We present the first measurement study of JoinMarket, a growing marketplace for more anonymous transfers in the Bitcoin ecosystem. Our study reveals that this market is funded with multiple thousand bitcoins and generated a turnover of almost 29.5 million USD over the course of 13 months. Assessing the resilience of the market against a well-funded attacker, we discover that in a typical scenario, a selective attack with a 90% success rate requires an investment of 14 000–54 000 USD (which is recoverable after the attack). We present economic arguments to explain the existence of this novel market for anonymity and underpin the hypothesis of heterogeneous time preference with empirical data.
The trend of digital currencies is catching fire these days, more and more people want to use digital currency. When we talk about digital currencies then how can we forget taking the name of Cryptocurrencies like Bitcoin. These currencies because of their P2P nature have won lot of hearts. You must have heard that "Every Rose has a thorn", similar type of thing is with Cryptocurrencies too. Because of the reason these currencies are P2P nature and there is no 3rd party who controls these cryptocurrencies, these are being used for illegal drugsarms dealing and for purchasing weapons online which are used in the terror attacks. We have found out a solution in order to put an end to it and the solution is Freezing of Assets. In this the owner will have the liberty to freeze any account whichever seem fishy and the freezed accounts will have their money intact, just the difference will be that they won't be able to transfer the money.
Bitcoin is a cryptocurrency which has received increasing interest over the last five years. Built upon a decentralized peer to peer system, it supports transparent, fast, cost effective, and irreversible transactions, without the need for trusting third party financial institutions. We know however little about people's motivation and experience with bitcoin currency. This paper reports on interviews with 20 bitcoin users in Malaysia about their experience and trust challenges. Findings show that bitcoins are used more as store of value for speculative investment or savings' protection. The paper advances the HCI theories on trust by identifying main bitcoin characteristics and their impact on trust, such as decentralization, unregulation, embedded expertise, and reputation, as well as transactions' transparency, low cost, and easiness to complete. We discuss insecure transactions, the risk of dishonest traders and its mitigating strategies. The paper concludes with design implications including support for the transparency of two-way transactions, tools for materializing trust, and tools for supporting reversible transactions.
Malte Möser, Kyle Soska, Ethan Heilman, Kevin Lee · 11 authors
Abstract Monero is a privacy-centric cryptocurrency that allows users to obscure their transactions by including chaff coins, called “mixins,” along with the actual coins they spend. In this paper, we empirically evaluate two weaknesses in Monero’s mixin sampling strategy. First, about 62% of transaction inputs with one or more mixins are vulnerable to “chain-reaction” analysis - that is, the real input can be deduced by elimination. Second, Monero mixins are sampled in such a way that they can be easily distinguished from the real coins by their age distribution; in short, the real input is usually the “newest” input. We estimate that this heuristic can be used to guess the real input with 80% accuracy over all transactions with 1 or more mixins. Next, we turn to the Monero ecosystem and study the importance of mining pools and the former anonymous marketplace AlphaBay on the transaction volume. We find that after removing mining pool activity, there remains a large amount of potentially privacy-sensitive transactions that are affected by these weaknesses. We propose and evaluate two countermeasures that can improve the privacy of future transactions.
Philippe Genestier, Sajida Zouarhi, Pascal Limeux, David Excoffier · 7 authors
In our digital world, access to personal data has become an item of concern, with challenging security and privacy aspects. Occurrences of hacking intentions and privacy violations make digital trust a major challenge. This is true in the eHealth area where management of patient health data must comply with many regulations, while remaining accessible to duly authorised health practitioners. Most will have heard about Blockchain because of its most known application - Bitcoin - in the payment area. However, Blockchain’s characteristics make it possible to fulfill the requirements of consent management, as illustrated in an implementation within a health domain use case.
One of the fundamental applications for a practically useful system of money is remuneration. Information pertaining to the amount of compensation awarded to different individuals is often considered sensitive, commanding a certain degree of privacy. As Bitcoin and similarly designed cryptocurrencies evolve into a recognized medium of exchange for larger swaths of the world economy, an increasing number of people will earn income in the form of blockchain-based payments. The nature of these transactions is such that the minute details of an affected individuals compensation package and spending habits will be exposed to public scrutiny. In some cases this violates cultural norms which respect the confidentiality of salaries, yet in other cases it could be regarded as providing the benefits associated with greater transparency. In this work we analyse the Bitcoin blockchain record of periodic payments accruing to an individual address in exchange for goods or services rendered. For differing levels of available information we seek to determine the extent of insights that can be gleaned about the transacting counter-parties and the privacy implications this entails.
Mathieu Chanson, Alexander Bogner, Felix Wortmann, Elgar Fleisch
Giving people ownership of the data they produce becomes more and more important in times of ever-growing capabilities to collect and analyze data of individuals. In light of this challenge, we show how blockchain technology can enable privacy by presenting an odometer fraud prevention system. It records mileage and GPS data of cars and secures that on the blockchain, which strongly hinders odometer fraud. Our users own and control their data while at the same time data integrity is ensured. This facilitates the certification of that data. We discuss the advantages of this approach compared to current systems and also highlight limitations of our architecture and the use of blockchain technology.
Within the phenomenon known as the Internet of Things (IoT), an enormous growth is taking place. IoT systems exist in different ways, ranging from industrial applications to user focused systems. A specific subset of a user-focused IoT system is found as Smart Home environments. At Smart Homes, themultiple Smart Objects or Smart Devices are working together, frequently based on sensor input, to increase the comfort and user experience of the home inhabitant(s) and guest(s). Smart Objects can have automated tasks, home security enabling functions or efficiency improving functionality. Apart from great applications of Smart Home devices, threats from a cyber security perspective are present: cyber risks arise due to a variety of threats on such IoT systems. We show that in the development of new Smart Home products or systems, vendors fail to meet requirements for security and privacy are not met. Comparing the current state of the market, the four most used Smart Home ecosystems (Samsung Smartthings, Apple Homekit, Amazon Echo and IFTTT) are surveyed based on three key focus areas: 1. The regulatory compliance of the systems according to the upcoming General Data Protection Regulation (GDPR). 2. The commercial threats due to data profiling. 3. The risk of data leaks due to insufficient security. This analysis results in four key observations: 1. Security- and Privacy-By-Design is usually not in place due to the fact that the focus lies on launching a product as soon as possible, e.g. due to market competition; 2. Vendors process (meta)data on the vendors locations resulting in data profiling, which can compromise user privacy; 3. Smart Home ecosystems are not ready for the GDPR; 4. A trade off between privacy, security and utility usually results to the detriment of the first two and favors the latter. We propose a new design for a Smart Home ecosystem. In this design, the focus lies at the privacy of the end-user. We design a network for device-fitting encrypted communication between Smart Devices and User Devices and the Privacy Enforcing Arbiter (or Peter). Peter functions like a hub in the network, managing among others all traffic, user privileges and key distribution. With Peter, the centralized cloud party (vendor) for data storage and data analysis is replaced with a decentralized personal storage and computation entity at home. With our network design, we facilitate the use of IoT devices in home in a privacy-friendly way. Within the network, devices are authenticated using PhysicallyUnclonable Function technology and users are authenticated with a Zero Knowledge Proof. We analyze the privacy and security of our proposed network, based on a series of possible cyber attacks and the upcoming GDPR. Furthermore, we analyze the computational complexity and scalability of the network, based on market conform device power.
Bitcoin has emerged as the leading cryptographic currency since its inception in 2009 and at the time of writing holds a market capitalization of $28.4 billion. This ever-increasing figure has attracted adopters seeking to advance their investments, often leaving purely technical aspects on the sidelines. As is the case with any innovative technology, misconceptions are plentiful and information is not always conclusive. The research effort presented in this paper consists of a quantitative study seeking to address the subject of user anonymity in the Bitcoin network by employing an online survey on one of the most prominent Bitcoin forums. This includes 50 eligible participants, whose motivation is derived through the application of temporal motivation theory. The survey seeks to form an understanding of user attitudes towards the aspect of anonymity by following a methodological approach for exploring common tendencies among the representatives and will serve as the underlying data set from which conclusions can be drawn. Furthermore, this paper will present a literary study of the actual state of anonymity in this peer-to-peer technology by reviewing current findings highlighted in the area, thus presenting a comprehensive view of anonymity in the Bitcoin network, which will contrast the user study.
Ethereum represents the second generation of blockchain technology by providing\nan open and global computing platform which allows the exchange of cryptocurrency\n(Ether) and the development of self-verifying smart contract applications.\nSmart contracts present a foundation for possessing digital assets and a variety of\ndecentralized applications within the blockchain area. Ethereum and smart contracts\nare public, distributed and immutable, as such, they are prone to vulnerabilities\nsourcing from simple coding mistakes of developers.\n\nMotivated by the security breaches and recurring financial losses in smart contracts,\nwe aim to advance the field of security in smart contract programming.\nThe main objective is to aid smart contract developers by providing a taxonomy of\nall known security issues and by inspecting the security code analysis tools used\nto identify those vulnerabilities. Based on previous research as well as attacks on\nEthereum smart contracts, we propose an updated taxonomy which categorizes\nall known vulnerabilities within their architectural and severity level. Our second\nproposed taxonomy is a novel categorization of security tools on Ethereum.\n\nFurthermore, we conduct the investigation of security code analysis tools on\nEthereum by assessing their effectiveness and accuracy. In particular, we analyze\nfour security tools, namely, Oyente, Securify, Remix, and SmartCheck. The results\nindicate that there are overall inconsistencies between the tools on different security\nproperties. SmartCheck outperformed the other tools in terms of effectiveness,\nwhereas Oyente performed the best in terms of accuracy. Furthermore, based on\nthe limitations we identified, we propose future improvements within the user interfaces,\ninterpretation of results, and additional vulnerability checks.
The sharing economy, the business of collectively using privately owned objects and services, has fuelled some of the fastest growing businesses of the past years. However, popular sharing platforms like Airbnb or Uber exhibit several drawbacks: a cumbersome sign up procedure, lack of participant privacy, overbearing terms and conditions, and significant fees for users. We demonstrate a Decentralised App (DAPP) for the sharing of everyday objects based on a smart contract on the Ethereum blockchain. This contract enables users to register and rent devices without involvement of a Trusted Third Party (TTP), disclosure of any personal information or prior sign up to the service. With increasing distribution of cryptocurrencies the use of smart contracts such as proposed in this paper has the potential to revolutionise the sharing economy.
Michele Amoretti, Giacomo Brambilla, Francesco Medioli, Francesco Zanichelli
Location-Based Services (LBSs) build upon geographic information to provide users with location-dependent functionalities. In such a context, it is particularly important that geographic locations claimed by users are trustworthy. Centralized verification approaches proposed in the last few years are not satisfactory, as they entail a high risk to the privacy of users. In this paper, we present and evaluate a novel decentralized, infrastructure-independent proof-of-location scheme based on blockchain technology. Our scheme guarantees both location trustworthiness and user privacy preservation.
In Mobile Crowd Sensing (MCS), the power of the crowd, jointly with the sensing capabilities of the smartphones they wear, provides a new paradigm for data sensing. Scenarios involving user behavior or those that rely on user mobility are examples where standard sensor networks may not be suitable, and MCS provides an interesting solution. However, including human participation in sensing tasks presents numerous and unique research challenges. In this paper, we analyze three of the most important: user participation, data sensing quality and user anonymity. We tackle the three as a whole, since all of them are strongly correlated. As a result, we present PaySense, a general framework that incentivizes user participation and provides a mechanism to validate the quality of collected data based on the users' reputation. All such features are performed in a privacy-preserving way by using the Bitcoin cryptocurrency. Rather than a theoretical one, our framework has been implemented, and it is ready to be deployed and complement any existing MCS system.
Kibin Lee, Joshua I. James, Tekachew Gobena Ejeta, Hyoung Rae Kim
Cryptocurrency, and its underlying technologies, has been gaining popularity for transaction management beyond financial transactions. Transaction information is maintained in the block-chain, which can be used to audit the integrity of the transaction. The focus on this paper is the potential availability of block-chain technology of other transactional uses. Block-chain is one of the most stable open ledgers that preserves transaction information, and is difficult to forge. Since the information stored in block-chain is not related to personally identify information, it has the characteristics of anonymity. Also, the block-chain allows for transparent transaction verification since all information in the block-chain is open to the public. These characteristics are the same as the requirements for a voting system. That is, strong robustness, anonymity, and transparency. In this paper, we propose an electronic voting system as an application of block-chain, and describe block-chain based voting at a national level through examples.
Digital forensics must constantly adapt to new technological developments. The advent of Bitcoin is such a development. Bitcoin represents a new model for financial transactions. In many cash transactions between strangers, the underlying model is parties-unknown/transaction-unknown. There is no ledger record of the transaction. In contrast, PayPal illustrates the parties-known/transaction-known model. An intermediary will record both items of information. Bitcoin differs from both of these models; Bitcoin uses a parties-unknown/transaction-known model. The Bitcoin block chain records the transaction, but the user’s Bitcoin address is not expressly tied to an identity. Thus, Bitcoin users enjoy pseudo-anonymity.As the recent experience with Silk Road demonstrates, there is a downside to this pseudo-anonymity. Precisely because of that feature, Silk Road served a marketplace for vendors to sell illegal narcotics, forged identifications, and other illicit goods and services. Given that danger, law enforcement authorities have a felt need to develop techniques to penetrate the pseudo-anonymity. To do so, they have turned to digital forensics experts.This article evaluates two techniques that have been proposed for this purpose. The first is traffic analysis. This technique relies on the entry nodes that users employ to access the Internet. The second is transaction graph analysis. This technique clusters transactions to identify natural chokepoints in the Bitcoin economy, that is, service islands where, for example, the user might convert Bitcoins to fiat currency. The chokepoints becomes a target for a law enforcement subpoena to learn the user’s IP address. After describing each technique, the article assesses the research conducted to date. In particular, the article reviews Alex Biryukov’s research into traffic analysis and Sarak Meiklejohn’s work with transaction graph analysis. The article applies the standards announced in Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993) to determine whether, given the available data, expert testimony based on either technique would be admissible today. The article explains that it is doubtful whether testimony based on either technique would survive a Daubert admissibility challenge. The article concludes that further research is needed to enable law enforcement authorities to effectively penetrate the pseudo-anonymity of the new parties-unknown/transaction-known model.
Enormous amounts of data are collected by hospitals, social networking systems, government agencies, and other organizations. There are huge social benefits in analyzing this data, but we must protect the privacy of the individuals in the data. The current standard definition of data privacy is differential privacy [22, 19]. In this thesis, we introduce new definitions of data privacy that can be better than differential privacy in certain ways. We first argue that differential privacy might not be strong enough in social network settings. We then introduce a zero-knowledge based definition of privacy called zero-knowledge privacy, which is strictly stronger than differential privacy and is particularly attractive when modeling privacy in social networks. Both differential privacy and zero-knowledge privacy provide strong privacy guarantees. However, for certain tasks, mechanisms satisfying these privacy definitions have to add a lot of "noise", thus lowering the utility of the released data. Thus, we introduce a new definition of privacy called crowd-blending privacy that strictly relaxes the notion of differential privacy. We demonstrate crowd-blending private mechanisms for histograms and for releasing synthetic data points, achieving strictly better utility than what is possible using differentially private mechanisms. Differential privacy guarantees the same level of privacy protection for all individuals. However, we demonstrate that some individuals may need more privacy than others. Thus, we introduce a generalization of differential privacy called tai- lored differential privacy, where an individual's privacy parameter is "tailored" for the individual based on the individual's data and the data set. We focus on a natural instance of tailored differential privacy, which we call outlier privacy: an individual's privacy parameter is determined by how much of an "outlier " the individual is. In this thesis, we also study the problem of strategy-proof voting, which is plagued by impossibility results. We take a bounded-rationality approach to this problem and consider a setting where voters have "coarse" beliefs (a notion that has gained popularity in the behavioral economics literature). In particular, we construct good voting rules that satisfy a notion of strategy-proofness with respect to coarse i.i.d. beliefs, thus circumventing the existing impossibility results.
Bitcoins have recently become an increasingly popular cryptocurrency through which users trade electronically and more anonymously than via traditional electronic transfers. Bitcoin's design keeps all transactions in a public ledger. The sender and receiver for each transaction are identified only by cryptographic public-key ids. This leads to a common misconception that it inherently provides anonymous use. While Bitcoin's presumed anonymity offers new avenues for commerce, several recent studies raise user-privacy concerns. We explore the level of anonymity in the Bitcoin system. Our approach is two-fold: (i) We annotate the public transaction graph by linking bitcoin public keys to "real" people - either definitively or statistically. (ii) We run the annotated graph through our graph-analysis framework to find and summarize activity of both known and unknown users.
Tässä opinnäytetyössä tutkittiin bitcoin virtuaalivaluuttaa, mitä bitcoin on ja kuinka se toimii. Työssä virtuaalivaluuttaa verrataan perinteisiin fiat-valuuttoihin ja pohditaan, millä tavoin bitcoin eroaa tavallisista valuutoista. Työn tutkimuskysymyksiä olivat bitcoinin käytön edut ja haitat, toimivuus maksuvälineenä sekä bitcoinin tulevaisuuden näkymien pohtiminen. Työssä tutkittiin myös, täyttääkö bitcoin rahan määritelmän vai onko se vain hyödyke. \n \nOpinnäytetyön teoriaosuus pohjatuu pääasiassa ajankohtaisiin artikkeleihin ja uutisiin sekä muutamiin bitcoinia käsitteleviin kirjoihin. Aihe rajattiin virtuaalivaluutoista vain bitcoiniin. Työssä ei perehdytä syvemmin bitcoinin teknisiin ominaisuuksiin, koska niihin perehtyminen vaatisi niin lukijalta, kuin kirjoittajalta enemmän tietoteknistä tietämystä. \n \nTutkimuksen tuloksissa todettiin, ettei bitcoin vielä aivan täysin täytä valuutan määritelmiä, eikä siitä nykyisessä muodossaan ole korvaamaan perinteisiä fiat-valuuttoja. Bitcoinin käyttö maksuvälineenä joka tapauksessa yleistyy ja käyttäjäkunta kasvaa. Toisaalta on kuitenkin vielä mahdoton sanoa tuleeko bitcoin kasvamaan merkittäväksi valuutaksi fiat-valuuttojen rinnalle, vai jääkö se pienen yleisön maksuvälineeksi.