Abuse and Harassment on the Blockchain
blog.mollywhite.net
blog.mollywhite.net
I’d say this is not really accurate. Apple chose to put detection and warnings in place for when an AirTag is potentially moving with someone without their knowledge, and they had these in place from day 1. Sure, they could have done a better job (especially when it comes to other platforms like Android, which have taken time for Apple to get caught up on), but it’s a stretch to say they didn’t put thought into it. If anything, they could have kept much more quiet about it rather than put tools into place which help detect abuse, but also raise awareness and call attention to it. They made a choice, and the right one at that.
Meanwhile there are plenty of electronic devices available which can be used for stalking purposes and can be bought very cheaply on Amazon (no, I won’t link to any) and give no such warnings from any apps when they are unexpectedly traveling with someone. These are much cheaper and much harder to detect. If someone is genuinely concerned about such abuse of technology that should be equally called out along with Apple. Of course that might not get as much attention as going after a visible company like Apple, but it nevertheless deserves the same level of concern.
Yeah, that’s a crazy allegation.
It’s really obvious to anyone familiar with the product that Apple put a lot thought of thought into this.
Their solutions might not have been perfect, but anti-abuse was clearly a top priority for the airtag team.
> there is very little privacy available once your crypto wallet address is known, because every transaction is publicly visible, and attempts to obscure them often easily unobscured with chain analysis tools
Any good crypto wallet will generate a distinct address for each transaction. (Granted, chain analysis could help correlate addresses, but doing so requires a vastly larger effort and success is not guaranteed.)
> immutable social network content is horrifying given what people post themselves. Imagine if the cringy posts by a twelve-year-old were guaranteed to be available in perpetuity as soon as they were saved
Once your data is on my machine, it is out of your hands forever. This is a fundamental principle, and the alternative is surely more dystopian. Norms must change to accommodate what is a technological fact; the reason they haven't changed yet is because most social technology is still centralized. But people already understand that you can't un-send an email, for example. Why should the rest of the internet be different?
The world isn't quite that apodictic. While the worst case may not change, its likelihood can. Information has always had a half-life that people had a general idea of, and that they considered in their decision-making. An effort specifically aimed at creating immutable, perpetual records will hurt both the people who fail to adjust, who will more likely see damaging old stuff coming up than expected, as well as the people who do change their habits, who are forced to restrict their openness and thereby lose whatever utility they used to derive from the previous, more liberal ability to share content.
The mechanism is identical to a change from traffic laws being enforced by cops, where some slack in the system was unavoidable, expected, and sometimes compensated for with higher fines (where the risk of being caught is too low), to some automated system where every single traffic violation is recorded and fined.
Blockchain is built from the ground up to prevent exactly one type of security vulnerability: man in the middle attacks. It is absolutely abysmal at protecting against any other form of attack. Anything that involves, say: social engineering, is fair game. After all it is YOUR fault if YOU leak personal information that can be used to destroy YOUR life. If that ends up in the blockchain its not MY fault, I cant do anything... what do you want me to do? change it? punish someone? oops sorry I cant!
Ultimately this form of thinking is the logical conclusion of "personal responsibility" arguments. Why criticize the system when you can instead pretend the problem is the individual? Crypto doesnt have philosophical issues, you are using the wrong wallet. It isnt MY fault that someone made an NFT containing your home address and bitcoin wallet ID, YOU trusted your information with the wrong service.
The ultimate scapegoat is blaming the end-user. At some point you need to take the L and at least admit these are oversights. Blockchain tech has been around for over a decade and it's had plenty of time to solve these problems but instead it has dug its heels in and said "no all of this is by design and good actually"
Two banks in Italy have launched a crypto buying and custodying services, the customers can't even access their crypto, nor they even want to. And it is doing well. Yet another proof no one cares about blockchain solutions and tgat the problems they solve do not exist.
I wonder where that Man in the Middle attack thing is coming from? Dan mentioned it in his recent video, so he must have picked it up somewhere.
If you Google the term + blockchain, you'll mostly find some discussion about potential attack vectors regarding wallets. It's not a term used in academic blockchain literature as far as I aware. It's not used in the Bitcoin whitepaper.
Man in the middle has a specific meaning, and I don't see how describing blockchain's main purpose as preventing this kind of attack makes a terrible amount of sense.
Ultimately, what you critique is simply an inherent part of the system. These are not oversights. These are basic consequences of the whole approach. To say "blockchain evangelists suffer a deficiency in not addressing them" is merely saying "there should be no blockchain evangelists".
> Ultimately, what you critique is simply an inherent part of the system YES THATS THE PROBLEM. Systems arent immutable facts of the world. We can change them. Systems are built by people and people can be wrong or at the very least mislead.
You may want to re-run that search without "blockchain". It's an _extremely_ common phrase in information security. Like - NETSEC 101 sort of stuff.
> It's not a term used in academic blockchain literature as far as I aware. It's not used in the Bitcoin whitepaper.
I don't even...
To say "blockchain evangelists suffer a deficiency in not addressing them" is merely saying "there should be no blockchain evangelists".
Honestly... yes. If there are a bunch of problems preventing digital cash from working and you solve two of those problems then you haven't created digital cash; you've created an attractive nuisance.
From what I know, the would require an extra transaction, and additional fees? At least on ETH. Correct me if I'm wrong.
if you need privacy just use Monero
https://wolovim.medium.com/ethereum-201-hd-wallets-11d0c93c8...
> Some cryptocurrency enthusiasts envision a world where cryptocurrencies have replaced dollars and euros (which they refer to as “fiat”; I prefer the term “real money”)
if the author wanted to get their point across, maybe they could have avoided the snarky comment in the article's introduction? Whenever I read this type of statement, there is a switch in my brain that flips and goes "OK what you're going to read next is probably biased". At least in my personal experience, this style of writing ends up diluting the validity of any other statement within the article.
One of them: "I have instead come to believe that [crypto is] so harmful that I cannot ethically continue to ignore them, and must instead do my best to educate and advocate against their wider adoption. I am picking my battles, and this is one of them."
The argument that transparency can lead to coercion can be quite convincing — privacy technologies can give power to victims.
And those two are the tip of the iceberg. Check out Dero for one that's doing smart contracts with homomorphic encryption.
The future of privacy coins, based on these examples, is simply that they work, and will do so as long as the encryption mechanisms do. So we are presented with a question of which applications benefit from public vs private chains.
If Mina can rebrand from Corda, (much better name) Dero should think about it too.
By what metric?
Monero and Zcash probably do more actual business than non-private chains do. It’s all drugs and ransomeware, but it’s actually being used as money.
There's no better endorsement for Monero than the unclaimed bounty to crack its privacy and its usage by cybercriminals.
Monero is used more in "the real world" than any other cryptocurrency.
I don't doubt that anonymous transactions are possible, I want to know if they're actually accomplishing what this person is claiming. They've had plenty of time to do so.
I think what he might be referring to in particular is that the traditional blockchain and even financial system at large is incapable of protecting at-risk individuals (eg activists), as the former is subject to chain analysis and the latter is subject to the whims of whichever regime has taken power.
https://www.treasury.gov/ofac/downloads/sdnlist.txt
> Digital Currency Address - XMR 5be5543ff73456ab9f2d207887e2af87322c651ea1a873c5b25b7ffae456c320;
https://localmonero.co/blocks/search/5be5543ff73456ab9f2d207...
What, if any, solutions have been proposed for such situations? Have there been any lawsuits or proposed legislation to combat such crimes?
As there are a lot of people who are quite opposed to Bitcoin/PoW/blockchain/etc, I assume if it was true, someone would have come up with some indisputable, solid evidence for it, and it would make the tech news rounds for quite some time (there are enough anti-Bitcoin writers and commenters that such a thing would never die, and would be brought up with some links to the evidence in literally every article written about Bitcoin).
As that's not happened, I remain inclined to treat it as rumors and "But if you use this OTP you can get the following out!" sort of trickery.
There are JPGs, ASCII art, PDFs, religious messages, firmware keys, "illegal" prime numbers and all sorts.
Is there anything worse than that? There are certainly some GPG encoded files in there. Perhaps someone is planning on shorting Bitcoin and is waiting to announce something so evil is stored that possession of the chain becomes a criminal offence is most countries.
However, the specific claim of CP remains, as far as I'm aware, entirely hypothetical. And I'm at least not aware of any legal precedent that says the possession of random data, of which you don't have the keys, and don't have any reason to know the content of it, is illegal.
I found this reference for you: https://fc18.ifca.ai/preproceedings/6.pdf
See under "Illegal and Condemned Content":
> Bitcoin’s blockchain contains at least eight files with sexual content. While five files only show, describe, or link to mildly pornographic content, we consider the remaining three instances objectionable for almost all jurisdictions: Two of them are backups of link lists to child pornography, containing 274 links to websites, 142 of which refer to Tor hidden services. The remaining instance is an image depicting mild nudity of a young woman. In an online forum this image is claimed to show child pornography, albeit this claim cannot be verified (due to ethical concerns we refrain from providing a citation)."
I'm sure if you really put your mind to it, you could find and recover the images, but then you'd just have illegal content and that's not very useful, so why dig for it?
The cost to sustain an illegal media attack such that consecutive blocks contain such data is unsustainable and far easier to ameliorate than a 51% attack. According to this $76k per gigabyte on Eth. https://ethereum.stackexchange.com/questions/872/what-is-the...
How do you alter a block without altering the headers of every other block afterwards? Unless you are capable of second pre-image attacks on modern cryptographic hashes that's simply not possible. What you have is a database, not a blockchain.
How do you get everyone to agree to fork each time someone stores or identifies offending material (or a pointer to such) on chain?
At least in the Ethereum DAO case, everyone had a vested interest in switching to the fork.
You would need a regularly scheduled "Hard Fork Thursday" or similar to effectively address the issue, and that's quite unlikely as this introduces new vulnerabilities.
What is the practical solution? Clean nodes. If such web server is in a jurisdiction of said illegal content, it must run a clean node that specifically filters such content to the web. This technology exists today, it's called "moderation", it's just that the backend is a MySQL database, not a blockchain.
If someone wants to access resources that were pruned (ex: call an old contract), they will submit the state to the network along with a proof that the data is correct. In this model, you’d have to store the illegal content yourself in order to ‘rehydrate’ it into the current state of Ethereum.
If Bitcoin's primary design and purpose to disseminate bluray decryption keys, and provide unfettered access to them to anybody and everybody, and advertise it as such, there may be some kind of an argument to be made.
But as it's not, and there are hoops to jump through, doesn't it make about as much sense as trying to make malls and permanent markers illegal, because someone wrote a bluray decryption key under a mall toilets cistern lid?
In our present reality, almost every piece of information - with sufficient intent - can effectively become immutable, owing to our interconnectivity and resourcefulness.
And as I understand it this is the part that matters legally - the law is concerned with that intent.
I often see people claiming an immutable blockchain and all of its users are potentially in violation of the law because someone put something on it that's illegal and therefore everyone around the world with an unwitting copy of that information is breaking the law. But is that how the law works? (Well, when it's working - which it doesn't always, but in general.)
In this example of someone putting illegal content on the Bitcoin blockchain, the system and its users could be more rightly seen as victims of the crime. Just as much as the mall owner is a victim of an act of vandalism, or the github repo's owner.
None of these parties had the intent to host this information.
However if a particular blockchain was specifically created and marketed as a place to host and get bluray keys, and all peers and miners hosting copies of it clearly knew that, then they are showing intent to break the law and would be treated differently.
Now IANAL, and neither is this a perfect metric and it becomes a grey area at times, but as I understand it, this question of intent is fundamental to law and how it's enforced in the real world.
We can think of countless examples of how doing anything else would result in continual and repeated injustices.
Turning an apartment buildings worth of people into criminals would be as simple as putting a piece of paper with a decryption key on it into everyones letterbox.
No. They're the victims of unsolicited mail. It doesn't mean all of them and the postal system should be considered illegal, even if they unwittingly kept the letter in a stack with other junk mail in their room.
It's somewhat common in the UK for people to send each other a couple of pennies, along with a short message, via banking apps. Some banks will block senders on request. As banks have to perform KYC checks, it's also possible to report people for harassment to the police.
I'm not sure how unregulated cryptocoins can do that. I'm sure you can tell a wallet to ignore any transactions from a specific address - but there's no way to prevent those transactions actually being committed to the chain.
I don’t think blockchains accomplish what they’re supposed to, but you’re telling me the problem with them is they don’t respect and privacy and allow people to send me unwanted messages? Compared to the status quo? What world do you live in?
This isn't am inherent problem with blockchains though. Privacy blockchains exist. Monero transactions don't reveal much. There's no way to tell who's sending the money, who's receiving it or even how much.
I believe it's due to ignorance of the increasing risks associated with bitcoin and of the existence of better technology. Smarter criminals are already using Monero.
> You really can't infer that much from looking at the blockchain, especially when there is no address re-use.
You don't even have to infer anything. Just look up a known address and you can see its entire transaction history. There are rich lists which allow you to track whales. You can literally see them deposit the coins on Binance when they're about to dump on the market.
> Even less when CoinJoin is used. You can make some probabilistic guesses at best.
This is not a good idea. The coin anonymizer transactions will be there for all to see. Your money is tainted the second it passes through these systems even if you do it for privacy reasons. Exchanges will refuse these coins and as a result so will everyone else because they won't be able to cash them out. They might as well be worthless.
This sort of anonymizing feature has to be built into the system in such a way that it is always enabled for everyone and can't be turned off. Anonymous money should be the rule and it should be impossible to break it. That way nobody can be discriminated against for protecting their privacy. If you can discriminate against coins based on their origin, they are not fungible.
> Ross Ulbricht, aka "Dread Pirate Roberts", was using Bitcoin extensively and never got identified through the blockchain
That was years ago.
The risk is practically non-existent, they're not getting caught through the blockchain.
> You don't even have to infer anything. Just look up a known address and you can see its entire transaction history. There are rich lists which allow you to track whales. You can literally see them deposit the coins on Binance when they're about to dump on the market.
That shows a misunderstanding of how Bitcoin wallets work. There are some services that claim to track the inflow/outflow of Bitcoins to exchanges but they are very approximate and you can't track individual "whales". If you use a modern wallet there really shouldn't be more than 2 Bitcoin transactions per address (in and out).
> Exchanges will refuse these coins and as a result so will everyone else because they won't be able to cash them out.
That is false.
PS: I know there are blockchains with better anonymity than Bitcoin but please, slow down with the overstatements.
Any and all criticism is deflected with “but look at x, they do y which is just the same. Well so what?
Bad behavior within another system doesn’t absolve the system under scrutiny from criticism.
The place this ends is not about crypto currency, if you really want to stop all “harm” on the internet you end up in a society where encryption is demonized. I wonder what abuse and harassment will be irrestistable to corporations and governments who completely deny you privacy or digital autonomy. And we are worried about problems that already exist with or without crypto? Give me a break.
Which she doesn't so we can stop there. Your kind of discourse is exactly part of the problem here on HN.
This. Simply.
The road to hell is once again paved with good intentions. From email, to the blockchain.
Sent "f*_this_s*coin_to_the_ground" to everyone that had more than about $10 worth of NEM.
It was highly satisfying to use their own network to message people about the dishonesty of the developers after they tried to censor me on every other platform.
Yes you can send a token or NFT to anyone on the chain, yes as far as the data layer is concerned that is "immutable". That however does not prevent you as a user to forgo your access/freedom to an entity that knows best for you, just like we do everyday in traditional web services, social media, banking institutions etc.
What does that look like? The underlying data layer (the blockchain) is public and open source. A "moderation" company can build their own middleware that filters data, throws out spam/harassment etc. Then, your node or wallet consumes and interacts with this middleware instead of the base layer. Now you have successfully incorporated abuse/harassment moderation without having to worry about the blockchain at all. If someone sends you something undesirable, you never see or interact with it.
At the end of the day, blockchains give you *the option* to have your freedom, they do not force it upon you. The same can't be said about the traditional tech.
The utility is still right there for whoever wants to take advantage of it, but they still have the option to forgo part or all of the trustless nature.
It doesn't matter if the "offending data" is sitting on a computer somewhere (that's all a blockchain is) what matters if it's accessible and as I mentioned, it's up to the blockchain nodes to transmit it or a user to consume it. Both of which can be solved if needed with middleware.
now, IPFS (not a blockchain, obviously) gives node owners control over the content they want to host. it's definitely not as free as a traditional blockchain, but it's probably closer to what you're looking for
You're welcome to say that you prefer these tradeoffs in your monetary systems but please don't try to say that it's somehow better at handling abuse. It is objectively worse.
It's not the job of the software protocol to address social/legal problems. That's the job of governments and law. If the law in particular jurisdiction prohibits certain illegal content, then the node operating in that jurisdiction will be compelled to follow it, blockchain or not.
It is objectively better because one has an option and the other doesn't.
What option do you have if twitter _does not_ filter out media that you deem bad?
Conversely, what option do you have if twitter _does_ filter out content that is not objectionable to you?
That said, even in this beta there's an easy to reach option to "Block user". Nice work Etherscan!
You can just wait until most bugs get fixed and these features get implemented in the next 10 years. You'll have less upside potential, but another mature system to choose from.
This clarifies the purpose of web3.
I don’t think the author would like to know how the abuse of both projects by ‘criminals’ is happening; even worse when MobileCoin is a privacy coin like Monero. Good luck tracing the sender.
Like the internet, email and now blockchain, the road to hell has been paved with good intentions, until the criminals came along abusing Signal and MobileCoin.