The Trouble With Anonymity

There is an old adage that on the Internet no one knows you're a dog. It accompanied a cartoon in The New Yorker in 1993, which eons in Internet evolutionary terms, but issues with identity remains as problematic today as ever.  This holds true for system to system communications as well as those from person to person.  One attack that has become well known in forging identities in peer to peer networks is the Sybil attack.

The essence of a Sybil attack is simple: you subvert the reputation of a system in a peer to peer network by setting up a large number of pseudonymous identities and thereby gain an undue influence allowing you to, for example, gather data that you would not otherwise be able to do.  The ease with which a Sybil attack can be mounted is largely a factor of how cheaply identities can be generated.

In the last 10 years much work has been done on how to defend against Sybil attacks in particular contexts, such as, social networks and peer to peer (P2P) networks.  All such defences basically rely on one approach: having a trusted agency certify identities.  Researchers showed as far back as 2002 that without a logically centralised authority Sybil attacks were always possible unless you make unrealistic assumptions about networked resources.

Anonymity vs Pseudonymity In Cryptocurrencies

I wrote earlier this week about some of this misconceptions around Bitcoin.  Probably the biggest is that if you transact using Bitcoin you can do so with total anonymity.  In the case of Bitcoin Users are confusing anonymity  with pseudonymity.

Part of the design of the blockchain that Bitcoin uses is that every transaction is visible.  The blockchain is highly visible.  The table below shows the very latest blocks that have been accepted into the Bitcoin blockcahin:

This data is drawn from a site called http://blockr.io/ but there are several. If you visit https://blockchain.info/ you can even see the latest transactions that have been submitted but not yet accepted into the blockchain. In most of these online systems you can drill down into each transaction, including the as yet unconfirmed ones.  Here's one chosen at random: