Topic: [ANNOUNCE] TORwallet - anonymous mixing wallet service - page 4. (Read 29583 times)
Anybody have any idea where Torwallet is? I've been trying to get in contact with them the last couple of weeks.
The way in which the operator of TORwallet has partially compromised his identity confirms for me this entire approach is wrong; it's a mistake to trust a third party to protect your anonymity. Even when the owners of a mixing service have the best intentions they can make mistakes and if they can be located they can be threatened.
I don't know enough about cryptography to say how (or if) it can be accomplished but mixing coins needs to be done in a way in such a way that it's not necessary to trust the mixing service.
I don't know enough about cryptography to say how (or if) it can be accomplished but mixing coins needs to be done in a way in such a way that it's not necessary to trust the mixing service.
If your security/anonymity needs are that high, Bitcoin may not be the right thing for you. You always leave a trail while aquiring bitcoin. Your IP will always be there at some point (if you don't trust TOR). The closest thing would be mining over TOR or something like this.
In short, Bitcoin is well known to be pseudonymous, so you might instead use a centrally managed system (only one instance to trust) or better yet, some offline commodity (where you trust your partner). No free lunch once you become paranoid enough ;-)
I still say TORWallet comes close to the most trustworthy tumbler, in terms of anonymity (not in terms of "noone runs away with your coins" necessarily though). Which doesnt say you shouldn't cascade several services and tumblers.
Ente
This is not always true... there are ways to take precautions if one so desires. There is a reason BTC is used on the black market.
I, personally, feel secure enough with my way of handling bitcoin for the things I do with them. Which involves trusting various companies, services, exchanges and so on.
What I tried to say, is, you will quickly find limits in the usefulness of Bitcoin when you don't trust absolutely nobody..
Which, as a mind experiment, I enjoy, but not for (my) real-world applications.
Once you start calculating risks, thus accepting risks, things become much more reasonable. Like trusting the integrity of the TOR network, for example.
Ente
The way in which the operator of TORwallet has partially compromised his identity confirms for me this entire approach is wrong; it's a mistake to trust a third party to protect your anonymity. Even when the owners of a mixing service have the best intentions they can make mistakes and if they can be located they can be threatened.
I don't know enough about cryptography to say how (or if) it can be accomplished but mixing coins needs to be done in a way in such a way that it's not necessary to trust the mixing service.
I don't know enough about cryptography to say how (or if) it can be accomplished but mixing coins needs to be done in a way in such a way that it's not necessary to trust the mixing service.
If your security/anonymity needs are that high, Bitcoin may not be the right thing for you. You always leave a trail while aquiring bitcoin. Your IP will always be there at some point (if you don't trust TOR). The closest thing would be mining over TOR or something like this.
In short, Bitcoin is well known to be pseudonymous, so you might instead use a centrally managed system (only one instance to trust) or better yet, some offline commodity (where you trust your partner). No free lunch once you become paranoid enough ;-)
I still say TORWallet comes close to the most trustworthy tumbler, in terms of anonymity (not in terms of "noone runs away with your coins" necessarily though). Which doesnt say you shouldn't cascade several services and tumblers.
Ente
This is not always true... there are ways to take precautions if one so desires. There is a reason BTC is used on the black market.
The way in which the operator of TORwallet has partially compromised his identity confirms for me this entire approach is wrong; it's a mistake to trust a third party to protect your anonymity. Even when the owners of a mixing service have the best intentions they can make mistakes and if they can be located they can be threatened.
I don't know enough about cryptography to say how (or if) it can be accomplished but mixing coins needs to be done in a way in such a way that it's not necessary to trust the mixing service.
I don't know enough about cryptography to say how (or if) it can be accomplished but mixing coins needs to be done in a way in such a way that it's not necessary to trust the mixing service.
If your security/anonymity needs are that high, Bitcoin may not be the right thing for you. You always leave a trail while aquiring bitcoin. Your IP will always be there at some point (if you don't trust TOR). The closest thing would be mining over TOR or something like this.
In short, Bitcoin is well known to be pseudonymous, so you might instead use a centrally managed system (only one instance to trust) or better yet, some offline commodity (where you trust your partner). No free lunch once you become paranoid enough ;-)
I still say TORWallet comes close to the most trustworthy tumbler, in terms of anonymity (not in terms of "noone runs away with your coins" necessarily though). Which doesnt say you shouldn't cascade several services and tumblers.
Ente
We have at no point ever operated an exit node. We may or may not be operating a relay. Our system keeps no records of deposits or withdraws, only a balance, even if someone gained access to our hidden server there is no way they could link past deposits and withdraws, only ones in the future.
Even if you just ran it as a middle-relay. You admited you ran it and you admited it went down on a specific date with an aproximate hour. That was not a smart thing to do.
Next time your server goes down, keep the reason to yourself.
We just experienced about an hour of down time. We thought it would be a good idea to configure Tor as a relay to increase security, but it used up all the ram on the server and we had to reboot it.
Please do not worry if you had deposits. We are here for the long term.
Please do not worry if you had deposits. We are here for the long term.
We have at no point ever operated an exit node. We may or may not be operating a relay. Our system keeps no records of deposits or withdraws, only a balance, even if someone gained access to our hidden server there is no way they could link past deposits and withdraws, only ones in the future.
(alough that does not help the Hushmail scenario you mentioned).
What's the point of mixing if it isn't secure against that scenario?If you don't like including protection from governments in your threat model then just replace court orders with sufficiently-motivated elements of organized crime, or malicious operators.
(alough that does not help the Hushmail scenario you mentioned).
What's the point of mixing if it isn't secure against that scenario?If you don't like including protection from governments in your threat model then just replace court orders with sufficiently-motivated elements of organized crime, or malicious operators.
blockchain.info's new anonymizer service reportedly only keeps records long enough to process the transaction (alough that does not help the Hushmail scenario you mentioned).
And it is open source
And it is open source
Use Instawallet through Tor. You can see for yourself using blockexplorer that it gets mixed nicely.
Mixing isn't the problem. If Instawallet keeps records of its users it can map the mixed outputs to the original inputs and provide that information to third parties. Accessing Instawallet through Tor doesn't help with that.It doesn't matter how trustworthy the operators of Instawallet are, they can be forced to keep those records against their will. https://en.wikipedia.org/wiki/Hushmail
So the only way to have secure mixing is if it's not possible for even the operators of the mixing service to determine which outputs correspond with the original inputs. I don't know if it's possible to do that or not; if I knew any cryptographers I'd ask them.
But what you can do is repeat the same few steps with different shared wallets or even simpler, just use SR.
Use Instawallet through Tor. You can see for yourself using blockexplorer that it gets mixed nicely.
Mixing isn't the problem. If Instawallet keeps records of its users it can map the mixed outputs to the original inputs and provide that information to third parties. Accessing Instawallet through Tor doesn't help with that.It doesn't matter how trustworthy the operators of Instawallet are, they can be forced to keep those records against their will. https://en.wikipedia.org/wiki/Hushmail
So the only way to have secure mixing is if it's not possible for even the operators of the mixing service to determine which outputs correspond with the original inputs. I don't know if it's possible to do that or not; if I knew any cryptographers I'd ask them.
The way in which the operator of TORwallet has partially compromised his identity confirms for me this entire approach is wrong; it's a mistake to trust a third party to protect your anonymity. Even when the owners of a mixing service have the best intentions they can make mistakes and if they can be located they can be threatened.
I don't know enough about cryptography to say how (or if) it can be accomplished but mixing coins needs to be done in a way in such a way that it's not necessary to trust the mixing service.
Use Instawallet through Tor. You can see for yourself using blockexplorer that it gets mixed nicely. I don't know enough about cryptography to say how (or if) it can be accomplished but mixing coins needs to be done in a way in such a way that it's not necessary to trust the mixing service.
The way in which the operator of TORwallet has partially compromised his identity confirms for me this entire approach is wrong; it's a mistake to trust a third party to protect your anonymity. Even when the owners of a mixing service have the best intentions they can make mistakes and if they can be located they can be threatened.
I don't know enough about cryptography to say how (or if) it can be accomplished but mixing coins needs to be done in a way in such a way that it's not necessary to trust the mixing service.
I don't know enough about cryptography to say how (or if) it can be accomplished but mixing coins needs to be done in a way in such a way that it's not necessary to trust the mixing service.
Wow, seriously guys, I thought I was paranoid!
I am impressed, keep up the good work!
Ente
I am impressed, keep up the good work!
Ente
I really like the idea of this, but given recent disclosures like this makes wonder if it being ran by the intersango group
I LOL'd True, all exit nodes are public.
Running an exit node on a hidden server is dumb dumb.
Running an exit node on a hidden server is dumb dumb.
The dumb dumb part was saying they were running an exit node and even go as far as giving an aproximate timeframe for when it went live and when it went offline. Only the act of running an exit node could've even helped them with plausible deniability, if they managed to do it right.
I really like the idea of this, but given recent disclosures like this makes wonder if it being ran by the intersango group
True, all exit nodes are public.
Running an exit node on a hidden server is dumb dumb.
Running an exit node on a hidden server is dumb dumb.
The dumb dumb part was saying they were running an exit node and even go as far as giving an aproximate timeframe for when it went live and when it went offline. Only the act of running an exit node could've even helped them with plausible deniability, if they managed to do it right.
True, all exit nodes are public.
Running an exit node on a hidden server is dumb dumb.
Running an exit node on a hidden server is dumb dumb.
We are experiencing some issues with our tor server at the moment. Its not responding to its public IP address. There has been some rough weather in the area and a power outage. We believe that the UPS on the server may have ran dead before the power came back. One of us has to physically drive out to where the server is located and check on/reset it. Please give us a couple hours to get this resolved. Do not worry about your funds, we will be back.
Probably not the best idea publishing time and cause of outage on a public forum. You just narrowed down the possible physical locations of your "hidden" server somewhat.
+1. What I was thinking.
Since the moment they posted publicly that they had started running an exit node on the server as disguise and that was why the server was slow so they stopped running the exit node the list of possible IP's was already narrowed down enough. This disclosure was just the last nail on the coffin. lol
We are experiencing some issues with our tor server at the moment. Its not responding to its public IP address. There has been some rough weather in the area and a power outage. We believe that the UPS on the server may have ran dead before the power came back. One of us has to physically drive out to where the server is located and check on/reset it. Please give us a couple hours to get this resolved. Do not worry about your funds, we will be back.
Probably not the best idea publishing time and cause of outage on a public forum. You just narrowed down the possible physical locations of your "hidden" server somewhat.
+1. What I was thinking.
Jump to: