DappCon 2023: Your Ethereum Wallet Isn't Private - Let's Fix That! - Sebastian Buergel

Transcript

thank you all for showing up here on a somewhat rainy afternoon on the last day of dcon my name is Sebastian I'm fer of Hopper and I'm very happy to talk to you about a topic that's kind of dear to me and I think very much overlooked in The Wider ethereum ecosystem so is there anyone in the room who has an ethereum wallet hands up please I see a few hands that's good cool so um I am making this uh more interactive Workshop so um yeah we're going to place through some stuff and my objective here is to First make aware of what the issue is with wallet privacy on a layer that's not so much talked about

secondly briefly talk about what we do at Hopper and thirdly um present a like latest project that we're just launching now um to fix that and yeah that's what we'll be talking about in the next 45 minutes or so there's any questions please interrupt me anytime and ask if there's any technical issues my colleague Felix here in the front also in a yellow t-shirt is very happy to help you throughout the workshop so after we've seen that there's some people in the room who do have an ethereum wallet that's great um you know uh I would like to make you think about do you have something to

hide right you might say no I have nothing to hide right but this is the wrong question when we think about privacy right so privacy is really about getting these fundamental human rights back into the digital space that's what this is about for me for me this is not about oh you know I'm not an illegal guy I didn't trade on Silk Road you know most people who entered crypto early did trade on Silk Road and you know I don't judge any of that it is about giving you the human rights that we we have in the real world and try to bring as much as possible of that to the digital world because without that this digital great new world that we're building for us and for the generations

after us who are you know building amazing things is just it's just corrupt that is to me what the web 3 should be all about now as we enter the etherum ecosystem with our wallet there is um you know your wallet which is kind of naive it doesn't does know what's going on in the world in fact your wallet is a pretty dumb piece of software it can typically store a private key more or less secure can make transactions but that's pretty much it specifically your wallet does not know for example your balance it needs help and the help that your wallet gets is coming through a so-called RPC

provider RPD send for remote procedure calls and it's what your wallet does in order to get some information such as what is my eth balance what's my erc20 token balance what is the current gas price and stuff like that so the first thing that we're going to do is we look at you know there's a bunch of people here who I know are familiar with all of that but we will look at that in a practical setting because I promise you there's going to be some things that even the more the ones who are more familiar with ethereum for many years already will find surprising so the first thing that we're going to look at is derp derp stands for dumb ethereum RPC provider and basically all that derp does is it serves

information to your wallet and it echoes it back to you we made a nice website which makes it a bit more interactive and tangible because otherwise the data which is made available to these Central providers which are you know seeing and helping out your wallet with all the information that it needs um it's something abstract right metadata is something yeah you know I care about my IP address well bad news it's much more than your IP address so the first thing I would like you to do for the ones who want to play along um is navigate to derp that's dp. Hopper net.org h o net.org this you can do this on a mobile it is a bit more cumbersome on a mobile

so if you do have a laptop I would encourage you to do it on a laptop just because you can have like multiple windows at one in one instance now what this thing is is again like you can add an RPC provider to your wallet and it echoes it back to the website we call it dummy thp provider because we don't actually do anything with it in fact how it works is um by the way you'll also find the code for all of this as everything we do on our GitHub so if you want to mess around with this for other purposes please feel free to do so so uh what this does is actually we have a server which just proxies requests right it it takes your request it's it sends it to some other provider that we've configured and it it also like Echo it back to your website we

don't store that information of course you have to trust me right it could be that we're running different code there you know so don't assume this is private just as with any other RPC provider do not assume this thing is private do not assume that we are good guys um and yeah then it's it's it's mirroring it back to the same IP I just realized we are all connected to the same IP address I'm pretty curious how this will work um let's so I'm going to demo um to make this at least for me a little bit quirky um I'm going to be connected to my hotspot the second thing if there are some quirks here with everybody having the same public IP do not do that with a wallet

that you don't want everybody else in the room here to know yeah so I'm going to talk about privacy but in his demonstration purpose um you might leak information about you that you don't want to leak if you if you don't want to do that don't go ahead here do it from your home from a isolated Network and so on so I'm on a derp website again it's dp. hopper. org and I am using metamask this does work with most other ethereum wallets that I'm familiar with just to you know make it easier to follow along because I know mamas is not the prettiest wallet but it's the most popular one I'm going to demo it for metamask so I'm going to hit that setup button and you see can you actually see

that let me make that a bit bigger so you can use derp on various you can use derp on various chains and again all that it that we're doing here is we are you know adding this endpoint to our wallet now and what our server in the background does it just proxies it back to some other provider so I am going to be since we're in Berlin I'm obviously going to do that on nosis chain so I'm going to I have my metam Mass um unlocked here by the way you saw that little like glitch when it took like half a second to load like this little metamask moment we will look in a second what that metamask moment actually is like why does that happen so you just get that URL again yes it's dp. Hopper

net.org h o NE t.org dp. Hopper net.org um yeah so basically I have my metamask I have it unlocked by the way there was a new version of metamask coming out last night um but it should work with either they know have snaps integrated which is awesome so I'm going to hit switch and now you will see that it adds this end point um to my metamask it ask me do I want that and in uh my case yes I do want that so it just asked me to confirm that again like what's the what's the worst

case trust assumption at this point like mamas ask you about something hey watch out like at this moment you all should be do I trust these guys so the worst case trust assumption here is that this provider sees absolutely everything that your wallet does okay just for your info um I'm going to proove it and I'm going to switch the network from ethereum Main net to derp nosis chain switch Network and I'm going to scroll down here and there's a bunch of interesting things going on here so first of all um it shows me I'm in Switzerland that's weird right this is my IP address why is that because I'm connected to my hotspot yes I doxed myself as having a a Swiss

carrier and you see already some addresses here you see chain ID and you see that it made Seven calls like okay interesting right so the RPC provider was already um you know being informed of my etherum addresses anybody get a clue why that is I just connected it and the RPC provider already knows my ethereum address I didn't make any transactions why is qu balance querium balance exactly so in a table down here we see the extra requests that are being made and what we see is um that let me try to see The Ordering of that one so the latest one is on top so basically what

it did is an eth get balance so for the one who are not familiar with ethereum RPC calls there is it's basically a server and on the server we're calling a function to say get me my balance and the function that's called get me my balance is called eth get balance that's the end point that's kind of obvious right and in order to find out my balance it needs to know my ethereum address and that is this one here now what is maybe a little bit less obvious is that there are additional so-called header fields in this requests which reveal already something about about me right so this is all metadata information which if you actually think about it the provider has no point in knowing right there's absolutely no

reason why a provider would need to know that I'm on some you know Mozilla based thing on a Linux you know and a bunch of other information so that's a bit weird it's oversharing and the more important thing I find is up here my IP address right so the provider at this point um knows about my IP address and at this point I would like to make a little pause because I um sometimes get this feedback about flag da okay you know Sebastian surprising the RPC provider knows my IP address tell me something new and I'm saying well you know that's private information that is not necessarily shared with them okay fine I'm not so concerned

about sharing my IP address what are you going to do about that what I am concerned about is linkability who here has more than one ethereum address okay one or two people good now maybe some of us have an ens domain that is linked to the name like I have like SD burgle which is my you know handle that I use all over the place I have a pup address right Patricio running around here everybody that runs into Patricio gets a pup if they want it or not you collect these things that are tied to your face to your real world identity and many of us have you know some Savings in crypto so that do not necessarily need to be tied together you should have the right to separate these

two now this provider here can link them this provider now sees that the exact same IP address quered you know within very short time actually if you look at the time stamps here it's kind of it's kind of funny So within the same millisecond you get hit from the same IP address with you know an eat balance request from two different addresses well probably that person is is um yeah is is controlling these addresses or was sitting in the same room and so on so yeah that is um that is something that I find much more concerning right so that is something I find much more concerning than just sharing my IP addresses linkability the second um answer that I sometimes

get is well you know you're a pleb you use a centralized provider I'm a smart boy I run my own ethereum Noe I run my D node that's cool but let's think about what that means you use your D note and these read requests to check your balance and so on they all go to your note and your note doesn't inform anybody else that's okay but when you send a transaction this transaction is being sent through your D note from home that doesn't originate any other type of addresses so it is pretty trivial for other participants in a network to find out where that transaction originated from so your D note your only ethereum note is in fact helping you for reading

it keeps reads private because it isn't shared with anyone but it does not keep rights private right writing to the blockchain is not kept private because your that not or whatever you use is synonymous with your identity it's exclusive in other words as we sometimes say privacy loves company right so you want to share this thing but then again you have a provider which other people need to trust what do I also sometimes get the answer well you know I use a VPN okay let's look into that you're a smart person who uses a VPN a VPN is great because that VPN provide that that RPC provider doesn't see where you live they don't see IP

address but I'm not really concerned about that because this information of my IP address is not really concerning I'm concerned about linkability so in essence you're changing one centralized provider which is like infura Alchemy or some of these other RPC providers with another one that's called a VPN provider I have no reason to trust one more than the other it's a centralized trust assumption that this person and all the people in that company um you know don't violate that trust so let's think about how that actually is in terms of privacy um under this threat model of I'm concerned about linkability use a VPN provider okay like nordvpn something you know hopefully

something you know more legit um this VPN provider has a bunch of servers so your anonymity set so the number of people who could be you is the number of people who use your VPN provider on that very server that you're connected to at that exact time with the same metadata information that your wallet produces I can guarantee you whatever VPN provider you're using you are alone your anonymity set is going to be one so in terms of linkability of addresses you know that's not really going to help you that's not

good so we're going to fix that but you know first of all I just want to show a few more things that I find kind of interesting when when looking at this thing here so first of all like for you all here in the room do you see everybody's request actually yes you see like a whole lot of other addresses which are not yours yes or no you just see yours sorry there are more there are more cool okay so you know welcome to the club of you know ethereum addresses in this room congratulations you dock each other um so yeah let's look at what is actually going on as you interact with a dep out there if you do anything right because

it gets worse with regards to privacy so again for the ones who didn't manage to set it up at first you just go to dp. hopper. org dp. hop.org you hit the setup button and you add this network to your metamask now um what happens actually so far is kind of you know not surprising metamask is quing the block number basically asking hey provider what's the time right now in terms of you know block number we just see the request we don't see the response because the response is kind of it doesn't matter you can always kind of reconstruct it from the request so I didn't do anything so all the time while I was talking my metamask

seems to be every 30 seconds to be quering the current block number fair enough so let's do something I'm going to send myself some um e by the way if you want to do something cheap I encourage you that you do that in nosis chain there is a fet called nosis faucet dot uh Felix what is it nosis faucet . just for no yeah noes faucet.com you can request like a fraction of an X which is kind of cool to just toy around with it now the first thing that I'm going to do is I will um what am I going to do is I'm actually going to use Sushi like sushi is kind of

like um yeah it's kind of interesting to look at so I am going to keep my browser windows next to each other so we can follow um the new requests as they come in as I'm doing stuff here so so far metamask is just cing the block number um I'm going to oh okay that's a bit lame because I'm already connected here um I'm going to disconnect I'm going to reconnect my metamask and I'm going to uh start a swap So Sushi swap already knows that I have 0.3x die here and I'm going to switch you know uh one

cent for gno it's going to be a tiny amount of gno that I'm going to get out of this one okay I'm willing to swap for it right this is just frontend interactions now something interesting starts happening here it doesn't ethg get code right what is ethg get code well ethg get code is just um a request to get the bite code in the evm at that address which is probably the sushi rouer let's quickly check it out nosis scan. it's the nosis blockchain Explorer I'm just going to copy paste the address I'm going to look at the contract and indeed is the root processor number three okay um we're looking at this from a privacy angle here so what does that

leak about you that leaks to the RPC provider that you're about to use Sushi swap right okay whatever it does an e call okay interesting well it's the same address and now we're calling a function we reading right this is a read on a smart contract so what are we reading here so if you new to ethereum like you might be uh interested to hear that the first um the first four bytes of this things so the first like 10 characters encode the function of what we're calling there so I'm going to copy paste the first two four eight bytes of this and there's a very cool website called 4

bytes. directory um 4 byte directory um that allows you to do a reverse lookup of this function signature and um yeah this one is a like since just first four bytes there is some there's some override so the first one I think is just some some thing where somebody found a hash Collision but the second one is most likely what I'm actually going to call which is supports interface right so it's basically trying to find out like if the smart contract supports something I don't know exactly what it does so um another eth call a Bunches of eth call and a fee history right so now somebody's quering kind of what is the

fee history so how expensive is it going to be if I make a transaction and now something very interesting follows eth estimate gas so if you look at this eth estimate gas um that's basically asking hey tell me how exp how much gas do I have to spend for this transaction um and that's basically just so that your wallet knows how much to send along again very boring I know most of you know it but think about it from a privacy perspective what does that mean we might trade you know a million dollar worth of stuff what happens when you trade a million dollar on an on a kind of naive amm you know there's front running back running all this fun stuff called me cool now you are sharing with the centralized provider what you're

about to do is this is not a transaction this is something that you're pretty certainly going to do because you just hit the button what you want to do so you see in this transaction like this from addresses me you send something to the sushi router you um see you know exactly how many X die I'm going to send along and a bunch of other things this is like root information and the recipient address and I don't know why my address is in there twice actually so you disclose everything what you're about to do before you have even signed it now congratulations I can tell you what I'm going to do with that information if I'm an meev Hunter yeah so again if this is nothing new this is all cool but let's think about it for a second the direction in which ethereum

moves Direction ethereum moves in the direction of decentralization I'm all up for decentralization I want decentralization of power I want to see decentralization of infrastructure but this information is currently going to you know if you're on mainnet chances are it goes to you know Joe's basement and we all trust them um maybe that's fine let's fast forward you know there's people working on decentralized rpcs which again I want to see decentralized rpcs but there's now a random lady on the Internet or a random dude on the internet that you trust with this information is that going to end well I don't think so so in order to decentralize infrastructure we need

privacy building blocks in order to use that safely so that's what this is about and that's what I want to think about when I see these things so you disclose something that is not signed yet so it could be but chances are this is real right if I observe you for a long time I'm going to find out patterns and I'm going to be able to front run everybody else because I know what you're going to sign in a minute from now so that's why um I find it kind of interesting to to look at these things okay I was talking for a long while so it was crying my balances getting block numbers and whatnot now let's actually go ahead and sign this trans action um cool confirm I signed it we seen e

send raw transaction e send raw transaction takes the signed transaction broadcast it to the network that's the thing that now you know if this was main net where a bunch of Searchers would jump on this thing and go like you know Goblin mode on that one try to find out how they can screw me so and if you compare these two if you compare these two uh requests it's a bit it's a bit longer to scroll but you might remember it they look quite similar the only thing that's different is the signature the signature is the only thing that's different than the second one compared to the first one and um yeah so there's an opportunity to front run the Front Runners if you're an RPC provider there's a lot of other information that you leak um even before you signed that

actual transaction um good okay so that was basically something that that can go wrong I want to show one extra fun thing I told you like this little metamask effect when you like clicked the thing the first time it was stalling for a while I promise you we're going to look at that um you know what actually happens there in order to look at that I'm going to close my browser window it's going to be probably a bit more messy for all of you who share the same anonymity set there um what I'm going to do is I will actually by the way uh shout out here to cubes OS I found a wonderful uh privacy respecting and safe operating system um I'm going to open a separate VM here just to keep things super separate and

I'm going to open this website again just to you know um visualize that that I'm not cheating So currently my metamask is closed metamask is not running that's why it doesn't show any requests yeah so oh interesting um you know something somewhere is cring an e block number now that's weird uh because I had this one open okay okay well fail cool reload this now actually everything else is closed so I'm going to open my My Demo VM again I'm going to open my my Brave again um okay there's a bunch of requests

um yeah interesting right my metamask is locked yeah my metamask is locked and yet it already like made a bunch of requests to the RPC provider I'm connected to luckily in this example I didn't you know it didn't leak my address yet but like it made requests to an RPC provider which revealed private information about me such as my operating system my IP the browser version that I'm using the the wallet version version that I'm using and so on before it's unlocked so and the next thing that you see is um as scroll down here on the right minimize that one um ah okay Sushi wants to connect to it let close

sushi um if I hit this metamask you see this request going out here like so metamask is making a request it seems to be like synchronously waiting for the request to come back and then it loads the UI so like that's stuff that you see when you kind of look at the requests in parallel that's why we have this Midas second when we load I don't know why they do it that way but we see it good okay I don't want to dive any deeper into the issue of um what your wallet leaks about you I think it should be evidently clear that an RPC provider is a centralized point of failure which we trust with a lot of metadata that can be used against us as individuals which are interacting with the web 3 I don't care if you're doing

you know million dollar trades on Unis Swap and you can get front run um by some Searchers or if you're sniping an nft where somebody is you know trying to confirm first if you're interacting on web 3 social where people kind of can see what you do and who you interact with even before it happens you're being watched all the time and that's something that needs to be fixed there's a lot of people working on onchain privacy and I really hope that happens but onchain privacy isn't enough we need transport privacy to PR protect this sometimes they call it aillis heal of ethereum because yeah um if we have onchain privacy and your IP address becomes your primary identifier that doesn't help us much so luckily

somebody's working on it yes it's us we at Hopper and let's briefly uh talk about what we what we do at Hopper um let me open that up real quick um so basically Hopper is a mixnet what is a mixnet a mixnet is a network um for relaying data so I can send data to someone here in the room by sending data packet to you who release it to the next one to the next one who sends it to the final recipient so I'm forwarding data packets so the recipient of these data just sees the last sometimes also called exit note

they don't see the previous relayer or the previous relayer before that or even the center it's upos skating where data came from and where it goes to and again there's some people in the room here who have heard about vpns we talked about it or tour and indeed that is something that sounds very similar to Tor you have this multihop relaying of data that is very similar to Tor but there is three important differences to tour the first one is we do what is called packet mixing so as visualized there data packets are coming into a mix note this mix note is caching data packets for a short amount of time transforming them so they look different and indistinguishable when they come out and

sending them out in a different order and that is how even a super strong adversary let's say your internet service provider who sees every packet that goes into your router and every packet that comes out of your router cannot link incoming and outgoing traffic that's something that you don't have in tour because tour takes packets and sends them on and you can kind of tag them a mixnet therefore has stronger privacy assumptions than tour specifically the trust Assumption of a mixnet is that only one note along this path is honest if you have one honestly mixing note your route of multiple hops then you're fine why because this this mixing and tumbling of data cannot be um yeah cannot be linked cool so the second

one is that this is of course a decentralized network so it's it's a bunch of fre layers in this network and the third one um is that people can make money by doing so so if you re relay data for others you earn Hopper tokens so the people who operate these notes they stake Hopper tokens in order to for you to use that and gain privacy that's the hopper Network and you can use it for general purpose application you can build a private chat app on top of it and uh by the way we've done that a while ago you can use it for a private iot app or coming back to our wallet problem we can try to solve that wallet problem that's what I'm going to

get into now and you're going to be the first first ones outside of the hopper team who are actually testing that so please forgive me if something up this is a product that's live since two days which is running on top of infrastructure that is live since seven days so somebody's laughing yeah please laugh when it fails so um yeah what is rpch rpch is as we call it a private RPC provider now since we've been diving a little bit deeper into the whole thing like this is actually not true but it's catchy and people understand what I'm talking about when I say it so for this audience rpch is privacy middleware that sits between

your wallet and the RPC provider and connects or actually disconnects these two by the hopper mixet so rpch stands for RPC over Hopper so we change the underlying transport infrastructure when you um when you edit a network to your metamask you have this drop down again takes one and a half seconds obviously um you have this drop down here these entries let me actually unlock it and we can look at the entries they all begin with https right so HTTP is using existing internet infrastructure which is not privacy respecting so um at Network so all these networks basically

begin in the um RPC URL begin with https which is sec cure right it's entered encrypted but it's not private in the sense that third parties can see exactly who you're pinging there so um that's what we want to fix and therefore we cannot use just another entry because all the entries on this list use htps which is not metadata private so we need to do something else so that's a bit tricky right because Hopper is as I said live since like in that version since 7 Days um for some unfortunate reason Brave has not integrated Hopper yet in this seven days chances are it's not going to happen tomorrow so we need to find a solution and what we actually do um what I'm going to demo and we can do

together here is um that we add a executable that's running on your computer and uh what I'm going to demo here is based on Docker so the ones here who have Docker running um yeah that's a Docker container that will install that is running a local instance to which you can connect your wallet which is then taking the these requests that reveal so much about you breaks it up into indistinguishable looking packets that we've seen in a in a beautiful animation before sends it through this Hopper Network and then sends it to an RPC provider and remember when I said I was cheating a little bit when I said that Hopper is the private RPC provider well you can send it to any of the

centralized providers that we have today but they will not see your IP address and they will not see that it came from you right they just see the exit note from which it was coming and you know that looks kind of indistinguishable it's used by a bunch of people and therefore you have stronger privacy assumptions than you know even a VPN so let's look into how that actually works so I would like you to go by the way St questions this far yes will it also help with the time um correlation that could be made because if even if they don't know who you are or where it came from if they see two requests that come in the same Mill for two different

addes they can there's not much you can do exactly and also you know if you have additional information such as Header information you're screwed basically you know if the application is screwing you there's nothing we can do we can help you to get better in the net if the application tries to you know do a reasonable job you know um in a previous version metamask had actually these batch requests which in a single request was sending out like all your addresses so that's even more trivial we got one step better now half year later I think you know um if we're all bitching a bit more maybe they just do individual requests and um yeah and and separating that but you're absolutely right if

there's application layer data or metadata that is being leaked you can fix that on a transport site other questions why why did you choose to like mix the and add latery to requests rather than just subate with a bunch of C yeah so why did we choose to um like fix latency instead of adding a bunch of craft that's actually a good question and in fact we are doing both so this adding a bunch of crap is translated in um kind of academic terms we call that cover traffic right so cover traffic is background noise and if you know you can imagine that if you're

standing in a football stadium and you're shouting I know it's you if there's 50,000 other people who are shouting around you I can hear to you so that is what's going on we do that general purpose again on the transport layer not with the RPC data but in theory what you could do is you could run some you know something locally a service that is you know dispersing a bunch of random RPC request from like vitalic eth and whatnot right yeah you can you can totally do that um good okay so let's jump into RPC so I would like to ask you to enter RP ch.net again which stands for RPC over Hopper and RPC over Hopper is again this this additional layer and we we want to

use it now so in order to get access um it's a free Alpha again you're the first ones who actually use this thing I would like you to hit the access button the top right fonts are looking almost right um and you hit the D package is a d package because because the only way to access that is unfortunately um Docker I know normal people are not going to use Docker I hope some of you are so in order to get started because it's for you we do not ask you to lock in with Google we ask you to lock in with ethereum so I'm going to connected to my metamask metamask is going to ask me to sign some stuff whenever you sign something please do check what you sign

when somebody asks you to sign random looking hex strings please don't do it like there standard ards that look better than this which is this one here so you say you know sign in with etherum to rpcd gen the URL chain ID and so on looking good okay please do not sign random Hax strings lots of accidents happen there cool I'm logged in um and that is basically to just enforce that you know there's not people who just completely Hammer us and overrun the network with a ton of request and we could just say okay for that uh client secret we will just on the entry note side reject these requests so this is this this demo expects that you have Docker installed

um if you do not have Docker installed we have docs here which show you how to do that um I will not go through the docker installation because especially if you're on Windows it's like a bit painful um if you're on Linux congratulations if you're on Mac it's so so so uh you can basically just copypaste that one into your um into your command line interface into my terminal I'm just just going to going to copy going to copy that one in and what this does is let's let's take a very quick look at what this does here it starts a Docker container which is a translator between your wallet that you locally run and the hopper Network now this thing is in its first version

also not very smart it doesn't really know the hopper Network it needs to get introduced so there's a central point of trust and failure which is called a Discovery platform the discovery platform is basically your Matchmaker in this decentralized network you're um invited to the party but you need to get to know other people that's your Matchmaker if you don't like that well you're going to run a hopper note um again as a first version I think it's still much more private than any VPN that you might have so I think it's fair enough right now but I want you to be aware of what is the trust assumptions of this network um so yeah it pulls this thing and it uh exposes a locally running RPC server on Port

45750 um it's a little puzzle to figure out what the number stands for I will not reveal it here um and that's what we will add to our metamask or whatever other wallet you have uh running locally so I'm going to run that I um have already pulled the image so the first time you run it it takes a bit longer because it's pulling the uh the image I already have that and once your rpch server that's how we call it this Docker container started you see basically this message here so some status time RPC server started on and yeah there's some additional flags that I'll talk about later cool so now this thing is running

here and I'll keep this running in the background and um there's a button down here at nosis chain over rpch access ah okay sorry for for accessing for the first time I didn't mention that you need a code to actually uh pass this thing thank you it's called free privacy in capital letters free privacy is the access code thank you Felix for that I forgot to mention that because I was already logged in so to get there you log in with ethereum and in order to log in you need to code free privacy very important please let me know if there's any issues we had already a service crashing or whatnot no system still

alive cool um yeah if anybody managed to get that Docker container up and running please feel free to show your hand up anybody get that far still loading I'll give it a minute for you to to load these the images so again this is is locally running it's going to do this translation from taking the RPC requests sending through this mixet on the other side when the response comes back doing the same thing taking requests gluing them back together again and um therefore for your wallet this is

transparent right so your wallet does not need to understand Hopper the wallet does not need to understand mixnet now how we cheat it here basically is you have to have this locally running container this local container running that's basically how we cheat it right of course the mid to long-term road map for us is we want to get that one integrated into wallets so if you're working on a wallet please come to us we love to talk to you if you're running on a like if you're working on a you know web app that has like an integrator wallet or something would be super happy to make it work like in a in like deps directly as well it's possible we have an SDK basically this doer container is just running this SDK instantiating it

and running it in a standalone fashion but you can totally um kind of as a drop in replacement for web 3js or ethers JS for example add to a wallet like that so that's our goal to make it um much easier for you know normal World users and still offer them privacy that they deserve in the Digital World um yeah okay anybody running the docker container by now loading slow Wi-Fi slow Wi-Fi okay cool um good I'm going to show you how it works on my side then error theor we'll get there uh that means your your Docker container is already up and

running if so the the last the last line that you you should see when it's up and running is this RPC server verbus RPC server started on so this line means it started if you do not see that it means it's still like loading and doing a bunch of things so if you if you connect conect this network um it won't work right because the thing is not up and running so we try to make that easy for you so we have this uh this button here for nosis chain over rpch I'm going to hit that button Dam it sorry I had a c version so I need to sign in again so the ones we need this this passcode is free privacy all

capital letters f re e e and you know how to write privacy yeah help um I'm going to add that to my to my metam mouse you just hit the button if it doesn't work if you're running a different wallet um you can find all the information in the docs so you find this information in the docs and now if we look again who do we add here so it's not some centralized server it's Local Host on Port 45750 and the interesting thing here is we're passing it this uh provider flag so it's a URL parameter and that's how you can use derp uh that's how you can use rpch with any evm chain so if you want to run this thing on like whatever

DGL 2 you want to you can do that as long as it's evm compatible with the RPC standard you can use it with any L1 L2 L3 whatever um that you might like you just need to adjust the uh URL parameter and pass it the RPC provider that actually serves this request coming from the exit node so worst case assumption here just briefly thinking about it what does it mean this exit note provider the last one who translates this uh Hopper into RPC call and response back they will see all your requests but they do not see where it came from right so we have a separation of data which is unfortunately not private many smart people working on that I hope they

succeed from the metadata like your IP address and your identity so we separate these two right so it's important to to realize that cool so I'm going to add that and the rest is just like normal normal nosis J approve good so I approved the network I'm going to switch the network and similar things just not as as prettily rendered as before uh pops up here so you see requests that are being rooted through my locally running translator service from RPC request to Hopper so you see um that this one was let's see what was going on here um an e cut balance request right so my metam is obviously doing this exact same thing as

before it Roots requests and gets responses on the way back and just to demo it I'm going to go again on sushi.com and I'm going to swap the same thing that I did before I'm going to swap it back um so where is oh it's already connected cool so I'm going to swap it back and we keep looking at the requests that pop up here uh um I purchased some gnl now I'm going to swap these gnl back proove gnl we see a bunch of things are going on again same thing that you saw before in kind of pretty rendering on the Der website is now going through here but now it's being made private so I'm going to approve

it you see this big request here which was probably an e estimate gas right this huge ass thing here W okay no idea what that was looks like a huge request okay approve nice transaction failed um unable to process internal Json RPC so probably I was waiting for too long let's try again so I'm going to prove it again prove transaction failed okay so I'm going to hit some I'm going to hit some error here no idea what's going on but in essence we see these requests

being rooted in the exact same fashion as before kind of through this mixet from your wallet to this exit Noe and responds on the way back that's what you see kind of being being locked down here and coming in coming in and out so here what do you receive here uh e gas price so that is rpch which uses the underlying Hopper mixet and again if you're working on a wallet working on anything that is um using RPC calls happy to talk to you and think about how to integrate that how to make use of that how to make the web 3 more private than it is

today if there's any questions happy to answer it later otherwise thank you so much for joining me here [Applause] today in terms of the mixnet and uh communicating between peers when you are bootstrap what I what networking topology or networking protocol do you use underlying say like UDP P2P these kind of things so h b on lip2p so it can

use any sort of underlying transport that lip2p supports and uh yeah so it's quite flexible So currently we recently shifted to um rust lipop so it's yeah we we had a JS lipop which was a bit painful and all yeah that was that was quite a good transition and how wide is the K anonymity set at the moment very small because uh currently the entry and exit node is operated by us that's what I mentioned before so it's very small we have currently in the network approximately 300 nodes running um what matters though is we have this payment Channel topology so in order I I didn't really get into Hopper here because I wanted to keep the discussion at the

level of this RPC provider so um your note has a customizable strategy by which it opens payment channels you can open payment channels to everyone here or you can say hey I optimized for Roi right I open channels to a few select candidates and you know optimize my my return of investment cool and uh when sorry for the hoppo specific questions um for each subsequent uh IPC request does it essentially become um non-re repayable so I the next message that I sent along the hopper network is it uh able to be identified as related to a preceding message it is for the exit Noe yes the

exit node needs to know that they become that they belong to together so basically the current version of Hopper is a bit like UDP and that you send individual packages and that's why it's a bit painful to build applications on top of it so we basically need to build TCP like features on top of this UDP like protocol which yeah we know there's some work left for us so and and that's why the exit no knows they belong together so yeah we have a crypto paper description and the docs where you can find the details to it sure cuz it it would be quite nice if the say estimate gas was completely disconnected from say the F SRO transaction that is the case so that is actually the case because every packet goes a different route but

the exit provider needs to be able to glue them back together right so per request you hit the same one but then in between like they all go different routes cool thank you thank you thanks for the talk uh do you have a plan for mobile like running a Docker container there and like consuming so much data is is a problem for a lot of users have an idea Sol that yeah so in fact that's one of the main reasons why we are migrating to rust is you know not just performance and stability but also to much more easily support mobile ecosystems uh which so far was hard but yes that's absolutely the plan in terms

of bandwidth um as a user as long as you're not actually running a hopper note the um bandwidth utilization is not going to be crazy it's going to be higher than before because we pad the packets all to be to the same size and so on and obviously have header overhead but otherwise it's not going to be too crazy like in the next next version you would run kind of like a small Hopper note on your device and then the bandwidth overhead that you have is well it's really up to you so there's this annoying uh trilemma it's called the anonymity trilemma which is a trade-off between low latency low bandwidth overhead and you know strong anonymity and like in there you can choose and for example if you want like pretty decent

privacy and pretty low latency you need quite some some data bandwidth but basically our you know objective of Hopper is to give you a choice you as an application developer or user should be in a position where you can make trade-offs in this triangle because it's not going to be the same for all of us yeah I'm not that concerned about the the the data usage while running it I'm more concerned now with the whole setup of Docker because like alone there you transfer like 500 megab exactly yeah yeah so the current version we are not complete with our rust migration so it's still running in a it's still running in a in a node engine and then unfortunately it's big yeah so the memory footprint we already managed to like significantly reduce so I think currently around 60 megabytes um and

like if you run it in optimized setting but uh yeah it's it's going to get there it's going to be manageable thank you so much there's no more questions I'm also around you find us in the yellow t-shirts happy to answer any questions later on thank you so much stay [Applause] private