Search

One reason for the popularity of Bitcoin is due to its anonymity. Although several heuristics have been used to break the anonymity, new approaches are proposed to enhance its anonymity at the same time. One of them is the mixing service. Unfortunately, mixing services have been abused to facilitate criminal activities, e.g., money laundering. As such, there is an urgent need to systematically understand Bitcoin mixing services. In this paper, we take the first step to understand state-of-the-art Bitcoin mixing services. Specifically, we propose a generic abstraction model for mixing services and observe that there are two mixing mechanisms in the wild, i.e. {swapping} and {obfuscating}. Based on this model, we conduct a transaction-based analysis and successfully reveal the mixing mechanisms of four representative services. Besides, we propose a method to identify mixing transactions that leverage the obfuscating mechanism. The proposed approach is able to identify over $92$\% of the mixing transactions. Based on identified transactions, we then estimate the profit of mixing services and provide a case study of tracing the money flow of stolen Bitcoins.

TheChain is a solution to many problems such as monopoly, heavy state transition, and security vulnerabilities. TheChain solves these problems by introducing the intersection of regions as an incentive before allowing validators to nest a client directory. Intersecting their operating territories forces them to keep a watch over each other. The definition of privacy can take many forms, starting from the right to be forgotten beside being away from public attention. Although the pseudonymity of the user within the network can enhance the user's privacy, several pieces of research have studied the techniques to take advantage of the network structure to identify the users of pseudonyms. Moreover, two models have been used to record the updated exchange of values within the blockchain system, which are the unspent transaction output (UTXO) and the balance model. The UTXO suffers from duplication of information and the balance model suffers from having a single point of entry. This paper introduces TheCoin model that defines the protocol of the exchange of valuable datum within TheChain system. The solution has introduced a novel approach of initiating the transaction from the receiver side by taking advantage of mobile agents empowering a topology hiding to the network. Billing within the platform has been introduced to allow advanced contractual logic to be adopted into the system on the information level. Moreover, traceable fuzziness has been used to eliminate duplication. The paper presents an evaluation of the TheCoin model in terms of system security, block size, and search performance.

A ride-hailing service, where passengers choose the origin and destination of their ride, preserves location privacy if the origin and destination of the ride are not revealed to anyone other than the driver. Pseudonymity means that the driver and the passenger use a pseudonym and do not reveal their true identity to each other. The service is trusted if a dishonest passenger cannot use the service without paying, and a driver must provide the service to get paid. In this paper, we introduce cryptotrasnport---a ride-hailing service powered by cryptocurrency and blockchain---and we show that it can preserve privacy, pseudonymity, and trust, simultaneously. Furthermore, by using blockchain technology, cryptotransport matches riders with vehicles in a decentralized fashion, without relying on any company or organization to manage the system.

Gender equality between mothers and fathers is critical for the social and economic wellbeing of children, mothers, and families. Over the past 50 years, gender roles have begun to converge, with mothers doing more work outside of the home and fathers doing more domestic work. However, popular parenting sites in the U.S. continue to be heavily gendered. We explore parenting roles and identities on the platform Reddit.com which is used by both mothers and fathers. We draw on seven years of data from three major parenting subreddits-Parenting, Mommit, and Daddit-to investigate what topics parents discuss on Reddit and how they vary across parenting subreddits. We find some similarities in topics across the three boards, such as sleep training, as well as differences, such as fathers talking about custody cases and Halloween. We discuss the role of pseudonymity for providing parents with a platform to discuss sensitive parenting topics. We conclude by highlighting the benefits of both gender-inclusive and role-specific parenting boards. This work provides a roadmap for using computational techniques to understand parenting practices online at large scale.

We report on the design of ThinkActive - a system to encourage primary aged school children to reflect on their own personal activity data in the classroom. We deployed the system with a cohort of 30 school children, over a six-week period, in partnership with an English Premier League Football club's health and nutrition programme. The system utilizes inexpensive activity trackers and pseudonymous avatars to promote reflection with personal data using an in-situ display within the classroom. Our design explores pseudonymity as an approach to managing privacy and personal data within a public setting. We report on the motivations, challenges, and opportunities for students, teachers, and third-party providers to engage in the collection and sharing of activity data with primary school children.

A current trend on the Internet is the increasing surveillance of its users. A few big service providers have divided most of the user-facing Internet between them, observing and recording the activities of their users to increase profits. Additionally, government agencies have been found to practice mass surveillance. With regard to this it becomes even more important to provide online services that protect the privacy of their users and avoid censorship by single, powerful entities. To reach these goals, a trusted third party should be avoided. A prototype service which fulfills these goals is DPS-Discuss, a decentralized, pseudonymous online discussion application. It uses the libraries BitNym and Peer-Tor-Peer for pseudonym management and anonymous communication.

Thanks to their anonymity (pseudonymity) and elimination of trusted intermediaries, cryptocurrencies such as Bitcoin have created or stimulated growth in many businesses and communities. Unfortunately, some of these are criminal, e.g., money laundering, illicit marketplaces, and ransomware. Next-generation cryptocurrencies such as Ethereum will include rich scripting languages in support of smart contracts, programs that autonomously intermediate transactions. In this paper, we explore the risk of smart contracts fueling new criminal ecosystems. Specifically, we show how what we call criminal smart contracts (CSCs) can facilitate leakage of confidential information, theft of cryptographic keys, and various real-world crimes (murder, arson, terrorism). We show that CSCs for leakage of secrets (a la Wikileaks) are efficiently realizable in existing scripting languages such as that in Ethereum. We show that CSCs for theft of cryptographic keys can be achieved using primitives, such as Succinct Non-interactive ARguments of Knowledge (SNARKs), that are already expressible in these languages and for which efficient supporting language extensions are anticipated. We show similarly that authenticated data feeds, an emerging feature of smart contract systems, can facilitate CSCs for real-world crimes (e.g., property crimes). Our results highlight the urgency of creating policy and technical safeguards against CSCs in order to realize the promise of smart contracts for beneficial goals.

While a number of Internet applications determine the optimal service tailored for a client based on its identifier, the client's identifier, if explicitly leaked to the Internet applications, raises critical privacy concerns. To address the privacy problem for those sender-sensitive systems, this paper proposes a privacy-preserving service of pseudonymizing Internet client. Replacing real identifier with pseudonymizing identifier in talking to Internet applications preserves the client's privacy. Delegating sender-sensitive optimization tasks to a trustworthy third party ensures the performance of Internet applications. The usage of pseudonymizing-client service in CDN is presented to improve CDN performance as well as privacy on client's IP address.

Proceeding of: 11th ACM Conference on Emerging Networking Experiments and Technologies ACM (CoNEXT 2015), Heidelberg, Germany, 1-4 December 2015 Preservation of user privacy is paramount in the publication of datasets that contain fine-grained information about individuals. The problem is especially critical in the case of mobile traffic datasets collected by cellular operators, as they feature high subscriber trajectory uniqueness and they are resistant to anonymization through spatiotemporal generalization. In this work, we first unveil the reasons behind such undesirable features of mobile traffic datasets, by leveraging an original measure of the anonymizability of users' mobile fingerprints. Building on such findings, we propose GLOVE, an algorithm that grants k-anonymity of trajectories through specialized generalization. We evaluate our methodology on two nationwide mobile traffic datasets, and show that it achieves k-anonymity while preserving a substantial level of accuracy in the data. This work was supported by the French National Research Agency under grant ANR-13-INFR-0005 ABCD and by the EU FP7 ERA-NET program under grant CHIST-ERA-2012 MACACO.

There is a growing public concern regarding big data and intelligence surveillance on unsuspecting Internet users, and an increase in public conversation around what does privacy really mean in the digital realm. Although technologies have been developed to help generate public protect their privacy, average users found the tools complex and difficult to decipher. This research aims to weed through some of these complexities by reviewing 6 publicly recognized technologies promoted to help users protect their privacy while browsing the web. The scope will be broad in order to touch on the important aspects each technology including promises, privacy realities, technical construct, ease of use and drawbacks average users should be aware of before using.

The design of social media influences the way people interact with each other online -- and shapes our society. This course will look at three key areas: how social identity is portrayed online; our changing social networks and the technologies that support them; and the role of pseudonymity in supporting privacy.

Using Twitter as a case study, this paper sets forth the legal tensions faced by social networks that seek to defend privacy interests of users. Recent EC and UN initiatives have begun to suggest an increased role for corporations as protectors of human rights. But, as yet, binding rather than voluntary obligations of this kind under international human rights law seem either non-existent or highly conflicted, and structural limitations to such a shift may currently exist under both U.S. and UK law. Companies do not face decisions regarding disclosure in a vacuum, rather they face them constrained by existing obligations under (sometimes conflicting) legal demands. Yet, companies such as Twitter are well-positioned to be advocates for consumers' interests in these legal debates. Using several recent corporate disclosure decisions regarding user identity as illustration, this paper places questions of privacy, free speech and disclosure in broader legal context. More scholarship is needed on the mechanics of how online intermediaries, especially social media, manage their position as crucial speech platforms in democratic as well as less democratic regimes.

This paper describes the potential of systems in which many people collectively control a single constructed identity mediated by socio-technical networks. By looking to examples of identities that have spontaneously emerged from anonymous communities online, a model for pseudonym design in social machines is proposed. A framework of identity dimensions is presented as a means of exploring the functional types of identity encountered in social machines, and design guidelines are outlined that suggest possible approaches to this task.

The management of group context in socially mediating technologies is an important challenge for the design community. To better understand how users manage group context, we explored the practice of multiple profile management in social media. In doing so, we observed creative and opportunistic strategies for group context management. We found that multiple profile maintenance is motivated by four factors: privacy, identity, utility, and propriety. Drawing on these motives, we observe a continuum of boundary regulation behaviors: pseudonymity, practical obscurity, and transparent separation. Based on these findings, we encourage designers of group context management systems to more broadly consider motives and practices of group separations in social media. Group context management systems should be privacy-enhancing, but a singular focus on privacy overlooks a range of other group context management practices.

It has been claimed that people discuss their own illicit drug use online because anonymity allows them to avoid the legal and social risks of identifying themselves as drug users. Discourses around the risks, strategies and management of online drug discussion were produced by interviewing 26 'party drug' users who reported participating in internet forums where drugs were discussed. Three factors influenced the extent to which drug forum users discussed their own drug use in public internet forums: perceived visibility, perceived legal risk and social stigma, and perceived effectiveness of pseudonymity. Implications for internet research with drug users are discussed.

Online anonymity often appears to undermine accountability, offering little incentive for civil behavior, but accountability failures usually result not from anonymity itself but from the disposability of virtual identities. A user banned for misbehavior---e.g., spamming from a free E-mail account or stuffing an online ballot box---can simply open other accounts or connect from other IP addresses. Instead of curtailing freedom of expression by giving up anonymity, online services and communities should support accountable pseudonyms: virtual personas that can provide both anonymity and accountability. We propose Pseudonym parties, a scheme for creating accountable pseudonyms, which combine inperson social occasions (parties) with technical infrastructure (a pseudonymous sign-on service) to enforce the rule that one real person gets one virtual persona on any participating online service. Pseudonym parties enable the user to adopt different personas in different online spaces without revealing the connection between them, while ensuring that each user has only one accountable pseudonym in each space. Pseudonym parties can be started incrementally in a fully decentralized fashion, can run on volunteer labor with minimal funds, and may even be fun.

Web-based learning involves provision of personal on-line spaces to learners and teachers. Yet due to a lack of proper privacy policies and technical frameworks to implement them, seemingly innocent data transactions can carry risks to privacy in e-learning environments. We investigate privacy issues in e-learning and make recommendations for building environments that enhance privacy but allow features like content personalization and peer- collaboration. iHelp, a learning environment that supports both learners and instructors, implements many of these recommendations.

Anonymity is one of the most controversial issues related to the Internet. It greatly encourages misdeeds such as piracy, defamation, and fraud. However, anonymity is important to protect the privacy of individuals and to support the freedom of speech. Identity escrow is a potential solution to achieving a balance between anonymity and identity. The basic idea is to utilize a two-tiered identity: the first-tier identity carries the minimal amount of information for normal use, and the second-tier identity bears precise information regarding the individual to be disclosed when necessary. In this paper, we introduce a decentralized identity escrow scheme called DECIDE. It has three identity tiers: anonymity, pseudonymity, and identity, and it has a high decentralization capability. We also present an analysis on three service models - online discussion community, whistleblowing, school networking - to explore the public acceptance of the proposed scheme.

Mobile Location-Based Services (LBS) have raised privacy concerns amongst mobile phone users who may need to supply their identity and location information to untrustworthy third parties in order to access these applications. Widespread acceptance of such services may therefore depend on how privacy sensitive information will be handled in order to restore users' confidence in what could become the "killer app" of 3G networks. In this paper, we present a proxy-based public key infrastructure that allows LBS mobile users to shield their identities using pseudonyms and protect their communications using mediated identity-based encryption. In particular, we propose the first identity-based signature scheme applicable in a mediated environment. Furthermore, we introduce a process whereby a mobile user is only required to own one private key in order to protect her communications when accessing LBS under different pseudonyms. The identity-based character of the PKI simplifies significantly key management by removing the need for digital certificates. Its mediated architecture makes key revocation easier and more efficient as it allows for instant revocation of security capabilities.

Privacy and accountability are potentially con icting organizational and legal requirements which can be approached by allowing users to act pseudonymously. The reidenti cation of pseudonyms should be bound to a legal purpose requiring accountability. Existing solutions entrust this function to third parties. Upon good cause shown, these parties perform reidenti cation on demand. The ability to perform reidenti cation should be technically bound to the actual existence of a legal purpose, which in some applications can be interpreted as the transgression of a threshold. We present an approach for constructing transaction-based pseudonyms as shares for a suitably adapted version of Shamir's cryptographic approach to secret sharing. Only if pseudonymous actions exceed a threshold speci ed by a predetermined purpose, can the actor's identity be recovered.

The first topic of concern is anonymity, specifically the anonymity that is available in communications on the Internet. An earlier paper argues that anonymity in electronic communication is problematic because:(1) it makes law enforcement difficult (tracking down and catching on-line law-breakers is difficult when their identity is unknown);(2) it frees individuals to behave in socially undesirable and harmful ways (individuals seem to engage in behavior they wouldn't engage in if their identity were known);(3) it diminishes the integrity of information since one can't be sure who information is coming from, whether it has been altered on the way, etc.; and (4) all three of the above contribute to an environment of diminished trust which is not conducive to certain uses of computer communication.Counterbalancing these problems are some important benefits. Anonymity can facilitate some socially desirable and beneficial behavior. For example, it can eliminate the fear of repercussions for behavior in contexts in which repercussions would diminish the availability or reliability of information, e.g., voting, personal relationships between consenting adults, and the like. Furthermore, anonymity can be used constructively to reduce the effect of prejudices on communications. (Gender can be masked, students can write about professors with candor, and people with disabilities can participate without stigma, for example.) Negative aspects of anonymity all seem to point to a tension between accountability and anonymity. They suggest that accountability and anonymity are not compatible, and they even seem to suggest that since accountability is a good thing, it would be good to eliminate anonymity. In other words, the problems with anonymity suggest that individuals are more likely to behave in socially desirable ways when they are held accountable for their behavior (i.e., asked to explain, justify, or bear the consequences for the behavior), and they are more likely to engage in socially undesirable behavior when they are not held accountable. I am not going to take issue with the correlation between accountability and anonymity, but rather with the claim that accountability is (always) good.To examine this problem, let's look at a continuum that stretches from total anonymity at one end, and no anonymity at all at the other end. At the opposite extreme of anonymity is a panopticon society. The panopticon is the prison environment described by Foucault in which prison cells are arranged in a large circle with the side facing the inside of the circle open to view. The guard tower is placed in the middle of the circle so that guards can see everything that goes on in every cell. In a recent article on privacy, Jeffrey Reiman, reflecting on the new intelligent highway systems, suggests that we are moving closer and closer to a panopticon society.When we contemplate all the electronic data that is now gathered about each one of us as we move through our everyday lives- intelligent highway systems, consumer transactions, traffic patterns on the internet, medical records, financial records, and so on- we see the trend that Reiman identifies. Electronic behavior is recorded and the information is retained. While actions/transactions in separate domains are not necessarily combined, it seems obvious that the potential exists for combining data into a complete portfolio of an individual's day to day (if not moment to moment) life. So it would seem that as more and more activities and domains are moved into a IT-based medium, the closer we will come to a panopticon society.A panopticon society gives us the ultimate in accountability. Everything an individual does is observable and therefore available to those to whom we are accountable.Of course, in doing this, it puts us, in effect, in prison. The prison parallel is appropriate here because what anonymity allows us is freedom; prison is the ultimate in lack of freedom. In this way the arguments for a free society (and for democracy) become arguments for anonymity. Only when individuals are free will they experiment, try new ideas, take risks, and learn by doing so. Only in an environment that tolerates making mistakes will individuals develop the active habits that are so essential for democracy.In a world without information technology, individuals have levels or degrees and various kinds of anonymity and consequently different levels and kinds of freedom. Degrees and kinds of anonymity vary with the domain: small town social life versus urban social life, voting, commercial exchanges, banking, automobile travel, airplane travel, telephone communication, education, and so on.Drawing from our experience before IT-based institutions, we might believe that what we need is varying levels or degrees and kinds of anonymity. This seems a good starting place because it suggests an attempt to re-create the mixture that we have in the physical, non-IT-based world.Nevertheless, there is a danger. If we think in terms of levels and degrees of anonymity, we may not see the forest from the trees. We may not acknowledge that in an electronic medium, levels and kinds of anonymity mean, in an important sense, no anonymity. If there are domains in which we can be anonymous but those domains are part of a global communication infrastructure in which there is no anonymity at the entry point, then it will always be possible to trace someone's identity.We delude ourselves when we think we have anonymity on-line or off-line. Rather, what we have both places is situations in which it is more and less difficult to identify individuals.We have a continuum of situations in which it is easy and difficult to link behavior to other behavior and histories of behaviors. In the physical world, we can go places and do things where others don't know us by name and have no history with us, though they see our bodies, clothes, and behavior. If we do nothing unusual, we may be forgotten. On the other hand, if we do something illegal (or socially undesirable), authorities may attempt to track us down and figure out who we are. For example, law enforcement officials, collection agencies, those who want to sue us may take an active interest in removing our anonymity, ex post facto. Think of Timothy McVeigh and Terry Nichols-the men who apparently bombed the federal building in Oklahoma City. Much of what they did, they did anonymously, but then law enforcement officials set out to find out who had done various things, e.g., rented a car, bought explosives, etc. The shrouds of anonymity under which McVeigh and Nichols had acted were slowly removed.Is this any different than behavior on the internet? Is there a significant difference in the kind or degree of anonymity we have in the physical world versus what we have in an IT-based world? The character of the trail we leave is different; in the one case, its an electronic trail; while in the other it involves human memories, photographs, and paper and ink. What law enforcement officials had to do to track down McVeigh is quite different from tracking down an electronic law breaker. Also, the cost of electronic information gathering, both in time and money, can be dramatically lower than the cost of talking to people, gathering physical evidence, and the other minutia required by traditional detective work.We should acknowledge that we do not and are never likely to have anonymity on the Internet. We would do better to think of different levels or kinds of identity. There are important moral and social issues arising as a result of these varying degrees and kinds of identity. Perhaps the most important matter is assuring that individuals are informed about the conditions in which they are interacting. Perhaps, even more important is that individuals have a choice about the conditions under which they are communicating.In the rest of this paper we explore a few examples of levels and kinds of identity that are (or could be) practical on the Internet. We discuss the advantages and disadvantages that we see for these "styles" of identity for individuals, and we examine the costs and benefits of these styles for society as a whole.