<p>Privacy is one of the most common myths about Bitcoin. By default, it does not provide anonymity, for many reasons, including the ones you have mentioned. Applying graph theory on the transactions can reveal a lot of information, connect seemingly independent addresses and thus compromise them. Bitcoin was never meant to provide anonymity out-of-the-box, so it's hard to blame it.</p>

<p>However, this does not mean the anonymity is impossible to achieve. There are many 3rd party services specializing at this, mixing your coins with other people's coins, for example <a href="https://bitmixer.io/" rel="nofollow">bitmixer.io</a>. You can find more such services and use them in chain for even better anonymity, just search the Internet for <strong>bitcoin mixer</strong> or <strong>bitcoin laundry</strong>.</p>

<p>Note: the problem of connecting addresses to the same owner is not specific to HD wallets, but concerns also simple wallets that generate all the addresses randomly. For the outside observer, there's no way to tell if you're using one or another, but this information is not necessary to connect the addresses once you've made a transaction combining their inputs.</p>

CC BY-SA 3.0
2014-10-08T12:57:13.023Z
mixers are inconvenient, expensive, centralized, not trustless, contain records, the user nor the admin would never know if the mixer has been compromised for years, and ultimately it greatly increases the transaction cost. secondly, if this isn't done before one is seeking to make an unlinkable payment, for example - to a bitpay address - then they won't be able to mix within the 15 minute window that bitpay gives.
CQM
CC BY-SA 3.0
2014-10-08T17:15:35.883Z
yep, it is essentially true what you're saying, yet Bitcoin mixins play a significant role especially in the black markets, where coin anonymization is essential. It is a common practice to always keep some "mixed coins" in your wallet, so that you can use them (immediately) whenever needed. You can increase the anonymity by using multiple mixins in a row, but obviously you can never be 100% sure. Well, guess Bitcoin would have a much harder time getting legal recognition if it was anonymous :-)
knaperek
CC BY-SA 3.0
2014-10-08T07:51:15.757Z
2014-10-08T07:56:28.860Z
2014-10-08T07:56:28.860Z
knaperek
<p>Whatever the answer is today, it probably won't matter in the not-too-distant future.  The blockchain is a public and permanent record of everyone's transactions.  </p>

<p>Besides the fact that one would have to be 100% anonymous for each and every transaction, 100% of the time to remain anonymous (whatever that solution is)... There's that permanent public record of every one of your transactions.  If somebody wants to they will eventually connect the dots from enough public and private databases.  Not to mention quantum computing or other future advancements.</p>

<p>If I were a tax collector and wanted to prevent cheating, I would create a foolproof system to maintain a permanent record of every transaction.  Then we could make it easy, troll the blockchain and submit monthly tax invoices to my minions.  Don't pay it?  Your transactions will not confirm. Can't spend. Kinda hard to refute then.</p>

CC BY-SA 3.0
2014-10-06T21:53:14.507Z
pure conjecture, John, the exchange operator, cannot prove that Alice, an account holder on the exchange, is in possession of a private key by the mere existence of Alice sending bitcoin from one address to the next. if Alice uses different addresses for every transaction, there are simply no dots to connect. Your answer suggests you have no idea what the actual "threat" from quantum computers is.
CQM
CC BY-SA 3.0
2014-10-06T22:27:05.300Z
Yes, conjecture.  Hence the 'probably'.  My point is whatever happens in the future, there's this blockchain permanent record that will be used to retroactively nab people.  One vector we currently know if is quantum computing and the potential to hack our keys (not to mention SSL etc.).

Another vector would be mixing your banking info with your bitcoins by buying coins from someone like Coinbase.  Coinbase could easily be forced to give up info tracing the purchase of my coins, connecting the dots.
siliconsys
CC BY-SA 3.0
2014-10-07T03:07:50.573Z
You are missing the point. The entire scenario already considers that this is already happening, consider the exchange already having this information, best practices from  satoshi's 2008 whitepaper still counteract this. you are just writing random gibberish for the sake of it, this is about unlinking transactions, where unlinking is unlinking. There would be no correlations to make, no encryption to bust.
CQM
CC BY-SA 3.0
2014-10-06T21:43:34.327Z
2014-10-06T21:43:34.327Z
siliconsys
<p>I'll fill in the technical aspects where I can later today, but in principle what's happening is a private key is being altered in such a way so that HD public keys can be created and traced up the family tree, that we both know.</p>

<p>But here's a few thing to consider:</p>

<ol>
<li>Can a pubkey be isolated as being <em>your</em> key? Most likely not, but assuming so, it's still only the hash160 shared publicly. What's to say you haven't changed wallet seeds, for example?</li>
<li><p>Assuming 1 to be true, reversing the SHA256 AND ripemd160 for your public key x/y coordinates is ~impossible ie </p>

<p>pubkey &lt;==A==> hash &lt;=====B===== 0x04 X + Y</p>

<pre><code>      A = base58,     B = SHA256/RIPEMD160
</code></pre>

<p>.</p></li>
<li><p>The only probably way a link between the public key and the private key can be found is by having at minimum the private key, and ideally for an attacker, a set of privatekeys</p></li>
</ol>

CC BY-SA 3.0
2014-10-07T03:04:35.110Z
yes, but lets say I have 3 pubKeys, with 1 btc each. I then encounter a bitpay pubKey and to acquire the good/service I must send that bitpay address 2.5 btc. Any thing I think of will combine the transactions from pubkey A, B and C, whether I do it in one transaction or 3+ transactions, within the 15 minute time period that bitpay allows.
CQM
CC BY-SA 3.0
2014-10-07T00:52:36.647Z
2014-10-07T00:52:36.647Z
Wizard Of Ozzie
<p>As mentioned, I don't believe HD Wallets are relevant to this problem. Even with simple wallets combining inputs from multiple addresses proves that a single person owned all the addresses included. I'm not sure if this would meet your specific privacy needs, but it is at least a straightforward way of avoiding that problem:</p>

<p>Assume you have 4 addresses, A, B, C, and D. You want to send a transaction that requires funds from all 4 without proving that they were owned by the same person. You could generate a 4th address E and over the course of several days combine all the address values at a new address. </p>

<p>While the blockchain would show that the funds in E came from A-D, there wouldn't be any proof that A-D were owned by the same person, as they were never in a single transaction together, and it is feasible that 4 different people all transferred value to E, instead of the same person transferring value to E. </p>

<p>It seems feasible to write a client that follows that policy of never combining inputs from multiple addresses in a single transaction, which would at least allow plausible deniability. The user would be able to manage timeframes depending on their needs, so that the combination could occur over the period of an hour or a year, depending how soon they need the transaction. You could also add some intermediary steps to split things up a bit more and pass through a few extra addresses to make it slightly harder to follow. </p>

<p>Since it is a public ledger it really isn't a very anonymous system, and achieving anonymity is difficult without a mixer, but the biggest compromise to anonymity is connecting multiple addresses in a single input, so simply avoiding doing that will be helpful, but at the expense of convenience. </p>

CC BY-SA 3.0
2014-10-12T15:02:00.173Z
hm yes, an algorithm to never combine inputs
CQM
CC BY-SA 3.0
2014-10-13T18:41:50.867Z
Is there a way to eject an address out of an HD wallet? remove an existing address from the sequence of addresses?
CQM
CC BY-SA 3.0
2014-10-13T19:50:24.180Z
Unfortunately I cannot conceive of a way that would be possible. The purpose of a HD wallet is that a single seed is capable of generating all the addresses under it in a deterministic fashion. So if a wallet falls under your seed's space you would need to undo laws of math to get rid of it. Your best bet would be generating a new seed and sending your coins there.
Andy Groff
CC BY-SA 3.0
2014-10-13T19:52:07.277Z
interesting, I think BIP32, BIP39 and BIP44 needs to come with best practices. I see a variety of problems with it that may not be apparent. What it can do and what it can't do for you.
CQM
CC BY-SA 3.0
2014-10-12T13:39:17.603Z
2014-10-12T13:39:17.603Z
Andy Groff
<p>HD wallets create a series of addresses, and then when one address has received an input it will give you a new address that hasn't received inputs yet</p>

<p>So in the idea of you sending yourself bitcoin from an exchange, and having different addresses all the time on the exchange, and different addresses in your wallets, then an observer wouldn't be able to track the sum of all your funds.</p>

<p>But isn't this all undermined when you move a large amount of bitcoin and the transaction combines bitcoin from all of the addresses in that wallet?</p>

<p>How is that part avoided while retaining the ability to realistically send funds quickly and conveniently? I understand that it is possible to form a transaction to only use a certain address for sending, but ultimately there is still a third party with one address that I want to send bitcoin to. So I will have to use several of my addresses to get the appropriate balance.</p>

<p>This seems to completely undo my privacy. Not necessarily from blockchain analysis but by having records of a single address (such as from the exchange).</p>

<p>For instance, lets say an exchange gave over the user names to a government. The government then looks at all the addresses that user sent bitcoin to from the exchange. Then they simply look in the blockchain for that address and look to see where it was used again to combine bitcoin with other addresses, as this reveals that one person had the private keys to all those addresses used. Privacy undermined.</p>

<p>Solution? I can imagine a scenario where I could do one transaction at a time back to a different exchange, generating new addresses in my exchange wallet. Cumbersome. But for something like a bitpay payment, I don't see how this is practical, unless third parties also let me choose how many addresses they would generate for me.</p>

<address><privacy><address-generation><bip32-hd-wallets>
HD wallets and address reuse
CQM
# HD wallets and address reuse

(Asked by: username_0 on 2014-10-03)

HD wallets create a series of addresses, and then when one address has received an input it will give you a new address that hasn't received inputs yet

So in the idea of you sending yourself bitcoin from an exchange, and having different addresses all the time on the exchange, and different addresses in your wallets, then an observer wouldn't be able to track the sum of all your funds.

But isn't this all undermined when you move a large amount of bitcoin and the transaction combines bitcoin from all of the addresses in that wallet?

How is that part avoided while retaining the ability to realistically send funds quickly and conveniently? I understand that it is possible to form a transaction to only use a certain address for sending, but ultimately there is still a third party with one address that I want to send bitcoin to. So I will have to use several of my addresses to get the appropriate balance.

This seems to completely undo my privacy. Not necessarily from blockchain analysis but by having records of a single address (such as from the exchange).

For instance, lets say an exchange gave over the user names to a government. The government then looks at all the addresses that user sent bitcoin to from the exchange. Then they simply look in the blockchain for that address and look to see where it was used again to combine bitcoin with other addresses, as this reveals that one person had the private keys to all those addresses used. Privacy undermined.

Solution? I can imagine a scenario where I could do one transaction at a time back to a different exchange, generating new addresses in my exchange wallet. Cumbersome. But for something like a bitpay payment, I don't see how this is practical, unless third parties also let me choose how many addresses they would generate for me.

**Tags:** address, privacy, address-generation, bip32-hd-wallets


---

## 4 answers

### Answer by username_4 on 2014-10-12. Score: 5 | Accepted answer

As mentioned, I don't believe HD Wallets are relevant to this problem. Even with simple wallets combining inputs from multiple addresses proves that a single person owned all the addresses included. I'm not sure if this would meet your specific privacy needs, but it is at least a straightforward way of avoiding that problem:

Assume you have 4 addresses, A, B, C, and D. You want to send a transaction that requires funds from all 4 without proving that they were owned by the same person. You could generate a 4th address E and over the course of several days combine all the address values at a new address.

While the blockchain would show that the funds in E came from A-D, there wouldn't be any proof that A-D were owned by the same person, as they were never in a single transaction together, and it is feasible that 4 different people all transferred value to E, instead of the same person transferring value to E.

It seems feasible to write a client that follows that policy of never combining inputs from multiple addresses in a single transaction, which would at least allow plausible deniability. The user would be able to manage timeframes depending on their needs, so that the combination could occur over the period of an hour or a year, depending how soon they need the transaction. You could also add some intermediary steps to split things up a bit more and pass through a few extra addresses to make it slightly harder to follow.

Since it is a public ledger it really isn't a very anonymous system, and achieving anonymity is difficult without a mixer, but the biggest compromise to anonymity is connecting multiple addresses in a single input, so simply avoiding doing that will be helpful, but at the expense of convenience.

> **Comments:**
> **username_0**: hm yes, an algorithm to never combine inputs  
> **username_0**: Is there a way to eject an address out of an HD wallet? remove an existing address from the sequence of addresses?  
> **username_4**: Unfortunately I cannot conceive of a way that would be possible. The purpose of a HD wallet is that a single seed is capable of generating all the addresses under it in a deterministic fashion. So if a wallet falls under your seed's space you would need to undo laws of math to get rid of it. Your best bet would be generating a new seed and sending your coins there.  
> **username_0**: interesting, I think BIP32, BIP39 and BIP44 needs to come with best practices. I see a variety of problems with it that may not be apparent. What it can do and what it can't do for you.  

---

### Answer by username_1 on 2014-10-08. Score: 1

Privacy is one of the most common myths about Bitcoin. By default, it does not provide anonymity, for many reasons, including the ones you have mentioned. Applying graph theory on the transactions can reveal a lot of information, connect seemingly independent addresses and thus compromise them. Bitcoin was never meant to provide anonymity out-of-the-box, so it's hard to blame it.

However, this does not mean the anonymity is impossible to achieve. There are many 3rd party services specializing at this, mixing your coins with other people's coins, for example [bitmixer.io](https://bitmixer.io/). You can find more such services and use them in chain for even better anonymity, just search the Internet for **bitcoin mixer** or **bitcoin laundry**.

Note: the problem of connecting addresses to the same owner is not specific to HD wallets, but concerns also simple wallets that generate all the addresses randomly. For the outside observer, there's no way to tell if you're using one or another, but this information is not necessary to connect the addresses once you've made a transaction combining their inputs.

> **Comments:**
> **username_0**: mixers are inconvenient, expensive, centralized, not trustless, contain records, the user nor the admin would never know if the mixer has been compromised for years, and ultimately it greatly increases the transaction cost. secondly, if this isn't done before one is seeking to make an unlinkable payment, for example - to a bitpay address - then they won't be able to mix within the 15 minute window that bitpay gives.  
> **username_1**: yep, it is essentially true what you're saying, yet Bitcoin mixins play a significant role especially in the black markets, where coin anonymization is essential. It is a common practice to always keep some "mixed coins" in your wallet, so that you can use them (immediately) whenever needed. You can increase the anonymity by using multiple mixins in a row, but obviously you can never be 100% sure. Well, guess Bitcoin would have a much harder time getting legal recognition if it was anonymous :-)  

---

### Answer by username_2 on 2014-10-06. Score: 0

Whatever the answer is today, it probably won't matter in the not-too-distant future. The blockchain is a public and permanent record of everyone's transactions.

Besides the fact that one would have to be 100% anonymous for each and every transaction, 100% of the time to remain anonymous (whatever that solution is)... There's that permanent public record of every one of your transactions. If somebody wants to they will eventually connect the dots from enough public and private databases. Not to mention quantum computing or other future advancements.

If I were a tax collector and wanted to prevent cheating, I would create a foolproof system to maintain a permanent record of every transaction. Then we could make it easy, troll the blockchain and submit monthly tax invoices to my minions. Don't pay it? Your transactions will not confirm. Can't spend. Kinda hard to refute then.

> **Comments:**
> **username_0**: pure conjecture, John, the exchange operator, cannot prove that Alice, an account holder on the exchange, is in possession of a private key by the mere existence of Alice sending bitcoin from one address to the next. if Alice uses different addresses for every transaction, there are simply no dots to connect. Your answer suggests you have no idea what the actual "threat" from quantum computers is.  
> **username_2**: Yes, conjecture.  Hence the 'probably'.  My point is whatever happens in the future, there's this blockchain permanent record that will be used to retroactively nab people.  One vector we currently know if is quantum computing and the potential to hack our keys (not to mention SSL etc.).  Another vector would be mixing your banking info with your bitcoins by buying coins from someone like Coinbase.  Coinbase could easily be forced to give up info tracing the purchase of my coins, connecting the dots.  
> **username_0**: You are missing the point. The entire scenario already considers that this is already happening, consider the exchange already having this information, best practices from  satoshi's 2008 whitepaper still counteract this. you are just writing random gibberish for the sake of it, this is about unlinking transactions, where unlinking is unlinking. There would be no correlations to make, no encryption to bust.  

---

### Answer by username_3 on 2014-10-07. Score: 0

I'll fill in the technical aspects where I can later today, but in principle what's happening is a private key is being altered in such a way so that HD public keys can be created and traced up the family tree, that we both know.

But here's a few thing to consider:

1. Can a pubkey be isolated as being *your* key? Most likely not, but assuming so, it's still only the hash160 shared publicly. What's to say you haven't changed wallet seeds, for example?
2. Assuming 1 to be true, reversing the SHA256 AND ripemd160 for your public key x/y coordinates is ~impossible ie

   pubkey <==A==> hash <=====B===== 0x04 X + Y

   ```
         A = base58,     B = SHA256/RIPEMD160

   ```

   .
3. The only probably way a link between the public key and the private key can be found is by having at minimum the private key, and ideally for an attacker, a set of privatekeys

> **Comments:**
> **username_0**: yes, but lets say I have 3 pubKeys, with 1 btc each. I then encounter a bitpay pubKey and to acquire the good/service I must send that bitpay address 2.5 btc. Any thing I think of will combine the transactions from pubkey A, B and C, whether I do it in one transaction or 3+ transactions, within the 15 minute time period that bitpay allows.  

---

