Privacy Highlight: Privacy by Design

So yeah thank you for uh for joining us I think um you're in the most important session of this whole Leaf Denver and my my personal opinion um my name is Josh weihart by the way I'm the senior vice president of growth policy and Regulatory relations for the electric Coin Company we built and support something called zcash if you haven't heard of zcash it was the first implementation of ZK on a blockchain it actually may be the first implementation of it in software before anybody knows how to spell ZK so that's my little homobrag but we have a an amazing panel of builders that are experts and if you're a builder um I'm glad you're here and maybe there'll be some good insights from from these experts on how to think about privacy as you're building your products so we'll just start here with busera and maybe if you could introduce yourself mobilecoin hello I'm Joseph nicolita at polygon ckvm and I've been developing a lot of tooling since the zero knowledge like circuma and it's not actually yes I'm John Wu head of growth at Aztec we're building an encrypted ZK roll-up on ethereum I'm a professor in computer science at UC Berkeley and also the co-director of a new campus-wide center at Berkeley called the Berkeley Center for responsible decentralized intelligence focus on blockchain web 3 decentralization Technologies and I'm also the founder at Oasis labs great thank you for for being here so we want to start by just getting to a fundamental question and then we'll jump in because so privacy is not a binary thing I've heard other people talk about it different kind of privacy leaks metadata leaks things like that choices and consent that people have and what they choose to disclose or not disclose so when you guys are designing products um with privacy because all privacy is a key part of everything you guys are building how do you think about how to go about building privacy into your products what are the considerations and the first thing is Developers should have privacy in mind I mean this is quite obvious but it's I mean I don't think that many developers in the world have that in mind I pulled pad you I will put you some examples when you are designing a program in general you tend to capture as much data as you can sometimes you don't even know why this data is gonna happen but you want to have it and this is quite common and you just don't care you don't have privacy in mind you don't you don't know what happened if this data is leaked at some point or what's going to happen so I mean the first thing is okay developers when you are developing anything please think that there is one thing named privacy which is a right and take that in account and from there we can start talking but I think this is the first step I think there's also there's also some consumers growing and growing of how important privacy is and that they're going to demand it in their products and part of the challenge is that that education piece of trying to communicate from the design side of this data is private or this data is not um and what that means to the user and how do you kind of gently educate them if they don't already feel that privacy is important uh and so little things in the wallet that can indicate this in Mobile coin there's like a private pay indicator for any transaction that is end and encrypted um I think so that's on the design side that faces the user and then on the system design side going from when you're starting at we want to design our entire system so that we don't have any data if someone were to come subpoena us and ask for data we could give them everything because we just don't have any data on our users if that's your first design principle and then everything follows from that I think that's very effective yeah at Aztec we like to say that uh privacy needs to be built in the base layer um and one of our other sayings is that privacy is not evm compatible back when ethereum was created you know we couldn't really build privacy into the base layer and that's what we're working on for our next Generation encrypted blockchain and so we're using a utxo model at base and the idea is to be generalizable and programmable um to the extent that you can put smart contracts into you into u2xos and encrypt smart contract logic and so we've seen historically in the past what happens when privacy is not the default and it's not available on the base layer it can be censored it can be shut down and the Privacy is privacy set and anonymity of users is really restricted um so right so privacy by Design essentially we need to help educate developers to really think through the Privacy architecture as uh like the earlier panel as I mentioned so essentially the development to now essentially who has access and control of what data and those needs to be building from the beginning and also at the same time we need to provide the tooling for developers so that they can actually more easily achieve the Privacy goals so right so yes so ethereum has no privacy um so with Oasis Oasis actually has just launched a privacy layer for web3 so it essentially provides this privacy compute functionality and capability to actually all different chains where the smart contracts are launching and if they want to use privacy compute capability they can actually utilize this privacy there to do privacy compute so that's one example of complementing for example ethereum and other changes that don't have privacy but actually provides the capability for the application to have this additional capability to help protect certain functionality and data and so on yeah I really appreciate that idea of educating developers and and you know Jody had mentioned as well right is this kind of within the um fat the whole fabric of the country company or the the project that you're working on to be able to inculcate that as a core value it was interesting I like I heard um I think her title was and I may be getting it wrong was like the Chief privacy office of her apple uh and and she had told me some privacy or she was speaking to a group of us but had told us um about some of the Privacy protections that they take internally like for maps they don't know if you're on on Apple Maps who that person is that's doing that query to find that place um and that sounds nice as a PR bite but I I asked a senior engineer if that was true and he said when they go through they they have been chartered within their groups when they do design that they have to look at two things they have to look at usability and they have to use a privacy they don't have they're not looking at like what the market potential is but if those two those two elements have to be there for any engineering work that that's being done so I hope that's true um but I think that's great kind of great advice for um uh for for projects so with that then what are do you think companies that are building whether they're privacy preserving projects or not kind of inherently do you think developers have an obligation to the to users for protecting privacy what do you think those obligations are can kick this off of an obligation and I think it's an obligation because privacy is a human right that all developers need to think about what it what it means to build privacy into their products just from the perspective of being a human who's delivering a product that's not going to exploit users because right now the the driving kind of business mechanism is if we can find uh pain medication you know if we can solve the pain for our users then they'll pay us money and that is a little bit it can lead to exploitation because the users need your product and so if you can instead say from the beginning we're going to solve your problem and we're going to do it in a way that protects your privacy ultimately users will choose the things that protect them as well and so I do think it's an obligation even just in terms of long term your product being successful yeah the world the world the word obligation I mean from the legal perspective of course there are some rules and yeah probably you have some obligations to do things in the right way but there is more the ethical obligation and here is where uh it comes from I think as a human beings from the ethical perspective we need to think about this right of privacy so yes I would say that it's an obligation but it's an ethical obligation is something that nobody is gonna Force you directly but it's something that if you are honest with yourself and if you believe in this you have to do it definitely this might be an unpopular view but I actually do think we're obligated and have to actually take a very opinionated and even paternalistic view toward protecting user privacy and I'll give you an example um one of the things that we're working on is a private voting proposal for nounsdao and one of the big problems with private voting is that if people elect public voting they can reduce the Privacy anonymity set and thereby actually hurt the privacy of other users so privacy is kind of this unique thing especially if they're they're uh there's some interaction between public State and private state which we all aim to build um it's this weird thing where it's a communal good if everyone participates it strengthens privacy and if people defect it weakens privacy and so one of the ways that we can help protect user privacy is be really opinionated and actually reduce user choice to expose their own privacy and security and of course this is very hard to square with you know our libertarian principles of you know self-sufficiency and freedom and autonomy but it's really hard otherwise to expect people to always perform exactly the actions they need to make sure that they're protected um I think yeah the certainly we want to you know help educate developers to really take this privacy as human rights more seriously but on the other hand I think we want to take a practical view as well developers ultimately so first they need to survive they need to build a great app that's actually you know get users get growth and so on so I think for us we actually we need to provide better tooling better Technologies to one make it easier for developers to build privacy first applications and two we need to help them to view the Privacy first as an advantage for them for their business because otherwise so for example earlier Apple actually complains that some of some of the people inside Apple complained that because because of their privacy they don't have enough data to uh like other companies uh to actually train models and hence it's harder for them to get as performing models as examples so basically because of certain restrictions due to the Privacy protection certain capabilities and searching functionalities is harder for the app to build so that's why we understand a lot of developers maybe they do um they I mean even though they in the ideal World they would like to make it privacy first but they have a lot of other practical considerations so I think for us from the Privacy technology perspective we need to help them to somehow flip flip this around to wanting to make their life easier so that they can still do the things that they want to do and by providing better Technologies and also somehow help them to show this as an advantage for example getting users to have better trusts of the applications and so on so I think there's a lot of work to be done instead of just saying that it's developers obligations they have to survive first yeah so there's trade-offs there's trade-offs that everybody has to make as it relates to privacy and security or maybe and or privacy and usability or maybe there is maybe there isn't um so kind of maybe a hard question for some of you all like what do you see as some of those trade-offs based on the tooling that we have available today and within your projects do you have any examples of where you've had to make um some trade-offs as it relates to user experience and and kind of perfect privacy or privacy protections I love this question because there's in in privacy Primitives there's a lot of overlap with blockchain Primitives which is uh just cryptography and cryptography is does not always present uh easy to use concepts for example we have 24 12 to 24 words that represent your secret key and that is something that as an industry I think we're still struggling with a lot is how do you onboard someone to cryptocurrency and say now you're going to have these 12 words that you have to either memorize which is what some people suggest or put it into a safe or back it up in a password manager that might be some like it's a leap right it's not familiar and then if you have to try to explain what are those 12 words it's like you go down a rabbit hole and so however those that entropy that seed phrase is so critical that every piece of blockchain and every piece of privacy that derives in that same environment and so Something That We're obsessed with is is there is there a world in which we can remove those 24 words from the onboarding experience from the user having to think about that and there's this wonderful technology that signal developed signal messenger that's open source called secure value recovery I encourage everyone to check it out where you're able to back up that 24 words in a way that is completely oblivious to the service operator so they have no idea at that you're even accessing those words or like what your activity is around those words and they can't take those words and they can't custody your funds and this is something that I think like Don was saying we have to build these sorts of tools that are open source that the developers can then build on to make it across the whole industry we're able to remove these barriers to entry around honestly just challenging ux this I remember the first time that the you know in in blockchain for some circumstances I had to no I I really got a lot of money in my accounts and was money that was not mine and okay you realize that at that point the importance of the privacy and and and you need to learn something okay maybe you know about cryptography you know about things but how you protect your things how you make these things privacy what are my risks and you realize that I had no idea but then you ask people around and I mean the industry well people some had some ideas but there were not Clear Solutions on how to do that so I think that this shows the immaturity that we are in the space for relying on privacy and so what are the best practices for the users what are the best practices for the applications what are the best practices for protecting and then against I mean done losing and these balances on that this was a I mean this was a learning you realize that there is not a good Solution that's clearly a place where the industry needs to invest and and to work on on that you at this point you discover the hardware wallets but then you realize the risk of Hardware wallets and what happened when you lose it or you re you understand about the hacks of the hardware wallets itself I mean there is a lot of things and and and but I want here to to just uh I would like to ask here to the people is just to start thinking in this process in a more stand right way so in a more you know best practices way so that this can be exported not to the community but to the new people that's coming to the community and to the world in general um and Aztec one of the things that we believe uh is that your transactions have to be fully encrypted client-side before they leave your machine now the problem there is there's a little bit of inbuilt latency because there's some client-side proof generation time that has to occur that's a really distinct trade-off for blockchain systems if there's some client-side latency and so I think a lot of the challenge that we're going to face in the next months and years is convincing developers to trade a different uh a set of constraints for privacy and it's going to be superior in a lot of ways you know with zero knowledge proofs you're going to get arbitrary run times and you're going to get um kind of you're going to have to lose the idea of gas and that's a huge benefit on the other hand you're gonna have to really think about proof generation time and so I I think the trade-off set here is just convincing developers that there's a whole new set of actions that they can take inside their applications which is reading and writing to private State accessing private compute and that's worth this kind of different set of trade-offs from what you see in public blockchains um and also I think people need to recognize as that privacy is a really complex topic when we talk about privacy it's actually um I mean as we know for anything that you want to do that's interesting sufficiently interesting like computes over data and so on you can't have absolute privacy that simply doesn't exist and hence then when you talk about trade-offs really you have to write essentially understands the applications deeply and understand exactly what um right what privacy actually means in this in this application I mean in blockchain today most of the conversation in privacy today more focused on privacy in transactions and some of this simpler Financial uh right applications and so on but when we look at the broader scope the Browder world really people are talking about more sophisticated data now just CR transactions but you know other types of more specific data and into computer over the data and then in right in that area privacy is a lot more complicated and I think that's really where the application developers need to have a very good understanding of the right of the app what the application does and figure out what they what you can right what kind of private psychology you can you can use to achieve what so for example we've done some work even in a space like when you train Machinery models these like large language models for example actually they remember sensitive information in the training data so then even when the attacker doesn't know the the model architecture and the model parameters that you're screw in the model they can extract information about the the inputs from just recording the model so this this is just an example like when we talk about privacy problem it's actually so much broader and that it's actually really really difficult and complicated so so that's why I think um yeah it's basically in the browsing space so far I think the Privacy a lot of the Privacy discussion more focus on the transaction size but as the blockchain space growth as we see more different types of applications richer applications we need to help the developer to recognize the complexity of the of the domain yeah absolutely so so with with some of that in the way that we're thinking about some of these trade-offs and not having absolute privacy um there's this panel Michelle mentioned it uh that's coming up so what what is your opinion on um user security and privacy are they the same thing or are they different things I think the I'm not actually sure what the consensus is on whether security and privacy have to be at odds or whether they kind of Encompass each other like my feeling is that privacy kind of encompasses security and that for example uh if you are going to a coffee shop and you're going to buy some coffee with the blockchain and it's a fully transparent blockchain then not only does the Barista know everything about every transaction you've ever done the people behind you know what you paid to your therapist but also someone who knows the address of the coffee shop now knows your real-time location if they're if they're tracking you and if you have a stalker that's like bad news um and so I think that security and privacy kind of go hand in hand when we're talking about protecting the user and security for the user in many cases and they can also be at odds in scenarios where you have someone who being taken advantage of and then if there's if their funds disappear and there's no recourse to get them back that can also be distressing so I think there's a balance of how do we find the right transparency to protect the user or opt-in to give them the security around around that while also giving them the security that privacy supplies yes Securities I would I mean I understand security as I mean protecting against something that can hurt you okay so and and definitively privacy is a tool or is a way or is a characteristic in order to get this Security in for many things you know that's what I would say between the two worlds yeah I think we're all here because we want individual freedom and privacy is actually the prerequisite for all of our personal freedoms and so to make that a little bit more tangible right what is security or you know getting spearfished but losing the freedom to your assets and so you can't Spearfish a fish you can't see you can't front run a transaction you can't detect um privacy and security are deeply interlinked we believe um and so while they might be orthogonal right there are certainly things that privacy can't protect if you for instance have a public-private key pair and you just decide to show somebody your private Keys we can't help protect you there but everything on chain um being exposed is obviously a really bad place for us to be and being able to limit the amount of targeting for users is a clear step forward with a value in the billions yeah I think it both are important problems using certain needs better in security protection right for example there's key management and and so on it's very important for right for users to protect their assets and and so on and also it's a I mean it's a broad problem like every essentially every application has this type of issues um whereas so for example every application you need to help users others in web3 you protect your keys in web 2 you protect your passwords and two-factor authentication and so on I mean these are just examples uh so but for privacy I think as I mentioned again it's a much more complex problem and oftentimes it's more application specific right so for example key management for different applications essentially you all need to solve similar key uh Key Management problem but for privacy it's more I would say oftentimes it's more application dependent so and hence it's actually more complex more tricky that you actually need to provide the application developer needs more help and needs to think more carefully specifically for the application to do the Privacy the Privacy design and so on for the application hey thank you how am I doing on time I see I'm done I can't see the thing so I'm sorry I am two minutes and 30 seconds over I have so many more questions um thank you for joining us we'll go to the next panel sorry for overrunning thank you guys so much really appreciate it