public inbox for bitcoindev@googlegroups.com
 help / color / mirror / Atom feed
From: Patrick Strateman <patrick.strateman@gmail.com>
To: bitcoin-dev@lists.linuxfoundation.org
Subject: Re: [bitcoin-dev] Bitcoin XTs Tor IP blacklist downloading system has significant privacy leaks.
Date: Tue, 18 Aug 2015 17:00:09 -0700	[thread overview]
Message-ID: <55D3C709.8010000@gmail.com> (raw)
In-Reply-To: <20150818233130.7A22815F000@c-in3ws--03-03.sv2.lotuslive.com>

[-- Attachment #1: Type: text/plain, Size: 1710 bytes --]

First of all I would like to say... LOL

Second Andrew LeCody is correct, this is off topic.

On 08/18/2015 04:31 PM, F L via bitcoin-dev wrote:
> Bitcoin XT contains an unmentioned addition which periodically
> downloads lists of Tor IP addresses for blacklisting, this has
> considerable privacy implications for hapless users which are being
> prompted to use the software.  The feature is not clearly described,
> is enabled by default, and has a switch name which intentionally
> downplays what it is doing (disableipprio).  Furthermore these claimed
> anti-DoS measures are trivially bypassed and so offer absolutely no
> protection whatsoever.
>
> Connections are made over clearnet even when using a proxy or
> onlynet=tor, which leaks connections on the P2P network with the real
> location of the node.  Knowledge of this traffic along with uptime
> metrics from bitnodes.io can allow observers to easily correlate the
> location and identity of persons running Bitcoin nodes.  Denial of
> service can also be used to crash and force a restart of an
> interesting node, which will cause them to make a new request to the
> blacklist endpoint via the clearnet on relaunch at the same time their
> P2P connections are made through a proxy.  Requests to the
> blacklisting URL also use a custom Bitcoin XT user agent which makes
> users distinct from other internet traffic if you have access to the
> endpoints logs. 
>
>  
> https://github.com/bitcoinxt/bitcoinxt/commit/73c9efe74c5cc8faea9c2b2c785a2f5b68aa4c23
>
>
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev


[-- Attachment #2: Type: text/html, Size: 2878 bytes --]

  parent reply	other threads:[~2015-08-19  0:00 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-08-18 23:31 [bitcoin-dev] Bitcoin XTs Tor IP blacklist downloading system has significant privacy leaks F L
2015-08-18 23:56 ` Andrew LeCody
2015-08-19  0:00 ` Patrick Strateman [this message]
2015-08-19  1:08 Christophe Biocca
2015-08-19  1:36 ` Peter Todd
2015-08-19  1:48   ` Gregory Maxwell
2015-08-19  2:25   ` Peter Todd
2015-08-19 15:45     ` Mike Hearn
2015-08-19 18:51       ` Btc Drak

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=55D3C709.8010000@gmail.com \
    --to=patrick.strateman@gmail.com \
    --cc=bitcoin-dev@lists.linuxfoundation.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox