Pith. sign in

REVIEW 4 major objections 6 minor 40 references

Hello, won't you tell me your name?: Investigating Anonymity Abuse in IPFS

T0 review · 4 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that IPFS pinning services and public gateways provide no effective checks against malicious content, letting attackers anonymously upload and keep malware and phishing pages online.

desk verdict A useful measurement study with real code, but the headline claim overreaches for gateways given the paper's own admission that Bad Bits is enforced on Protocol Labs gateways. read the letter →

arxiv 2506.04307 v1 pith:D2YILXO5 submitted 2025-06-04 cs.CR

Christos Karapapas , Iakovos Pittaras , George C. Polyzos , Constantinos Patsakis This is my paper
classification cs.CR
keywords IPFSAnonymityPinningServicesPublicGatewaysMalwareDistributionKYCBypassBadBitsDenylistWeb3Security
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that IPFS, a decentralized file-sharing system, currently offers a practical anonymous hosting channel for malicious content. The authors show that popular pinning services accept accounts from temporary email addresses or cryptocurrency wallets, and accept both a simulated antivirus-flagged executable and a legacy WannaCry sample without any content check. They also show that public gateways cache uploaded files and can keep them reachable for days after the uploader disconnects, turning the cache into a de facto pinning service. Finally, they report live evidence that CIDs listed on the Bad Bits denylist, including phishing pages, were advertised by major pinning services within a single 24-hour window. If these findings hold, IPFS and its ecosystem currently give attackers persistent and hard-to-takedown content availability with weak attribution.

What carries the argument

The argument runs on the lifecycle of a CID (content identifier) in IPFS: content-addressed files are pinned by remote providers, then served through HTTP gateways that cache by least-recently-used (LRU) policy. The paper combines four instruments: temporary-email and crypto-wallet registration to bypass KYC; VirusTotal-flagged but benign executables and a legacy WannaCry sample to test content screening; repeated HTTP requests to public gateways to keep files in their LRU caches; and the ipni-cli indexer to collect CIDs from providers' advertisements, matched against the Bad Bits Denylist. The Bad Bits Denylist is the named mechanism Protocol Labs maintains to block undesirable content, but it is enforced only on Protocol Labs gateways and advisory elsewhere; the paper also notes that changing the chunking size when adding a file produces a different CID that bypasses the list.

What would settle it

Upload a diverse batch of known-malicious files, for example several dozen VirusTotal-flagged executables and current malware families, to each pinning service and monitor whether any are rejected, quarantined, or reported; if a substantial share are blocked, the claim that providers lack content-assessment mechanisms collapses. Similarly, repeat the gateway-cache experiment with continuous high-volume traffic and compare eviction times; if files are evicted within hours under realistic load, the public-gateway-as-pseudo-pinning attack would not sustain persistence as claimed.

Watch

Extended reading notes

Core claim

The central claim is that the combination of weak KYC practices at pinning services and the caching behavior of public gateways lets an attacker distribute malicious content on IPFS persistently and anonymously. Registration tests found that Pinata and Fleek accepted the first temporary email, Filebase accepted on the fourth attempt, 4EVERLAND required only a crypto wallet, and Web3.Storage required a payment account for uploads; Tor access preserved the attacker's IP anonymity. Upload tests found that every tested service accepted the simulated malware and the WannaCry sample and made them immediately retrievable through public gateways, indicating no content scanning or restriction. Gateway tests found that after one hour, six hours, twelve hours, or twenty-four hours of requested popularity, files remained cached beyond sixteen hours on three of five gateways and the authors could keep them alive by periodic requests. A 24-hour IPNI-based collection recovered over two million CIDs advertised by Pinata, Filebase, and Fleek, five of which were on the Bad Bits denylist, with three retrievable samples identified as phishing or malicious content.

Load-bearing premise

The conclusion that pinning services and gateways have no content-screening or restriction mechanisms rests on a small test set: one simulated AV-flagged executable per service, one legacy WannaCry sample, five gateways, and a 24-hour observation window; if providers actually scan but miss these particular samples, or if gateway caches behave differently under realistic traffic, the general claim would not follow.

Editorial extensions

If this is right

  • An attacker can create anonymous accounts on major pinning services with a disposable email or a fresh crypto wallet and upload malicious binaries that remain pinned and immediately accessible through public gateways.
  • Even without a pinning service, an attacker can upload from a short-lived node, generate traffic to fill public gateway caches, and then refresh the caches periodically to keep the content online.
  • DMCA-compliant removal by one pinning service does not delete content from IPFS; the file stays available through other gateways and nodes, which matters for double-extortion ransomware scenarios.
  • The Bad Bits Denylist provides only partial mitigation because not all gateways enforce it and because re-chunking content yields a new CID that escapes the list.
  • Stricter KYC, content scanning, and universal denylist enforcement at gateways would reduce, but not eliminate, this abuse because the underlying protocol has no deletion mechanism.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The 24-hour indexer snapshot likely undercounts abuse, because ipni random samples from the most recent advertisement and only three providers were monitored; a longer or wider collection would probably find more denylisted and novel malicious CIDs.
  • The same gateway-cache trick should transfer to other content-addressable storage systems with HTTP gateways and LRU caches, so the finding is a general property of the bridge design rather than an IPFS implementation detail.
  • A concrete next test would be uploading a larger corpus of known-malicious files to see whether any provider rejects them, which would reveal whether the observed acceptance is universal or sample-specific.
  • If regulators require gateway-level filtering or pinning-services KYC, the protocol's immutable CIDs mean the burden moves to access points, suggesting reputation systems or decentralized flagging as the only scalable responses.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper investigates how malicious actors can abuse the IPFS ecosystem for anonymous, persistent content hosting. It evaluates the registration/KYC requirements of five pinning services (Pinata, Filebase, Fleek, Web3.Storage, 4EVERLAND), uploads a simulated AV-flagged executable and a legacy WannaCry sample to test content filtering, and runs a multi-day caching experiment across five public gateways. It additionally mines IPNI advertisements from three pinning providers and reports five CIDs matching the Bad Bits Denylist, three of which were retrieved and identified as phishing or malicious content. Based on these experiments, the abstract and Section 6 claim that pinning services and public gateways lack mechanisms to assess or restrict the propagation of malicious content, allowing attackers to ensure persistent availability while masking their identities. The paper also sketches a double-extortion scenario and discusses countermeasures.

Significance. If the central claim were established at the claimed generality, the paper would be a useful, timely empirical contribution: it would quantify real abuse paths in a widely deployed decentralized storage system and would provide concrete evidence for the security community and for IPFS ecosystem operators. The authors supply reproducible code, describe their ethical safeguards in unusual detail, and combine active measurements with observational data from real provider advertisements. However, the paper's headline conclusion is a universal negative about content-screening and blocking mechanisms, and the evidence presented is too narrow to support that universal claim. The contribution remains valuable if re-scoped to the specific services, files, and gateways tested, and if the gateway claim is tested against the denylist mechanism that the paper itself acknowledges exists.

major comments (4)
  1. [§4.2, §3.1, §6] The gateway experiment tests only four freshly created, non-denylisted files per gateway and never fetches a CID that is on the Bad Bits Denylist through a gateway that enforces it. The paper itself states in §3.1 that 'some public gateways follow blocking mechanisms' and in §6 that the Bad Bits Denylist 'is enforced only on gateways managed by Protocol Labs.' Cache persistence of arbitrary files therefore cannot establish that gateways 'lack mechanisms to assess or restrict the propagation of malicious content,' because a denylisted phishing page could be blocked at the HTTP layer even while its bytes remain cached. The claim should be re-scoped to 'the tested gateways did not block these particular non-list-listed files,' or the experiment should directly probe denylisted CIDs through ipfs.io and the other gateways.
  2. [§4.1, RQ2] The inference that pinning services apply no content scanning rests on one simulated executable and one legacy WannaCry sample per service. Acceptance of these files shows that these particular samples passed, but it does not establish the absence of scanning mechanisms in general: providers may scan and miss these samples, or may scan only certain file types, or may apply post-upload checks that were not observed. The authors should either broaden the test set (more malware families, benign-but-suspicious files, known phish pages, varied file types) or soften the conclusion from 'lack mechanisms' to 'accepted the tested malicious content without detectable screening.'
  3. [§4.4, RQ4] The inference of 'organized exploitation' from five denylisted CIDs advertised by three pinning services over 24 hours lacks a baseline or statistical framing. Without knowing how many denylisted CIDs appear in comparable non-malicious or random advertisement streams, or how often benign users accidentally pin blocked content, overlap across providers cannot be distinguished from chance. The authors should either provide a baseline comparison, or present the five CIDs as anecdotal evidence rather than as a demonstration of organized abuse.
  4. [§4.2, Figure 3] The caching experiment is a single un-replicated run over approximately three days on five gateways, with no information about gateway load, cache size, or request patterns from other users during the experiment. Moreover, the paper's proposed attack of 'sustaining availability by periodically sending requests' is not directly tested: the experiment measures retention after fixed intervals (1, 6, 12, 24 hours) and does not measure whether periodic refresh requests actually prevent eviction. The authors should either replicate the experiment across multiple runs, test the refresh mechanism explicitly, or describe the current results as preliminary observations rather than a validated attack.
minor comments (6)
  1. [Table 1] The column header 'KYC T emp Mail F ree Registered DMCA' is difficult to read due to spacing; please reformat as separate columns or use clear line breaks.
  2. [§4.4] The description of standardizing CID formats for comparison with the Bad Bits Denylist omits the concrete conversion method (e.g., CIDv0 to CIDv1, case normalization); please specify the exact procedure so the matching can be reproduced.
  3. [§6, RQ5] The sentence 'a malicious actor can circumvent it by simply choosing an alternative chunking size when adding the file to IPFS (RQ5)' appears to address content filtering, not RQ5, which concerns gateway caching abuse; the research-question label seems misplaced.
  4. [Ethical considerations] The phrase 'the corresponding URLs have been siphoned' is unclear; presumably the authors mean the malware sample URLs have been sanitized or taken down, but the wording should be revised.
  5. [Figure 3] The axis label 'ratio ν5 per hour' is undefined; please define ν and explain how the ratio is computed and smoothed over time.
  6. [§4.1, Tor tests] The statement that 'the recorded IP address differed from our actual address' would be more convincing if the paper described the method used to confirm the observed IP address (e.g., a WHOIS or IP-echo check from the service's perspective).

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the empirical measurements are independent of their inputs; the paper's few self-citations are contextual and non-load-bearing.

full rationale

The paper's claimed result is an empirical measurement chain, not a formal derivation. In Section 4.1 the authors upload simulated malware and a legacy WannaCry sample to five pinning services and observe that the files are accepted and immediately accessible; in Section 4.2 they create 20 fresh files, cache them through five gateways, take the source node offline, and measure cache persistence over three days; in Section 4.4 they match CIDs advertised by three pinning services against the Bad Bits Denylist. None of these measured quantities is defined in terms of the conclusion that pinning services and public gateways lack content-restriction mechanisms, and no parameter is fitted from a subset and then reported as a prediction. The self-citations [22], [23], and [24] appear only as background or related work, for example 'a significant proportion of its nodes are operated by malicious actors [23]' and 'CyberCrime-as-a-Service scenarios [22]'; they are not load-bearing, no uniqueness theorem is imported, and the central measurements would stand without them. The one substantive concern in the manuscript is evidentiary scope, not circularity: Section 4.2 tests only freshly created files that are not on any denylist, while Sections 3.1, 4.4, and 6 acknowledge that the Bad Bits Denylist 'is enforced on the public gateways operated by Protocol Labs.' That asymmetry weakens the universal-negative claim about gateways, but it is a generalization and validity problem, not a reduction of the conclusion to its inputs. Overall circularity is minimal; the score reflects only the presence of minor non-load-bearing self-citations.

Assumptions & free parameters 0 free parameters · 4 assumptions · 0 invented entities

The paper introduces no free parameters or invented entities. Its central claims rest on domain assumptions about how IPFS gateways cache content, how maliciousness labels (VirusTotal, Bad Bits) relate to actual harm, and how IPNI advertisements reflect pinning-service content. The most fragile assumption is that the small set of test files and services is representative enough to prove the absence of content restriction mechanisms.

assumptions (4)
  • domain assumption Public gateways use LRU caching with capacity-based eviction, so periodic requests can keep a CID cached.
    The gateway attack (§4.2) relies on this caching model; the paper cites [38] for LRU but does not observe internal cache configuration or eviction policy.
  • domain assumption VirusTotal detection and Bad Bits Denylist membership are accurate proxies for 'malicious content'.
    The upload tests in §4.1 and the denylist matching in §4.4 treat these signals as ground truth for maliciousness without independent verification.
  • domain assumption IPNI advertisements from a provider address accurately reflect the CIDs pinned by that provider.
    The 24-hour enumeration in §4.4 assumes the indexer records are authentic and unspoofed.
  • ad hoc to paper A single accepted upload demonstrates the absence of content scanning mechanisms.
    The paper generalizes from one AV-flagged file per service to the conclusion that services lack scanning; this is a representativeness assumption specific to this study.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Hello, won't you tell me your name?: Investigating Anonymity Abuse in IPFS." pith.science (2026). https://pith.science/paper/D2YILXO5

@misc{pith2026250604307,
  author       = {Pith},
  title        = {Pith review of: Hello, won't you tell me your name?: Investigating Anonymity Abuse in IPFS},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/D2YILXO5}},
  note         = {Machine review of arXiv:2506.04307}
}
read the original abstract

The InterPlanetary File System~(IPFS) offers a decentralized approach to file storage and sharing, promising resilience and efficiency while also realizing the Web3 paradigm. Simultaneously, the offered anonymity raises significant questions about potential misuse. In this study, we explore methods that malicious actors can exploit IPFS to upload and disseminate harmful content while remaining anonymous. We evaluate the role of pinning services and public gateways, identifying their capabilities and limitations in maintaining content availability. Using scripts, we systematically test the behavior of these services by uploading malicious files. Our analysis reveals that pinning services and public gateways lack mechanisms to assess or restrict the propagation of malicious content.

Figures

Figures reproduced from arXiv: 2506.04307 by the authors.

Figure 1
Figure 1. The File Lifecycle In IPFS. Pinning Services IPFS, according to its design principles, does not provide a mechanism to ensure that files added to the network remain online if the original uploader deletes them or disconnects from the network. Files are primarily cached by requesters to ensure their availability to other nodes. The more popular a file is, the higher its chances of staying online for an extended perio… view at source ↗
Figure 2
Figure 2. Design of the “Pinning Service Attack” [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗
Figure 3
Figure 3. Time-Dependent File Availability Analysis. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (2 more)
Figure 4
Figure 4. Figure 4: Design of the “Public Gateway Attack”. physical address while uploading the files via the local node. As previously mentioned, this process requires minimal time, significantly reducing the exposure window for the attacker. Additionally, the attacker could perform this…
Figure 5
Figure 5. Figure 5: Design of the “Double Extortion Attack”. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

40 extracted references · 37 canonical work pages

  1. [1]

    https://pyinstaller.org/

    work page

  2. [2]

    https://www.virustotal.com/

  3. [3]

    https://github.com/ipni/ipni-cli

    ipni-cli. https://github.com/ipni/ipni-cli

    work page

  4. [4]

    https://ipfs.github.io/public-gateway-checker/

    Public gateway checker. https://ipfs.github.io/public-gateway-checker/

    work page

  5. [5]

    Web of shadows: Investigating malware abuse of internet services

    Mauro Allegretta, Giuseppe Siracusano, Roberto Gonz´ alez, Marco Gramaglia, and Juan Ca- ballero. Web of shadows: Investigating malware abuse of internet services. Computers & Security , 149:104182, 2025

    work page 2025

  6. [6]

    zklogin: Privacy-preserving blockchain au- thentication with existing credentials

    Foteini Baldimtsi, Konstantinos Kryptos Chalkias, Yan Ji, Jonas Lindstrøm, Deepak Maram, Ben Riva, Arnab Roy, Mahdi Sedaghat, and Joy Wang. zklogin: Privacy-preserving blockchain au- thentication with existing credentials. In Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security , CCS ’24, page 3182–3196, New York, NY, U...

    work page 2024

  7. [7]

    Monitoring data requests in decentralized data storage systems: A case study of IPFS

    Leonhard Balduf, Sebastian Henningsen, Martin Florian, Sebastian Rust, and Bj¨ orn Scheuermann. Monitoring data requests in decentralized data storage systems: A case study of IPFS. In 2022 IEEE 42nd International Conference on Distributed Computing Systems (ICDCS) , pages 658–668. IEEE, 2022. 11

    work page 2022

  8. [8]

    Cryptocur- rency scams: analysis and perspectives

    Massimo Bartoletti, Stefano Lande, Andrea Loddo, Livio Pompianu, and Sergio Serusi. Cryptocur- rency scams: analysis and perspectives. IEEE Access, 9:148353–148373, 2021

    work page 2021

Show all 40 references
  1. [9]

    IPFS-content Addressed, Versioned, P2P File System

    Juan Benet. IPFS-content Addressed, Versioned, P2P File System. arXiv preprint arXiv:1407.3561, 2014

    2014 arXiv

  2. [10]

    Mapping the defi crime landscape: An evidence-based picture

    Catherine Carpentier-Desjardins, Masarah Paquet-Clouston, Stefan Kitzler, and Bernhard Hasl- hofer. Mapping the defi crime landscape: An evidence-based picture. arXiv preprint arXiv:2310.04356, 2023

    2023 arXiv

  3. [11]

    IPFS and friends: A qualitative comparison of next generation peer-to-peer data networks

    Erik Daniel and Florian Tschorsch. IPFS and friends: A qualitative comparison of next generation peer-to-peer data networks. IEEE Communications Surveys & Tutorials , 24(1):31–52, 2022

    2022

  4. [12]

    Privacy-enhanced content discovery for Bitswap

    Erik Daniel and Florian Tschorsch. Privacy-enhanced content discovery for Bitswap. In 2023 IFIP Networking Conference, pages 1–9, 2023

    2023

  5. [13]

    Accelerating Content Routing with Bitswap: A multi-path file transfer protocol in IPFS and Filecoin, 2021

    Alfonso De la Rocha, David Dias, and Yiannis Psaras. Accelerating Content Routing with Bitswap: A multi-path file transfer protocol in IPFS and Filecoin, 2021

    2021

  6. [14]

    Tor: The second-generation onion router

    Roger Dingledine, Nick Mathewson, Paul F Syverson, et al. Tor: The second-generation onion router. In USENIX security symposium , volume 4, pages 303–320, 2004

    2004

  7. [15]

    Toward decentralized cloud storage with ipfs: opportunities, challenges, and future considerations

    Trinh Viet Doan, Yiannis Psaras, J¨ org Ott, and Vaibhav Bajpai. Toward decentralized cloud storage with ipfs: opportunities, challenges, and future considerations. IEEE Internet Computing , 26(6):7– 15, 2022

    2022

  8. [16]

    European Union. Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act). https://eur-lex.europa.eu/eli/reg/2022/2065/oj/eng, 2022

    2022

  9. [17]

    https://www.friend.tech/

    friend.tech/. https://www.friend.tech/

  10. [18]

    Data persistence in decentralized social appli- cations: The IPFS approach

    Barbara Guidi, Andrea Michienzi, and Laura Ricci. Data persistence in decentralized social appli- cations: The IPFS approach. In 2021 IEEE 18th Annual Consumer Communications & Networking Conference (CCNC), pages 1–4. IEEE, 2021

    2021

  11. [19]

    www.techtarget.com/whatis/feature/8-largest-IT-outages-in- history, 2024

    Grant Hatchimonji. www.techtarget.com/whatis/feature/8-largest-IT-outages-in- history, 2024

    2024

  12. [20]

    A conti ransomware attack day-by-day

    Michael Heller. A conti ransomware attack day-by-day. https://news.sophos.com/en-us/2021/ 02/16/conti-ransomware-attack-day-by-day/ , 2021

    2021

  13. [21]

    Andrew Horton. Whatweb. https://github.com/urbanadventurer/whatweb

  14. [22]

    Ransomware as a service using smart contracts and IPFS

    Christos Karapapas, Iakovos Pittaras, Nikos Fotiou, and George C Polyzos. Ransomware as a service using smart contracts and IPFS. In 2020 IEEE International Conference on Blockchain and Cryptocurrency (ICBC), pages 1–5. IEEE, 2020

    2020

  15. [23]

    Polyzos, and Constantinos Patsakis

    Christos Karapapas, George C. Polyzos, and Constantinos Patsakis. What’s Inside a Node? Mali- cious IPFS Nodes Under the Magnifying Glass. In Norbert Meyer and Anna Grocholewska-Czury lo, editors, ICT Systems Security and Privacy Protection , pages 149–162, Cham, 2024. Springe...

    2024

  16. [24]

    Enhancing IPFS privacy through triple hashing

    Thomas Katsantas, Yannis Thomas, Christos Karapapas, and George Xylomenos. Enhancing IPFS privacy through triple hashing. In 2024 IEEE Symposium on Computers and Communications (ISCC), pages 1–6, 2024

    2024

  17. [25]

    Privacy violations, security breaches and other threats of Web3 and the metaverse

    Nir Kshetri. Privacy violations, security breaches and other threats of Web3 and the metaverse. 32nd European Regional ITS Conference, Madrid 2023: Realising the digital decade in the European Union – Easier said than done? 277993, International Telecommunications Society (ITS), 2023

    2023

  18. [26]

    https://www.lockheedmartin.com/en-us/news/features/2024/smartsat- equipped-satellite-uploads-new-mission-on-orbit.html , 2024

    Lockheed Martin. https://www.lockheedmartin.com/en-us/news/features/2024/smartsat- equipped-satellite-uploads-new-mission-on-orbit.html , 2024

    2024

  19. [27]

    https://docs.metamask.io/services/reference/ipfs/

    MetaMask. https://docs.metamask.io/services/reference/ipfs/. 12

  20. [28]

    https://nft.storage/

    NFT.Storage. https://nft.storage/

  21. [29]

    Unravelling ariadne’s thread: Exploring the threats of decentralised dns

    Constantinos Patsakis, Fran Casino, Nikolaos Lykousas, and Vasilios Katos. Unravelling ariadne’s thread: Exploring the threats of decentralised dns. IEEE Access, 8:118559–118571, 2020

    2020

  22. [30]

    Del- egated content erasure in IPFS

    Eugenia Politou, Efthimios Alepis, Constantinos Patsakis, Fran Casino, and Mamoun Alazab. Del- egated content erasure in IPFS. Future Generation Computer Systems , 112:956–964, 2020

    2020

  23. [31]

    Looking Into the Eye of the Interplanetary Storm, 2020

    Silvia Pripoae. Looking Into the Eye of the Interplanetary Storm, 2020

    2020

  24. [32]

    https://www.protocol.ai/

    Protocol Labs. https://www.protocol.ai/

  25. [33]

    Bad Bits Denylist

    Protocol Labs. Bad Bits Denylist. https://badbits.dwebops.pub/

  26. [34]

    Web3 challenges and opportunities for the market

    Dan Sheridan, James Harris, Frank Wear, Jerry Cowell Jr, Easton Wong, and Abbas Yazdinejad. Web3 challenges and opportunities for the market. arXiv preprint arXiv:2209.02446 , 2022

    2022

  27. [35]

    Guardians of the galaxy: Content moderation in the interplanetary file system

    Saidu Sokoto, Leonhard Balduf, Dennis Trautwein, Yiluo Wei, Gareth Tyson, Ignacio Castro, Onur Ascigil, George Pavlou, Maciej Korczynski, Bj¨ orn Scheuermann, and Michal Kr´ ol. Guardians of the galaxy: Content moderation in the interplanetary file system. In Davide Balzarotti...

    2024

  28. [36]

    IF-DSS: A forensic investigation framework for decentralized storage services

    Jihun Son, Gyubin Kim, Hyunwoo Jung, Jewan Bang, and Jungheum Park. IF-DSS: A forensic investigation framework for decentralized storage services. Forensic Science International: Digital Investigation, 46:301611, 2023

    2023

  29. [37]

    Is your wallet snitching on you? an analysis on the privacy implications of web3

    Christof Ferreira Torres, Fiona Willi, and Shweta Shinde. Is your wallet snitching on you? an analysis on the privacy implications of web3. In Proceedings of the 32nd USENIX Conference on Security Symposium, SEC ’23, USA, 2023. USENIX Association

    2023

  30. [38]

    Design and evaluation of IPFS: a storage layer for the decentralized web

    Dennis Trautwein, Aravindh Raman, Gareth Tyson, Ignacio Castro, Will Scott, Moritz Schubotz, Bela Gipp, and Yiannis Psaras. Design and evaluation of IPFS: a storage layer for the decentralized web. In Proceedings of the ACM SIGCOMM 2022 Conference , pages 739–752, 2022

    2022

  31. [39]

    The Illusion of Anonymity: Uncovering the Impact of User Actions on Privacy in Web3 Social Ecosystems, 2024

    Bin Wang, Tianjian Liu, Wenqi Wang, Yuan Weng, Chao Li, Guangquan Xu, Meng Shen, Sencun Zhu, and Wei Wang. The Illusion of Anonymity: Uncovering the Impact of User Actions on Privacy in Web3 Social Ecosystems, 2024

    2024

  32. [40]

    Hiding in plain sight: An empirical study of web application abuse in malware

    Mingxuan Yao, Jonathan Fuller, Ranjita Pai Kasturi, Saumya Agarwal, Amit Kumar Sikder, and Brendan Saltaformaggio. Hiding in plain sight: An empirical study of web application abuse in malware. In 32nd USENIX Security Symposium (USENIX Security 23) , pages 6115–6132, 2023. 13

    2023

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.