HackerPapers

arXiv:1708.04748cs.CR

When the cookie meets the blockchain: Privacy risks of web payments via cryptocurrencies

Steven Goldfeder, Harry Kalodner, Dillon Reisman, Arvind Narayanan

Abstract

We show how third-party web trackers can deanonymize users of cryptocurrencies. We present two distinct but complementary attacks. On most shopping websites, third party trackers receive information about user purchases for purposes of advertising and analytics. We show that, if the user pays using a cryptocurrency, trackers typically possess enough information about the purchase to uniquely identify the transaction on the blockchain, link it to the user's cookie, and further to the user's real identity. Our second attack shows that if the tracker is able to link two purchases of the same user to the blockchain in this manner, it can identify the user's entire cluster of addresses and transactions on the blockchain, even if the user employs blockchain anonymity techniques such as CoinJoin. The attacks are passive and hence can be retroactively applied to past purchases. We discuss several mitigations, but none are perfect.

arXiv comments
Journal reference
DOI
Subjects
cs.CRCryptography and Security

On Hacker News

Linked by 5 identifiable commenters in 5 comments across 4 threads, from Aug 2017 to Jun 2022. Found in 3 HN submissions from Aug 2017 to Aug 2017. Open submission discussions.

Comments linking this paper, per year.

Discussed in comments4 threads

  1. ZeroStableCoin is out from stealth mode 1 comment

    • This series of presentations explains how ZeroStableCoin perfectly mitigates and protects users from Monstrous Cookie Attacks and Double Counting Attacks, as described in the paper by Goldfeder, Kalodner, Reisman, and Narayanan: https://www.youtube.com/watch?v=xjHSPyFjZpc…

      DonHopkinsView on HNParent context

  2. Bitcoin faces regulatory crackdown, Bank of England warns 1 comment

    • Once an address has been doxxed, you've got a lead on any address used in a common transaction. It doesn't conclusively unmask these other addresses, so whether this counts as “really that difficult” depends on your investigative powers and your definition of “difficult”.…

      osteeleView on HNParent context

  3. It’s time to kill the web app 1 comment

    • "We show how third-party web trackers can deanonymize users of cryptocurrencies. We present two distinct but complementary attacks." - "When the cookie meets the blockchain: Privacy risks of web payments via cryptocurrencies", https://arxiv.org/abs/1708.04748

      jodrellblankView on HNParent context

  4. Web merchants routinely leak data about Bitcoin purchases 2 comments

    • I'm a co-author of this paper. It's available here: https://arxiv.org/pdf/1708.04748.pdf The surprise here isn't that Bitcoin isn't perfectly anonymous. There are two new findings. The first is the extent to which your Bitcoin payment details get leaked to third party trackers.…

      randomwalkerView on HNParent context

    • dang, would be nice to change title/link to the paper (https://arxiv.org/abs/1708.04748 for non-PDF link). Too much commentary here is reacting to the article title. (By dang I of course mean https://news.ycombinator.com/user?id=dang)

      sowbugView on HNParent context

Submitted to Hacker News

Connected through shared HN threads, not inferred similarity or a recommendation.