Why not use Chainanalysis to see your privacy score

[pawanjain]

I don't know if it already exists but why can't we use chainanalysis technique to see if our privacy score is good or bad.
I did try using a chainanalysis once on some website but it was paid (seems that it was earlier free) . Why can't there be a free one now ?

How to achieve it ?

We can have a website or tool that performs chainanalysis on a particular bitcoin address and gives the output as a rating from 1 to 10 (bad to good) and 'may be' also list the connected addresses.
We can have the option whether we want to list the connected addresses or not.

Now comes the question that what if people use it wrongly and input someone else's bitcoin address to see their connected addresses.
For this we can use a signed message with specific format so that the website/tool can verify that we own the bitcoin address and are not using someone else's address.
The format could be something like this

The website/tool can display a message "'short message' + current time + OTP generated at that time(valid for few minutes)" - we should be signing the message with this format only
This way people won't be able to use old  signed messages of other people to wrongly use their bitcoin addresses.

If our privacy score is good then no worries but what if our privacy score is real bad ?
I only one way to overcome this solution and that is to use mixing services. Can anybody else suggest some good methods ?

[1714926803]

1714926803

[1714926803]

1714926803

[1714926803]

1714926803

[1714926803]

1714926803

[1714926803]

1714926803

[1714926803]

1714926803

[ranochigo]

It's not difficult to determine the link between addresses just that there are varying degrees of certainty and that the certainty will never ever be 100%.

The privacy score is pretty deceptive due to the myriad of resources that could be used to uncover your tracks. I think it's fair to say that most of the paid/free services are not intuitive enough to go right in depth into the specifics. I'm sure someone can train scripts to study the patterns used between various transactions to identify addresses. IMO, most of the services offer proprietary algorithm which means they shouldn't provide it for free because they don't stand to benefit from it's use.

There is no point trying to determine your privacy score because someone with sufficient resources could potentially discover links even though the services may give you a good rating. Blockchair provides a privacy meter[1] and walletexplorer.com can link addresses. If you're really serious about privacy, going by privacy ratings is not sufficient.

[1] https://blockchair.com/api/docs#link_M6

[RHavar]

It's not as easy as you think.

As an example look at this transaction:

https://blockstream.info/tx/a697ea66639ba7966269e935d4374e28bc368ca683c7214dfc28e42eae026dde


blockstream has a pretty basic privacy analysis:
* Round payment amount
* Mixed script types
* Unnecessary input heuristic

which suggests the privacy of this transaction is quite poor. However, it could actually be excellent! I have frequently hand-created transactions that look like they are doing something obvious (e.g. this transaction looks like it's a payment to the 0.3 BTC output) but in fact, that 0.3 BTC output might be the change output! (thanks to careful coin selection/mining fee)  and maybe the 0.021026 BTC output is actually the payment. The absolute best transactions from a privacy point of view look like one thing, but are doing the other.


So to create a real "privacy score" you basically need to know "what it looks like" vs "what it actually is" on a wallet level (?)

--

Another good example is: https://en.bitcoin.it/wiki/PayJoin  it looks like a normal transaction, but is actually a special type of coinjoin. It's kind of like kryptonite to chain analysis, because they make the wrong assumptions but have no idea where. I did one, and watched chainalysis (i think best in the business), create wrong assumptions about literally thousands of transactions, all because of a single payjoin

[o_e_l_e_o]

I don't know if it already exists but why can't we use chainanalysis technique to see if our privacy score is good or bad.

You can. Go and pay Chainalysis, Elliptic, or some similar company large sums of money for their services. These companies aren't going to hand out their service for free when they can charge centralized exchanges huge sums of money for the ability to invade your privacy.

We can have a website or tool that performs chainanalysis on a particular bitcoin address and gives the output as a rating from 1 to 10 (bad to good) and 'may be' also list the connected addresses.

A score of 1 to 10 is completely meaningless. You need a breakdown of their conclusions and how they reached them.

The website/tool can display a message "'short message' + current time + OTP generated at that time(valid for few minutes)" - we should be signing the message with this format only

So the service in question can then link your bitcoin addresses to your IP, your browser fingerprint, and what other bitcoin addresses you look up. Not great for privacy.

Can anybody else suggest some good methods ?

As RHavar says, these simple heuristics are easy to fool if you are paying attention. Purposely send your change to a different address type from the inputs. Obscure which values are change and which are not. Use multiple change addresses. Carefully use coin control so all your outputs are of similar value. Do not reuse addresses. Use common lock times, versions, and sequences, to make your transactions less unique. Make use of coinjoins and mixers. Do all this over Tor.

By far and away the biggest risk to your privacy is completing KYC and using centralized exchanges.


Similar to RHavar, I've made a transaction in the past which spent an output from ChipMixer (a legacy address) to pay a service (also using a legacy address), and sent the remaining change to a fresh P2WPKH address. Blockchair and Blockstream told me my privacy was poor, since it was obvious which output was the change, when in fact they were completely wrong.

[gmaxwell]

The only use for a 'privacy score' is introducing privacy concepts to someone who knows nothing about them and won't have as easy a time learning from reading a list by itself.

There is also potential for abuse.

For example after a prominent wallet added mechanism to improve privacy-- when it spends from one of a reused output it it tries to spend all of them-- one of these explorer sites changed to start reporting all those transactions as 0 privacy.  Were they just incompetent?  Trying to trash that particular wallet?  Trying intentionally to encourage users to use less private software?  No way to know.

Obviously anyone plugging their own addresses/transactions into these things are trashing their privacy.  Highlighting transaction properties can be useful for educating people, giving a score -- less so,   encouraging people to search their own transactions and/or addresses is just a bad move.

[acquafredda]

KYCP is a Bitcoin privacy explorer which lets you understand your txs links. It is based on OXT data. I imagine people with better skills that the ones I have could make the best out of it.
https://www.kycp.org/#/about

What I do not quite like is that they are creating a database of bitcoin entities (called Anon) which the longer it runs the more it will be de-anonymized.
See this tx as an example
https://www.kycp.org/#/b3dcc5d68e7ba4946e8e7fec0207906fba89ccb4768112a25d6e6941f2e99d97

[o_e_l_e_o]

What I do not quite like is that they are creating a database of bitcoin entities

It is trivial for anyone to create their own such database with publicly available blockchain information. Other sites, such as walletexplorer have done similar things. And anything that a free site is doing, you can guarantee that paid blockchain analysis technology from companies like Chainalysis is 100 times worse.

This database they are creating might be useful for the casual user who wants to look more closely at some transactions, but in terms of the entities you should actually be concerned about when it comes to privacy - exchanges, banks, governments - it is insignificant compared to what they are already using.

[Karartma1]

I have been using kycp (it's from Samourai Wallet's devs) for quite a while now. I have to confess I find it very handy to understand my blockchain fingerprints. I have been basically trying to obfuscate as many UTXOs as I possibly could. It's no easy task, but I would do that and more to protect my bitcoin privacy.
Here's a demo for your reference https://www.youtube.com/watch?v=faWjUuI5XOQ

[Wind_FURY]

The only use for a 'privacy score' is introducing privacy concepts to someone who knows nothing about them and won't have as easy a time learning from reading a list by itself.

There is also potential for abuse.

For example after a prominent wallet added mechanism to improve privacy-- when it spends from one of a reused output it it tries to spend all of them-- one of these explorer sites changed to start reporting all those transactions as 0 privacy.  Were they just incompetent?  Trying to trash that particular wallet?  Trying intentionally to encourage users to use less private software?  No way to know.

Obviously anyone plugging their own addresses/transactions into these things are trashing their privacy.  Highlighting transaction properties can be useful for educating people, giving a score -- less so,   encouraging people to search their own transactions and/or addresses is just a bad move.

It's like that "Have I been pwned?" site that checks if your current password is known, or in a hacker's dictionary list, or not. But actually it might be collecting passwords to add in their dictionary. Haha.

[acquafredda]

In fact, I feel so dumb to have been using blockchain.info as my preferred bitcoin explorer up to last year. I was mainly using it for convenience because it looked like the best one around. Then when I started digging more into privacy I stopped using it. My hope is that I am only some raw piece of data with no meaning.....

[Wind_FURY]

I have been using kycp (it's from Samourai Wallet's devs) for quite a while now. I have to confess I find it very handy to understand my blockchain fingerprints. I have been basically trying to obfuscate as many UTXOs as I possibly could. It's no easy task, but I would do that and more to protect my bitcoin privacy.
Here's a demo for your reference https://www.youtube.com/watch?v=faWjUuI5XOQ

Doing it too much/specific could make you stand out and reducing your own privacy instead.

It's like that "Have I been pwned?" site that checks if your current password is known, or in a hacker's dictionary list, or not. But actually it might be collecting passwords to add in their dictionary. Haha.

"Have I been pwned?" and similar website doesn't need your password, but only your email. What they collect is similar when you search bitcoin address on block explorer.

https://haveibeenpwned.com/Passwords

[o_e_l_e_o]

In fact, I feel so dumb to have been using blockchain.info as my preferred bitcoin explorer up to last year. I was mainly using it for convenience because it looked like the best one around. Then when I started digging more into privacy I stopped using it. My hope is that I am only some raw piece of data with no meaning.....

I don't like blockchain.info because it has a poor layout and it doesn't accurately display fees, still using fee per raw byte rather than fee per virtual byte, but it is no inherently worse for your privacy than any block explorer. Since the vast majority of people only use block explorers to look up their own transactions, then block explorers can at least infer which address belong to the same person based on the requests coming from the same IP, same browser fingerprint, same browsing session, etc.

The absolutely best way to look up transactions is to run your own node and look them up locally. If you are going to use a block explorer, then use Tor and if looking up your own transactions then only look up one at a time.


Typing either your email or password in to a site like haveibeenpwned is a security risk. Typing your password in is obvious. But they also have over 10 billion compromised accounts - obviously no one is going to check 10 billion accounts looking for something they can monetize. But if you type your email in, then it tells them that all accounts associated with that email address are potentially still active and therefore a good target for phishing, hacking, etc.

[ranochigo]

The absolutely best way to look up transactions is to run your own node and look them up locally. If you are going to use a block explorer, then use Tor and if looking up your own transactions then only look up one at a time.

I imagine that looking transactions up using your own node could be slightly difficult. Will have to enable TX index and possibly parse all the transactions into something that's optimized for searching, unless there is a way for the node to arrange them?

Typing either your email or password in to a site like haveibeenpwned is a security risk. Typing your password in is obvious.

Yeah. Should download the dumps that they've curated, it's in SHA1 and NTLM. But again, I didn't find them transmitting the password over, but it's hard to tell in the future.

[Karartma1]

I have been using kycp (it's from Samourai Wallet's devs) for quite a while now. I have to confess I find it very handy to understand my blockchain fingerprints. I have been basically trying to obfuscate as many UTXOs as I possibly could. It's no easy task, but I would do that and more to protect my bitcoin privacy.
Here's a demo for your reference https://www.youtube.com/watch?v=faWjUuI5XOQ

Doing it too much/specific could make you stand out and reducing your own privacy instead.

Trying my best as per my knowledge. I'm hoping to keep a balance between an overly paranoid approach and one focused on keeping as many layers of separation as possible. I'm no security expert and I'm probably making many mistakes but so far so good.
Surely, cashing out (fiat) will be hard one day and therefore I hope I will be able to choose the best jurisdiction when I will have to.

[acquafredda]

In fact, I feel so dumb to have been using blockchain.info as my preferred bitcoin explorer up to last year. I was mainly using it for convenience because it looked like the best one around. Then when I started digging more into privacy I stopped using it. My hope is that I am only some raw piece of data with no meaning.....

I don't like blockchain.info because it has a poor layout and it doesn't accurately display fees, still using fee per raw byte rather than fee per virtual byte, but it is no inherently worse for your privacy than any block explorer. Since the vast majority of people only use block explorers to look up their own transactions, then block explorers can at least infer which address belong to the same person based on the requests coming from the same IP, same browser fingerprint, same browsing session, etc.

The absolutely best way to look up transactions is to run your own node and look them up locally. If you are going to use a block explorer, then use Tor and if looking up your own transactions then only look up one at a time.

Thanks for the hints. I am very much aware of it actually and I have a pretty clean and tidy browsing setup: different user agents, different IPs (via either tor or VPNs), before looking for my txs I usually pick a few random ones. With this setup, plus uBlock origin I believe I am the "worst" user a site want to have on its platform. I don't leave fingerprints, don't accept cookies, have no JS (whenever possible).
I try hard not to be monetized.

[o_e_l_e_o]

But again, I didn't find them transmitting the password over, but it's hard to tell in the future.

Ideally, everyone should be using an open source password manager to generate long and random passwords, and using a unique one for each and every site they visit or account they use. Then if you search a password you know immediately which account is compromised and who leaked your data.

Surely, cashing out (fiat) will be hard one day and therefore I hope I will be able to choose the best jurisdiction when I will have to.

Centralized exchanges are steadily asking for more and more ridiculous amounts of information. It won't be long before they want to see proof of income, copies of your paycheck, PDFs of bank statements, and the like. As you say, it is going to be harder and harder to use centralized exchanges without completely and utterly giving up every inch of privacy. However, short of taking control of the bitcoin network, governments can't stop you from buying and selling coins directly with other individuals using cash or some other direct payment method.

I don't leave fingerprints

Small correction - you always leave a fingerprint. Your goal is either to make it completely generic and therefore not identifiable (which is why customizing Tor is generally not recommended), or to change it frequently so it can't be used to link your activity. There's much more to a browser fingerprint than simply the user agent.

[acquafredda]

I don't leave fingerprints

Small correction - you always leave a fingerprint. Your goal is either to make it completely generic and therefore not identifiable (which is why customizing Tor is generally not recommended), or to change it frequently so it can't be used to link your activity. There's much more to a browser fingerprint than simply the user agent.

Thanks man, great hint. I have never thought of that in those terms and it makes a lot of sense. Whenever using Tor I will never make any customization from now on 

https://www.whatismybrowser.com/
Screen resolution, browser window size ...... they know almost everything. Or, at least, they know what we are able to obfuscate.
Thanks!

[demchukvm]

It's not as easy as you think.

Chainalysis uses clusterisation method to combine blockchain addresses into groups (usually cluster = group = crypto service), gives clusters some AML-risk score (in %), and then calculates risk score of any address by finding it's connections with those clusters.

Another good example is: https://en.bitcoin.it/wiki/PayJoin... I did one, and watched chainalysis (i think best in the business), create wrong assumptions about literally thousands of transactions, all because of a single payjoin

Other crypto AML companies use the same clusterisation method to find address' connection with known owners. There are several problems with these companies:
1. They collect data for further clusterisation.
2. They ask for KYC.
3. They ask for monthly or yearly prepayment (by bank transfer)
4. They are B2B only.

All these problems we tried to solve in AMLBot, so you can check any address anonymously.
Here is an example:

To get such result you can use Telegram or any email at web.amlbot.com

Here is our main page at bitcointalk.
Would be glad to answer all your question.

[demchukvm]

Make use of coinjoins and mixers.

For AML-tools old mixers do not work. Ask me Why?)