Onchain Privacy: Where Are We Going?

[Music] excellent well from an OG Cipher Punk uh to Modern Cipher punks um this next talk is another Allstar Allstar panel um we will be talking about onchain privacy where are we going our moderator is Claire cart and we have two founders of ethereum question mark uh as a part of the the panel so round of applause please thanks so much um thank you all so much I'm Clara cart I'm the CMO to Aztec we're privacy first L2 and joined by my panelist um three vitalics so wish me luck you know I'm up against greatness times three uh okay given the masks I'm going to let you guys briefly introduce yourselves as you wish to be known so start here uh go ahead I am speaker number one yeah speaker number two associated with the iron fish layer one cryptocurrency chain uh make communism great again okay sounds good so we have some mystery breing maybe through their answers you'll get a sense of uh who they actually are or maybe maybe they'll be so kind as to tell you um so what we want to discuss today is onchain privacy kind of like where where it's going and where it stands today I think there's a lot lot of really complex parts of this right it touches like kind of audiences in our industry like cyppher Punk versus maybe you know onboarding more um mainstream users it touches regulations um it just touches so many topics so hopefully we'll have a chance to get into all of them um I guess like I'd like to start just by hearing from each of you like what exact part of onchain privacy are you working on and um you know kind of what's been your experience as a builder in onchain privacy yeah so we're working on Oxo which uh we we provide uh asps Association sets and uh privacy pools as well yeah iron fish uh we are working on a layer one chain we're fully live on mainnet and recently launched a bridge with chain Port um you get transfer fully private usdc um you guys can give it a shot um yeah feel free to check it out our website yeah I'm I work with uh the esteemed colleague speaker number one on Oxo uh launching privacy pools it's on the testnet right now as of today you can go to testet uh. privacy pools.com and use sepolia eth and it's a private money protocol that keeps out the terrorist okay um next question you know I think like being in the space and thinking about like fully transparent block space the idea of privacy can be like a little bit of maybe a difficult construct to think about like how do those things work together um so could you tell me a little bit about just like your perspective on why onchain privacy is important um and maybe also like how you're approaching it and I'm going to start down at the end with speaker three um well we wanted to do payroll on the blockchain and so uh one of the first private payment systems that launched on ethereum was called Tornado cache and this launched because everybody in ethereum was jealous of zcash and we thought it was silly that all of your payment history and transactions are public every time you pay someone they know how much you uh have and you know how much they make so that didn't make a lot of sense to us so uh mik da which was like a punk rock da helped give the grants to tornado cash and they launched that and then like this was back when eth was $100 we did it because we wanted it and uh the unfortunate Downstream effects of this were that uh lots of you know North Korea hacked a video game axi Infinity for $500 million and then started putting hundreds of millions of dollars into our privacy system and so then we had to do a lot of self-reflection on how we design these things uh 20 tornado cash built a compliance tool that they don't get enough credit for it allowed you to reveal which deposit actually belonged to you and despite the St Louis fed publishing a paper recommending the usage of this compliance tool the legal action was taken against them anyway and so now uh we have learned more techniques for trying to keep the illicit funds out of our privacy systems because we want to have privacy for the good guys and so uh that's what we're doing at Oxo nice speaker too yeah I would say uh that's an interesting question uh we we also want to make things as usable for users as possible but uh as the same thing for us is trying to keep out the Bad actors um with the bridge that we launched it was very important to us that um we have the ability to filter out the hackers so uh basically we the the bridge provider that we use to go to our chain before you can do privacy funds actually does a lot of automated detection for hacked wallets and such to prevent transfer and I guess the other point I wanted to mention as well is our chain is a utxo based chain it's similar to bitcoin or zcash um it's a privacy based chain um but we found is that like to do programmability and to do some interesting things related to privacy we wanted to do um have an evm associated with it as well so we've been working to some extent to put an evm on our chain as well so that we can interop with all the other types of chains um that are out there and potentially other Bridge providers um as well okay and last speaker one um yeah I don't think I really have much more to add speaker 3 provided pretty good context yeah you guys are working on working on the same project um okay we talked a little bit about kind of like the situation with on chain compliance and speaker 3 you mentioned how you know in your first iteration of building it you sort of had some Reflections I guess um Can Can you all sort of talk about like the approach that you're taking and what some of like the risks are generally speaking like as Founders and Builders um just in terms of like our current regulatory environment yeah well obviously there's quite a bit of risk given that previous developers who worked in the same space are uh have gone to prison so um but I think with the current regulatory climate it's a lot seems to be a lot it seems to be kind of like Open Season now but I don't know I don't want to speak too soon but all I know is that most of the legal work we spent a whole lot of time putting in uh is made obsolete essentially with the new uh with the new uh now that Trump's in office and sorry what do you mean by Open Season when you say that like well I think that crime is legal Now isn't it I'm just kidding uh I mean I think that um now we're starting to see legislation that actually Mak sense or at least rolling back a lot of the the laws and the previous regulation that uh was kind of halfhazard haphazardly put into place um it seems like our Regulators are actually listening to us to a certain extent now and we're looking forward to working with policy makers to help inform a sensible approach to privacy as well as larger you know cryptocurrency um like lobbying activities yeah I I'll expand on that a little bit so when Roman storm and Alexi made tornado cash uh the Netherlands went after Alexi 2 days after the United States sanctioned the tornado cach program it's the only program in history that was considered a terrorist uh it seems like there was probably some uh collaboration between between those jurisdictions uh and then one year later Roman storm was arrested at gunpoint at 6:00 in the morning in front of his daughter at his house and this is despite complying with the ongoing investigation the director of the FBI said that you know we will get you shadowy coders wherever you are and it's like he was just complying right and in the aftermath of this thanks to uh Joseph and Preston vanloon with the backing of coinbase for example they sued uh ofac and uh it became uh it was ruled in court that the ofac could not have actually sanction tornado cash to begin with because they didn't have the jurisdiction uh the authority to do so they can only sanction people or their property and they determined tornado cash was not property uh and and separately the judge who uh in in the pre ruling on the tornado cash case talked about how uh the relayer is a money Services business and this is part of why they're going after him for uh you know running an unlicensed Money Services business and uh through the good work of for example Jake shirinsky and the defi education fund uh they submitted an uh Amicus brief that which is like when an outside lawyer uh also contributes to uh a case and it explains that in the entire history of Money Services business uh rulings there has never once been a case where custody was not involved and so uh we're optimistic that there will be better regulations around these aspects of both privacy protocols and the rest of defi so that uh developers especially American developers can uh work build here and build businesses that contribute to the well-being of Americans you know we we like to say uh uh privacy is also self-defense you don't want you know your entire database getting hacked by China and then China knows all of your transactions and that's not very good for American citizens and so if the US government can't protect all of our data then we should allow citizens to protect themselves and I think that's where we come from with our approach to privacy thank you um I want to switch gears a little bit and and talk a little bit about like maybe the dichotomy and the industry of you know we're all here we're at a crypto conference I think the idea of this like kind of Cipher Punk version of privacy is very like we all know what that means um but we also know that not not everybody thinks about privacy that way right like kind of in this more binary like really sort of Hardcore way and I'm curious how you guys as builders in the space think about you know more like a Normy version of privacy or just how to make privacy um not seem more appealing but you know like how do you kind of balance all of these things where you don't want to be known as like the crime chain right um and so you have to do a lot of different things and then how do you kind of think about this idea that maybe privacy is just for criminals or just for sort of Hardcore like Cipher punks I mean as hat says it privacy is normal I don't think that privacy is something that's like Cipher punk I think it's something that my grandma wants um no nobody wants to see what their transaction I don't want my bank isn't my bank isn't just by default open right so I don't think it's absurd and I don't think it's like a hard sell to convince people that privacy is like a good thing and a human right yeah I I would add to that as well um I think the current privacy Solutions are actually uh they get a lot of flak because uh they're difficult to use like a lot of them are um the tech is there but uh from a user standpoint I agree I think that they it should be transp AR to the user it should just happen automatically and um we're doing things in the industry to try and make that the case but it's just a a technical challenge that we have to overcome um there there are certain things in ironfish that we've done particularly where you can have a tradeoff where it's a better user experience with slightly less privacy um or you know to have if you want to have full privacy then basically you uh you you need to do a little bit more work as a user um okay so I'm curious on that you have these different kind of options for privacy so do you have any information or data on like what people choose do they choose like the full privacy with the maybe worst user experience or do they choose sort of the Lesser privacy with a better user experience well I would say that we're relatively young as a chain and so we've been targeting people who um are very invested in privacy and the concept of privacy and so everybody that is using it is like basically doing full privacy because that's what they're interested in but I think from a users perspective I can imagine my parents using privacy and and uh you know H they're not going to really care if some centralized service is hosting their viewkey so that they can uh potentially see those transactions um they're just care that the product is easy to use and uh and that it sa it safeguards their data against people who are trying to scam them yeah I think as uh hacks and breaches of data become more prevalent I people might start appreciating uh basically services that cannot uh get hacked and Reveal Your information uh like if you use coinbase for privacy for example uh any support engineer at coinbase you can bribe them give them $1,000 and get the entire transaction history and then you know everything so uh I don't think that's a great system yeah okay you guys mentioned well speaker 3 you just mentioned um hacks and I think it's on everyone's mind like the bit hack that happened last week um obviously there's a few things there that I think interest with onchain privacy you know first of all like could it be less easy to Target these kind of like whales and you know the multisig like for the Social Engineering in the case of IET that's not how it was done but in many cases it is so could onchain privacy help there and then as well um how do you all think about you know when when the hackers want to kind of launder and wash those funds and and making sure that that's not happening um on on on your projects yeah um uh Natt could could you stand up for a second uh this guy over there stand up stand up let everybody see you stand up go up to this guy and tell him Kim Jung Un sucks and you will be added to the Oxo proy pool's white list and you'll be able to skip the line when it launches in about two weeks uh we're doing some in-person kyc at this event so uh make sure you talk to Nat does anybody else want to talk about like kind of more in the weeds of how you're thinking about you know exactly that just making sure that um your CRI your chains aren't used for Crime this is what this is what I call the Paradox of privacy which is that if you want privacy for the good guys you have to have surveillance so that you know who are the good guys and not and I think Taylor manahan who works at metamask posted a tweet that said something like bybit has now split up their funds across 7,000 addresses and done 10,000 trans actions and so you actually need digital forensics experts uh to be able to trace all of these funds and you need to build in time delays so that you can do your own research and figure out where the funds are coming from so you can block it and kyc systems uh unfortunately are not the end all be all because I don't really care what id you show me for example if your money comes from a North Korean hack the professional criminals use identity mules all the time and so I I think as people realize that those systems are weaker uh things like privacy pools where we do transaction screening are going to be uh viewed more favorably yeah I would I would agree with that we I like at ironfish we actually did a airdrop to um to like 60,000 people when uh we launched our chain and we did a kyc process uh through a St like one of the biggest kyc providers and um we had like we had a uh I would say the automated detection did a very poor job of of dealing with like these mules like he's suggesting um and we did a lot of like manual and intentional detection on our side as developers to sort of filter out those people but those systems are um yeah they're rif with with um with problems I I would agree with that okay I want to share a reflection of like something I've picked up talking to people at the conference and then get your reactions so um we don't all need to like share our age or anything but I'll just say I'm sort of like Gen X maybe Elder Millennial and like I find privacy like very fundamental right um I've spoken to a lot of like younger people at the conference maybe like gen Z or they in their early 20s and they were telling me this idea that like we're in a post- privacy World which I found really interesting and I just got curious about it and their perspective was like I grew up sharing my entire life on social media it feels so normal to me um so much data gets hacked and so it's sort of like almost like a nyus view of just like there's no hope right there's no hope and also it's normal now to just expect all your information to be public in online so I wanted to get your reaction to that because when I heard that it really made me think and I'm curious how like different generational views of this like could impact maybe how we build or how the technology is adopted I think an important thing is not necessarily privacy but consent um if I choose to share things online I'm doing so of my own valtion um that's a consensual engagement between myself and my audience um being forced to provide that data or share that or not being able to uh you know Shield that and have the the autonomy to determine who with whom I'm sharing my data I think that I think those are two very different concepts so I understand where you're coming from from and yeah we're all hyper online but I don't think that that means that we're in a post- privacy world that's insane yeah I mean I would agree like there's like some simple cases that you can imagine like with Healthcare data for example where you know if data gets out about some test that you got done then it's going to potentially have an effect on your ability to get health care or insurance and so it's like well they these younger kids may have not had to deal with these sorts of problems yet so it's potential that you know in the future future they're like oh wait actually I I didn't want that to be public you know and I I think at that point they would really be a proponent of privacy you remember those uh those Canadian truckers you remember like the protest and uh people that were like donating uh they would like their bank accounts were shut down I mean that's a pretty good reason why we need privacy right yeah I'll chime in and like I uh decentralization uh Maxis or you know connoisseurs are made not born right vitalic invented ethereum after uh World of Warcraft removed his siphon life spell from the damage component of his Warlock and uh he rebelled against centralized Services since then uh I remember losing all of my money in Mount Gau and after I lost all my money in Mount gaau I started appreciating decentralization more so I hope that the kids don't have to learn these lessons the hard way but I know they will all right yeah thank you I I also found it really interesting and but I like your point you know speaker one around consent right like showing up on social media and doing all those things that people do that sort of make them think it's post privacy like they voluntarily participated in that and so it's quite different to like live in a situation where those things are required and you have no control over them um so that's a really good Nuance um so we're coming up uh at time I want to end the panel in a little bit like more of a kind of personal or emotional note um I think because all of the challenges that privacy Builders have had like we mentioned tornado cash and Roman storm and and just the industry's been under attack you guys have kept going you've kept building I'm just really curious to hear like what motivates you why you're here why you care if there's a personal story you want to share um because I think it is one of the hardest like niches to be building in um so yeah if you don't mind sharing that I think it's only difficult because of regulatory issues that we've had and um I think it's going to get a lot better especially with projects that have continued to build despite regulatory uncertainty um so keep at it yeah I mean I would I would agree with that wholeheartedly like I I have a lot of Hope with the new Administration in terms of their appointment ships uh for these key roles there's a lot of pro uh Pro crypto people coming in and I hope that uh you know the right thing is done relative to privacy so privacy is Meaningful in many contexts right uh like I was using it for payroll uh Tor tornado you know things like that and then vitalic was using it to send money to Ukraine without the Russians figuring out how much money he's saying and so as sending and so it's useful for basically the whole Spectrum uh and and I I posted a meme uh because Roman storm appealed to the Supreme Court uh and the meme is like the Domino Meme and it's like me trying to pay payroll privately on chain click and then at the end of it it's like the Supreme Court deciding on the fate of private money on the blockchain right uh we didn't expect any of this and part of the reason that I think it's important for us to keep going is because I believe that Alexi and Roman had the right intentions they built the compliance Tool uh the stuff that we've been building at privacy pools is an extension of those compliance tools that they built to the next iteration and so I think it's important for us to stand up and say you know we've been trying to build uh tools for people to protect themselves this has always been what we've been trying to do and this is still what we're trying to do amazing I love that like I mean just long-term commitment I think all of you are really like you're in it for the right reasons so to speak um and I think that goes for most privacy builders in the space um okay well we're at time so I just want to thank panelists one two and three so much the three vitalics and yeah Round of Applause thank you all thank you thanks thank you thank you [Music]