The dark side of transparency in crypto / Lefteris Karapetsas, Konstantinos Paparas

Transcript

okay can you can you guys hear me can you hear me okay cool so um okay slides are there welcome all um I'm left there is I'll be talking to you about the Dark Side of transparency in crypto with you know April Palpatine here um first of all a little bit about me I'm leifteris I've been ethereum since 2014. um I've created and helped um uh clean up the the Dow with um uh christophians in the rest of the Slowking team I've been in um uh with Ryden uh I've almost almost four years I think three and a half and um

that was something like the lightning network is to bitcoin but didn't work out due to the well the L2 is now becoming the the Roll-Ups and I'm the founder of rodkey which is um uh portfolio tracker and accounting tool um that protects and respects your privacy so um transparency in crypto so um okay so maybe you can come from here so in we have transparency like we know that this is one one of the most important [Music] um uh attributes that crypto gives us because everything is open right everything is is uh persistent they will not be deleted the data

um everyone can audit it so if it's about public spending it's perfect it's beautiful you can see where do your taxes go how are they spent it's it's a it's a really beautiful attribute of crypto um the problem then becomes and I like memes so there is a lot of memes in this presentation I'm sorry in advance so um everything is open right but uh can you selectively share and do you know how much of this you you can say with um certain uh group of people let's say your accountant uh something else with with the authorities something just completely private for your family so unfortunately that is not possible with crypto everything is so

transparent that anybody can look you up um and even people that can wish you harm um this whole thing with with the right to data deletion doesn't exist in Cape so it's there once it's done it's persistent it's never going to go away um and um others will connect the dots because everything is um auditable if something uh some data metadata you have leaked somehow three combination of of tweets uh Onsen activity people will find it and can uh we and they will use it against you so this this all sounds like you know a lot of fear-mongering why you know

crypto is great why why don't you give some more specific examples um let's look at ens for as an example um you go to the NSF you register a name I don't know who this guy is sorry in advance to the guy that using his name it's direct Silva he has first and last name so this was the first guy with first and last name that I found that did something that some people may may call questionable I don't mind it at all but let's say that wow what the heck thank you guys thank you thank you

now um um yeah we have to this is a feature preview this is like um uh our entire um yeah yeah sorry for that all the memes that I wanted to show you I'm sorry I'm sorry but uh we will get to it okay so please don't move again yes so let's assume that we are in a world where um some people don't like spanking because whatever like uh this is just an example

um you are using it and then you're using it with your ens and the problem then becomes that you have connected all of your personal details with it like your personal website Twitter um telegram everything so someone who wants to look you up and and like punish you for for doing something like for example for using tornado or whatever if you use it with your ens name and you have such metadata then all of that is is leaked this may sound like of course I wouldn't do it come on what I'm an idiot the way that we try to make things very simple for for the newcomers um Unfortunately they don't understand

that this is public they really many times think I I have seen newcomers I have even uh talked to my wife about making some of these things for her and the first assumption is that this is not public they will not understand it it's not something that you would think of by default um another mistake that many of these also make is depositing to a centralized Exchange in order to sell something let's say that the Republic address is this 0x75 and you go to binance you know you type I want to deposit usdt it gives you an address to deposit this 0xa cocoa um cool you deposit your cell then you have a private address that you have some private stuff that you don't want

to be known that it is you um you go to binance you deposit again and unfortunately then you're coding in 4k because um just by going to the binance deposit address you can see that you deposit to the Xerox a cocoa from both your public and your private and you suddenly dose your private address this there is Bots that actually run through the post addresses of various exchanges and try to find who has done this mistake with known people so with known public agencies to try and find um other Associated addresses with them this is not just a like an imaginary scenario my favorite is a signing with ethereum so we have a lot of Dubs which

in reality have a big server-side component that asking you to sign with ethereum sounds like a good idea but when you do that um there's a lot of consequences that people do not understand which is that you leak IP locations another metadata and associated with something even more important than your iban let's say because the ethereum address is um it contains the history of everything that you did with that address and everything that you will ever do in the future I wanted something about that to say about the Guild of consequences here but they were not very safe for this presentation safe for work um using any such a meme so are we screwed what can we do how how

can we get out of the situation because it's not as if um transparency in crypto are bad inherently we just need to use them correctly so we just need to to fight together both for um the new users and those to understand and create apps that are protect users privacy and also um promote education so that people understand what it is that they are doing for example when you're using on off ramps for crypto you should only use exchanges that offer you multiple deposit addresses never ever um uh use an exchange that does not allow such a thing you should have different

deposit address for every account that you have in crypto be very careful how you associate them use any labeling or address book um that your wallet may contain and do not use say the centralized exchanges because they may leak your data in various ways that you don't expect binance I don't know just something here before so um I want to borrow a concept from Japanese Which is my which is really really well applies here um it's the idea of the private self that you have and that you

have only for your for your personal feelings for your inner self and for your close family and then the tatamai which is what you saw to the outside world so take this concept and apply it to crypto like religion keep separate public and private addresses identities they don't need to be only one there can be multiple there can be various layers so I have my private my semi-private my super private the one that only has ever had funds from mining ethereum back in 2014 and so on and so forth never connect them just um okay now you never connect them you have a public and the private address the public and you know the happy face I'm a great guy

everybody should love me in the private you do whatever you want there um use VPN to uh reinforce the separation basically have um good privacy aware habits um minimize the use of dapps so I'm putting dabs in quotes here because unfortunately most of what we call Dubs right now they are just centralized server apps that have some small onset components thanks to which they like to call themselves dabs so what they do is they have a centralized architecture they have a database all of the data is stored there remotely you don't do anything locally there is nothing the only thing that you do locally is just

curl API course you just do API calls to to their server um there is no privacy and the data is not anywhere in your computer it's like the advertise they're there it's great it's a very beautiful application but it's our data right it's the data is always on their server uh it can leak um the internet may just press a button wrong and then they fire him but then everything is is um is over for your data and you're at the emergency of data leaks and hacks everybody that I have accused for this they always tell me that you have a privacy policy it's it says right there we respect your privacy great like having a privacy policy and

saying that you respect it it's it's it's all talk though because it's not about um it's what uh Google was saying don't be able it's you should not be able to even be evil because again the poor internet I'm gonna use him again he may make a mistake because he may have not read their privacy policy and he made just somehow use they may have a master decryption key and make a mistake and all of your data is out and about for hackers to play with um uh an idea that I really like and talk about very very often is local fair software this is a paper

um that came out in 2019 that tries to talk about how software should be in an internal connected world right now and it should always be local first um go read the paper it's made by many authors but mainly by this guy his name is Martin clebman he's an amazing software engineer he also has books about distributed technology all of his books that I have read are really good so I really recommend you look him up the ideas of local first software is that the majority of the functionality is local the data should be stored mostly locally and it's applications that are made to have privacy and security as as Paramount and the network here is um of course we live in an interconnected

world the there is always the network but the network is used but it should not be necessary so not every keystrokes would be a roundabout trip to the server like I don't know with Google Docs so with that said all right I'm gonna head out and I'm leaving it to my um colleague kelsos who is going to be talking about once that's up and I think the name sense now uh so I'm kelsos I have been working uh in doing software the development in ethereum since 2017. I worked in the the Bradenton front end and then in the Bradenton light client and I have been doing from the ninja since 2018 and now

I'm the front end lead uh so what is Road game uh like Lester said uh we are doing a local first up so rotkey is a portfolio tracker in a management tool uh where everything is stored on your machine we don't have your data you we don't have your accounts everything is stored on your computer so we don't have access to anything uh so when you're up in Rocky for the first time uh you can see an overview like not the first first time but after you add your accounts you can see an overview of everything you have like uh centralized exchanges uh balances in blockchains uh and then you can see the historic view maybe have some graph of uh you're holding its time every day um

so uh in the dashboard you can see a breakdown of your assets an aggregation of everything you own all across the tracked accounts uh you can see the price uh office asset at the current time so if you use Euro USD we support different currencies uh and then one of my our most important features is the history section uh so this originally started as a transaction history which was really unfriendly and we have been slowly evolving it to a complete history of your review and transactions and the plan is to make it uh a total history of everything like if you have linked centralized exchanges

all your activity like uh trades swaps deposits uh deposits and withdrawals from D5 protocols everything should appear there uh the idea is that this sanction is uh completely filterable so you can see your movements uh your actions through a specific period you can see only specific protocols uh uh and the idea is that uh we want at some point to start uh integrating it with our profit loss report so we have a historical panel report and you can see cost basis and you can apply fee for leave for different algorithms to see where the funds come from and uh what everything is

sale or movement came from uh you can also export this uh to a CSV file uh for example if you want to sell it with your accountant but the idea that we want to do is that uh since you have a nice history view you should be able to also doing the spot calculations say for example you want to see the total fees that you paid uh I don't know depositing on specific protocol for a specific period and we want to add actions uh so that you will be able to do that then we have uh some periprotocol views so for example if you are using liquidy uh you can see how much you have stacked in the different pools uh you can see if you have any gains or losses and you can get

more information on that then we also support the theorem stacking you can track all your validators you can see your daily averages you can see the gains and everything uh the amounts you have already withdrawn and you can filter by account by validator and a period of time and you can see many details so uh if this was talking about identities before and in Rocky we have uh the ability that you can tag and customize accounts so for example if you can do a private and public tag and then you can have the accounts and filter by only the public or only the private accounts

um and you can see that in the account management screen the weeds are which accounts are private which are public and then you can split your identities and be sure that uh you don't uh do actions between them uh then we have another book feature uh where you can assign friendly names because we know that uh you know like uh remembering which Andreas is which is really hard so this is easier because then uh when you see your history you can see for example that uh maybe you have your binance deposit address or a deposit address you use on something you can name it and then in your history you will see uh all the details and you will see the friendly names of the address

um and then you actually can control uh so rotkim gets information uh for your own film node for uh open uh notes outside and you can customize these nodes you can add new you can remove uh some of the predefined and you can add a probability uh on the chance that this node will be hit with its information and then for prices we use external oracles and then again based on what you trust you can customize and you can also add missing prices for articles that we don't support or for tokens that we don't have enough information like I said if you want your data so

everything is local uh there are backups and you can always revert and in worst case anything that happens to us you can still have access to the data uh whereas in some software as a service platforms basically if the platform goes you lose everything uh so yeah to close it we are looking for more people uh we are also looking for open source contributors and we would like you to give a try like spread the word about the software and also give us feedback because uh we are building the software for us but also for people out there that have these needs so we're interested to hearing and building for

the users so thank you very much I don't know do we have time for questions that's a very very good question so we want to thank everybody that has been donating uh through the git coin rounds for since 2017 I think we've been doing that uh so it's mostly donations we have a premium um a premium service that we also offer like it unlocks features and limits but this is

unfortunately not the bulk of our revenue and then grants so various protocols have given us grants over the years for Integrations so all that together they create the funding for a small team hey Alex no well I mean I would like to but I don't think I'd wear a qualified we are not uh protocol we are a application okay nice to see you Alex by the way I haven't seen you in such a long time yeah is there a plan to make a mobile app at

any point in the future uh yes so mobile app is really hard because we will have to rewrite everything uh but there are ways for because we have a Docker container like a document sorry and the app is also available in that note so we have users that use the app through that node and most of the UI is mobile friendly so for example if you have dub node you have a VPN where you can access the dub node and then you can go to rodkey through this and see and manage everything from mobile so that's the closest we have right now we would like to go at some point but I like talking about funding right that

would require a dedicated different team like different directions it's it's hard so from the daps Builders perspective like what can we as Builders do to protect users privacy more like what features do you think are needed from the top sides to to protect uses as adapt developer as an app user no I mean from the Builders of the apps as Builders what can we do to help users protected property very good question um I don't think we have a link to this but if you search for local first software like try to follow the everything that that paper says basically it's the idea

is to it doesn't mean it's an offline up there is no such thing anymore you should that would make no sense but try to utilize the the computer of the user and give him as much agency over his data as possible any more questions you oh sorry um you said you you uh support evm chains but which one do you support already we support optimism mainnet and in Weak polygon and maybe in one month arbit room hey um so you mentioned you can tag your

public private accounts does rocky give you like alerts if you make a mistake and accidentally expose yourself like does it is there a way for you guys to run the same Bots Etc that the the hackers do to alert us if we've actually accidentally it would be easy we don't do that but by then it's too late so once that's done you you you're done like you you you're dogs uh we could write a script that does exactly the same but it's maybe it would make sense in the sense that uh you know that you have to stop using this account because it's already doxed yeah if you have a GitHub account please make any uh thanks for the talk I just thought um

regarding the first part of the talk about people linking their Twitter accounts with their eth domain names and so on I thought it could be even an attack service so someone can register an eth name with my real name and do some shady activity and then someone can blame me and it's would it be up to me to prove that that actually was not me and someone in a booster and so on this also looks like an attack vector yeah yeah that that could be something but I guess it would be easy to hmm yeah yeah interesting I just started to think oh yeah how can you prove that it's not worth it the key yeah yeah that's an interesting attack Vector

too any other questions no okay thank you guys thank you very much [Music]