The Future of Privacy in Web3 | European Blockchain Convention

foreign [Music] right welcome everybody uh before we get stuck into this um just want to put a shout out for anybody that's based in Barcelona um to come to the web free family events on every Wednesday at say something gallery and uh sometimes it's privacy focused sometimes it's more about governance and that kind of thing but um yeah and uh I'm joined by these uh uncommonly Attractive people today to talk about privacy in web free it's often um overlooked and we talk about this trilemma of decentralization security um and scalability but nobody's really until now solving the problems of privacy so uh so yeah um guys you want to introduce yourself and tell us a little bit how how you're solving this problem all right I can start from my side my name is Oscars fsis I'm a co-founder of alter Network we've been developing safe and private communication platform on secret Network so we're using programmable smart contracts there as well we are giving uh our end user the so-called encryption key to generate on their device as well to decrypt and encrypt everything on their device so nothing is passing through our Network and also our servers so basically everything that is being done on our platform is also completely private we don't ask any information about your personal details so you can be completely Anonymous our website also doesn't use any kind of like trackers cookies so if you really want to have Anonymous messaging and also a protocol to use for your also team and productivity to replace slack it's also possible um that's about myself hello everyone can you hear me all right yeah yeah uh so my name is Jaya and I work for a project called Nim and I'm also severely jet lagged and it's the end of the day on Friday so bear with me I'll try and kind of be as energetic as I possibly can um so Nim is uh is a project that provides something called Network layer privacy um so if you kind of imagine the internet and you imagine data packets you know traveling all across the internet those data packets even when they're encrypted are visible to see so people even even though they can't you know some an observer cannot look at the content of the actual data packets the uh the patterns of communication reveals a lot in and of itself um in other words the metadata of communication reveals in fact many times more than the content itself also because metadata is is very easy for machines to read which means that machine learning driven surveillance can make a lot out of of observing networks in this kind of a way so what Nim primarily provides is something called a mixnet which takes those data packets mixes them through three different layers of mixed nodes and also kind of encrypts each packet in several layers of something called a sphinx encryption so it makes all the data packets look exactly the same so someone that's actually looking at all this kind of pattern of communication you know they just they cannot suss out any any patterns so yeah what we provide is essentially Network layer privacy um across you know any type of application or wallet and we're kind of web2 or web3 agnostic in that sense cool thanks um so hi I'm Fraser um CEO of checked where we're building uh basically payment infrastructure for a paradigm called self-sovereign ID decentralizer the self-managed ID or last year buzzword came out which was web five but the whole idea is individuals having control and ownership of their data um and basically just just having that utility that portability and we're very focused on enabling payments enabling the commercial side of that so the organizations with data silos release that data to individuals instead of the status quo right now as we heard on quite a few panels across these two days and the other side of things that we're working on now is decentralized reputation so the idea that you don't necessarily need to know someone's identity in terms of like their passport or their name uh or their driving license what you really need to know about them is can I trust this person within this interaction and that's it um and the final thing to say on unchecked is where one of the 10 startups pitching at five or ten past five um so if you see me run off stage it's because the bat Signal's gone and I have to ditch the panel to go and Pitch downstairs and not go this not go through the service elevators because I found out they don't go downstairs which yeah so it's a long way around good luck thanks so uh so yeah guys um why is why is privacy important in uh in in in blockchain why why does it matter I give a factor I think there's been like this historic it's almost been a bit of a wave that we've seen this time around but like historically in crypto web 3 like a lot of stuff has been put on Ledger like a lot and I think people are starting to realize that that is not necessarily a good thing like it's very very easy to trace someone's Behavior if you you know their address like the easiest thing I could kind of give as an example there's an example in an anecdote like if you ever interact with someone and you find out someone's address you can effectively watch their behavior across the network like it's it's a known thing in projects where people very quickly find out who the whales are they find out who the exchanges are the foundation and they watch those addresses because it's all on Ledger um and there's another anecdote which was um happened at the UK I think two nfts were stolen from someone and I think it was something like whoever stole them was using ens or at least they've given some part of their identity away and the police showed up at their front door and in that situation like the outcome is positive for the individuals involved apart from the person caught but like the implications for like putting that kind of stuff on chain and exposing that privacy that way is pretty terrifying if you get it wrong yeah I completely agree and I think uh the irony here obviously is that a lot of the kind of early ideas around web3 was you know in response to some of the problems that we were seeing in web 2 right so uh which includes you know centralization of both infrastructural control and and value um but also overreach by you know nation states and and corporations in terms of you know just how much they know about people um and then ironically we end up in a situation where we have public ledgers where things are even more visible not just to you know super powerful um secret services or extremely powerful corporations but you know a lot of other a lot of other actors so you know the question of privacy um I think most of us on the pan this panel probably agree is even more urgent when it comes to web3 um in fact just uh just one thing to kind of add on to what you said around nation states I saw whether it's true or not a great tweet the other day was like if you wanted to create a system as a government entity where which was perfect for minimizing like money laundering or making it super traceable Bitcoin though like as soon as you know the addresses you can just watch it move around and it's all out there in the open which yeah I mean it's pretty conspiracy theory in terms of where it's pitching from and you never know but in terms of like the actual outcome of what you can do in terms of traceability is pretty wild um from my side actually is that the most important thing is that we don't want to make the same mistake as in web 2 that we are giving our person data as a user to large corporates like Facebook Twitter they're using the so-called activity tracking or so-called data what we do on a platform as well giving up our information that we insert of it of course so and we are not getting any monetization on it so I think also the Privacy side on blockchain is very well needed just to monetize your data as a user so basically it's not for free so all these public ledgers are very transparent and they're publicly available right but it doesn't give the so-called user the right to choose whether he wants to share it or not because I think the web 3 should be more peer-to-peer and it should be giving more options as a end user as an end client rather than just focusing on user experience because again we are doing the same stuff on web 2 now we want to do the same stuff on web3 so how we're gonna incentivize users more to use your product so one of them is offering up a piece of part of your Revenue uh but at the same time your blockchain must be private from the public side so people cannot monetize your data like from analytical companies because when you see all those cookie settings and how many data companies are there like it's it's in 200 so if you want to especially more websites have like no possibilities to just decline all so you have go one by one and decline it in order to perceive your so-called trackability and what you do on the internet so that's where I see privacy with blockchain very well needed plus it will incentivize to create more products and definitely I see a lot of potential in privacy based products with such monetization nice so uh so tell me what probably everyone in the room is using telegram right as their their main messenger app I think in this industry it's quite it's like the the go-to um so why aren't we using something that's that's private or secure or why do we use this yeah that's crap solution I mean that's because it's very well organized and the user experience is quite too remarkable I would say except the spamming of course on telegram like when you meet people and you don't remember from conference with the pfp like from NFD with the profile picture and username well it's and then you kind of spam and all the groups like that's that's one of the miners but in general it's really great to use experience easy to use Easy to share but again those platforms don't and don't use any end-to-end encryption so that means what they're what they're offering is the free product which is really nice to use and basically white for free because you're being monetized on your data so what you type what what's your interest what you're doing they're they're consuming that and selling of course you don't care about it right you're just getting the product for that but when it comes to more decision maker analysis when it comes to more of like my marketing you'll always get what relative ads relative things which also makes of course convenience for us at the end but all these products don't want to connect much more into web3 space which is like using smart contracts using NFD gated access which is of course like board ATR club like good good example with Discord they they got hacked and then basically the admin rights everything was really bad and just built into organization is like decreasing like why should I then risk my accessibility to this communication if I if you cannot preserve the security side so and web3 is offering more security side like that's one of the biggest reasons why social platforms and Communications should be replacing in the nearest like two or three years definitely um because we're attaching so-called potential data that cannot be changed so we either is nft either it's Unique token that will give you the access at the same time you're also preserving your privacy when you're connecting to these so-called platforms because all these like telegram solution and Signal they're still offering to add your phone number and that's like interesting I still need phone number if you're saying that you're private you're entering decrypted but you're still requesting some kind of like data that is actually being used for my site so but the most important thing is that evolvement uh adding more extra features that make sense to use like in-app payments between the users to split the bill I like the always the utility of WeChat but I don't like their approach when it comes to data of course but they have really nice features that can be extended to real life use cases like the payments sharing content as well monetizing content so all these are part of the messaging culture and also part of the social platforms so cheers so what what do we give away when we when we use those kind of platforms what do what what do we expose Jaya if you want to answer that one well it varies from platform to platform right but to pick up on the telegram uh thread I think like many times people tend to um like Mis uh interpret what goes on when people choose to use something like telegram for example right so I hear a lot of people say things like ah you know end users don't really care about privacy all they care about is convenience right which you know I would actually fundamentally disagree with because um sometimes if you ask a little bit of further questions like I have friends of mine who'll be like oh but I think isn't telegram better for privacy than what's up or isn't you know people invent all these different hypotheses and they're trying to work out what to use right most people they want to know what to use and they want to protect their privacy it's just about making that information easily available and is easily accessible for people um you know and I'm going to do a little bit of a Shameless plug here too uh Nim we have a kind of a cute little app called Nim connect that actually privacy enhances telegram so it runs your telegram traffic through the Nim mixnet it's absolutely in beta version so it's it's in terms of usability you know it takes a little bit of you know you need to set your traffic to run through a stocks five proxy this kind of thing so we're not quite there you yet but it is there and it's available um to use if you want to privacy enhance your telegram app um yeah so uh so in terms of like okay so we're if if we're exposing ourselves or if if we're completely private then um how do we maintain a reputation as uh you know it was a good an upstanding citizen let's say if we want to interact with a a bank or a government how do we do governance with with complete privacy I I think it's maybe it's not complete privacy but it's it's more just it's a range yeah and that range is like in web 2 has existed for a long time so if you look at um how you get your identity at ranges from they've got basically identity Assurance levels and that's basically like when you're issued an identity document of some description what process have you gone through to get it and that might be like a biometric scan it might be someone checking your passport and it might be like in physically in front of a like a border agent or something answering questions and that's like the far extreme of like how far you can go to like check someone out but for a lot of interactions like you don't need that at all like you just need to know like does this person like are they trustworthy do do I know that they have a social history that I get involved in like a good example is like a lot of our investors like they don't know each other like they've never met in person at all some of them are literally running on like just handles that they've known for like years and yeah I've heard stories of them being like yeah yeah I'll send you like whatever money you want for like a couple of days because you need to like clear a bill or something and just send me it back and they're not operating on like any form of identity that web2 would like recognize but in web 3 it's just like it's completely natural they're operating on a telegram handle they've interacted with for five years and so I think if you're shifting like one of the things that we think will happen this year or maybe over the next few years is a shift from like needing to know identity like we what we would consider identity data like names passport numbers all that kind of stuff into a bit more like social proof um or at least like going into the data points that you care about like to get a parcel to your front door you don't really need someone's name you just need their address um and so you can start massively cutting down on the data that you need and it's also bringing it in from other places like if you look historically you would have got that data inside a village from just social proofs it would have been like yeah I know that person I know how they like they always pay their bills or they typically and so you would give them credit like you would barter with them and I think it's gonna almost head back that way it's like we don't need to have this massive surveillance Society to do this we can just go for what we need and that's kind of one of the principles of self-solving ID or decentralized ideas um like minimum disclosure it's like what do you actually need for this interaction and get rid of everything else and therefore you don't don't leak as much certainly unlike the actual data but then I guess to Jazz but like you're still there's still the metadata side that sits underneath that you probably still are exposing like like privacy and surveillance or like visibility and invisibility as if it's kind of too completely like a black and white binary right um it's it's not a binary and it's not even like a grayscale it's actually like a really complex field of actors that where the question the more relevant question to ask is what's visible to whom and under what conditions right um and in fact like I think now we have got some incredibly sophisticated tools um for shaping those kinds of relations and I'm talking about you know the full stack right I'm talking about you know of course the mixed net you know but I'm also talking about you know a very clever use of zero knowledge proofs we actually have uh you know the way to think about it is um tools to shape you know the digital space in incredible new ways and and here I mean you know in ways that actually operate differently than the physical world because when we're talking about zero knowledge proofs and the ability to prove something without revealing the underlying data yet we're in the world of math right we're in a different kind of scenario and we haven't actually like there's there's a whole uh load of conversations that needs to be had um about what that means for society before we even get to kind of building some of these more sophisticated architectures and so you know I think um I think there's work to do in terms of the understanding of privacy um using both analogies from The Real World um but also saying you know the digital world actually just works quite differently so we need to we need to start developing kind of new analogies there too um uh and and trying to kind of map out you know this question of what's revealed to to whom and under what condition um yeah I mean I I this is a topic that I think is really important and I think we can do a whole panel just on this I think the issue is that everybody wants an easy life like people are used to the the messaging up that they've got now but they don't consider the implications of of using something like that or you know that that banking Apple that kind of stuff so how do we make it easier for people to well it's not very easy right now right yeah like it's actually really annoying like the experience of using the internet right now is probably worse than it's ever been in the sense that like the amount of logins that you have to do the amount of like legal documents that's attached to every single web page that you visit the situation that we're in right now is practically like crazy you know and I think that's that we need to start solving that like the idea that things are very usable now and if we add more privacy it's going to become less usable like it's actually the the inverse is is true the more privacy we have the less of all this other that we need to deal with because like you know if you don't if you're not creating a sensitive data in the first place you don't you don't have to deal with that problem right so it's this idea of like if you have privacy by default like the less data the better right it's like you don't have to worry about gdr gdpr compliance all this other because you do not have the data right you just you just have a website and people can read what's on that that's it right yeah and to build upon that that was a great point from um the guy from protocol Labs that builds filecoin and he was like you almost need a trojan horse where the ux is like super shiny but underneath everything just works like flawlessly like that I think looking across all of us it would be it is technically feasible to build something like LastPass or one password or like Chrome autofill and do it entirely privacy preserving so it's filling in a fake name if you need to give your address it gives the real one it maybe gives a tokenized credit card and that's it and otherwise it's not giving anything and that's entirely feasible and doable as a product it just needs doing and then rolling out so I think that's going to be the fun bit of like the next two years is the Tech's starting to get there it just needs implementing into like really Hot Products and that's gonna be the really fun stuff yeah I completely agree and I think then we're gonna start to see a basically a shift in the entire Innovation pathway right away from one that's surveillance driven towards something that that looks radically different I mean a different type of digital economy another thing that I want to quickly add is about the actually everything around the internet is covered by email and the so-called email can be replaced with so many tools first like the most easiest one is a world address like of course the Vault headers can be identified Etc later on if you are interacting but like email have been around for 30 years it's been governing our so-called signups registrations following up a login so I think this is where basically the first step will occur in the nearest Future that the email will be shifting to something else and that solution will be more private more anti-spam and definitely more secure towards the user side so that's something that I'm super really interested from other side as well yeah I think um just from um delivering workshops to people the the hardest bit to get through often and it takes like an hour is just setting up a seed phrase and a wallet like if you ever try to onboard an artist to do to Mint nfts like in person it takes so long I think I feel like we need to remove all of that crap from the from the user experience basically I actually have thought about this um there's a possibility actually to use a picture-based encryption so basically instead of like having your seed phrase written down you just incorporate everything inside like a like a JPEG right so like a picture and this picture is like your private key so your access of your wallet so that means it would be taking around three clicks to create your wallet one click is to create generate the image download it and it can be I know a kitty cat on your desktopalls right who will understand that this is like a private key well there's one character that always will give out is the size of the picture because it will be around 12 till 20 megabytes worth of file signs but that's the only like differential from the uh just regular picture so this is actually another way how we can improve the experience sorry just that's really like I'd heard the technique before that I'd never thought about using it in a in a login or securing experience because it's just clunky and like it's why so many wallets at the moment are defaulting to like Gmail login unlike other equivalents because it's just easy and it's and it's it's not just it's not just user experience but it's developer experience as well which I'd imagine all of us have like tried to optimize for because just not only is using like privacy like hard like developing it is even harder especially developing on top of it um so just making that user experience as easy as possible like there's a reason why people use things like Facebook and Google login and it's because they've got it down to one line of code yeah it's super super quick um so if you're a developer and you want something that will you know will work for a lot of users around the world and it will not take you more than five minutes to implement you just shook it in and it needs to get to that Simplicity where people will start adopting it because it's equivalent but better yeah I think um I think people either if it's a picture or if it's a fingerprint that that gets you in it's it's always the most difficult bit about teaching uh people that aren't crypto native um how to how to get involved is always the the C phrase the wallet I actually remember my previous experience in banking when the several internet Bank age started we need to onboard people there so we needed to explain everybody like grandmothers everything else like what is this tool you have the call calculator you need to go inside of the internet so it took a Time it's the same with wallets now it will just take time cool um okay so uh so okay so let's talk about um let's talk about metadata now so like we have this um we have this map of um of interactions between between different parties and if you have enough computational power or enough enough um you know enough resources you can watch everything so how how do your various projects like um obstacate that information and make it difficult to for the viewer I think that was directing to me you know yeah well uh I mean like I explained you right so and when we're talking about metadata we're talking about metadata surveillance we're talking about not just the patterns of communication but also things like the size of the packets the time that it's sent all that kind of stuff exactly essentially you know can can de-anonymize you pretty easily um and not only that you can also tell you a lot about the relationship between you know who's talking to who is are they likely to be business associates are they likely to be lovers right depending on what time of the day yeah I like to visualize it like a detective uh map basically yeah like who's you're talking to him at that point like yeah you know with all the strings yeah to give it to give a really quick example from today I was speaking to a guy who does like in-depth cyber security like analysis like basically network analysis of people and the one he was looking at was basically people running it was a far it was a group of far-right groups and they're using crypto scams like raise funds and then he was basically followed it all the way down to his like an individual he could find yeah all using like domain Registries stuff like LinkedIn and just basically mapping all together and that's without even getting to metadata where you're leaking it just all over the place like this is using publicly available data sources and in this case it's being used for good but like you could quite easily go the other way and tear someone's life apart with it so it's yeah it's just so easy to follow it around yeah I think it's going to become uh maybe a bigger problem when when you know all this all this stuff takes off and people you already see people doing governance capture methods and whatever strategies yeah I think the easiest way of putting it is like like whichever side you're on it's always cat and mouse you're always trying to develop something and then the next side is catching up whether that's like encryption versus surveillance or whether that's what what is going on with these guys where you've got fraudsters versus like a forensic like an analyst they're both just playing cat and mouse and it's going to continue pretty much forever and I think I'd hope that we're on the right side of where we're going um on the stage um and I think I guess I've rounded off I don't know if this was going to be your closing remarks but like there's been a bit of a narrative shift like if you were here last year like I think 50 of this was probably nfts and now like I think there were there's like 67 sessions they're like six sessions purely on privacy about foreign data and a load more on trust and half of the ones I've been to have been on those like they've talked about those topics all the way through so I think it's just it's a massive narrative shift that we're I think really on the right side of I agree and I think I think the narrative shift is partially driven by um people suddenly realizing that privacy is actually closely related to security not just the people but also the systems that you're building um and that it also because of that relates directly to Value right so people are starting to kind of really see what is the effect of of the lack of privacy or kind of leaks data leaks um so uh so yeah I think I think we've only just started to see the beginning I think privacy is going to be a huge theme for the next year if not the theme and we're going to start it start to see it play out and many of these debates play out in in some of the kind of much bigger topics especially when it comes to things like cbdcs and privacy and payments and and this kind of thing so um so yeah this is just the beginning absolutely yeah I think I think um and thank you guys for uh for for the lovely talk but I think the The Vibes like it's a combination of different methods it's not just going to be one at the end of the day it's got it has to be a different encryption methods different forms of communication like alter mixed Nets and um and checked as well for identity protection you know it's it ha we have to combine all these uh these these strategies together to achieve the solution that we want and um yeah I think that's that's the path for all on so thank you everybody and uh thanks for coming thank you especially on the Friday