NFTs Are a Privacy and Security Nightmare

VENMO’S BAFFLING DECISION to turn payments into a social media feed, where public transactions are the default, has rightly been met with criticism. But at the very least, it’s always been possible to make Venmo transactions private. Now, imagine a financial system that’s not just public by default, but can’t ever be made private, and nothing can ever be removed or deleted.

That’s how crypto works. And for years, it’s been too seldom recognized as an issue—in large part because systems like Bitcoin, Ethereum, and other crypto platforms are technically “anonymous.” More specifically, unlike a bank or financial app, you don’t have to attach your real name, address, or other identifying information to a wallet. Sure, everyone can see what a random wallet is doing, but they don’t necessarily know who is doing it.

NFTs, however, radically undermine this already tenuous anonymity.

Public Blockchains Are Low-Privacy Environments

With any new technology, one supposedly beneficial trait often comes at the expense of another. For example, one way to describe an immutable blockchain that contains a public record of every transaction is that it’s a transparent way to maintain accurate records.

Another way to describe it is as a low-privacy environment that gives, among others, law enforcement access to the transaction history of the entire network—as was the case when the US Department of Justice arrested two individuals accused of stealing $4.5 billion worth of cryptocurrency. Said assistant attorney general Kenneth A. Polite Jr. at the time, “Today, federal law enforcement demonstrates once again that we can follow money through the blockchain.”

Crypto wallets may be pseudonymous, but many exchanges have Know Your Customer protocols and collect tons of other data on users. Moreover, transactions necessarily require sharing your wallet with another party. As software engineer Molly White wrote, once someone knows your wallet address, privacy can be difficult, if not impossible to maintain: “Imagine if, when you Venmoed your Tinder date for your half of the meal, they could now see every other transaction you’d ever made—and not just on Venmo, but the ones you made with your credit card, bank transfer, or other apps, and with no option to set the visibility of the transfer to ‘private.’”

The primary way to combat this public scrutiny is with obfuscation methods like using unique wallets for each transaction, or employing a tumbler or mixer service. The latter combines many people’s money into one pool and then redistributes it so as to obscure which money is going where. While this process itself isn’t inherently illegal or even suspicious, you’d be forgiven for thinking it sounds a bit like money laundering, because sometimes it’s used for exactly that.

These techniques are by no means foolproof, but even if they were, it’s a cumbersome layer of work that simply doesn’t scale. An obsessed crypto investor with plenty of time on his hands might learn how to manage a dozen crypto wallets, a wallet manager, a mixer, and every other tool needed to stay anonymous. But that’s work the average person simply can’t be expected to do on their own.

NFTs Shatter the Illusion of Privacy Entirely

A key component to keeping crypto activity anonymous is to avoid tying transactions to any identifying information. Which means NFTs, by their nature, can fundamentally undermine this goal. The idea behind NFTs is that they are fundamentally unique, identifiable tokens. And while they don’t work quite the way advocates say they do, it’s still technically true that no individual NFT can be duplicated.

This means that, if a user ties an NFT to any part of their online or IRL identity—say by using an NFT as a profile picture on Twitter or maintaining a profile on an NFT marketplace—it becomes trivially easy to find out what else their wallet has been up to.

This doesn’t even require…

Read The Full Article at WIRED