search

cryptoadvance / specter-desktop

A desktop GUI for Bitcoin Core optimised to work with hardware wallets
MIT License
805 stars 238 forks source link

Fetch Block Explorer data over Tor #408

Open 6102bitcoin opened 4 years ago

6102bitcoin commented 4 years ago

344 added the ability for users connected to pruned nodes to fetch missing data from blockstream.info.

This leaks IP to blockstream in addition to allowing blockstream to link the utxo's (should they wish).

If you connect via tor to blockstream's onion address this will stop leaking the IP address.

If you refresh the tor connection between requests this may stop linking the utxo's based off a common tor circuit.

Timing analysis would still be an issue, this could be resolved by staggering the lookups by random time intervals (in addition to the refreshed tor circuits).

Finally, there are other services (like mempool.space) which have a tor address so it would be best to add both and have the lookup randomly switch between these to further improve lookup privacy.

Summary

  1. Use tor lookup to stop IP leak
  2. Also refresh tor circuit with each lookup
  3. Also stagger lookup times to stop timing analysis
  4. Also randomly switch between multiple tor services
stepansnigirev commented 4 years ago

Good ideas! Why did you close it? With https://github.com/cryptoadvance/specter-desktop/pull/383 Specter tries to get utxo data over tor, making a new session every time. Not sure if it refreshes the tor circuit though...

ben-kaufman commented 4 years ago

Yes I agree that's a good idea. I'd say point 1 is already implemented, but I think we should reopen this issue until we also have the others handled. I'm pretty certain it doesn't change circuit, so we should probably do that, and randomly querying from multiple Tor supporting services with time delays is also a great idea to improve privacy.

6102bitcoin commented 4 years ago

Didn't mean to close it - apologies.

My code for txCast does 1/2/3