rule110-io / surge

Surge is a p2p filesharing app designed to utilize blockchain technologies to enable 100% anonymous file transfers. Surge is end-to-end encrypted, decentralized and open source.
https://getsurge.io
Apache License 2.0
413 stars 48 forks source link

[Claim/Not Proven] This isn't anonymous at all, just pseudonymous #114

Open Superfly-Johnson opened 1 year ago

Superfly-Johnson commented 1 year ago

Describe the bug Replacing the main identifier in a P2P swarm from an IP address or a DHT address to a blockchain address doesn't solve the core problems of anonymous P2P networking, namely, anonymity. It's merely another form of pseudonymity.

This might actually be much worse for privacy than simply an IP address; Lawsuits have been attempted using an IP address as sole evidence and failed. They aren't sufficient evidence on their own. The same precedent doesn't exist with blockchain addresses.

More importantly, the mere usage of a VPN or other proxying methods are sufficient at providing a decent-enough level of anonymity for most P2P users. And the usage of a VPN most likely provides better privacy too, unfortunately...

WizardOfCodez commented 1 year ago

Hey there and thank you for the time you spent on testing Surge,

As you may know, Surge is based on the NKN P2P network and also sends all data through it. The concept of NKN is described in their whitepaper which can be found here.

Because of the decentralized approach and the forced hop size through the network, there can't be made any connection between a person IRL and the public key he publishes to the network that makes him identifiable. Therefore the term "pseudonymous" is not applicable to me in any case.

Since we disagree with your statement, it would be nice of you to explain it in more detail. A good idea for example is to pick one of the seeders in the "Surge Official" and explain how their public key can be retraced to a person or at least some information that identifies the PC the Surge Client is running on (f.e. the IP address) which would substantiate your claim of pseudonymity.

If your raised issue is just a claim without any proof this is also fine btw. But then please mark this Issue as "not proven" so others can jump on this train and work on some proof.

Cheers,