Building a Privacy Browser for Ethereum

Transcript

So uh why not start there when you when it's about privacy, right? Um so we're building a privacy browser and privacy is part of it. Uh I mean we covering the whole stack. We want to be a decentralized browser uh with all the decentraliz decentralized features in it. And um yeah, so if you uh uh look at the stack, the the stack that you need to cover uh to have privacy on Ethereum, it has uh three components. It's the browser itself because that's your you know your window to most of the interactions that you do. And uh obviously you have the wallet that you need to need to cover and the network.

So that those are sort of the three components that I'm also going to focus on today uh that are all working together in a in a concert to make privacy happen because guess what uh all of them are the major attack vectors. So you um have leaks privacy leaks on all three layers here. So the first of course being the network you expose your IP address uh and other metadata like the domain names that you that you open and so on so forth. So that needs needs to be protected to keep your privacy and uh the browser itself uh heavy fingerprinting going on. So even if you don't want to be known obviously you're fingerprinting very nasty things like uh scanning your canvas running some some

scripts in the background to draw things on on a canvas or play some silent sounds crazy stuff and uh yeah we need to protect from that and uh obviously on chain we covered that in the lightning talks before um yeah many things many traces you leave uh transactions are one of them but yeah it's just plenty plenty of things that you need to take care of and um yeah so with freedom browser we are working on all three of these things apart from making bookmarks work and other things that a browser needs but uh obviously privacy is important sorry and um yeah on the network part uh we have uh local nodes running for swarm and for

for IPFS also experimental uh light clients for um for Ethereum and also So we have tour integration for um like traffic that comes directly from onion sites and uh what we are doing next is that we will route more traffic through tour to kind of mask the IP address at least and uh also separate that by tabs by by wallet applications or by by different sessions. And uh the major gap that we still have is um that the peers still see the requests. So if the peer-to-peer clients go out, they they broadcast your IP address and uh that's obviously an issue and uh yeah uh things related to that we need to address

still. And on the browser end we have uh the uh user agent that we have recently in the last release a few days ago uh sort of anonymized uh which is actually quite a win. So you can can get quite of a lot of privacy from just doing that. Uh that was a bit of an eye openener. And uh next will be that uh the wallet transactions are more private or even hidden through yeah like using pools and and other obiscation mechanisms let's say and uh the biggest uh gap and that's also the hardest nut to crack is obviously the um uh the fingerprinting which I just described. uh there are approaches brave uses one and then there's uh other suggestions to to yeah

uh to mitigate that but it's it's a huge engineering task because it's so deeply in the browsing engines uh and uh the people the adversaries which can be advertisement providers or or you know people uh like these they are going really long mile to to kind of try to find out by as I said uh crazy scanning and and uh playing uh silent sounds on your device. So yeah, there's uh one approach that we will um that we're looking into which is uh sort of uh a muffling of the of the um of the randomness that that's coming from uh the fingerprinting but yeah as I said it's the biggest part the onchain part um as I mentioned uh shared pools

already uh we we are using uh we have tested this uh in on test net devices or sorry on test net implementations and the biggest gap is still that that none of this this in production we have test branches but that definitely is a focus that we also introduce privacy there um so our uh user interface or UI good UI is always a focus for us and uh we want to give the user some sort of control for when it costs them something when it costs some slower loading of websites or some other inconveniences but for things that are essentially free for the user that they won't see we we just make that the default and um yeah so That's kind of uh we want to make the trade-offs

transparent and also kind of warn users in the interface where things are private and where where they are not. And um yeah, so um that's essentially uh our decision for the stack that we give the user some control. We don't go all in uh maxi uh uh like all private because that would would really break some experience and we don't want that. We want people to use it as a normal browser. We're open source. Freedom.bab baby is the kind of clear website and there's also going to be a deep uh deep dive of all this tomorrow at 3 p.m. Thank you.

>> Awesome. Thank you, Reinhardt. Okay, and you heard that there will be a deep dive tomorrow 3 p.m. >> Yeah. >> Great. Okay. Um in case you have a question, we still have a little bit of time for questions. And okay, watch out here, Martin. There will be a box. There you go. >> Uh yes. Hello. You mentioned fingerprinting. So I wanted to say in in how far does freedom browser prevent from fingerprinting? I know it's a hard task but >> the honest answer is it doesn't uh simply because we're using electron in the background and we have the same let's say quality or non-quality in that uh that electron uses. It's it's a huge construction site uh that we want to address. So right now yeah very minimal to non no protection to the very deep

fingerprinting the sort of nasty stuff. Yeah. If we reach sort of brave standard uh soon we'll be very happy but we might have to switch out the browser engine before that which is obviously quite a huge undertaking. Any other questions? Just raise your hand if you have one. Otherwise you can obviously um come up to Minehard afterwards or attend the deep dive where there'll be way more information. And this is another session.