CROPS of India

Transcript

[music] [music] Hello. Yeah. All right. Uh I think this is a very interesting panel because the acronym which we're using crops which is the core focus of the organizers of defcon EF and it is has an at a place in India which fortunately or unfortunately not that crops so lots of interesting things

to talk and discuss with uh Denver came up with the panel's name. I have always worked in the crop side of things. He was you know questioning me okay can you take up this and all these things because both Nisurg and sinas I have different sets of experience I have to go through your Twitter understand what you do you know learn educate myself and everything but personally looking forward to learn a lot of things from the crops of Indian [snorts] side and yeah and hopefully people all here enjoy conversation uh before we come to the questions uh I'd like everybody to you know introduce yourself uh I personally want to know more and also to the people

uh who you are what you do and how crops is related to you know what you are associated with n you can start >> uh hi I'm Nisag I'm 19 most of you probably know because I hacked the largest high school system in India which was the CBAC and I got a lot of traction from that after that I've also been involved with nonprofit work related to internet freedom and activism and privacy rights I still work with some nonprofits to track data breaches, protective of civil rights and internet rights in India and I do a lot of independent research on data breaches on security funds in government systems on critical infra and so on. I also work on the same thing at work sidas.

>> Uh hi I'm Sinas Kodali uh I'm trained as an engineer but uh eventually I got a law degree with uh doing resistance stuff with the Indian state. uh most of my work was interdisciplinary. Um I was studying ecological systems uh it's science tech and society at large uh but I come from this place called cyber where cyerspace meets physical space in a way uh where my city is pretty dystopian. We have like lots of policing. We are the most surveiled city in India. Uh which is one of the reasons why a lot of my work came out of the city uh questioning the police,

questioning uh digitization models. Uh which led to me uh fight for the right privacy, right? Like we were people who were showing data leaks, questioning breaches, questioning censorship and resisting uh force digitization. Hey everyone, I'm Vijay and I'm one of the co-founders of Fileverse and uh for those of you who don't know uh what Fileverse is, Fileverse is a end to end encrypted workspace and collaboration protocol and uh we have been following the principles of crops uh from even before this was something that was a focus of Ethereum and everything else in general and uh like we try to uh build

our tech in a way which is value aligned with all the different principles and uh it it's and that that is one of the reason why people uh come to us and are uh using our product is because they get the walk away page and they also get the values of uh crops in their daily usage environment. Yeah. >> Uh okay. Uh let's start with our real questions. I think uh Vijay we'll start with you uh in the era of you know Google Docs sheets and all the other Google products and also if we can add Microsoft what made you start in this difficult space difficult in the sense

yes crops we know the value of it but a app which or a set of apps which already has a very concrete market it needs some sort of you know passion or internal problem facing or some sort of purpose to start u what was your why basically beyond starting fileverse both DOCS and D sheets yeah so basically I have been using these products um like before starting file and I one key problem that I faced or I was uh looking at it is that these tech has been built with all the different uh things that that are based on the trust assumptions

Right. And the trust assumptions being that there is a server that server controls everything about your digital life uh even your what it what uh data it holds who is able to access what they are able to access and everything else. So when we started Fileverse we said that this needs to change and blockchain has a way in which it can be utilized where we can come up with new primitives that will help anyone build apps that don't rely on these trust assumptions. So like if you take a look at DOC the way that it is built is it also comes with the walk away page which you can just go drop your keys and everything else everything that you have created on

uh DOC you can export that out. So that data stays with you and we cannot even take a look at under the hood what's what you are doing on that uh account of yours. Why? because we don't hold the keys the servers or any of the services that we have built. It's just throwaway services like uh anybody can self-host them, anybody can run them and so on and so forth. And there is no uh keys that are anywhere with us or with anyone uh that we uh that they use. So yeah, >> cool. Uh studios, I have a question for you. uh as I was mentioning I have very little understanding about who you was

and I went to your Twitter and I saw you quote tweeting a lots of incidents that has security breaches and all these surveillance issues and all this thing uh it is as I was mentioning that crops we might in the ecosystem or the people who are working towards have understood a bit okay the need for it but the wider people like if we go outside our ecosystem they don't understand you know the how big The problem is also your experience is in a very you know good intersection that you are a technologist but you also have a law degree. So you also have lots of these policies and all those you know those those power of academics I'll say. Uh give us a picture you know imagining that okay we are not

that much aware of what crops is and how this centralized systems you know are not good for us or affecting us in a day-to-day basis. I think you have lots of interesting stories to tell because I have found if you can paint any such incident or story in detail as much as you detail as you want will be great to hear. Uh okay let's talk about Bombay. Okay. Uh a lot of my work is in on the intersections of cities. Uh I'm I'm trained as a civil engineer. Uh I mean it's all mathematical modeling right?

You're doing mathematical formal proofs. uh when we when we're looking at digitization in India uh we did not find the logics of a lot of digitization uh coherent right like there no formal proofs uh in law like even if you're trying to say look I'm trying to build a democratic operating system for India by I'm I'm codifying the constitution I'm codifying the laws into governance systems then your mathematical model should be at least uh close to whatever the law is or whatever the constitution says. Uh but you won't find that, right?

Uh so when you're talking of mathematically modeling a city, we do a lot of traffic simulations. Uh so you are creating a digital twin of the city. Uh again that's not what is happening at digital India. So there is an inherent assumption there's a sort of centralized uh truth. So uh with ADAR with S right now with a lot of digital India systems uh there's a highly centralized model in place and this model came out because of Bombay attacks. Uh in 2008 when Bombay attacks happened uh India went through a major security crisis. it suddenly said we

really need to know who our population is. We really need to control our borders. Uh and that's where other project comes in part of the 2011 census. It starts getting executed since 2010. And a lot of India's digital India model at a fundamental level is on identity. But when you look at uh the cryptoverse uh it's it's it's anonymity or rather it's very decentralized and control the individual control of identity rather than state control of you. So uh a lot of people get this now they didn't get it 10 years ago. They didn't even get it when this the constitutional debate for

right to privacy was happening. So we had to tell people uh explain this to them like even now a lot of people don't understand what privacy is right. So we said you know what we're going to show it to them. So we showed how other data was leaky. We showed how systems were leaky, how broken they were, including policing systems, right? So the state says, "Oh, I need all of your information to protect you or protect your borders." But it doesn't protect their own systems. When all your data is being centralized and it's leaky, the entire it's it's a security problem for the state itself. So this fundamental idea that everything needs

to be highly centralized is something that I'm against. And a lot of people who have been pushing back both in the tech world and in the legal world in courts like you have the internet freedom foundation, the software freedom law center who've been questioning all sorts of censorship, right? Like and all the rules have changed over time now like you can have VPNs but you need logs, right? So India is linking identity to every packet on the internet and that's just crazy. Yeah. I think uh maybe we have been told or conditioned in such a way that where the moment we say our national ID it's kind of considered sacred so much so if

you say I don't want to use my ID you are started you know considering you are shady or you know you are not legit because I think it's a conditioning for a lot of years yes there is a need of ids for sure but I I think as you mentioned there are uh again you are the person who has tech knowledge or the most tech knowledge in on these systems you actually know that okay I have heard I've studied that these are leaky but after your research you have found that I think I'll come to Nisa also on that CBSC part how he found it but before that uh in the world of blockchain I think another follow-up question to sinas you know in the world of blockchain even you know when I logged into vijay's dox and d sheets they don't

ask my ID I can just create anon ID and I can use even if I don't want to use it I can still collaborate and do all these things that means and so in in in in the defcon team in the EF team it's quite a big it's like 200 plus people team we cross collaborate access across sheets and docs till now I haven't heard any bug that okay this this docs has been crashed or other things and they're very fairly small team so that means this all these softwares including starting with very basics I think everybody is aware of like doc sheets and all which the first step of you to do anything meaningful. Uh you need a identity attached with it starting from mail to Aadhas and all this thing. Uh blockchain team and blockchain ecosystem has found a solution. I think again he is a very

great example. But the the brand of blockchain in India specifically is not good. The moment I say I want to do something with blockchain they're like hey you are a crypto guy you will put a coin and scammer us. So that's not the point. It's like crypto is just one small application of the entire blockchain thing. And even like Vitalic when he was talking about the yesterday's opening ceremony, he just said okay our goal is to have a technology where people at the center not us and not the centralized ecosystem. So our work and our fight is also not for the blockchain. I think it's very much suitable to you but blockchain has found a solution. India doesn't consider blockchain identity is an issue. What do you think the what can be done today? Is it a way we should

talk with the institutions and tell them hey we have a better solution or we might you know build new set of architectures which is quite challenging I'll feel what what is the solution you will recommend to this you know just get out of this ID issues >> okay uh yeah so we don't just push back against the state right we also try to work with the state to find a mutual ground u like how do you say oh I want privacy I want some things you want this okay sure we can come to middle ground somewhere how do you negotiate that uh so there are a lot of organizations who do this with litigations and courts there also organizations who write to the state uh when I was with the free

software movement of India we actively engage with certain certain has a citizen charter where they have to actually respond to you there was a phase where certain was under RTI so you would actually engage with the state in terms of very specific [snorts] to blockchain. Uh it's not very black and white, right? A lot of uh state institutions when I say state all arms of government actually tried to use blockchain. There was one election commission conference where they're saying we should use blockchain for elections. The election commission of India. So uh the problem was uh the push by the Indian developers to push identity everywhere and blockchain

essentially didn't fit their model there. Now there is a bit of uh interaction uh integrations happening with this idea of finteret that's being proposed uh where you have a lot of fintech companies that have been doing a bit of work with account aggregators UPI who are all trying to integrate uh with blockchain uh different others I don't know if they've done anything with Ethereum they've definitely done some with Solana so um there is a case for blockchain uh I mean it's just that you have to find where uh for example digital signatures uh is great so if you're trying to do a

bit of contracts on blockchain or smart contracts literally in Indian law like there's a whole rise of legal tech that's happening uh but there digital signatures also regulated in India with by CCA we've seen what happened with Emodra so I think we have to find some scenarios where a certain bit of identity is acceptable in case of contracts that part is acceptable. So we just have to work with the state on some of these use cases which are acceptable to us.

>> I think I think evolution is the way not like revolution I think many people in the our ecosystem says that you know progressive evolution versus you know uh revolutionizing against the state and all. I'll come to Nisara. Uh uh I think as you mentioned when you were introducing yourself about the CBAC thing, I personally went through your entire you know journey about uh how you found the CBC hack and also followed your Twitter which is quite rogue. This guy doesn't fear anybody apparently. But I'd like you to you know just in like five seven minutes just just take us through the you know the how you found the CBAC hack. what are the leakages in the website? How you discovered and then

finally how you you know fixed it and then the journey towards IIT Khan board. >> Oh nice question. So uh my board exams are going on this year. I was in class 12th. Uh I gave my physics exam and I came home. I opened news. I saw that they have shifted to some digital marking system this year which was controversial and people are criticizing it. So I looked up public circulars and I found out the evaluated dashboard URL. It is pretty interesting considering that the dashboard should be safe, secure behind a firewall or a VPN. It was open to the internet. I was on a exit node when I accessed the website and it opened properly for me. I as usual I've been doing CTS for a long

long time now. I've been hacking as a hobby. I used to work as a backend engineer at a startup at that time. I became curious. I digged into the side. I found a hard-coded master password in the front end and with that I was managed to take over a lot of examiner accounts. I found other vulnerabilities uh but as my exams are going on and as this was not exciting enough for me I documented all of it and sent it to the government and I forgot about it. Uh when results released I realized that they did not patch anything. Results were also pretty bad. So I went public with my research and it all blew up. Uh during that time CBC tried denying so I got a reverse shell in their server with a friend and I played an anime video on

the broad CBSC site. I also got access to 20 or 30 million answer sheets which they scan and after that they admitted that see that they were indeed compromised and they were working with people to fix it and during that time the director of IIT Kpu reached out to me and he said come work with us on cool stuff. So I said yes sure why not. I currently work with IT where I get to travel a lot for conferences like this. I keep traveling all over India all the time because we have office in Delhi as well. And yes I also do a lot of independent hacking. I have hacked the US DOJ DoD. I'm in the hall of fame. I also hack random Indian government sites like critical government sites just to secure them. I don't get paid anything for it. I don't even get an

acknowledgement for uncertain and yes it's just fun and that's what I do mostly. I think uh also uh along this you know exam things and all I also saw found you some tweets were tweeting about telegram uh so when the uh you know that uh the doctor's exam which is like I think uh need >> yeah need exam sorry for forgetting it uh so the needs exam which was going on I think they banned telegram for you know certain time and I saw you are you know posting crazy memes and those those those rogue tweets which you do which are quite funny as well as technically enriched what's your thought and you know what's what's your thought process behind the entire telegram saga which was going during neat >> so see uh I do not think that closing

roads will fix accidents and people will stop dying so that was the same analogy there closing telegram won't stop paper leaks people can leak paper on discord Twitter WhatsApp anywhere and closing an open source like it's not open source the client is open source but closing an app which is designed to circumvent censorship is pretty stupid Because to access telegram in a state where the telegram where telegram is blocked you can just use the based like telegram has inbuilt empty proto and sks proxies you don't even need a VPN to access telegram servers whether telegram is blogged so it was pretty stupid even I fought with my employer about this on Twitter publicly and that also ended up on news.

So it was a pretty crazy time. >> Awesome. I think I'll I'll accelerate a bit about a few questions I have. Uh meanwhile if you want to ask any questions you can ask here. I already got two questions but before I commit here I personally have you know one practical questions to all of you. Mr. Shinas you can start. Uh we are talking lots about crops. Uh by the way like I don't I don't told the full form of crops everybody might know but I just want to mention it once it's like censorship resistance opensource privacy security. I think everybody of us have already touched those points. This is just an acronym but coming back to you know shinas uh we're talking lots about crops now and uh at state level things

and the problems which state has but it's also a individual level problem I think you three of us has uh you know like much more awareness than other individual towards this important uh thing which you're talking about what is you follow on a day-to-day basis which is kind of crops aligned and what will be your suggestion to a normie that okay you can take this tape and you can proceed towards a crops powered future. >> Yeah. So for me when I started it it was more about freedoms.

So I was part of false communities in India and free was freedom right now kind of it's it's more about free free beer sort of it's become that it's uh but so we were just having fun. We were just uh building good tech until the state said that the tech has to be one way only. Right? I think uh the idea of resistance is just choosing any alternative. It doesn't has to be that uh the resistance need not mean that you have to get on blockchain, you have to get on signal or you probably have to get on do PGP. It it it cannot be one form.

Okay. Uh but yeah, if you if you want me to give you tips, uh it's from a security perspective, right? Uh I would say don't put a SIM in your phone, okay? Have multiple devices. Uh people people do like people I know have like seven SIM cards, different numbers. Uh the moment you put a SIM in your phone, your phone is registered with the state. the state knows that you have this device. There are all sorts of things that you can do your own personal safety. Uh but when it comes to privacy again uh you can choose uh there have been some experiments. There was a

friend who built an app called Dusra which gave a second phone number for you so that you can share it at supermarket marketplaces online. It'll just block all calls by default. Right? So you can personalize your own uh privacy uh at a personal level and just doing that at a personal level compounds largely. Uh but if you want to do anything state facing I would suggest you organize and don't attempt to do it individually. Uh it's a very bad idea trying to question anyone in authority as an individual unless you are trained to negotiate with them.

Yeah. I think uh before coming to you know Nisar I'll ask you the same question. I think what you mentioned about SIM card I think you know few days back Vitalik published one uh blog which was called technology minimalism something similar and here he explicitly mentioned that he was exper experiencing you know trying not to use to you know switching off the mobile data for a long time and he was just living by using Wi-Fi. He was I think the entire blog talks a lot about you know this digital minimalism life which is super crops aligned personally I think I've hardly got any vital blogs it's always goes over my head but that is one very practical approach just having those basic you know fixes in our life we can leave less digital footprints and you

know live a more crops life >> and he recently yesterday only said that treat personal data is toxic waste correct >> and I I think that's true. Uh meaning uh if you want to be uh minimal in your footprints, you have to start somewhere and that somewhere is with the personal things that you're using. >> I think uh Vijay I think you can since you already hold the mic I also like to hold you. Yes, DX D sheets is a great alternative. You know I am also personally trying to use more your products versus doc and sheets because that's I am convincing myself that I'm leaving a crops power world but other than that also since these are not you

know because these are your products what will be your advice to people obviously uh and also what you do like as suggested you know try to live with you know no seam and all what will be your one suggestion to live a crop spot life >> uh that's an interesting question uh like basically maybe I can start by saying why I suggest people to use files [laughter] and uh it's not to convince to you to use it. It's just to uh give you a reference point on how you can think about any tech that you have. So for example why I say file versus census resistant is because we don't have any kind of switch which can say that this account

is uh blocked right or this account cannot use the service that's where the census resistance comes from then there is uh open standards or open source. So for that like uh everything at file is open source. So you can just uh instead of believing my word you can take a look at the code and say that uh you say this but it's happening in a different way. That's uh the idea about openness and open source. Now uh for the privacy specifically we don't limit to one particular email you can even use your wallet for on boarding to the service.

uh and uh that's where the privacy picture comes in that you and this is how I think the defense of blockchain is as well that if you are fed up with one particular wallet you can just create a new wallet and go ahead and start using it. Then for security like we make sure that the audit and everything else is there. Now what do I take from all of this is try to see if you see these principles applied in any kind of tech that you use and go and support them. So it can be for example instead of using GitHub you can use radical uh instead of using uh like uh wallet that uh does not have privacy or all of these things.

Maybe go with some tools which has Kohaku integration or like different kind of privacy protocols integration. uh maybe run relay nodes for to or different kind of things and they would help other people get more out of the privacy ecosystem in general, right? Because the best defense is uh as uh uh Shina said uh is to organize and not to do it alone, right? and basically help others in uh being able to uh be uh safe, secure and uh do things that they want. And then figuring out alternate tools is the one thing that I do and uh personally and uh figuring out like

which services are implementing these uh things that I'm saying and how and why. And then third is like making sure that I'm doing something good for the others as well by being a useful person in the ecosystem. So yeah uh nar I'll come to you on your thoughts of you know what you do for bypassing all these centralized systems and what will be your advice to people >> for privacy >> for like the overall crops maybe using more open source tools for private lives.

>> Yeah. So basically stop using mainstream email providers. That is what I supposed to like what I recommend to people. Either self-host your own email. There are good mail providers like Docker mail server and all but that is too complex for some people and you can use niche mail providers like this route 42 or proton mail fence and etc. Secondly, stop using physical sim cards. I mean I my iPhone does not have a physical sim card slot. All sim cards I use I have one Indian eim and other US and UK eims.

I always use eim cards because suppose your phone gets stolen and someone takes your sim card they can hijack all the OTPs which and take over your accounts and that is a huge security risk with eim cards you can totally avoid that and third thing you can do is obviously decentralization is a way to go sell make your use ent your own next cloud don't store your personal data on iCloud or Google drive suppose you get into some legal trouble with the state and the state can request your data from Google to see what was there and if if you use proton mail or proton drive or your own self-hosted um encrypt encrypted cloud you can easily avoid that. So yeah, charity begins begins at home. Before taking any action

against the state or joining in digital protest or anything, you need to secure yourself and obviously maintain good obstac. >> Awesome. I think uh we got three questions. I'll quickly say my point of view about you know what I'm trying to do a more crops powered world. I think within EF and also outside I think signal is a great alternative might not be the best but it's quite best. It's open source. uh another great way is uh you know like as Nisag was saying few days back I he met somebody in IIT Bombay he was saying you know try to host as much as you know self-hosting things I think with claude and with this entire vibe coding shift I think uh the main challenge is just we ensure that we don't give all our data to this AI so

that it you know knows about who we are I think the security we have to be mindful but the hosting part with all these complexities have you know reduced a lot uh or use end to end encrypted apps. >> Yeah. Yeah. Uh okay. I got three questions. Uh I'll quickly short list of all of them. So uh one of the questions is uh we need more white hats. Few people are not enough. Uh how can the average person know enough to be able to be the truth? Uh not every white hat might be passionate to solve you know the problem of two billion like basically they're saying you know how can you solve your own problem? If anybody wants to take that >> I mean uh in cyber security right like

now with AI it's just like too many bugs everybody anybody with an uncensored model is a hacker uh but not everybody has access to my okay uh how do you then train people I think uh we need to talk about training people more into cyber security and there is this whole thing of like uh how many bugs can you patch even [snorts] though if you can find out that there is a bug right and which ones do you patch like what are the critical ones and which are the ones you can probably ignore so uh we need to do a lot more training um I guess as a community we can do a lot

more in that aspect yeah >> yeah and I have I think uh two things that you can do one is the like build defender setups like for example uh have uh LLM's setups that you can create which uh can audit some open-source software or any kind of software or create patches and things like that and I think uh Niss can add a bit more on that. That's one idea. Then there is another thing which is uh to donate your credits to people that are uh building those kind of setups and uh so that you can if this if some AI credits that might get wasted by the end of the week

you can donate those credits to those organizations and they can uh secure the open-source aspect of the different things that you're using. So those are the two key practical things I think you can do uh without knowing the tech side of things. And my advice will be a little bit philosophical on this because see white hacking or vigilante hacking this requires people who are motivated by a particular philosophy or an ideology not money nor accomplishment. When you're finding vulnerabilities in government sites you should not expect anything in return. No popularity, no recognition, no acknowledgement. You just need to keep that in mind that you're doing it for the society. You're doing it for the greater good. And the second thing we need to focus on like

teaching pe like finding more passionate people and curious people and grooming them to be a white hackers. So suppose you find someone who's opposite computers just give them enough compute show them how hacking looks like tease them and they can go on hacking sites and finding reporting to the government that creates a net positive for the society. So you need more communities like lag gransport threat loud and others. >> Awesome. I think we have a minute for a one quick question that's uh like government is trying to like basically like summarizing it. It's like mentioning that yes our existing identity systems are a issue but how can we negotiate with them to suggest an alternative maybe you know sinas you can suggest actually we had this negotiation in 2017 2018 right like uh we pushed for

tokenization we got something called virtual Aadhaar there's actually uh the app the Aadhaar app allows you to generate virtual Aadhaar right uh so we actually piggybacked hacked their design while pushing back by showing leaks. What we said is hey you're building a highly centralized system uh and this is very dangerous. So when we went through the whole code process to tell the code that oh no this is not bad entirely we can minimize the damage by having a virtual Aadhaar. It wasn't something that we proposed. It was something that they the uh the people who designed Aadhaar including Mr. Nilikini uh said that and he got virtual Aadhaar but they

won't let you use it anymore right like they still and we we got the state to force masking your Aadhaar numbers [snorts] right uh otherwise they like oh other numbers should be shared everywhere uh and we got the ex CEO of UIDI to share his Aadhaar number on Twitter right like so there are many ways you can do it and I think you can still practice that right now now the government itself saying oh we don't want Aadhaar we want your voter ID all of your voter data is also public anyway. So [snorts] >> there was an exploit on ECI site called Data and you can use that for doxing. So it's >> so whenever anybody used to ask me for a privacy option in using ID cards I say okay use your voter ID everywhere because it's anyway public. It's by law

public right >> that is also public if you know how to find >> that is leaky but voter data is by law public. Uh so we said okay use your water data. You're checking into a hotel wherever you're going use your water data. There's nothing much they can do with it. It's public by default. Uh it's not linked. It doesn't have a OTP. They can't misuse it anyway except probably they'll remove you out of the voter list. But uh uh other because it's linked to your bank account, it's linked everywhere. It becoming leaky has more risk versus any other ID. So the less you use it, the better.

>> Awesome. Uh I think we are out of time but if any anybody have any quick closing thoughts and yep we can wrap up the panel. N >> people need to be curious. People should not expect anything from the state and they need to do what they're good at and never back down from the state. Never lose hope. Always try the best. Whatever happens happens. >> Yeah. And I think uh one thing that I would say if you take away from this panel uh it's uh treat personal data as toxic waste. uh and uh like try to use end to end encrypted apps or and uh reduce as much as digital footprint as you can by using healthier alternatives.

>> Can I just say one sentence >> please? Uh privacy for people, transparency for state. >> Yeah, >> that's what we need. Yeah. >> Awesome. I think uh great great chat you know great learned so much from all of you guys with much little context I have particularly for both of you and I hope you everybody who are here the 10 people who are here >> [music]