Privacy and blockchain: Difference between revisions
m removing stale inuse template as last edited 1 days ago |
removing comments as no copyediting cone |
||
| Line 1: | Line 1: | ||
{{copy edit|for=style|date=December 2018}} |
|||
{{expert needed|date=December 2018}} |
{{expert needed|date=December 2018}} |
||
{{more citations needed|date=December 2018}} |
{{more citations needed|date=December 2018}} |
||
Revision as of 14:16, 29 May 2019
 | This article may require copy editing for style. (December 2018) |
 | This article needs attention from an expert on the subject. Please add a reason or a talk parameter to this template to explain the issue with the article. (December 2018) |
 | This article needs additional citations for verification. (December 2018) |
A blockchain is a public, shared database that records transactions between two parties.[1] Specifically, blockchains document and confirm who owns what at a particular time through cryptography.[2] After a particular transaction is validated and cryptographically verified by other participants, or nodes in the network, it is then made into a "block" on the blockchain.[1] A block contains information about when the transaction occurred, previous transactions, and details about the transaction.[1] Once recorded as a block, transactions are ordered chronologically and cannot be altered or changed.[1] This technology rose to popularity after the creation of Bitcoin—the first application built on using blockchain technology—and has furthermore catalyzed other cryptocurrencies and applications.[3] Due to its nature of decentralization, transactions and data are not verified and owned by one singular, overpowering entity, as they are in typical systems. Rather, the validity of transactions are able to be confirmed by any node, or computer, that has access to the network.[4] Additionally, blockchain technology secures and authenticates transactions and data through cryptography.[5] With the rise and widespread adoption of technology, data breaches have become rampant and frequent.[6] User information and data are often stored, mishandled, and misused, causing a threat to personal privacy.[5] Currently, many are pushing for the widespread adoption of blockchain technology for its ability to increase user privacy, data protection, and data ownership.[5]
Blockchain and privacy protection
Private and public keys
A key aspect of privacy in blockchains lies in the use of private and public keys. Blockchain systems use asymmetric cryptography to secure transactions between users.[7] In these systems, each user has a public and private key.[7] These keys are random strings of numbers and are cryptographically related to one another.[7] Although the public and private keys are related to one another, it is mathematically impossible for a user to guess another user's private key from their public key.[7] This provides an increase in security benefits and protects from potential hackers or malicious users.[7] Public keys can be shared with other users' in the network, as they do not give any information regarding personal data.[7] Additionally, each user has an address, which is derived from the public key using a hash function.[7] These addresses are furthermore used to send and receive assets on the blockchain, such as cryptocurrency.[7] Because blockchain networks are shared to all participants, users can view past transactions and activity that has occurred on the blockchain.[7]
On the blockchain, senders' and receivers' of past transactions are represented and signified by their addresses.[7] Due to this, users' identities are not revealed.[7] Public addresses do not reveal any personal information or identification.[7] Rather, public addresses act as pseudonymous identities.[7] This furthermore allows users' to have their identities relatively concealed on the blockchain.[7] However, it is suggested that users do not use a public address more than once.[7] This tactic avoids the possibility for a malicious user to trace a particular address' past transactions in an attempt to reveal information.[7] Additionally, private keys are used to protect user identity and security through digital signatures.[7] Firstly, private keys are used to access funds and personal wallets on the blockchain.[7] Private keys also add a layer of identity authentication.[7] When an individual wishes to send money to another user, they must provide a digital signature (which is produced only when provided with the particular private key).[7] This process protects against potential hackers that aim to pose as certain individuals and use the individuals' funds.[7]
Peer-to-peer network
As previously stated, blockchain technology arose from the creation of Bitcoin.[8] In 2008, a pseudonymous Satoshi Nakamoto released a paper describing the technology behind blockchains.[8] In his paper, he explained a decentralized network that was characterized by peer-to-peer transactions involving cryptocurrencies, or electronic money.[8] In typical transactions carried out today, users put trust into central authorities to securely hold their data and execute transactions.[5]
In large corporations, a large amount of users' personal data is stored on a single device, posing an extreme security risk if an authority's system is hacked, lost, or mishandled.[5] On the contrary, blockchain technology aims to get rid of this reliance on a central authority.[8] To achieve this, blockchain functions in a way where nodes, or devices in a particular blockchain network, can confirm the validity of a transaction rather than a powerful third party.[8] In this system, transactions between users (such as sending and receiving cryptocurrency) are broadcast to every node in the network.[8] However, before the transaction is recorded as a block on the blockchain, nodes must ensure that a transaction is valid.[8] In other words, nodes must check past transactions of the spender to ensure that he/she did not double spend, or spend more funds than they actually own.[8]
After nodes confirm that a block is valid, consensus protocols, such as proof of work and proof of stake, are then deployed by miners.[8] These protocols allow nodes to reach a state of agreement on the order and amount of transactions.[9] Once a particular transaction is verified, it is then published on the blockchain as a block.[6] Once a block is created on a blockchain, it cannot be altered or changed.[1] Through blockchain's decentralized nature and elimination of the need for a central authority, user privacy is increased.[5] Peer-to-peer networks allow for users to control their data, decreasing the threat of third parties to sell, store, or manipulate personal information.[5]
A zero-knowledge proof is a consensus protocol where one party proves to another party that a specific set of information (i.e., that a transaction is valid) is true.[10] However, the "prover" do so in a way that does not reveal any specific information about the transaction.[10] This can be done through complex cryptographic methods.[10] This method, which has been recently introduced into blockchain systems using zk-snarks, has been enacted to increase privacy in blockchains.[10] In typical public blockchain systems, a block contains information about a transaction, such as the sender and receivers addresses along with the amount sent.[10] However, many users are not comfortable with this sense of transparency.[10] In order to maintain blockchain's nature of decentralization while decreasing transparency, zero-knowledge proofs do not reveal or share anything about a particular transaction, other than the fact that it is valid.[10]
Comparison of blockchain privacy systems
Private blockchains
Private blockchains (also referred to as permissioned blockchains) are different from public blockchains. As stated, public blockchain ledgers are available to any node that wishes to download the network. Common critiques of public blockchains claim that, because everyone has the ability to download a blockchain and look at the history of transactions, there is not much privacy.[9] However, in private blockchains, nodes must specifically be granted access to participate, view transactions, and deploy consensus protocols.[9] Due to the fact that transactions listed on a private blockchain are not public to all, private blockchains ensure an extra layer of privacy.[5] Since private blockchains have restricted access and nodes must be specifically selected to view and participate in a network, some argue that private blockchains grant more privacy to users.[9] While private blockchains are being deemed as the most realistic way to adopt blockchain technology into business models in order to maintain a high level of privacy, private blockchains also have cons.[8] For example, private blockchains delegate specific actors to verify blocks and transactions.[11] Although some argue that this provides efficiency and security, concerns have risen that in nature, private blockchains are not truly decentralized because the verification of transactions and control are put back into the hands of a central entity.[11]
Hybrid blockchains
Hybrid blockchains allow more flexibility to determine what data remains private and what data can be permitted to be shared publicly.[12] A hybrid approach is compliant with GDPR and allows entities to store data on clouds of their choice, in the region that is needed to be in compliance with local laws to protect peoples privacy. A hybrid blockchain contains characteristics of both private and public blockchains. Not every hybrid blockchain contains the same characteristics, as much as Bitcoin and Ethereum don't share the same characteristics, even though they are both public blockchains. Interchain[13] allows to keep sensitive business logic private, while also having control over what data is hosted on community run nodes and additional public blockchains. It can simply be the hash of the transactions to leverage Bitcoin its hash power and decentralized nature. Or, if explicitly permissioned, any other data such as a transparent overview of donations and what the funds are being used for. Other examples include decentralized authentication that provides autonomy over data. And more importantly, who may access it.
Use cases for privacy protection
Financial transactions
After Satoshi Nakamoto spurred the creation of blockchain technology through Bitcoin (the most well-known blockchain application), cryptocurrencies rose in popularity and prevalence.[8] Cryptocurrencies are digital assets that can be used as an alternative form of payment to typical fiat.[1] In our current financial systems, however, there exists many privacy concerns and threats.[8] A large hurdle in typical data-storage systems is centralization.[8] Currently, when individuals deposit money, a third party intermediary is necessary.[8] When sending money to another user, individuals must put trust in the fact that a third party will complete this task.[8] However, blockchain decreases the need for this trust in a central authority; rather, cryptographic functions allow individuals to directly send money to other users.[8] Because of Bitcoin's widespread recognition and sense of anonymity, criminals have used this to their advantage by purchasing illegal items using Bitcoin.[14] Through the use of cryptocurrencies and its pseudonymous keys that signify transactions, illegal purchases are difficult to trace and pin to a singular individual.[14] Due to the known potential and security that lies in blockchains, many banks are making steps in adopting business models that embrace and utilize the technology.[8]
Health care records
In recent years, more than 100 million health care records have been breached.[5] However, in attempts to combat this prevailing issue of data breaching, attempted solutions often result in the inaccessibility of health records.[6] A large part of this struggle is due to the fact that health providers regularly send data to other providers regarding a specific patient.[5] Furthermore, this passing of data between providers often results in mishandling data, losing records, or passing on inaccurate and old data.[5] Additionally, in some cases, only one copy of an updated health record exists; this can result in the loss of important information.[6] On top of these concerns, health records often contain highly personal information, spanning from patient names, social security numbers, and home addresses.[6] Overall, it is argued by some that the current system of transferring health information compromises patient privacy in order to make records easy to transfer.[6]
As blockchain technology has expanded and developed in recent years, many have pressed to shift health record storage onto the blockchain.[6] Rather than having both physical and electronic copies of records, blockchains could allow the shift to solely electronic health records, or EHRs.[6] Through placing medical records on the blockchain, health information would then be in the control of the patient rather than a third party, through the patient's having a private and public key.[6] Using this technology, patients could then control who has access to their health records, making transferring information less cumbersome.[6] Additionally, because blockchain ledgers are immutable, health information could not be deleted or tampered with.[6] Blockchain transactions, or updated to said health record, would be accompanied by a timestamp, allowing for those with access to have updated information and a clear sense of when particular things occurred in a patient's health history.[6]
Legal
Another popular use case that protects the privacy of individuals is notarization of legal documents.[8] Currently, documents must be verified through a third party, or notary.[8] This poses roadblocks, as notarization fees can be high.[8] Additionally, transferring documents takes time and can lead to lost or mishandled information.[8] Similar to healthcare records, many are pressing for the adoption of blockchain technology in regards to the storage legal documents.[8] This way, documents cannot be tampered with and can be easily accessed by those who are granted permission to such documents.[8] As a result, individual information is then protected from possible stolen information and mishandling of private information.[14] Another potential adoption of blockchain technology is the execution of legal contracts using smart contracts.[14] Smart contracts are a popular application of the blockchain network in which nodes automatically execute terms of a contract.[14] By using smart contracts, people will no longer have to rely on a third party to manage contracts, allowing for an increase in privacy regarding personal information.[14]
Legality of blockchain and privacy
GDPR
With the recent adoption of the General Data Protection Regulation in the European Union, questions have arisen regarding blockchain's compliance with the act.[15] In short, GDPR is a piece of data privacy legislation that was enacted to protect EU citizens from data breaches.[15] This piece of legislation applies to those who both process data in the EU as well as those who process data outside the EU for people in the EU.[15] However, personal data (as defined by the GDPR) is "any information relating to an identified or identifiable natural person".[15] Because identities on a blockchain are associated with an individual's public and private key, it comes in question whether or not this falls under the category of personal data, since public and private keys enable complete pseudonymity and are not necessarily connected to a specific identity.[15] Additionally, a key part of the GDPR lies in a citizen's right to be forgotten, otherwise known as data erasure.[15] This piece of the GDPR allows individuals to request that data associated with them to be erased if it is no longer relevant, along with other conditions.[15] Due to the blockchain's nature of immutability, there exists potential complications if an individual who made transactions on the blockchain requests their data to be deleted.[15] Additionally, another roadblock lies in the fact that once a block is verified on the blockchain, it is immutable, or impossible to delete.[8]
IRS
Because cryptocurrency prices fluctuate, many treat the purchase of cryptocurrencies as an investment. By purchasing these coins at particular prices, buyers hope that they can later sell them at a higher price, furthermore making a profit. However, the IRS, or International Revenue Service, are currently facing struggles due to the fact that many people do not include revenue made by cryptocurrencies in their income reports.[16] In response to these concerns, the IRS issued a notice, announcing that people must apply general tax principles to cryptocurrency and treat the purchase of cryptocurrency as an investment or stock.[16] Furthermore, the IRS has enacted that, if people fail to report their income from cryptocurrency, they could be subject to civil penalties and fines.[16] In attempts to strictly enforce these rules and avoid potential tax fraud, the IRS has called on Coinbase to report users that have sent or received more than $20,000 worth of cryptocurrency in a singular year.[16] However, the nature of blockchain technology makes these enforcements rather difficult.[16] Because blockchains are decentralized, singular, all-powerful entities cannot keep track of purchases and activity of a user.[16] Additionally, pseudonymous addresses make it difficult to tie identities with users, ultimately being a perfect outlet for people to launder money.[16]
Blockchain Alliance
Because virtual currencies and the blockchain's protection of identity has proven to be a hub for criminal purchases and activity, the FBI and Justice Department created the Blockchain Alliance.[14] This team, which is made up of law enforcement agencies, aims to identify and enforce legal restrictions on the blockchain to combat such activity through open dialogue on a private-public forum.[14] This allows such leaders in the law enforcement industry to work together to fight against these illegal exploitations of the technology.[14] Examples of criminal activity on the blockchain include hacking cryptocurrency wallets and stealing funds.[2] However, since user identities are not tied to public addresses, it is extremely hard to locate and identify particular criminals and robbers.[2]
Fair information practices
Importantly, blockchain has been acknowledged as a way to solve Fair Information Practices, which are a set of principles relating to privacy practices and concerns for users in modern technology.[5] Specifically, blockchain transactions allow for users to control their data through private and public keys, allowing them to own it themselves completely.[5] This way, third-party intermediaries are not allowed to misuse and obtain data in unsuspecting ways.[5] Additionally, if personal data is stored on the blockchain, owners of such data are able to control when and how a third party can access said data. In blockchains, ledgers automatically include an audit trail. This ensures that transactions accurate.[5]
Concerns regarding blockchain privacy
Transparency
Although many push for the adoption of blockchain technology because it allows users to control their own data and get rid of third parties, some believe that certain characteristics of this technology infringe on user privacy.[17] Because blockchains are decentralized and allow for any node to access transactions, events and actions of users are completely transparent.[17] Additionally, skeptics worry that malicious users can trace public keys and addresses (which is a way to represent sender and receivers, although made up of random numbers and letters) back to specific users. If this were the case, then a user's transaction history would be completely viewable and accessible to anyone, resulting in what some consider to be a lack of privacy.[17]
Decentralization
Another concern lies in the fact that, due to blockchain's decentralized nature, a central authority is not surveilling for malicious users and attacks.[17] This creates a concern that users might be able to hack the system anonymously and escape unscathed.[17] Because public blockchains are not controlled by an all-powerful third party, a false transaction enacted by a hacker that has a user's private key cannot be stopped.[2] Additionally, because blockchain ledgers are shared and immutable, it is not possible to simply undo or reverse a malicious transaction.[2]
Private keys
As previously stated, private keys essentially provide a way to prove ownership and control of cryptocurrency.[2] If someone simply has access to another user's private key, he/she are able to access and spend these funds.[2] Because private keys are crucial to accessing and protecting assets on the blockchain, users must store the private key safely.[2] Many have run into problems with this, as storing it on a computer, flashdrive, or phone can propose potential security risks if stolen or hacked.[2] Additionally, if a device is misplaced or lost that contains a user's private key, they no longer have access to their cryptocurrency.[2] This creates issues of storage, as placing physical place (such as on a piece of paper in a lock) can be stolen and placing it online can be hacked or lost.[2]
Cases of privacy failure
MtGox
In 2014, MtGox was the world's largest Bitcoin exchange at the time located in Tokyo, Japan.[18] However, the exchange suffered from the largest blockchain hack of all time.[18] During the year of 2014, MtGox held an enormous portion of the Bitcoin market, accounting for more than half of the cryptocurrency at the time.[18] Throughout the month of February, hackers infiltrated the exchange, stealing what amounted to 450 million dollars in Bitcoin.[18] Many in the blockchain community were shocked at the time, as blockchain technology is often associated with security and this was the first major hack to occur in the space.[2] Although analysts were able to track the public address of the robbers by looking at the public record of transactions, the person (or people) who committed the heist were not identified.[2] This is a direct result of the pseudonymity of blockchain transactions.[2]
DAO Hack
While blockchain technology is anticipated to solve privacy issues such as data breaching, tampering, and other threats, it is not immune to malicious attacks. In 2016, the DAO opened up a funding window for a particular project.[5] Within this period of time, the system was hacked, resulting in the loss of what was (at the time) 3.6 million from the Ether fund.[5] However, due to the ever-changing price of cryptocurrencies, the amount stolen has been estimated at a whopping 64-100 million dollars.[5]
Coinbase
Coinbase—the world's largest cryptocurrency exchange that allows users to store, buy, and sell cryptocurrency—has faced a multitude of hacks since its founding in 2012.[2] Users have reported that due to its log-in process that verifies login through personal phone numbers and email addresses, hackers have targeted the numbers and emails of well-known individuals and CEOS in the blockchain space.[2] Hackers then used the emails of these individuals to change their verification number, consequently stealing thousands of dollars worth of cryptocurrency from Coinbase user wallets.[2]
References
- ^ a b c d e f "BlockChain Technology: Beyond Bitcoin" (PDF).
{{cite web}}: Cite has empty unknown parameter:|dead-url=(help) - ^ a b c d e f g h i j k l m n o p q Wieczner, Jen (2017). "The 21St-Century Bank Robbery". Fortune. 176 (3): 34–41.
- ^ "Blockchain - What it is, and a non-financial use case" (PDF).
{{cite web}}: Cite has empty unknown parameter:|dead-url=(help) - ^ "Blockchain - What it is, and a non-financial use case" (PDF).
{{cite web}}: Cite has empty unknown parameter:|dead-url=(help) - ^ a b c d e f g h i j k l m n o p q r "Blockchain's roles in strengthening cybersecurity and protecting privacy" (PDF).
{{cite web}}: Cite has empty unknown parameter:|dead-url=(help) - ^ a b c d e f g h i j k l Dagher, Gaby G.; et al. (2018). "Ancile: Privacy-Preserving Framework for Access Control and Interoperability of Electronic Health Records Using Blockchain Technology". Sustainable Cities and Society.
- ^ a b c d e f g h i j k l m n o p q r s t u Joshi (2018). "A Survey on Security and Privacy Issues of Blockchain Technology". Mathematical Foundations of Computing.
- ^ a b c d e f g h i j k l m n o p q r s t u v w x Crosby, Michael; et al. (2016). "Blockchain Technology: Beyond Bitcoin". Applied Innovation Review.
- ^ a b c d Guegan, Dominique (2017). "Public Blockchain versus Private blockhain". Documents de travail du Centre d’Economie de la Sorbonne.
- ^ a b c d e f g Wang, Yunsen. "Designing Confidentiality-Preserving Blockchain-Based Transaction Processing Systems". International Journal of Accounting Information Systems.
- ^ a b Joshi, Archana (2018). "A Survey on Security and Privacy Issues of Blockchain Technology".
{{cite journal}}: Cite journal requires|journal=(help) - ^ Are blockchains compatible with data privacy law?
- ^ Awarded U.S. Interchain™ Patent
- ^ a b c d e f g h i Suzuki, Bryce (2018). "Blockchain: How It Will Change Your Legal Practice". The Computer and Internet Lawyer.
- ^ a b c d e f g h Berberich, M. "Blockchain Technology and the GDPR: How to Reconcile Privacy and Distributed Ledgers". European Data Protection Law Review.
- ^ a b c d e f g Heroux, Mark (October 2018). "Cryptocurrency: Compliance challenges and IRS enforcement". Tax Adviser.
- ^ a b c d e Primavera De Filippi (2018). "The Interplay between Decentralization and Privacy: The Case of Blockchain Technologies". Journal of Peer Production.
- ^ a b c d Li, X (2017). "A survey on the security of blockchain systems". Future Generation of Computer Systems.