DAPPCON 2025: Setting Up and Using the PoC to Browse Safely - Tino Breddin

Transcript

Great slides are working. Awesome. Hello everybody. My name is Tino. I'm from the Hopper team and today I want to show you how you can get started with the current version, the PC of NosisVPN. Uh set it up on your laptop if you're willing to follow my lead here. Uh otherwise just uh look at what I'm doing. It's going to be an interactive session and ultimately get a working VPN connection uh through the hopper network going. Um so again this is an interactive session. So um I will have some practical steps where I need to sit down and uh show you some terminal interaction. If you want to follow along

there's a couple of tools which you will need to have installed. So make sure you have internet connectivity. Um, depending on whether you're on Linux or Mac OS, you need some some different tools installed. So, make sure you do that while I'm talking. And then uh you could follow this step-by-step process. You will need a Hopper note uh to use the NosisVPN. We have a couple of demo notes prepared for you. So, if you need access, if you don't have your own Hopper node, um then there is my colleague around here somewhere who has handouts. Uh so just uh Mikal here um get a handout from Mikail. It has a connection info for hopper nodes which

you can use to get your VPN connection going. Okay. Um very rough. I will give you an overview of what NosisVPN actually is. If you are interested in that you can also on Wednesday um see another talk by Sebastian Burgle about the NOSVPN. I will give you some very high level information of what the hopper network does. That's important to understand uh because it's an integral part of NosisVPN. And then we go into setting up the VPN on the laptop. Afterwards, uh I'll give you a little bit of an outlook what's coming next for the product and then Q&A. Hopefully there's some questions.

Okay. So um everybody here has probably used the VPN. Let's have a show of hands. Who has used a VPN in the last year or so? Okay, everybody. Great. Who is using more than one VPN? Okay, half of the room who has built their own private VPN for their personal use or maybe friends and family. Awesome. At least one person. Um, well, as you know, you're very privacy conscious already having used VPNs and multiple VPNs. But uh the general VPN architecture in the market, by the way, this is a $50 billion market we're

talking about, is counterproductive in terms of increasing privacy. It's meant for you to tunnel all of your internet activity through single servers trusting a single provider, a VPN provider, which is a company somewhere you might not even want a relationship with. So it relies on you having a lot of trust in a single uh company, single server uh to do its job and not harvest the data you're pushing through. In my opinion, this is not the right way to do it. And that's why we are building NOSVPN to improve the state-of-the-art in this massive industry and improve the general privacy uh consumers can expect.

So that's the reason why we built no VPN. We want to remove trust from the equation. As a VPN user, you shouldn't have to trust anybody really because what you want is a safer internet browsing experience and not handing over your data to a company which you have full trust in. Communications are private right now and we want to really make it private. Um on a very high level this is trustlessness in a nutshell, right? So the VPN itself should be trustless. It's also decentralized. As you will see, there is a fundamental layer of the Hopper network which is a peer-to-peer network consisting of many nodes. So there's never a single server you have

to work with. And also it should be censorship resistant. Um because the internet as you know uh has a lot of parts which might be blocked based on your geoloc or not. And a VPN should actually allow you to get past censorship like that. We are right now productwise in the PC stage. So proof of concept and as you will see it's very technical still. You have to use a the terminal so bash shell and obviously this is going to improve over time but that's also the reason why this is a technical workshop. So bear with me there. Um the funding for this product development is coming from the nosis dao. We've had two gips. uh one which was already completed that's GIP

98 and one the more recent one is GIP 122 and that covers the development to make this an end consumer product so moving from highly technical low-level uh only developer orientation to being an end consumer product having UI a desktop app if you're interested in that check out the forum the GI and the details which we've outlined that okay how do we move from this super centralized single server tr single trust relationship and architecture to something which is more meaningful.

What we are doing is we are putting the hopper network which is a decentralized network on the fundamental lower layer between the client and the server or the the web server you want to access. So the internet web server in order to do that we have to have some client on the on the laptop let's say on your user devices which understands how that works so it can interface with a hopper network. We have to have some entry node that's a hopper node which is talking to the hopper network and translates normal internet traffic into hopper traffic. And on the other side there's something called the exit node which then takes hopper traffic and uh translates it back into internet traffic and talks to web servers, websites and

so on. So as you can already see we've removed this single point of trust um and added a decentralized network underneath which will which will help you get this trustlessness decentralization censorship resistance. Um just to give you a little bit of insight on what the hopper network does and this is ve very high level really if you're interested in more details I'm going to be around and in my team as well so we can we can give you more details in the next room afterwards. The hopper network is a mixet. The idea of a mixet is that whatever data comes in is being chopped up in small packets which all look the same sizewise.

It's all encrypted and then it's sent through many different path through the network. We call that hops and eventually will come to the destination where it's going to be reassembled again and then you get the final data uh together. In between none of these hops which the packets pass through can actually identify what the content is. Obviously that would be detrimental but also uh any adversary who has access to these these hops in between can only look at the hop but doesn't really can cannot really follow the packet flow.

The reason why this is important is if you can understand packet flow coming in and out of a system server you can actually understand what is going on who's communicating with whom. So what we want to do is we want to hide that knowledge and a single hub is what we call is doing what we call mixing. So packets come in uh it adds latency it changes the sequence of packets and then sends them out again. So when you look at that from a from a technical perspective, you see packets coming in and you can never make that relation from a packet coming in to a packet going out. And this is really important to counter any adversarial observation.

The second fundamental uh improvement of what the hopper network does is it makes it sustainable to run a hopper node. Every packet which is going through the network is actually incentivized. So you as a hopper node runner are incentivized to relay packets through the system because you're constantly getting paid for it per packet. And this is important because otherwise why would you actually run a node? It has to be sustainable in the long run. It's a decentralized network after all. Okay. So coming to our workshop here.

Let's assume just to kind of uh build the build the scene a little bit. We at a conference, your favorite conference like Devcon, you want to have anonymous internet access. So the DevCon uh organizers provide you access to Hopper nodes and want you to run novpn connections and browse the internet over the possibly insecure Wi-Fi here. So this was what we are going to do. We're going to set up the VPN client for you. Now um in step number one and this is maybe a little bit small for you to see but this is our original architecture right in step number one we need access to hopper node which uh you can get from my

colleagues uh step number two we will install the nosis VPN client on the on the client machines and configure them the client then step number four is we're going to establish a VPN VPN connection. So this is already then establishing a fully encrypted VPN tunnel. And step number five, we are going to browse the web. The ultimate goal. Okay. So um we going to go into the terminal. So you can either copy that uh or type it out, but you can also follow that link. I put all of the long terminal commands on a on a web page. So you can just copy paste it uh and and

hopefully not have any typing errors. Oh, I need uh access to hover as well. Obviously no cheating here. Okay. All right. So uh step number one out of the slides here is we have to download the um the install script. Since it's still um terminal based uh we've prepared a bash script to make it really easy for you to download the binaries which you need for your particular system if it's a Mac OS or Linux and uh

build the the initial configuration. So, I'm going to take that link. Is that actually readable? Is that better? Okay. So, I'm just copy pasting the same command like uh you would do. So I'm downloading the um instance script.

Check what I've downloaded. Uh you should obvious obviously later you can inspect that. This is a very exhaustive uh install script. It tries to give you as much information as possible. What's going on? Um what are the next steps which you should follow. So it's really like a tutorial in itself. And then I am going to install a particular version. This is just for making sure uh while the product is being improved um uh I'm sticking to a version which will work for us. So I tested that version in particular so we have a working experience.

Okay. So um the installer gives us a lot of information on what the requirement is basically what I just mentioned already. So I'm going to skip over a lot of this and we can just go through the steps uh by clicking enter. Now I'm being asked where do I want to install the binaries in the configuration file. This can be anywhere on your machine obviously. So you can enter any any directory. I'm just going to use the default here. So just clicking enter.

Then um I'm being asked for the hopper admin interface URL. This is just a um a convenience uh feature. So if I already have access to hopper node through what we call the admin interface, I can copy paste that URL in here and the installer will chop it apart and get the right information from it. Um what you got from from us here is the individual pieces of information. So, I'm skipping over this part. And now it's actually asking me for the information from our vouchers here. So, enter hopperd API endpoint. I'm going to copy what I have.

Print it out here. So, it's a IP and port. Double checking. Okay. Then the token to talk to the API. Okay. And then uh I have to enter so-called session port. So a hopper dn node can support many sessions at a time. And as a user um I have to just specify one particular port. Since uh some of these uh nodes might be used uh

by different people since these are demo nodes. Uh everybody has a specific port assigned. Uh normally if you have your own node uh the default port is 1422 and you would never have to change it really. You can use the default. So I'm using a different one for the demo here. And then it's going to check whether API access is working. it will download the binaries themselves and uh this is Mac OS specific uh I have to dequarine the binaries because on Mac OS if you just download binaries they are not usable um so the install script tries to do that for me so I'm just

going to enter my password here and uh complete okay so this all has worked so this is good already this uh this means I have access to a hopper node. It was reading the API. It understood in which uh which network the hopper node lives. So the production network and it configured we can look into that. It preconfigured um kind of a default configuration for me. So what this configuration shows and you don't have to really mess with that here is all of the information which I put in on top and on the bottom a set of

um servers or destinations which I can connect to um and very specifically this is uh configured to use one hub. So we are already going through multiple nodes in the network in the peer-to-peer network. So our packets not only travel from my laptop to the destination node, the exit node, but rather over two nodes in between. Um, and as you can see, this is not IP data or anything. This is pure ids. So basically a synonym in the hopper network to address servers or peers.

Okay. Now I could just follow the commands which um the install script has given me here. As you can see here, um, this would work just fine. I have a little bit shorter variant in our slide deck. So, I'm just going to copy paste from the slide deck or for me that's easier. So, you could do the same thing. Um so first what I have to do is I have to um start the service itself. The service uh running on your machine has to have

elevated privileges. That's why I'm using pseudo uh because it needs to create a network interface and a a tunnel. Um so you do this once normally and then it's being run um until you stop it and you can create new VPN connections uh throughout uh the day. So this is a one-off uh operation normally. So I execute NOSVPN as a service binary and pointed to the right configuration. The service will um basically do nothing on startup. it will just enter the listening mode and then wait for instructions whether you want to connect to a particular server. So here I have

to go into a different terminal and use the second binary which we downloaded and that's the control binary right and this is used to send control commands to the service. So, I'm going to use that first to check the status. And um since I haven't done anything yet, uh the status is disconnected. The uh VPN tunnel is down, but it shows me the part the different um servers which I can use as exit nodes. So, here I'm just going to use the one in Germany.

copying the pure ID and then use uh no CPN control connect and the pure ID hit enter and then we already see on the left hand side the service me again here um is then going to try to uh establish a connection to the server I'm trying to connect to. Let me check the logs here. Seemingly some error typical demo.

So let me try a different server. Maybe I have a problem accessing that particular server. Let's try Spain. Okay. So, this has uh worked. So, now I'm not going to stand up for this. Uh I have a VPN connection established. So, if I check the status again, it tells me I'm connected to a

particular pier and my VPN connection is up and running. Great. Now, what I have to do is since this is still a a proof of concept, it's not being used for all of the connection and the network access you do on your machine because uh that might be detrimental if uh the quality is not not great yet. What we do instead is we offer an HTTP proxy on the other end which you can configure in your web browser or in your system settings. So for this demo I'm going to configure that HTTP proxy in Firefox.

So going to Firefox settings and then into the network settings. And here um normally you would have something like uh use system proxy settings or no proxy. Uh if you want to use the VPN connection, you then have to configure the HTTP proxy which is on IP 10.128.0.1 and port 3128. You have to make sure that it's used for HPS as well. Now this HTP proxy is actually on the other side of the VPN tunnel, right? So by doing that, you're actually already going through the

tunnel itself. So I'm going to hit okay and then checking whether the VPN connection works and it's able to load what is my.com to test. Uh what I wanted to show here is um and maybe I show it in my other web browser which is not using the VPN connection. Just reloading that. Um if I go through the Wi-Fi here, I am being terminated here in Berlin, it's showing me even radial systems which is uh which is our location here. uh if I go through the VPN connection which we just established

uh I'm being terminated in Spain where that server which I connected to is is located. So I can verify that the communication is indeed going uh going out through Spain to the internet and I can then uh can continue browsing um through that connection and visit websites as normal. Right? So this is kind of uh functioning uh functioning setup now of um my local NosisVPN uh setup.

Okay, I'm going to just uh assume it worked for everybody here. And uh if it didn't, feel free just uh you know, so we don't run out of time, feel free to catch me or my team outside and we can troubleshoot your your setup if it didn't work. Now, um I already mentioned it. This is Linux and Mac OS specific right now. If you are on Windows, uh it's a little bit more complicated. We don't have a native version yet for Linu for Windows, but we have something which you can make work through the Windows uh Linux subsystem.

So just follow this website uh if you want to try it out and I would be certainly would be happy to to hear from Windows users who tried this um in order to understand uh what the user requirements are. Um, we can jump over this since it's essentially what we just went through. Okay. Um, I mentioned this is using hopper uh underneath. Uh, you already saw it's also using wire guard to establish the actual VPN tunnel. Uh, and then it's using the configuration in the web browser. So, there's a lot of components involved to to to make a successful private connection work. Um

and this means that there's a lot of packet uh tunneling going on. If you look at it from the high level perspective, a working internet connection to a web browser is normally just an HTTP connection which is TCP based and it's end to end encrypted, right? So you can be sure whatever that connection is is sending over as a response or if you send something as a request, nobody can actually look at it. So it's enter encrypted between your web browser and the web server. And obviously this has to stay that way uh over a VPN connection. Nobody in between should be able to to decipher what's going on. So what happens is uh with

that running VPN connection, the web browser will actually talk TCP to the wire guard client. The wire guard client locally will talk to the hopper entry node. There was the node which you got the um the API information for will talk UDP because that's what wire god uses to tunnel data. So it's already um wrapping splitting up TCP packets into UDP packets doing additional encryption. The hopper node will send hopper packets through a decentralized network. So that's again taking UDP packets turning them into hopper packets doing even more encryption.

On the other hand on the other side on the exit we get hopper packets we have to turn them back into UDP packets. Then wire guard has to turn UDP packets back into TCP packets which ultimately uh are being sent from the proxy to the web server. So it's a three-level uh wrapping and unwrapping of packets from TCP to UDP to whatever the hopper nodes speak with each other. Um this can be very complicated. This obviously uses a lot of computation and therefore increases latency um which we use in the end also to improve the privacy of that

connection. Okay. So given that we can already establish a working VPN connection over all of this locally uh like we saw earlier in the terminal what are the next steps I mentioned this is the PC so we can we have working binaries which can create end to end encrypted connections we can browse the web you could use it on your daily in your daily workflow uh to browse the web the next step is to build something which is normally called an MVP uh which is not only more private but also more usable because ultimately a VPN connection which you can only established by

dropping into the shell isn't really usable by anybody outside of this room. So we want to make it um we want to add some more privacy primitives very important stuff to the hopper protocol but also we want to remove the dependence on a separate hopper node. Um obviously if all of you would have to run a hopper node, set that up, configure it, keep it running, that would be quite the requirement uh in the long run. Now I expect all of you since you're in here to go out and and install hopper a hopper node and set it up tonight, but I don't expect that for the next 10,000 users. So what we want to do is we want to take the hopper node, make

it possible to turn it into the library and add it into the client. itself. So that ultimately you start up the VPN client locally. It starts up in let's say 10 seconds and all of a sudden you have a working hopper node running which can connect to to the decentralized network. The end user doesn't need to know about hopper. This is really a technical uh technical fundamental insight which nobody should care about. And once we have that MVP, we have to take care of making it as usable as a normal VPN client. So we're talking about all of the platforms, mobile, desktop, Windows. Um, we have to have incentives so that if you want to run an

exit node, if you want to become part of that ecosystem, it should actually be good for you. You don't do it for ideological reasons. That is that is great. But you also should get incentives out of it. And then we need better throughput. While you can already browse the web, you might want to do other stuff over the VPN. If we want to tunnel all of your traffic from your laptop, which you're doing on a day-to-day basis through the VPN connection, we have to have much higher throughput than just uh what you need to browse a website. So there's a lot of stuff ahead of us. We have a timeline which is outlined in the GIP which is going over the next one and a half

years. So if you want to follow us along uh it would be greatly appreciated. We rely heavily on feedback. Um so since we don't do obviously any tracking in our clients uh being very privacy concerned uh we rely on feedback which is actively given to us. So very much appreciated if you want to share kind of your user stories, what's important to you as a VPN user. Um so we can take that into account. And ultimately um if you want to see when there is new product updates, just follow us on.com uh where we push every time we have new product updates uh some news.

All right, thanks. Now opening up to questions. Any questions? I think there's a microphone in the back. Maybe might be easier. I just came in in the last minute. So, sorry. Uh, does it work on IPv6? Because my DS light connection at home, it I don't have a public IPv4. It should work on IPv6. Yeah. Okay, cool.

Right. Any more questions? Okay. One up front. Can we get the the mic? That's fine. Yeah, it's fine. Uh what step um runs the mixing because it's a mixet. Yes. and there is a hopper node and they could you please yeah that's a great question so um the mixing obviously runs within the hopper network at every step and the first step is your entry node so if we go back to that

to that overview hold on here so the first mixing is actually done uh when the packets are created and are going out of your entry node Even there let's say you are making an HTTP request which ends up being 10 hopper packets. So packet one through nine uh one through 10. Um even then we already change the order the sequence and add latency and send it out through different path through the network and this same process adding latency changing the sequence happens on every hop in between. So in our example it was one hop. So that means there was one node in between which did the relaying

which also did some mixing and then the packets end up at the exit node which only puts it back together. Right? So there's no mixing involved on the exit node. So it's um if you if you want to look at it from this example, it was three notes involved and the first two do some mixing. Say again. Okay. The question is, do the packets go to the second node or somewhere else?

Right. different. Okay. So, what I was referring to is uh the mixing of packets for which you choose a particular path, right? Um but what happens obviously let me go to this one. Well, this one um the node the relay node uh in between is not only serving me, it's serving maybe 50 other entry nodes and on the way back some other exit nodes. So there's lots

of packets coming in from different sources and destinations. And this is all going into that what we call the mixer, the process which adds latency, which changes sequences. So it's basically mixed up. it put it's being put into a bowl altogether and then stuff comes out again. Some packets go a different route because they have different destinations. So that ultimately for somebody looking at it with a high level network view it looks like there's random packets coming in from different uh transport connections and there's random packets going out. No packet looks the same because of encryption and decryption going on. No

packet every packet has the same size. So you cannot really make that onetoone link between packets and understand um based on the metadata what you who's doing what through that uh server. Yeah, it's in the note. It's like an integral part of the transport pipeline in the note. Yeah. Any more questions? How many exit nodes do you have in the hopper net or is every hopper node also an exit node? Uh also a very good question. So um for the NorthVPN use

case uh exit node has to be uh specific to the VPN use case because it has to understand it needs to terminate a VPN tunnel right not just talk hopper. Um so while potentially you could run that sidecar exit uh server uh on every hopper node that is not the case right now only Nosis runs uh uh exit servers. Um but every hopper node in the network could be used as a relay. Um the idea behind uh behind this approach is ultimately to have an ecosystem. Um so while we are in the PC stage nosis is running the servers the

exit servers because it's for one we can move very fast by deploying new versions on the other side um we we can uh provide good quality of service in this uh product development stage. Ultimately though we said we want this to be trustless and permissionless. So what we want is um to enable everybody to run exit servers register through some permissionless process um that they are available given a certain uh usage pattern they allow. So let's say I want to run an exit node in my on my residential IP at home and I only want to allow access to uh websites in

Germany for some reason. um then I can configure that in my in my exit server and announce that through that permissionless process to the rest of the ecosystem and then users could use my exit node um if they are browsing the web in Germany only. Yeah, German websites and if they want to browse websites which are somewhere else or IPs which are located somewhere else they just have to use some different uh exit server. Any more questions? Here's one last question.

Um, I would like to know more about eventually the tokconomics if I imagine I'm thinking quickly. I imagine you want VPN users to maybe use uh is it called hopper? I think the the token and validators or exit nodes sorry would get hopper uh if they run a node like are there other parts? Yeah, that's a great question. Um so incentives right and I mentioned that incentivization for the hopper network itself is important but then also on the VP VPN ecosystem level.

The hopper network itself uses hopper tokens to to incentivize relaying. Um so every packet can ultimately could be redeemed for hopper tokens. So so when you when you want to send out packets you have to pay basically for the packet to be relayed through the network. Now this is on a different layer though than the VP service work which is done by the exit servers. Right? Um I cannot give you a full answer yet. So this is kind of the kind of R&D we still have to do. So happy to do talk about that uh afterwards separately. But we have to find a way to incentivize exit servers to do their job. Whether this involves hopper tokens or circles or whatever, I

don't know yet. Um but there needs to be something. Yeah. Any more questions?