On Fri, Aug 5, 2011 at 1:16 AM, Gavin Andresen <gavinandresen@gmail.com>wrote:

>
> ... so it is a de-anonymize-via IP address not de-anonymize-via Bitcoin
> address.  And might go partway to explaining why we're having trouble with
> network connectivity...
>

Well it's good that the bitcoin network is seeing some security testing.

So I understand that we have a combination of problems at the moment:

1) A DDoS possibility  (if this is really the cause of the network
connectivity problems)

2) An attacker can figure out which node first broadcasted a transaction, by
connecting to the entire network or having everyone connect to his node(s)

3) The recipient re-broadcasts transactions (is Theymos right here?),
allowing both the sender and recipient to be found

Drawok's suggestion about using UDP packets with spoofed sender addresses is
interesting, as UDP has another advantage; you can open up an "inbound" UDP
port on almost any NAT router without any UPNP magic: just send out an UDP
packet, the router will wait a certain time for answers (on a mapped port
number) and relay these back.

It also has some potential issues; the client needs special privileges to
spoof sender addresses, and some ISPs might filter out packets with
non-matching sender addriess (unsure how common this is).

JS