arXivDaily arXiv每日学术速递 周一至周五更新
arXiv周末暂无论文更新,休息一下吧,周末愉快~~
arXiv 1708.04748cs.CR
收藏

当cookie遇到区块链:通过加密货币进行网络支付的隐私风险

When the cookie meets the blockchain: Privacy risks of web payments via cryptocurrencies

Steven Goldfeder, Harry Kalodner, Dillon Reisman, Arvind Narayanan

摘要:

我们展示了第三方网络跟踪器如何对加密货币用户进行去匿名化。我们提出了两种不同但互补的攻击。在大多数购物网站上,第三方跟踪器会接收有关用户购买的信息,用于广告和分析目的。我们表明,如果用户使用加密货币支付,跟踪器通常拥有足够的购买信息,可以在区块链上唯一识别交易,将其链接到用户的cookie,并进一步链接到用户的真实身份。我们的第二次攻击表明,如果跟踪器能够以这种方式将同一用户的两次购买链接到区块链,它可以识别用户在区块链上的整个地址和交易集群,即使用户使用区块链匿名技术,如CoinJoin。攻击是被动的,因此可以追溯到过去的购买。我们讨论了几种缓解措施,但没有一种是完美的。

英文摘要:

We show how third-party web trackers can deanonymize users of cryptocurrencies. We present two distinct but complementary attacks. On most shopping websites, third party trackers receive information about user purchases for purposes of advertising and analytics. We show that, if the user pays using a cryptocurrency, trackers typically possess enough information about the purchase to uniquely identify the transaction on the blockchain, link it to the user's cookie, and further to the user's real identity. Our second attack shows that if the tracker is able to link two purchases of the same user to the blockchain in this manner, it can identify the user's entire cluster of addresses and transactions on the blockchain, even if the user employs blockchain anonymity techniques such as CoinJoin. The attacks are passive and hence can be retroactively applied to past purchases. We discuss several mitigations, but none are perfect.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑