taler
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Taler] Privacy concerns


From: Michael Kohn
Subject: [Taler] Privacy concerns
Date: Sun, 05 May 2024 19:50:44 +0000

Dear colleagues,

the Taler project emphasizes "Privacy".

However, it appears to me that a system like Taler is exactly the opposite.

Currently and for the forseeable future, Banks and payment providers routinely 
block users that connect through Tor, a VPN or any other anonymizing network 
provider.
In the EU it is not possible to obtain an anonymous personal Internet access, 
either wired or cellular.
Also, it is - for example - not possible anymore to register even an
anonymous E-Mail address from any popular E-Mail provider by using an 
anonymization service or public internet access.
It is not hard to see that access to banks and payment providers is at least as 
tightly regulated as access to a free E-Mail account.

Banks and payment providers usually store IP addresses that are related to 
monetary transactions.
Governments have easy means, often completely invisible to a citizen and even 
the network provider, to relate an IP address to a specific person / network 
provider customer and vice versa.

Thus, while Taler acknowledges that the so-called "merchant" (I do not like 
this word because it is wrong the way Taler uses it: if one person gives money 
to another, the receiver does not neccessarily have to be a "merchant"; it is 
simply not anyone's business why money is transferred between two citizens and 
it can be transferred for many reason besides merchandise) is not anonymous, 
the "customer" for all practical purposes will also not be anonymous at all.

For a government, it is quite easy to correlate Person A withdrawing 934,29 
Euros from Bank A on May 5th, 22:18 by using Taler, and Person B receiving 
934,29 Euros on his Account on Bank B on May 5th, 22:19 by using Taler.

Arguing that Taler allows for "anonymous" "customers" is, in the best case, 
extremely naive and narrows the definition of anonymity down on some crypto 
specifics of Taler while ignoring the whole bunch of easy identification 
possibilities of a customer by analyzing bank transfers and/or network accesses.

Governments do have that kind of access to bank and network provider databases 
since decades.

I'd be happy if there's some hidden gem in the technical details of Taler that 
I have missed and Taler is indeed truly anonymous for a customer in a REAL 
WORLD scenario.

What is the threat model of Taler's security and how does it protect  the 
"customer" (spender) against being identified by a real-world Government, i.e. 
one that has full acccess to all banking and network provider databases?

Best, Michael



reply via email to

[Prev in Thread] Current Thread [Next in Thread]