibility to annotate their own transactions. Users would be allowed to annotate an address or transaction only if they can sign their message with the private key corresponding to the bitcoin address they want to annotate.

The site would allow users to report a transaction as fraudulent. In order to prevent abuses, a police report would be requested by the operator of the website in order to flag a transaction as fraud. Then, the website would allow all users to check if the bitcoins they receive have been involved in a fraudulent transaction. This could take the form of a webpage where users upload a list of bitcoin addresses, or it could be integrated directly to the bitcoin client with an API. A user receiving a positive answer could get in touch with the person who reported the theft, and the police would be able to start an investigation of the chain of intermediaries.

If such a tool was available, it would be easy for exchanges to detect and report thieves cashing out, because they know their real identities. If an exchange was unwilling to do so, its users would know quickly, because they would receive dirty money directly from that exchange.

What do you think ? If we, as a community, were able to unmask a bitcoin thief, I think the current lack of confidence could be reversed.

I'm attempting to build such a tool (gradually as I get time) in bitnot.es (http://bitnot.es)

i'm submitting more and more addresses as I find them each day (examples: http://bitnot.es/a/1vc3ZU4ae2cF6ZxqE44j5Ak3wfsZqybtb and http://bitnot.es/a/19QkqAza7BHFTuoz9N8UQkryP4E9jHo4N3) and hope others do too.

i think if it's built up it will make a good detective tool later. and for that purpose, i plan to add search features to it, so you don't need to know an address, you can just search for 'mybitcoin' for example and find any addresses/blocks/transactions that have been tagged as such.

lots of work left to do obviously, i've only just built the site a few days ago.

for more info, please see https://bitcointalk.org/index.php?topic=35178.msg437346#msg437346

[CydeWeys]

So you accept Bitcoins from someone, and because their inability to choose the inputs for the transaction they send to you, you end up with some coins that were "unclean" a few transactions ago. Or maybe you don't realize this, because you don't happen to subscribe to the arbitrary group watchdog that monitors this shit - until you go to spend those coins and someone who is subscribed calls you a scammer.

The fact that you have unclean coins does not mean that you are a scammer, it means that the scammer is somewhere between you and the victim. If you end up with unclean coins, the website will allow you to get in touch with the victim of the scam/theft.

Why would I want to do that?  I received the money in a legitimate transaction, presumably in exchange for something else that I no longer have.  Why would I turn around and give it to someone else?  Exchanges of currency in real life don't work like that.  Odds are that one of the bills in my wallet was stolen from someone at some point, but that doesn't mean that, if I could track down the original person it was stolen from, I should give it to that person.  I received these bills from bank, which gave them to me because my job deposits money into said bank.  I don't owe them to anyone else.  Likewise for Bitcoins.

[ThomasV]

I'm attempting to build such a tool (gradually as I get time) in bitnot.es (http://bitnot.es)

i'm submitting more and more addresses as I find them each day (examples: http://bitnot.es/a/1vc3ZU4ae2cF6ZxqE44j5Ak3wfsZqybtb and http://bitnot.es/a/19QkqAza7BHFTuoz9N8UQkryP4E9jHo4N3) and hope others do too.

i think if it's built up it will make a good detective tool later. and for that purpose, i plan to add search features to it, so you don't need to know an address, you can just search for 'mybitcoin' for example and find any addresses/blocks/transactions that have been tagged as such.

lots of work left to do obviously, i've only just built the site a few days ago.

That looks very nice ; do you plan to implement the features that I described ?
 1. make comments private : user can comment an address only if they have the private key corresponding to that address
 2. the website should flag stolen coins, based on police reports sent by victims
 3. a search engine that checks if bitcoins received on a given address have been reported as stolen in the blockchain. This engine should return the list of addresses between me and the victim, and allow me to contact the victim
 4. a simple API, so that I can query the search engine without a browser

(note: in order to do 1, the user will need to sign their comment with their private key. This is not possible with the current version of the client; but it should be added in the future)

[ThomasV]

Why would I want to do that?  I received the money in a legitimate transaction, presumably in exchange for something else that I no longer have.  Why would I turn around and give it to someone else?  Exchanges of currency in real life don't work like that.  Odds are that one of the bills in my wallet was stolen from someone at some point, but that doesn't mean that, if I could track down the original person it was stolen from, I should give it to that person.  I received these bills from bank, which gave them to me because my job deposits money into said bank.  I don't owe them to anyone else.  Likewise for Bitcoins.

I am not talking about reverting transactions, or owing something. I am talking about finding the identity of the scammer, or helping the police to find him.

[jimbo77]

2. the website should flag stolen coins, based on police reports sent by victims

How would you stop people falsely flagging addresses? Would they have to actually send you police reports?

[ThomasV]

2. the website should flag stolen coins, based on police reports sent by victims

How would you stop people falsely flagging addresses? Would they have to actually send you police reports?

Yes, a report containing the bitcoin addresses would be required. And once a case has been solved, the flag would be removed on those addresses.

[JoelKatz]

How would you stop people falsely flagging addresses? Would they have to actually send you police reports?

As I understand his scheme, a falsely flagged address wouldn't do any harm.

[payb.tc]

I'm attempting to build such a tool (gradually as I get time) in bitnot.es (http://bitnot.es)

i'm submitting more and more addresses as I find them each day (examples: http://bitnot.es/a/1vc3ZU4ae2cF6ZxqE44j5Ak3wfsZqybtb and http://bitnot.es/a/19QkqAza7BHFTuoz9N8UQkryP4E9jHo4N3) and hope others do too.

i think if it's built up it will make a good detective tool later. and for that purpose, i plan to add search features to it, so you don't need to know an address, you can just search for 'mybitcoin' for example and find any addresses/blocks/transactions that have been tagged as such.

lots of work left to do obviously, i've only just built the site a few days ago.

That looks very nice ; do you plan to implement the features that I described ?
 1. make comments private : user can comment an address only if they have the private key corresponding to that address
 2. the website should flag stolen coins, based on police reports sent by victims
 3. a search engine that checks if bitcoins received on a given address have been reported as stolen in the blockchain. This engine should return the list of addresses between me and the victim, and allow me to contact the victim
 4. a simple API, so that I can query the search engine without a browser

(note: in order to do 1, the user will need to sign their comment with their private key. This is not possible with the current version of the client; but it should be added in the future)

1. yeah that was sort of the idea i was going for in a thread entitled "encrypt/decrypt arbitrary text using bitcoin keys?" however i'm still not sure how that exact idea will be workable. I definitely do plan to make some notes private though (as an option for the submitter).

2. in addition to a straight tagging system, i could indeed implement other tick-boxes for the submitter, such as 'stolen'.

3. while i don't understand the detail of this question, i would think the search options would be continually expanded. i'm actually wondering about the possibility of basing the site off a heavily modified forum software instead of the current code, with each address/transaction/block basically recorded as a thread.

4. API will come with time too... not just for queries but i think there will be some cases where an API for submissions would be good. eg. every time a merchant generates a new address, they could voluntarily tag it and submit it to bit notes. ***i know this goes against most people's love of 'anonymous' bitcoin, but it will of course be voluntary, and it'd be up to users to decide whether they use a site which automatically submits notes.***

[elggawf]

I am not talking about reverting transactions, or owing something. I am talking about finding the identity of the scammer, or helping the police to find him.

... and so how do I reconcile that aspect with my company's privacy policy where I won't give out information about them without a court order instructing me to do so?

So I came for the loony libertarian pseudo-anonymous cryptocurrency, and I stay to give out my client's information because they happened to be six degrees of separation from a scammer?

Fuck everything about this idea.

[nhodges]

The recent allinvain and mybitcoin thefts have been terrible news, and the latter has strongly eroded confidence in Bitcoin. In addition, the SEPA bank accounts of at least two exchanges have been closed, not because banks are trying to destroy bitcoin, but because they are concerned by money laundering. I think we should try to stop this as soon as possible, before it gets too bad. We need to build collective tools that would allow us to detect and prevent laundering.

What I have in mind is an improved version of the blockexplorer website, where users would have the possibility to annotate their own transactions. Users would be allowed to annotate an address or transaction only if they can sign their message with the private key corresponding to the bitcoin address they want to annotate.

The site would allow users to report a transaction as fraudulent. In order to prevent abuses, a police report would be requested by the operator of the website in order to flag a transaction as fraud. Then, the website would allow all users to check if the bitcoins they receive have been involved in a fraudulent transaction. This could take the form of a webpage where users upload a list of bitcoin addresses, or it could be integrated directly to the bitcoin client with an API. A user receiving a positive answer could get in touch with the person who reported the theft, and the police would be able to start an investigation of the chain of intermediaries.

If such a tool was available, it would be easy for exchanges to detect and report thieves cashing out, because they know their real identities. If an exchange was unwilling to do so, its users would know quickly, because they would receive dirty money directly from that exchange.

What do you think ? If we, as a community, were able to unmask a bitcoin thief, I think the current lack of confidence could be reversed.

Similar to payb.tc's new project, we at Bitcoins For Charity have been working on a service that provides a "meta-data" layer that rests upon the existing blockchain, allowing users to mark transactions with publicly available notes. Very interested on getting more input before we make the source code repository public, and then shortly after that, launch to the Bitcoin community!

https://bitcointalk.org/index.php?topic=36058.0

[JoelKatz]

I am not talking about reverting transactions, or owing something. I am talking about finding the identity of the scammer, or helping the police to find him.

... and so how do I reconcile that aspect with my company's privacy policy where I won't give out information about them without a court order instructing me to do so?

Easy, you don't give out any customer information without a court order instructing you to do so. See how easy that was?

So I came for the loony libertarian pseudo-anonymous cryptocurrency, and I stay to give out my client's information because they happened to be six degrees of separation from a scammer?

It is a common misunderstanding of Libertarianism that you get to to do whatever you want to do exactly they way you want to do it. In fact, other people also get to to do whatever they want to do to the same extent, and if that includes revealing information that you would prefer to keep private, that's tough.

[payb.tc]

It is a common misunderstanding of Libertarianism that you get to to do whatever you want to do exactly they way you want to do it. In fact, other people also get to to do whatever they want to do to the same extent, and if that includes revealing information that you would prefer to keep private, that's tough.

also, if something's been submitted to my site, there's a good chance it was already public information beforehand. (just like the above 2 example links I gave).

[elggawf]

JoelKatz: Okay, so someone buys something from me using coins who were a few hops down the line was scammed or stolen from someone. Keep in mind that at every step of the way no one gets a choice of what coins they receive, which they spend, etc. As stated previously, pick any of the richest BTC addresses and send some scammed coins there - now what happens?

Anyway, so I spend those coins on to someone else who happens to be participating in one such bullshit there's-no-regulation-so-let's-invent-some scheme, who turns around and goes "STOP! I just got these coins from XXXX Company."

The pitchfork and torch-bearing mob comes to my doorstep and I say "fuck off until you get a court order", which they probably won't get because it's a fishing expedition separated by several hops from my client whom I'm protecting due to my privacy policy (or I might be a company that doesn't particularly care to identify Bitcoin clients for whatever reason). One of two things happens at this point:

1) Either the system proves ineffective - all you've got to do is find a few people to trade with who either don't need you to identify yourself in any way or don't participate in the scheme;

2) I'm ostracized by my lack of helpful participation: aka picking up my pitchfork, lighting a torch and joining the mob.

I'm leaning towards probably the second situation happening, because in general people filled with impotent rage on the internet won't simply go home and cool off once they realized their plan won't succeed. So in that case, fuck everything about this stupid idea. In an attempt to fix the "bitcoin is irreversible and pseudo-anonymous" thing (which can arguably be considered a feature rather than a flaw), we do our best to turn the complete-history-back-to-genesis thing into a flaw as well.

[ThomasV]

JoelKatz: Okay, so someone buys something from me using coins who were a few hops down the line was scammed or stolen from someone. Keep in mind that at every step of the way no one gets a choice of what coins they receive, which they spend, etc. As stated previously, pick any of the richest BTC addresses and send some scammed coins there - now what happens?

The guy who stole 75000 bitcoins from mybitcoin.com is not going to spend them inside the bitcoin economy; he is much more likely to convert them to fiat. This is because in the world we live in, where bitcoin has still not taken over, inferior currencies such as the dollar or euro are still being used by most people, and are still useful, no matter how inferior these currencies are :-).

This means that the "someone buys something from me using stolen bitcoins" scenario will most likely be "someone receives partially stolen bitcoins from an exchange". When this happens, if the receiver contacts the victim, the victim can forward the bitcoin addresses to the police, and the exchange will receive a court order. With a court order, the exchange will have to provide information on how the money has been laundered, and on which bank account it ended up. Money can be tracked in the real world, perhaps not as easily as in the blockchain, but it can be tracked at least by interpol.

If this could lead to the recovery of the money cashed out by the scammer, I am sure Bruce Wagner would be very happy and smile again, even if he would recover fiat money instead of bitcoins. More important, catching a thief with the help of the blockchain would have a tremendous impact in the media, and it would dramatically change the image that the general public has of Bitcoin. Such a feat would certainly help exchanges to get to do businesses with banks, without having their accounts frozen on suspicion of mauney laundering.