How Onchain Privacy Failed | Nathaniel Fried - 0xbow

[Music] go ahead and do your thing man I appreciate it and thank you very much for having me um so today I'm going to be talking about uh why onchain privacy is so important how it's progressed and why it's worth fighting for um so I think a good place to start is why privacy is so important so um limiting Government powers is the most you know well known use case but people often kind of misunderstand this they think it's just authoritarian regimes but it's also Western governments that you know engage in Warfare essentially against whistleblowers and journalists and people that are um trying to expose corruption and those type of things but it's you know most obvious in um kind of more surveillan States so in China what kind of begin as begins as kind of Trivial Technology um tends to evolve into more kind of dystopian stuff so if you go to to China and um cross the road Jay Walker legally then your picture will get taken they'll automatically build you through your government I ID and it will appear um on the on a sign which will kind of publicly shame you and this facial recognition technology has been um taken to uh and deployed in Hong Kong where um Freedom Fighters have been uh protesting and it's being used by the the CCP to to crack down on on those people and so the Hong Kong protesters have turned to privacy Tech privacy messing messaging applications like signal and telegram um to organize their their protests and with all of this kind of privacy privacy Tech it's a bit of a double-edged sword and I think telegram is the best example of this so within um telegram you have you know Hong Kong Freedom Fighters organizing their their protest but you also have some of the most heinous criminals using telegram as a place to organize and um commit you know cyber crime and child exploitation and um often times terrorism um and radicalization and this leads to government crackdowns on on privacy Tech so you know the the found of telegram was arrested in um in in Paris um and he he was released but I think they essentially struck a deal with the French authorities where um they have to comply more with the emergency data requests that the the police send and the police you know French police might be sending requests about um you know child exploitation but you've also got bellarus and Kazakhstan and uh Romania and Poland and some of these more kind of edge cases mova these type of countries which will kind of abuse these systems and these companies are pressured into complying with um the um their their request um essentially through through Force um but privacy isn't just a government only issue um it spreads all the way from kind of the weaponization of personal data if you look at whether you support it or not like the media doxing members of the um the Doge team and Publishing their information and people digging through their their histories to doxing and harassment um all the way to kind of people being targeted um for thefts based on the amount of money they have in their crypto wallet it's a big Trend in London um and in France as well with the recent Ledger guy that um was kidnapped and had his fingers um dropped off so I think it will be interesting if we go through and have a look at um kind of what companies gather what information on you um and why you might want to um avoid it so for example uh coinbase if you sign up to coinbase at least in the UK you go through a full kyc uh profile their terms and conditions essentially fingerprint everything you do on your browser so it's incredibly trivial for them to match that to ad tracking data and get a ton of information on you you can also onchain see the flow of funds if you transfer out um but I'm going to run through is a bit of a silly example but I'm going to demo some cool uh surveillance Tech um so I set up an open C account with this wallet you can go and check it out on openc if you can be want to type it in um and I set a profile picture I set the username that I use everywhere it's my my Twitter as well I link to my social media account obviously most people you know don't do this but um you're leaving this kind of fingerprint wherever you go online with loads of different applications and I'm going to show you um some some cool stuff you can uh do so starting off with the with the usern name what you can do is um you can take any wallet go on to um openc and uh it will redirect you to their their account um you can then you know pull a bunch of information out you can pull down the the picture I used as my profile picture you've got my username nty freed there you can see um all of this publicly available information and then you can take this username and you can go to um applications like dehashed or um other kind of breach data tools which what they've done is they've gone out and essentially from stolen data they've made a massive database that you can search against and if you're reusing your name or uh like your username or email you can really easily find data breaches so if you search my username on dhash you know all of the information that comes up I don't click onto it cuz it's literally like my passwords and my home address and IP um but you can very easily go from like this um username that you're utilizing in the crypto space that's linked to your wallet to a ton of personal information that you might not necessarily want or know is out there um profile pictures way way cooler I'll start this video um there's a bunch of um Tech out there um pinse is uh available to the public sector but there's also government only ones from uh like Clear View which got sued by um bunch of Human Rights organizations but essentially you can upload a picture of anyone anywhere and what it will do is it will search all across the internet for uh using facial recognition to find where that same person exists and you can see this is like a black and white picture of me that moderately looks like me it's taken from like an article um here of me standing in front of gch looking rather ominous but it also finds like ones where I have like bleach blonde hair and like from 10 years ago on some obscure uh mailing list but you can see here like it found this article which was uh you know has a has a picture of me um but yeah you can also see like stuff that I didn't even know was out there like here's a picture of me with bleach blonde hair and it's just correlating so anytime you're posting images you can get some real spooky spooky um data on people and you can see like it's quite far down this uh down this page because it's was from my uh student days but you can see he's uh here's me doing suspicious uh suspicious things at Uni um and so this type of data is um out there and very very available um with wallet addresses there's a ton of um you know online tools which will um look for where you have these accounts you can also do you know similar stuff to chain analysis or trm or Crystal which looks at flow of funds and can correlate wallets back um together and you know any social media accounts you've got uh linked you're entrusting these social media sites with a lot of data and they often do get breached and um for example most Twitter accounts like you can easily find the email address with the Twitter account because there was a massive scrape during the um transition to being uh Elon musk's uh personal project um yeah so there's um you know you when you find people someone's uh Twitter account you can you know find out the companies there's also some really cool tools where you can look at historic data of um you know what a Twitter account used to have in their bio what the username used to be cuz they're all tracking on ID so you know if people change this stuff it's like logged forever and you can find some really interesting modern um accounts like there's a um a Twitter account called ENT for Ukraine which if you look at like the historic data used to be an nft uh pump and dump that was Pro Ukraine and maybe gave the funds maybe didn't jury is out on that but now it's like a very legitimate organization and you can just see the evolution um going through um so you know the abuse of our personal data has led a lot of people towards wanting um you know privacy on chain and the journey of priv y has been a turbulent one which um they always are when you're kind of fighting for your rights but it essentially began at tornado cache which um sprung up because moak da run by Amin who's um over there um funded and vitalic funded this uh this this project uh essentially means motivation was he wanted to pay people's payroll on chain um and you know similar to the telegram story it's a trade-off when it comes to privacy and so when North Korea Lazarus group hacked axi infinti they dumped all of their or like a large hundreds of millions of US Dollars into tornado cash and then tornado cash around this time they were already developing compliance tooling but it was too late essentially and the developers got thrown in jail um and you know they're still fighting for their freedom and you should donate to their um cause um but Tony got sanctioned and um essentially got you know everybody thinks of it as a um negative negative uh privacy in it um like blacklisted from a bunch of um exchanges um so tornado cash is where the the story kind of um began but there's been people that have been out there fighting um and a large part of the recent developments come from a paper that was written by vitalic um and Amin and a few other people um around privacy pools which is the idea that you can um instead of correlating you can get on chain privacy but instead of correlating a deposit to a withdrawal you essentially say this withdrawal comes from this group of deposits which are known good and so rail gun has uh taken some of these ideas they were already quite a decent way down in their privacy journey and so the implementation of it has flaws in that you can essentially never get removed from What's called the um association association set so if you are a uh you know a terrorist and you manage to not get flagged going into to rail gun and get acceptable to the association set you'll be there forever like there's no way to to remove them and everybody else's um withdrawals will forever be associated with you know those uh those illicit funds um and so privacy PS um that comes from this um this paper and is backed by vitalic and others is kind of the next evolution of this um and the idea is that um you can relatively easily identify known good you know if something is fairly Obviously good you know relying on the kind of industry standard of um trm chain analysis elliptic those other people um you can flag something as as good and um then when those flow of funds go into privacy pools they get added to the association set after a period of time because a lot of times these hacks you don't want to be instantly approving funds the the the you know laundered funds or those type of funds don't often identified super quickly or a really complex laundering which we saw with the byet uh hack where there's like thousands and thousands of wallets which were strung up and then those funds in privacy pools when you go to withdraw you say hey this withdrawal comes from this you know long list of vetted and known good and so you're getting onchain privacy but um you're not having to um give up or um you know give away kyt information um and you're not risking that your funds are going to be intertwined with uh you know terrorists and we've been working on this for a decent period of time um it is now live on testet it's on uh tet. privacy pools.com um you should go give it a test see if you get accepted or declined it's not a not a perfect system but um if you get declined be sure to like complain on Twitter um and the idea is that everybody deserves privacy uh onchain and offchain and so we're kind of trying to fight towards that mission um if you want to this is just on test net but for the main net launch if you want to be added to the um Association set so you want to be included as known good you can come up to meet after or aan or someone from the Oxbo team tell us how you honestly feel about uh North Career and then we'll make a decision on whether or not we add you to the uh the the white list um but yeah this is our this is our project and this is kind of the mission behind it and I hope you guys found this talk interesting [Applause]