Realism vs. Idealism: Privacy Pools and the Fight for DeFi's Future | Zak Cole | Ameen Soleimani

so finsen has actually issued a proposal just this October trying to address what they think is a serious issue that comes from mixers however the government as always misapprehends how the underlying technology works and they resulted with a proposal that would Encompass day-to-day transactions on the blockchain including for example single use wallets compartmentalization that was talked on the stage before any type of pulling of funds and I think one of the solutions that the industry is proposing and the government is of course completely oblivious to is privacy pools can you guys talk a little bit about how privacy pools would kind of ease the tension between Athos of blockchain and privacy and anonymity and Regulatory concerns that have to do with Bad actors using blockchain and its ethos to perpetrate financial crimes um yeah I mean uh I think there's a history of governments being confused about new encryption technology dating back to when they tried to ban https and then later mandated https to be used on all government websites I don't think this is going to be much different than that because they know that they can't secure all of our data and so there's dangers to having these giant data honeypots and uh it doesn't make sense that on a blockchain I would be forced to you know like nobody puts their venmo on public right we all like make fun of people who do that so uh there's no reason why I should have to do that on a blockchain uh and so I think that if we can accomplish the goals of The Regulators which is that they don't want you know legitimate uh users who are deposit depositing their funds to be associated with uh illicit funds then there might be a way to get the best of both worlds where you get privacy for the legitimate users where without um but helping isolate the illicit funds yeah and privacy is a human right um your bank account isn't public by default um you should have the right to share what data you'd like to share with the world um that should be optional um so yeah and I think one of the arguments that are now being heard in DC and are so infuriating is that suddenly because you're a blockchain user you don't have any of your constitutional rights anymore you live in the US and suddenly you're supposed to be disclosing every part of your transactions and every part of your day-to-day life despite that even within the Community when the Privacy pool paper came out you guys did face a little bit of criticism from supporters of more Anarchist views I would say why do you think that is and how do you address that I think part of the reason is because they don't want to update their systems to incorporate new uh ways of allowing users to have more sovereignty over their own privacy um like privacy pools lets you do so for example you know I don't want to associate with the funds from a hacker who hacked my friend's defi protocol but if I don't have the option of dissociating publicly then I'm sort of forced into that and so uh I think there there's some natural tension there because uh maybe they think oh well it's better for the world if everybody's forced into associating with everybody uh and I don't really agree I think given the preference I would choose to not associate with the terrorists or you know irgc or people who hack my friends or what have you uh and that just requires building a slightly better compliance system into these privacy tools and at the same time privacy pools are designed in a way that essentially you opposed any type of disclosure to centralized Authority correct still you would have safeguards that would then allow a government now or 100 years from now or nine months from now to be able to exploit that data yeah so the way the Privacy pool's smart contract and protocol is designed is that uh it doesn't have any sort of centralized access uh or uh admin keys or you know prep like preferences for specific governments uh so it doesn't collect any of this information you basically decide as a user uh who are the other deposits that I'm willing to associate with and not uh if the services that provide those lists collect data that's you know you're choosing to use those Services it's not necessarily one group that's getting all of the data and I think one of the most interesting aspects of these systems is the way that they promote scalability of Defi and they also promote uh practical aspects of how these could be used and how they could promote broader use Zach you want to tell us a little bit about that yeah so I think in order to scale Defi and kind of uh bring it to a broader Market that's outside of just like retail and like DG and everybody here we need to provide uh like a better atmosphere for institutions uh like hedge funds Banks any organization that needs to follow particular guidelines uh to participate in a healthy way um so what privacy pools does is it essentially allows um uh those who are participating in these liquidity pools to uh know for certain that they're not co-mingling assets um who they're participating with and uh I think that's going to be a pretty big thing for this like next wave in the market and do you see that there is also or there could be an intersection between blockchain and trafi that for example a Traditional Bank could use privacy pools yes it would be a very different type of privacy pool which be limited to their customer customers but it could still be used by them and protect privacy even more yeah absolutely I think that all of traditional Finance is going to be uh on ethereum within the next 5 to 10 years and I think we're building towards that I look at the ETF now so what's it going to look like in the next 5 years I think that we need systems like this in place in order to create that atmosphere that enables that uh broader participation yeah and like there's practical examples where it can be useful today so when I withdraw from Kraken for example it says you know Kraken 3 to my address right uh you can imagine a privacy pool amongst exchanges that would OB fisc which specific exchange I have a relationship with so that you know somebody trying to get my data doesn't know who which exchange to call up and bribe in order to get the information uh Banks uh especially banks in Switzerland who have an enlightened view about privacy unlike the American surveillance State bankers want to uh promote the you know they also want to participate in defi without revealing their Competitive Edge so that's another use case for them where they just want that uh in order to scale up defi or even more practically like payroll this is really the best one yeah or or sending my overlooked sending my mistress some money I wouldn't know anything about that not that I know I don't know anything about that either love my wife privacy privacy is a right you know it's we're not going to judge on how someone uses it and part of the issue with what finson is doing and what and the way government is still viewing AML and kyc procedures is that in the future these are not going to work the way they work today and we're looking into Alternatives in how you can implement this procedure and do you see privacy pools and similar systems or something like Oxbo is doing in being able to facilitate something that works more efficiently and taking into account these concerns yeah definitely uh Oxo is our compliance solution for privacy pools monitoring all of the deposits and providing you know a judgment on whether or not we think it's acceptable for them to join our association set which would then be all of the users who withdraw and are part of that Association set would be associating with and so uh we're doing pretty rigorous wallet analysis that goes beyond kyc and kyc is basically going to be broken in the next year it's already getting broken like people are generating AI you know wallet IDs and stuff and it's not going to work as well and even if you get past the kyc of the system you still want to trace it back and be like oh actually this does come from this defi hack I don't care who you are uh I care that your money isn't illicit and so I think it's going to be even more important in the future yes I I think this is going to kind of uh hopefully take the place of kyc to some extent um you don't really need to prove who you are I don't need to know your name necessarily I just need to know that you're not a sanctioned individual you're not a North Korean you're not some Baddie out there that's trying to do something weird yeah exclusion what do you see as the weaknesses of of privacy pools like we have inclusion delays you do need intermediaries what do you see as one of the creators as the gaps that you want to see filled in the future sure like our original privacy pools demo was a pointand click and so you'd see all of the other deposits and you have to be like you know I'm not this guy not this guy not this guy and so that's not really a scalable solution uh for priv something like privacy pools to work at scale it does require this uh data analytics role which can do the monitoring to to make the lists right um that's one maybe you know weakness of the system in the future it would be cool if everybody had access to their own personal you know uh monitoring systems that that scaled but uh I don't see that happening just yet uh she mentioned the the time delays so one of the ways that you know privacy pool would be used is for when you know when somebody deposits they're not immediately added to the association set there's there's a delay we're thinking 3 days a week you know hopefully less but something like that to give us time to do the retroactive tracing of the funds and in order to you know make sure that the system doesn't allow elicit funds in and one of the issues that I think the paper touches upon and I think everyone is interested in is how do you defend against malicious ASP and that's kind of built into to the ethos of the system you want to explain that a little bit um like people improperly being like rejected from the yeah I mean ideally you don't want like the CIA guy's girlfriend to be like excluded because he hates her or something uh and so you would want to have a system that has some internal checks and balances unfortunately this isn't something that you can really make public because there's a lot of you know private information involved in the judgments but uh having multiple stakeholders who have you know transparency and and uh into the you know decisions that are made around the judgments and for what reasons people are rejected and accepted uh would be helpful to mitigating any personal you know attacks you might be able to implement some sort of social consensus as well if you're in enough Association sets you can essentially attest to the your peers within that Association set and the more Association sets you're in that kind of adds some degree of hardness to the identity and associating that identity with like one of the good guys or not being one of the bad guys do you guys want to talk a little bit more about Oxo what you're working on now how will this develop and what you're hoping to achieve yeah sure uh Oxo so we're right now we're uh one of the we're the first Association at provider so that's essentially vetting all of those lists and making sure that uh uh there aren't any addresses present within that Association set that are uh uh sanctioned entities or um hackers just general bad guys people that are exploiting things within the system that we're aware of um so that might extend to additional tooling that allows other users to create their own Association sets uh for now we're just information provider so um but we plan on scaling and doing a lot more stuff within the Privacy stack okay and I think I mean you mentioned that you have been trying to work with The Regulators educate the government on how this will work I will emphasize that this is critical like we were in DC yesterday meeting with different Senate staff and like the ignorance is just enraging one of the questions that the Warren staff asked was well there's no way to combat mixers so we need the report of every single transaction which you don't have with banks by the way as you just said so I think it's really important do have you seen any progress when you're talking to them do you see that there is actually like a way to work with them yeah I think something people should realize is that something like privacy pools on one single axis is actually the best thing on the planet uh you can't go in a bank today and withdraw from the bank and publicly prove that you're not the illicit deposits that went into the bank you can't do that with coinbase you can't do that with any other system ever except something like privacy pools uh obviously it doesn't do everything else a bank does but on that one axis it's better and so I think coming from the position of uh teaching them about the new compliance opportunities is help because they think you know every mixer is the same or you know I hate using that word but uh you have to educate them out it's not even really a mixer right yeah I don't think it's even a mixer really yeah uh and so um they've been receptive uh it's not super evenly distributed who's receptive right there's uh Swiss Central Bankers who I believe are uniquely enlightened because uh one of them proposed that that uh privacy from the Central Bank itself for the users it should be a feature that benefits the users that's not something you'll hear very often in America but I think that that helps legitimize uh privacy as a useful thing right they're concerned about honeypots they don't want to have to deal with all the data they get hacked they reveal all the stuff that's a security threat so um for them it's much better if if they have ways of Pres preserving people's privacy and how do you do that well you use the same zero knowledge proof systems that we've been building and iterating on and so they were you know when I went to uh the bosil uh University with Fabian and presented the stuff uh they were very interested he's been continuing to educate them I went to a regulatory conference in Philadelphia where I presented the Privacy pools paper to I don't know cftc finen SEC doj people and that was also helpful obviously they have concerns but we're still being able to make some progress on educating them about the opportunities for compliance and it's important because we didn't even really know this stuff was possible right so like it was only after the tornado cach sanctions that we started you know tried to figure out this problem of how do we you know publicly dissociate from these ilicit funds and realize that there is this compliance opportunity and the reason that we went uh move so fast to try and write this paper with Fabian about it uh was because he was providing recommendations to The Regulators about what the law should be around privacy and so we thought it was very important that they all understand what the total you know playing field of compliance opportunities are before they make all of the laws and I think it's really really important I can't emphasize that enough to change The Regulators perspective of the industry and most of the times we talk to them and we're trying to say we want to be regulated we want to be compliant you guys are not even trying to work with us and perspectives like this one and proposals like this one shows that the industry wants to exclude Bad actors and is actually actively trying to find Solutions rather than say oh everyone in the industry is the same we never want to comply with the laws we don't care if we work with North Korea which is fundamentally untrue and it's being used by politicians and certain Regulators in order to pay in the industry a certain way to promote their own Financial interests and their own political interest so I think what you're doing both of you is incredibly important if you have any final thoughts on privacy pools or anything else you'd like uh one way I'm kind of thinking about it is like SSL for money markets and that's kind of like a pretty simple uh explanation I don't know yeah SSL which was banned by by the government and then mandated to be used and that's what enables online banking yeah so what's the next Generation going to look like I think it's going to look a lot like this yeah check out uh privacy pools.com and uh oo. spelled with a zerox okay let's see what will be next year this time of year yeah we we'll talk about it here next year hopefully you all join us again thank you thank you