Bitcoin is NOT anonymous--and is a dangerous privacy issue for its users

[legiteum]

I would like to introduce a topic that I have been thinking about for a while.

Most people assume that because Bitcoin transactions involve anonymous numbers, and not a real name and other private information, then Bitcoin is perfectly safe from anybody knowing of your transactions.

However, Bitcoin is a public ledger, and every transaction is available to anybody on the Internet.

For me, this akin to web server logs containing your IP address: it's just a number, right? That's what everybody thought when the internet was new, but we all quickly learned that your IP could be "triangulated" to your real identity: once you used that IP to connect to something with your real identity, then the IP and the identity could be linked, and thus your IP was essentially the same as using your name and address for every single server access.

The advent of Monera and Bitcoin mixers would seem to verify my thesis here: why would these things have been invented and have become popular among those who are serious about their privacy (for whatever reason) if Bitcoin was not a privacy issue?

Bitcoin has the same problem IP addresses always had: if you used your personal information anywhere along the chain, the entire chain can now be attached to you.

How long will it be before somebody builds an app that allows you to put in a Bitcoin address and pop out a name and address? (Pardon my ignorance if this is actually already an available product).

How long before marketers start using this data to target ads at people? For criminal networks to start using this to target people?

Millions of consumers seem to believe, falsely, that using Bitcoin makes their transactions private. And that false information can be very dangerous since it will give people a false sense of security.

Bitcoin being a private means of transacting is a dangerous falsehood that needs to be corrected.

Am I wrong about any of this?

[Hatchy]

Bitcoin has the same problem IP addresses always had: if you used your personal information anywhere along the chain, the entire chain can now be attached to you.
Bitcoin being a private means of transacting is a dangerous falsehood that needs to be corrected.

It's not the same issue, mate. Bitcoin's privacy problem isn't related to IP addresses. The real reason people's privacy is compromised is because they use centralized systems. When you sign up for a centralized platform, you have to give away personal information, which eliminates your anonymity. This means authorities can trace a transaction back to you if they want to.

Bitcoin has always had privacy limitations, which is why solutions like CoinJoin were introduced early on to improve privacy. tumblers have also played a crucial role in enhancing privacy for Bitcoin users. What you should know is that bitcoin creates a decentralized system for transactions and doesn't mainly focus on privacy. Coins like xmr monero is what we term as a privacy coin.

[legiteum]

Bitcoin has the same problem IP addresses always had: if you used your personal information anywhere along the chain, the entire chain can now be attached to you.
Bitcoin being a private means of transacting is a dangerous falsehood that needs to be corrected.

It's not the same issue, mate. Bitcoin's privacy problem isn't related to IP addresses.

I never implied it was. It was just an example of a similar issue. Please re-read my post (?).

[Cryptohygenic]

Bitcoin has the same problem IP addresses always had: if you used your personal information anywhere along the chain, the entire chain can now be attached to you.
Bitcoin being a private means of transacting is a dangerous falsehood that needs to be corrected.

It's not the same issue, mate. Bitcoin's privacy problem isn't related to IP addresses. The real reason people's privacy is compromised is because they use centralized systems. When you sign up for a centralized platform, you have to give away personal information, which eliminates your anonymity. This means authorities can trace a transaction back to you if they want to.

Bitcoin has always had privacy limitations, which is why solutions like CoinJoin were introduced early on to improve privacy. tumblers have also played a crucial role in enhancing privacy for Bitcoin users. What you should know is that bitcoin creates a decentralized system for transactions and doesn't mainly focus on privacy. Coins like xmr monero is what we term as a privacy coin.

That is very correct and in further essence how bitcoin is privatized is that you can process your transactions on the decentralized exchange wallet without exposure of your identity unless the user executes the transaction using the centralized exchanges networks.
So if a device IP is being compromised, it does not entangle with the bitcoin transaction so if being tracked with as a course of insecured IP, it definitely has no linkage with the bitcoin transaction as bitcoin already is tied on its private and decentralized blockchains.

[d5000]

You're partly right but I don't see any "danger" here.

In first place, nobody really promotes Bitcoin as a "private" means of payment anymore. That was the case perhaps in 2011 or so. It is generally described as "pseudonymous". It's as "private" as social media is -- i.e. if you don't be wary to protect your privacy, everybody will be able to link a Bitcoin address with an identity, like if you publish your identity in a social media platform or forum.

In second place, you still can transact privately with Bitcoin, if you are strict about not publishing addresses and also don't reuse them. It is for a purpose that Bitcoin clients try to enforce the "no-reuse" policy to the users. And then of course there are techniques like CoinJoins and atomic swaps which can even make already "de-anonymized" funds (e.g. because by mistake you published an address online) private again, even without the intervention of mixers and tumblers.

Third, linking complete identities to addresses isn't that easy. You also need access to a database connecting different parts (e.g. full name, e-mail address, phone number) of the identity. These lists are of course sold in darknet markets, so criminals actually can have already access to some tools of some people (but not of the entire population normally). That's why everybody already warns about the "$5 wrench attack". But for companies, to purchase these lists for marketing use would be very risky as this is of course against data protection laws. It's also a cost issue: I think a marketing tactic based on the identity of an address would only make sense if the person behind it is very wealthy. But you may have to investigate a lot to find a wealthy person which is at the same time not wary about the privacy issue.

[Ojima-ojo]

When I first saw this thread title I baffles a little until i read through the entire discussion and I discover that ops have made alot of controversial statement about bitcoin and it privacy provision because in all his statement he failed to define what decentralised network means to him and how best to interact with centralised service without losing our identities.


This is the first time I am hearing of the statement that IP contains and transfer our identities, although I know of the traceability of IP but I haven't read where IP contains users identity that he has shared online and on the Internet before.

[legiteum]

You're partly right but I don't see any "danger" here.

In first place, nobody really promotes Bitcoin as a "private" means of payment anymore.

Are you kidding me? That's almost entirely how it is promoted to average consumers.

Yes, hardened criminals and those living under oppressive governments whose lives are in danger know these things well, but for the average US consumer, Bitcoin is mostly seen as privacy-enhanced.

In second place, you still can transact privately with Bitcoin, if you are strict about not publishing addresses and also don't reuse them. It is for a purpose that Bitcoin clients try to enforce the "no-reuse" policy to the users. And then of course there are techniques like CoinJoins and atomic swaps which can even make already "de-anonymized" funds (e.g. because by mistake you published an address online) private again, even without the intervention of mixers and tumblers.

Yes, and I touched upon this in the OP: that Bitcoin alone in the way most people use it is not private and therefore needs to be used in conjunction with other tools. But most Bitcoin users don't use these tools, or even know about them.

Third, linking complete identities to addresses isn't that easy. You also need access to a database connecting different parts (e.g. full name, e-mail address, phone number) of the identity. These lists are of course sold in darknet markets, so criminals actually can have already access to some tools of some people (but not of the entire population normally). That's why everybody already warns about the "$5 wrench attack". But for companies, to purchase these lists for marketing use would be very risky as this is of course against data protection laws.

Well, take a look at what companies do today with IP addresses. There are some laws here and there, and they certainly help, but your IP is pretty easy to triangulate to your identity, and the targeted ads you see (when you don't use a VPN) demonstrate that.

It's also a cost issue: I think a marketing tactic based on the identity of an address would only make sense if the person behind it is very wealthy. But you may have to investigate a lot to find a wealthy person which is at the same time not wary about the privacy issue.

That's how all marketing works. They put you in a database and sort by your demographic profile. You don't need to be "very wealthy" to be profitable for a marketer or a hacker...

When I first saw this thread title I baffles a little until i read through the entire discussion and I discover that ops have made alot of controversial statement about bitcoin and it privacy provision because in all his statement he failed to define what decentralised network means to him and how best to interact with centralised service without losing our identities.

I never intended to try to solve the problem here, only to point out that there's a problem.

This is the first time I am hearing of the statement that IP contains and transfer our identities, although I know of the traceability of IP but I haven't read where IP contains users identity that he has shared online and on the Internet before.

Google it. Using the internet without a VPN is... not safe. Once a single entity connects your IP to your identity that can be (and often is) shared widely. All of this is done with data marketplaces and so forth.

[Kruw]

Bitcoin being a private means of transacting is a dangerous falsehood that needs to be corrected.

Am I wrong about any of this?

You are correct, Bitcoin transactions are not private by default, you have to create a collaborative transaction called a 'coinjoin' to be anonymous. It's easy to have complete privacy on Bitcoin when you use Wasabi Wallet or BTCPay Server's coinjoin plugin: https://mempool.space/tx/fc13786aa9a350d06e7f63c69e7989917981c689f284a7eba3130cde958e23bb

[Fivestar4everMVP]

Bitcoin being a private means of transacting is a dangerous falsehood that needs to be corrected.

Am I wrong about any of this?

As much as you made some really good keypoints which I tend to agree with, I will still have to say that you are not entirely right, and the reason Is very simple, the fact that a person can own and manage as much bitcoin addresses as  he or she possibly wants, tells you that it's pretty difficult to track all addresses to a particularly person. Like for example, I personally have more 10 different and active bitcoin addresses, and even if one or two of those addresses can be linked to me, there is no way the other 9 or 8 addresses can be linked to me as well, because I recieve transactions from several people, and send transactions to several people as well; from those addresses.

Like I believe some other users must have mentioned, the only way or reason why tracking bitcoin addresses to real humans became quite possible is due to patronage to centralized services where kyc verification is mandatory, outside of this, it was never possible to link a bitcoin address to a particular person, except someone you know in person and have their address.

[d5000]

Are you kidding me? That's almost entirely how it is promoted to average consumers.

No. Censorship resistant isn't the same as "private". For example, do you see the word "private" on https://bitcoin.org in the main description of Bitcoin? No - the only part is where they give privacy tips actually, and that are the techniques I mentioned (no address reuse etc.).
If some influencer tells people Bitcoin is "private", this is of course is wrong, not good and it happens, but I don't see this very frequently. At least not without the usual warnings.

Well, take a look at what companies do today with IP addresses. There are some laws here and there, and they certainly help, but your IP is pretty easy to triangulate to your identity, and the targeted ads you see (when you don't use a VPN) demonstrate that.

Targeted ads do not need a link to a complete identity to work. The IP address and cookies are effective for targeting even without knowing more about you than the websites you visit. In some cases the IP address is linked to an email address for example, if you register at a site participating in an ad network, so you can also get advertising mails from different companies (which is forbidden in most countries but it happens), but in most cases it's not more than that. In the case of "blackhats" that may be different, but that's not the normal case of "targeted ads" you see everywhere, as a "triangulation" isn't that important for them. For marketers your real name for example isn't important, the interesting thing is what you could buy.

Let's say such a profile is now connected to a Bitcoin address or a group of addresses. The question is: could a marketing company really profit from that? They would need more information, for example if you use the Bitcoins to buy stuff. But the demographic of those holding and spending Bitcoin, which would be attractive for this kind of targeting, is unfortunately small. Traditional targeting via IP address and cookies is probably cheaper and equally effective.

]
That's how all marketing works. They put you in a database and sort by your demographic profile. You don't need to be "very wealthy" to be profitable for a marketer or a hacker...

What I mean is that you need to be wealthy if you are targeted specifically because of your Bitcoin address, in other words that the Bitcoin address represents a "value for itself" for the marketing company.

For marketers it's much more important to know your interests than a Bitcoin address you use.
The only case is the "5$ wrench attack", it may be of interest for criminals if someone holds e.g. $20k in Bitcoin in their city, which is not someone "very wealthy" but let's say a lucky middle class guy. Such attacks have occurred, but they're not very frequent, because they're difficult to organize. A fiat-based scam (e.g. via bank account hacks or Whatsapp scams) or simply robbing your physical fiat wallet on the street is much cheaper and more effective.

I'm not saying that Bitcoin is immune to those kind of attacks but I think you dramatize the issue as if it was an existential problem for Bitcoin. Just like this recent FUD attack fueled by some hedge funds about the "2140 problem"

Edit: Just to add: your title is completely wrong, Bitcoin is not a dangerous privacy issue. There are privacy issues with Bitcoin like with almost every other technology.

[Doan9269]

I would like to introduce a topic that I have been thinking about for a while.

Or maybe you're planning on showing to everyone in public on how confused you were about bitcoin, if you don't know much, then its better to take time in making some findings, this is not about how we feel or think, its on what we know as a reality concerning the needs of the people when it comes to finances, security and privacy.

Most people assume that because Bitcoin transactions involve anonymous numbers, and not a real name and other private information, then Bitcoin is perfectly safe from anybody knowing of your transactions.

However, Bitcoin is a public ledger, and every transaction is available to anybody on the Internet.

And what has this got to do bitcoin not being anonymous or why it should be dangerous for use, if you don't have an idea on what bitcoin is, its better to remain silent than throwing controversial thoughts that could be misleading to those ready to learn something new about bitcoin when they come across your post.

[legiteum]

Are you kidding me? That's almost entirely how it is promoted to average consumers.

No. Censorship resistant isn't the same as "private". For example, do you see the word "private" on https://bitcoin.org in the main description of Bitcoin? No - the only part is where they give privacy tips actually, and that are the techniques I mentioned (no address reuse etc.).
If some influencer tells people Bitcoin is "private", this is of course is wrong, not good and it happens, but I don't see this very frequently. At least not without the usual warnings.

I see the word "private" on the descriptions written by thousands of Bitcoin users ever day. They are obviously wrong, but that is clearly the perception of Bitcoin.

Let's say such a profile is now connected to a Bitcoin address or a group of addresses. The question is: could a marketing company really profit from that? They would need more information, for example if you use the Bitcoins to buy stuff. But the demographic of those holding and spending Bitcoin, which would be attractive for this kind of targeting, is unfortunately small. Traditional targeting via IP address and cookies is probably cheaper and equally effective.

Could they profit? Sure. As much as they currently do with IP addresses? Of course not. But you don't need to make a trillion dollars in order to profit. I suspect chain analysis will get to be more and more of a thing as advertisers get more sophisticated...

I'm not saying that Bitcoin is immune to those kind of attacks but I think you dramatize the issue as if it was an existential problem for Bitcoin.

Well, I guess "drama" is in the mind of the beholder. Using Bitcoin alone, without sophisticated techniques to obscure your transaction is a security risk--just like surfing the web without a VPN is. But I wouldn't call the statement, "surfing the web without a VPN is a dangerous privacy issue" an "existential problem for the Internet". I wouldn't call the statement, "driving in snow is dangerous" an "existential problem for winter driving". Etc.

Edit: Just to add: your title is completely wrong, Bitcoin is not a dangerous privacy issue. There are privacy issues with Bitcoin like with almost every other technology.

I certainly would call the risk of somebody triangulating you and beating you up for your Bitcoin (or killing you, as in the other thread from today here), something that is definitely a "danger". Just because other things are dangerous doesn't mean that Bitcoin isn't.

Perhaps what you might be missing here is that most people actually do not know about chain analysis and thus it's not "obvious" that Bitcoin has this issue--and their ignorance of this presents a danger...

And what has this got to do bitcoin not being anonymous or why it should be dangerous for use, if you don't have an idea on what bitcoin is, its better to remain silent than throwing controversial thoughts that could be misleading to those ready to learn something new about bitcoin when they come across your post.

What about my post is misleading? Are you saying--unlike most of the responders here--that Bitcoin does not present a privacy risk when you use it in its raw form? Are you saying it is anonymous?

[BitMaxz]

Since you are talking about web servers I guess you were talking about websites or exchanges I'm pointing to this "web server logs containing your IP address".
Well, yes they have your IPs but do you think when you withdraw to a non-custodial wallet and send it to another wallet they know if you still own the BTC or sent it to another guy or bought something online? Do they still know your IP?

Blockexplorer itself only shows the node IP, not the one who sent a BTC you can protect your privacy by having your node and use it as your Electrum server can be also a good alternative you hide your IPs or use a non-custodial wallet that supports TOR it can also hide your IP.

If you know everything to hide your IP why buy directly on the centralized exchange you can use the decentralized exchange to buy BTC and hide everything. Bisq exchange as a sample it support TOR or use eXch it also supports TOR.

[bbc.reporter]

Bitcoin being a private means of transacting is a dangerous falsehood that needs to be corrected.

Am I wrong about any of this?

Are you a real newbie? This argument is very much known, very much old and very much settled heheheh. If you want privacy you can use Monero if you can still buy this from exchanges.

Also, I reckon much of us small minnow users use bitcoin to speculate on altcoins and gamble on different games and sports. We do not need privacy for this. The criminals however, they have different problems because they need  privacy for their activities.

[FinneysTrueVision]

Most people assume that because Bitcoin transactions involve anonymous numbers, and not a real name and other private information, then Bitcoin is perfectly safe from anybody knowing of your transactions.

In the early days of Bitcoin this might have been true, but people are educated enough by now to know there are certain shortcomings in privacy if you are not consciously going out of your way to make it harder to be tracked and deanonymized.

Mixers were once very popular because of this reason and eventually people also started using coinjoin and privacy coins. Base layer privacy has not had meaningful improvement in a long time. Until there is less hostility from governments, progress will remain stalled.

With the amount of surveillance we are subjected to when we use the internet there is always a possibility that your personal identity can be attached to certain on-chain activity and you could possibly be targeted because of this. It is important to limit how much information you allow others to collect. Content blockers, VPNs, alias emails are all useful in preventing your personal data from being exposed.

[ABCbits]

Most people assume that because Bitcoin transactions involve anonymous numbers, and not a real name and other private information, then Bitcoin is perfectly safe from anybody knowing of your transactions.

It's commonly known that Bitcoin is not anonymous, but rather pseudonymous.

Bitcoin has the same problem IP addresses always had: if you used your personal information anywhere along the chain, the entire chain can now be attached to you.

Although it's worth to mention that just like you can use multiple IP address, you also can use multiple Bitcoin address. That's why most wallet software generate HD wallet.

How long will it be before somebody builds an app that allows you to put in a Bitcoin address and pop out a name and address? (Pardon my ignorance if this is actually already an available product).

I expect blockchain analysis company already offer such service. Although analysis result / data provided by them isn't always accurate.

Bitcoin being a private means of transacting is a dangerous falsehood that needs to be corrected.

Just don't forget that privacy and anonymity are 2 different thing.

[Solosanz]

That's true, so what? if someone think Bitcoin is anonymous, it's their mistake, Bitcoin is never been anonymous.

Yep Monero and Bitcoin mixers exist because Monero is a cryptocurrency better in terms of privacy and mixers is used to make Bitcoin more private.

However, Monero is already viewed as an illegal currency, many big CEX, institutions, banks and countries have start to ban this currency.

While Bitcoin, it's the only one currency that high unlikely get banned by many countries, instead some of countries who use to ban Bitcoin start to unban it.

I think it's completely fine, you can enjoy some level of privacy and a probability to grow your wealth in Bitcoin.

[SquirrelJulietGarden]

However, Bitcoin is a public ledger, and every transaction is available to anybody on the Internet.

Bitcoin is not a dark ledger and it is traceable but if you know how to use your Bitcoin wallet with a full node, Tor, good practice with addresses, change addresses, inputs and outputs, you can increase your privacy and anonymity.

It's not perfect in privacy and anonymity but it is better than if you use banks for bank transfers and other services that under control and management of governments.

General guidelines for sending BTC transactions

[legiteum]

It's not perfect in privacy and anonymity but it is better than if you use banks for bank transfers and other services that under control and management of governments.

It is absolutely not better than a bank transaction. This is the sort of dangerous misinformation I have been talking about here.

A typical credit card transaction is known to you, the bank involved, and the counterparty. The latter two present a risk of exposure of your privacy, but only  two entities that can expose your data--and they are known entities that are also heavily regulated. If a bank exposes your personal information, you can sue them for damages, etc.

On the other hand, a Bitcoin transaction is known to potentially five billion entities because it's open to the whole world. And none of those entities are accountable to any law or regulation, and they can't be sued no matter how criminal their intentions are since they cannot be known.

You are much better off using a credit card transaction, from the standpoint of privacy, than you are a standard Bitcoin transaction.

[Cookdata]

Bitcoin has the same problem IP addresses always had: if you used your personal information anywhere along the chain, the entire chain can now be attached to you.

This is where you got it all wrong. IP address isn't enough validation to detail a person on the internet, anyone can used fake IP address that gives a person different address and locations. Even this forum don't judge people by IP address because people protect their privacy alot with different IP addresses. I hope this clear your first intuition.

How long will it be before somebody builds an app that allows you to put in a Bitcoin address and pop out a name and address? (Pardon my ignorance if this is actually already an available product).

How long before marketers start using this data to target ads at people? For criminal networks to start using this to target people?

I will be waiting for you to build one so we can have the first person ttat personalized ads from people. Where will you get addresses from? Centralized exchanges? You want to pay Binance, Kucoin, Bybit, Coinbase to give you all their customers data, email, documents, photographs and all their corresponding wallet addresses? Please wake up from your dream. 

Millions of consumers seem to believe, falsely, that using Bitcoin makes their transactions private. And that false information can be very dangerous since it will give people a false sense of security.

Bitcoin being a private means of transacting is a dangerous falsehood that needs to be corrected.

Am I wrong about any of this?

I will assumed you know a little about Bitcoin but you are wrong about many things, start with Mastering Bitcoin and Bitcoin for beginners, it will help you reshape your thinking about some go the misconceptions aboyr Bitcoin.