Hello World,
There are other privacy issues in Core (node and wallet) but recently I came
across one which can be used to identify if someone is using Bitcoin Core with
just the bitcoin address and couple of transactions. I think people have
already given up and don't expect privacy in Core wallet especially developers.
However, below information may help some users who are not aware of this
specific issue and developers who are using Bitcoin Core wallet in their
project.
Issue is explained here: https://github.com/bitcoin/bitcoin/issues/22018
Even if there exists another wallet with similar behavior, it can affect
privacy in some cases. Example: Alice is spying on Bob and collecting as much
information as possible. She looks at social media accounts for Bob and thinks
he might be using one of the wallets mentioned in PoC. She can confirm if Bob
is using Bitcoin Core wallet by sending 2 small amounts to one of the address
in different transactions. One transaction should have really low fee rate that
it doesn't get confirmed.
I found this issue while reviewing PR:
https://github.com/bitcoin/bitcoin/pull/18418
It was also discussed in a 'Core Review PR club' meeting recently:
https://bitcoincore.reviews/18418
Also there are 2 things that helps identify wallet using address: 1. Can't
spend unconfirmed UTXO 2. OUTPUT_GROUP_MAX_ENTRIES
OUTPUT_GROUP_MAX_ENTRIES was 10 earlier and 100 after PR #18418 got merged.
This will help in confirming if someone is using latest Bitcoin Core once it is
available in next release. Example: Alice is using Bitcoin Core v0.21.0 and Bob
is using Bitcoin Core v0.22.0 Carol is the attacker and other two are victims.
Carol sends small amounts to same address in 11 transactions to both and
confirms Bob is using latest Bitcoin Core wallet while Alice is using an older
version.
I will try to fix both 1 and 2 which can take few days and maybe never get
merged. IMO 1 can be fixed by locking all UTXOs associated with a scriptpubkey
until all are confirmed. UTXO locks are stored in memory only so will have to
change that first. 2 can be fixed by using an approach similar to Electrum (All
or None)
--
Prayank
_______________________________________________
bitcoin-dev mailing list
bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
