Centralised Messaging Can’t Keep You Safe. Decentralisation Protects Privacy in Messaging

Transcript

Okay Google. Are we ready? Hello. We're not ready. Here we are. Hi everybody. My name is Crispy K. I'm one of the co-founders of Session, which is a decentralized private messaging application. Uh unfortunately, we had some technical difficulties. So, uh going to be a little bit shorter today. So, I'm going to speedrun this for you all. Uh but today we're talking about centralization and how it cannot keep you safe. Uh if you don't know this now, we're going to go on a fun little journey and I hope at the end of this you're going to realize, "Oh, crap. Um I'm I'm not too safe and there's better solutions." Uh and I think we're all here in the Web3 space uh and we understand that there are

better solutions that you can accomplish with a decentralized network. And that's what I'm all about. So, let's go. Uh so, there are signs that centralized technology and centralized messaging applications aren't really looking out for you and aren't really doing good job. Um you know, for instance, Telegram, uh I think I assume a lot of people here use Telegram. Founder landed in France. Uh he has a lot of control over things and it seems like they contained him until they started to release information and and started sharing information about Telegram and they sort of bent over and and sort of folded over for foreign entities. Uh and my my point here is that when you have these centralized tech companies with centralized control, you just have to

capture the king and you can capture the information because they pretty much have access to all of it. Um and then right now all around the world, uh chat control, specifically in Europe, seems to be kicking off. Uh it's it's failing. Um but this power and control that centralized organizations can be pressured into adding uh things that you really do not want. They're not really looking out for your privacy. And quite often, in especially in the case of Discord, uh they wanted to proactively roll out uh Face ID for everybody in March and everyone was so excited about it. Uh joking, it was a terrible trash idea and thankfully it got um pulled back and they didn't do it. Uh and but this is what's happening with these centralized sort of these

power figures, these companies. They want to they they want to get as much data as they can. And quite often, especially when it comes to the case of say Meta or um like big tech companies, they make money from your data. Like their business is your data. They're collecting your data and you're trusting them with your data. Uh and it's quite um apparent, at least to me, that these organizations that you're trusting with your data really don't seem to be um sort of >> [snorts] >> like

passing the sniff test in terms of what you expect uh someone to be doing and treating with your data. Um and they continue to betray you. When when the government sort of comes knocking on the door, they fold. Um when there's profits at hand, they'll try and pull out encryption to then train their AI models and make more data out of you as a product, not as a user but as a product. Um So, from my perspective, the problem is centralization. When it comes to metadata, uh from like this is a honeypot. This is just data sitting there ready to be compromised. Um Not many people think about metadata, but when when this like for me it's like where you're located, the time of day, who you're connecting to, your social graph, you know, like the size of your messages. Uh there's just so much

information that is packaged in. Uh and also a lot of people don't think about this, but when you're communicating on WhatsApp, you're using one of Meta's like many technologies. So, although you're chatting to somebody about something here, you're going on a website which probably has a cookie uh by Meta as well. So, they have this humongous social graph of every probable person. Um so, it's not just about the message you're sending, it's about all these little tiny cookies around the world that are coming together um that can be used against you in one way or another. Uh and that is like the challenge with centralized control, centralized data, and especially metadata.

Uh there's also humongous uh incentives for surveillance these days. Uh I don't know if everyone's familiar about this, but um the police used to uh you know, try and get a warrant to get your data from companies. Now they can just buy it. They can just buy your data from uh like uh aggregates like the data aggregates and they don't even have to talk to the tech company. They can just buy, you know, where were you Tuesday, Wednesday, Thursday, who you're connecting to, uh and like what were you doing. Uh and your web browser history as well. These things can just be bought by tech companies uh and they're happy to sell it to the highest bidder.

Uh and in terms of censorship as well when it comes to centralized technology, if you're reliant on a phone number, if you're reliant on a um some sort of uh trusted um like account, you can just be kicked out. And I've heard this and I've seen this many times when it comes to say Telegram, people have just had their Telegram account deleted and they come screaming, "Oh, I need a permissionless like decentralized tool. Like what else is there?" I'm like, "Well, I might have something for you." So, this is like really serious for me. These are like the uh the core issues that I see with centralization and you're trusting these companies, you're trusting these people and these people can be compromised.

Uh and I'm just going to throw this out there. I love Signal. I love privacy. I love uh like I'm a big privacy fan and I've been building Session for a very unit years now. Um the proof is in the pudding. I'm here. I love this Um but uh like an example of um like even the best of the best. I like Signal. Signal is an amazing application, better than the rest in terms of privacy, but uh there there there is a way that you can to compromise Signal. So, uh I think people are like I like cognizant that um when Amazon went down recently, Signal pretty much shut down, too. Uh so, I'm not I'm not like I can't say any certainty on this one, but all I'm saying is it is technically possible to compromise

something like Signal um because at the end of the day, you when you send a message through say Signal, goes to a centralized server, be it Amazon or Google. Uh and um thanks to Wiki No, WikiLeaks um Edward Snowden's uh leak about Prism and how it collects your data and how it is working with all the big tech companies in the US to collect as much data as they please and not talk about it. Um due to the infrastructure setup, you can compromise the infrastructure that say Signal is running on. And thankfully, it's generally just work um operating on say Amazon or just Google. Uh so, you just have to compromise one big tech company that is already probably working with Prism. So, this is a few years ago.

There hasn't been an update on this in a while, but you can assume that it's either still operating or something even more advanced is operating today with the complement of AI technology. So, there is a better way. And back to that point of everything running through one server infrastructure, so Session is a decentralized messaging application. And if you were to apply the same logic of say, "Hey, we're going to um compromise the infrastructure layer of Session." Uh it is actually running through a humongous decentralized node network, which means that you would have to compromise um hundreds of uh different internet providers, server server providers. Uh and they would all have to be quiet and not um you know, whistleblow or leak information about what they're doing. So, there's this

like next level in terms of uh like uh freedom from compromisation due to the decentralized network of Session. Uh if if you haven't used Session before, uh it is a it's a free messaging application. It has over 1.7 million monthly active users, probably around 50 or 60,000 French users. Uh thank you, French people. >> [laughter] >> But uh yeah, it it is a real messaging application that works today. No metadata. Yeah, it's it's a it's a real ripper. Feel free to try it out later. It's it's lovely. Um but in terms of our approach, like when we're thinking about these centralized um operators, uh the the core issue is the infrastructure. Like how easily can you compromise this infrastructure for us as like the company? Uh because all the

communications are running through decentralized networks, that means that we cannot access any of your messages. Even if I landed in France, which I did, it's a lovely place. Uh the I I didn't get a gun put to my head or pushed into handing of any information uh about people because I don't have any information. I work at the project. There is absolutely nothing I can give about an individual. Whereas, unfortunately, on the centralized options, they can pressure them and get what they please. Otherwise, you're not coming out of jail. >> [laughter] >> Um So, and in terms of uh like honeypots and leaked information, uh a lot of people trust Telegram, WhatsApp. Uh good for you. Have a good time. The the challenge here is that it's all sitting on these centralized servers that they relatively have access to. Uh especially

with Telegram, majority of the people, it's not encrypted. It's like a unencrypted messaging application. Uh and a lot of people think that Telegram is protecting their privacy, but it is like it's you know, uh it's it is what it is. I would just say um like it's a great application, but uh that information is sitting there and if you compromise the king, you can compromise the data. Uh and uh like in terms of our key like value propositions for session, there's no phone numbers, no email. And it seems to be a core feature in centralized applications where your phone number is your ticket to entry.

But we've seen many times in say Hong Kong, in Iran, in different countries where you know, they'll just block the access to signing up to an application with a phone number. They'll you can get your phones like phone sweep SIM swapped and then just completely lose access to all your communications messages. So, yeah, this is our approach. It's also so it's public private key encryption. Control mechanism. It's also onion routed. So, that concept before about metadata, when you're accessing session, you're just chatting to people, you're not sharing them your location, you're not sharing any sort of personal information. So, yeah, it stands out superiorly from the centralized options where you know, they've got your IP, they've got your location, and a lot of

your information. Cool. So, what is the special sauce with Session? Like a key concept here is when you send me a message, it will get it will get routed to three nodes on the decentralized network. It will strip off the metadata. We store it in a dense decentralized swarm of nodes and then onion routed again. That means that the company, the people behind it, we don't get your IP, we don't get any tracking, we don't even know really that you're using Session. You're just having a good time speaking freely and connecting with friends, family, or whatever the hell you want to do. Have a good time. You're free.

Uh, so yeah, these are like the key concepts. If you were to go out today and be like, "I'm going to build a messaging application. I'm going to build something and I care that I care about privacy a lot. I assume a lot of you do." You're not going to add phone numbers. You're not going to add email. You're not going to be tracking IPs because that is what will get you compromised. And maybe like you're not even a person of interest, but if you know someone who is very successful in any industry, you're a person of interest. There's like there's always some degree of separation in terms of how like who is a target and who is of interest. Uh, so this is our approach. These are the things that are not included in Session and it's it's like essential in terms of protecting

your privacy. All right. So, a little elephant in the room. If you use Session, if you've heard about us, you know, it's not perfect. It has a it has a few little quirks and bugs. Some would say features. But in terms of what we're looking forward to in the future, post quantum encryption is essential. This is getting very serious right now in terms of quantum computing. Uh, and perfect forward secrecy. One thing that is holding us back from Signal, Signal's a messaging application, has PFS. And that just means that if someone compromises your account, they can get more of your messages. And this is something that is big complaint about Session. We're bringing it back in. So, don't worry about it.

It's coming back in this year. If we can survive this year, this this is coming straight back in. And we can achieve this now due to a lot of changes that have happened over the years. And also decentralized device management. So, what that means is you just know if your account's compromised and you can have a much more secure experience. And this is our sort of like path to being the absolute number one in terms of private communications and user experience. >> [snorts] >> All right. So, Session is like you know, nothing's free. It is like a classic concept of like things always cost and if you're not paying for something, you're you're the product. Unfortunately, in Session's case, it is a free product. We are looking to launch pro and premium things to actually become a sustainable technology.

But it's a bit of a journey to get there still. And we're actually as a project, although we have I would say Session is probably one of the most used applications of Web3. We have hundreds of thousands of downloads per month, millions of users. But due to our sort of like path to sustainability, haven't got there in time. As a project, we've only It ends there. Oh, my last slide's gone. Ah, here we go. We've only got weeks to live. And this is like quite a serious call for action. As one of the most used private decentralized communication tools that exists that is truly looking out for people's privacy.

There's a lot of other projects popping off right now who say they're here for privacy, but really it's a bit of a facade and they're actually doing what's required to protect the users. We as a project are sort of on a really challenging time right now. If we don't get more support in the next few weeks, then we're not going to make it to the point of sustainability and to you know, continue being one of the biggest Web3 products that exists. So, this is sort of a call for help. If there's anyone who wants to get involved with the project, get involved. Feel free to reach out to me and the project. If you haven't used Session before, go for it. It's an amazing tool.

And yeah, that's us. We really care about privacy. And I'm I'm quite certain that you know, every company starts off every centralized company starts off caring about privacy. But if they ever can get access to your data, then there's a non-zero chance that it will get compromised at one point in time. So, our essence as a project is never touching your data. Like we don't even want to go near it. And by not going near it, it never allows us to then be corrupted in the future. So, I hope this project lives on. I absolutely love Session. I think it has so much momentum in the space.

And I appreciate everyone's time here today. And yeah, all the best. Thank you very much. Cheers. >> [applause]