Privacy in Web3 - Improving Privacy Protocol To Prevent Hackers & Criminals / Daniel Lumi

Transcript

got my dog everyone has a gun um welcome to my speech on privacy and web3 why should you care and how do we improve privacy protocols to prevent hackers and criminals first a bit about me or to tell there but my name is Daniel Lumi I'm a web 3 consultant researcher specializing in L2 ZK privacy endows so today we'll talk about why should you privacy it's cutting off a bit how do we improve privacy protocols to prevent hackers and what steps can you take to protect your privacy so why privacy and this is this is the most common thing that I hear honestly for privacy

is is if I didn't do anything wrong then why should I care it's fine like you know and I like what Edward Snowden said about this that essentially arguing that you don't care about privacy because you have nothing to hide is no different than saying you don't care about speech because you have nothing to say right and here's examples of where you would want privacy so let's say you get paid in crypto maybe you buy something like a Playboy or a very stupid jpeg maybe you don't want your employer to know that because it might not be a great signal about your professional capabilities right or maybe you buy something very stupid like Solana I mean uh ass rocket 69.

that that's not a great signal either right um or like you donate to a polarizing cause or charity right so the example of this is I gave money to Ukraine down right I did it actually purposely in public because [ __ ] you um I don't think I can ever go back to Russia it's pretty obvious and and now I'm or what is it considered a war criminal or something right or maybe it's abortions or you wanna free Edward Snowden right these are actually things that some governments might determine you as a risk being abused or harassed right someone has your account information now they

see every single transaction you have where you are what you're doing that's that's a bad situation to be in right or you pay or use something you go to a gas station should they have your entire Financial history because you bought some gas or a Snickers bar and like the the general question is like would you give your bank statement to every single person you ever met just because you wanted to join a party or bought something like it's it just seems dystopian it's not something we would actually do but this is actually how blockchains work right now and the point if though at some point achieves mainstream which right every single Bank every single institution Facebook everyone can Farm

your data and they can Target you a much a lot more specifically than just what things you're clicking like on right it's not a situation we actually want to be in so how do we improve privacy protocols helping hackers or criminals because I think that's the number one concern that people have for privacy protocols is true for me too I don't want to help hackers or criminals I just want to retain my personal right to privacy and and yeah that's part of it like if we if we actually made payments private how do we continue tracking terrorists for example and first of all I don't support a hack don't do hacking not a good thing don't

don't do crimes be good guys um but honestly like the the sort of man that we have for this distracting philosophical argument that we have for this is throughout human history money was always private nobody tracked you at all for anything right it wasn't until the 60s um that we started actually tracking financial information right so my argument is if we restore privacy and cash we're just going to the old Paradigm we just removed this data extraction Paradigm that we've been in in the last like 60 years right and a lot of things are reliant on privacy the internet today everything is encrypted right and that's a good thing because if

you make payments over the internet if you search something random you can't be tracked in it and you can't have your bank account stolen from and the way that we do this in the current world is you don't regulate the transport layer you don't regulate https and be like oh you're transmitting data on money like you you get to the like you regulate the banks the front ends and like you Bay you make sure that someone's not listing crack on eBay right we don't need to regulate it at the Privacy protocol level we can regulate it on off ramps on ramps you know and so here's actual examples we can improve privacy protocols to prevent

hackers so essentially this is called proof of exclusion membership essentially you can have a list of ofact individuals or known hackers known criminals and before you deposit into the Privacy protocol and after you deposit you essentially make a proof and you show that your address is not one of the addresses on this list right and that benefits us because privacy protocols inherit security by how long you keep your money there so it gives time for organizations to track down the Wormhole hacker for example before they move their funds another one is the opposite of

membership maybe your bank or your government attests to the fact that this is a real person they pay their taxes they have X amount of money and then you can use tornado cash if you're on this list um another thing that is already true in most privacy protocols is you have this thing called a viewing key right your data is encrypted your transactions are encrypted but if you want to show this transaction list for like you're being audited or you're you're being they have a warrant for your arrest you can give the um actual viewing key and then the IRS can actually make sure you pay your taxes on it

uh we can also do daily deposit limits and this greatly sort of limits how much money can be put through like you or me we're not gonna send well maybe some of you tens of millions hundreds of millions right someone else might right so we can Institute deposit limits both on a per account basis as well as a total protocol basis so if Wormhole gets hacked for 300 million you can only push x billion through this protocol in one day and then it takes them a very long time to push money through and it gives devs time to essentially block their accounts again with proof of exclusion and membership or something um there is something called a travel

rule as well um in the US and Europe if you send over x amount of money the bank needs to collect those transactions and report them right so in the US that limit is ten thousand it's trivially easy to make it so if I send over 10K it's not public private anymore that data doesn't get encrypted it becomes public but if I send under 10k a day is that it stays private right and 10K sounds like a lot but honestly like the amount of money that people are laundering or criminals are trying to get through is Tiny it will take you hundreds of days to move one million right and again gives you time to Institute like lists uh here's some random just completely

random other examples of how privacy could actually help uh blockchains besides just like you believing in your own privacy right we could fully eliminate Mev and all censorship if we did something called threshold encrypted transactions right we talk about Mev it's a huge issue easy like like there's like the reality is this is actually not that hard to do right you have the same validators you have on ethereum and essentially if a certain threshold of them don't collude you have fully private transactions they get inserted at block n and then they only get revealed n plus

one right so at that point the the transaction is already there they can't front-run you they can't sandwich you right uh osmosis is working on that also there's some eth uh proposals for that as well like youth research proposals um talking about this idea of private nfts uh so maybe you buy a monkey picture and you want to show it to your friends you don't want to burn your main accounts because those cost a lot right so you could actually hold that NFTA no one would know who actually belongs to you just have it in a private account you can do the same with tokens like we could actually have private accounts directly on ether one um actually another thing that I didn't

have time to put into a slide there's another New Concept of how to do private accounts directly on L1 or L2 uh you've probably heard of account abstraction right and the idea is that you don't actually know who's signing the account abstracted wallet right you see the address there but you don't know who the signer is right so if you combine that with a dark pool like uh essentially this sort of contract that sends out money in batches you don't know whose wallet is whose wallet right so it just becomes harder to track you right in this way we could interact directly with L1 with L2 without actually even having like a layer 2 system

here's steps that you can take to break your privacy or just considerations for privacy protocols so you might be able to use a centralized exchange like that might actually help hide your assets a bit at least from your friends or colleagues of course coinbase or whoever is going to know where it's going but it's a good step the problem is most exchanges don't Shuffle addresses right like Kraken for example do not deposit there from two addresses you're trying to keep hidden they freeze the address some other exchanges like coinbase at one point at least shuffled all their deposit and withdrawal addresses so that's a good first step to take to just try to segregate your funds a bit

um and the the better answer for what you can do is a privacy protocol whether it's a layer 2 privacy protocol it's an account abstract a dark pool right and essentially a privacy protocol just lets you send funds without actually showing who you who it's going to what amount you're sending it depends a little bit how they can right and essentially in a ZK privacy protocol you generate the proof locally on your computer that you're not double spending that you have enough money to spend and then the networks on or the nodes on the network just verify that they don't actually execute the transaction for you and currently there are some other methods to do it like fully homomorphic

encryption or Intel sgx or MPC for privacy protocols right now ZK is the best and in the future maybe fully homomorphic encryption with ZK will be the best um and tracking in a privacy protocol is really just a game of mathematical probability right so you are relying on this privacy or anonymity set right so if you're sending idiocentric synchronic amounts like 0.0132456 in and then you send it somewhere else it's pretty obvious who you are right so you should deposit in the amounts of 0.1 1 10.

and typically like this example of um tornado caches anonymity said before they actually like got sanctioned for whatever reason um so one eth was the most common so if you send one eighth or less than one eighth you're protected by this whole privacy set right it just becomes harder to figure out who exactly owns the 0.1 each and again positive time matters right because this is actually how we figured out who the Ronin hacker was North Korea by the way um was they were they were really dumb about it they sent it they sent 300 million to um I think it was 300 million at once uh the whole hack was 600 million to

tornado cash and then they withdrew it a couple of hours later it's like okay well there aren't many people that have 300 million dollars so that guy the longer you waiting a few days weeks months the more you get mixed into this anonymity set right the more likely it's it could be someone else's too [Music] any privacy protocol that supports um inter transfers like for example as they connect back in the day would let you do essentially swaps uh through L1 and then it deposits it back to into L2 so the more swaps you have the more like lending inside the protocol you have the more shuffles who it could possibly be

um normally I would say to try Aztec connect it's by far my favorite of the product privacy protocols the problem is they they turned it off right they're working on Aztec 3.0 it's actually super exciting it's a public private blockchain um it's coming out sometime next year um so that's a good option in the future right now here's some other privacy protocols you can I'm not vouching for any of these by the way I'm just saying like like if you're on ease like preferably you'd have a L2 but there aren't many l2s there is railgun but again I'm not even vouching for them I don't know how legit that is um you could do Secret Network you could

use polygon Maiden in the future um zcash but good luck doing save cross chain pitching um I do have a whole speech on zk101 um we talked a lot about ZK today actually I did this speech earlier today you can watch it here you're probably not going to be able to scan that QR though so just go on my Twitter you'll find it there's also the issue of when we don't use L2 and we have funds on ethereum there's a lot of security risks of moving funds to other chains uh so I have a the next generation of safer Bridges and how they all [ __ ] suck uh

it's a crypto advocacy because honestly if you believe in privacy if you believe in some of these rights nobody's going to do it for us it's not like Joe Biden is going to sit there being like yeah yeah privacy that's that's a that's a good thing like like you need to actually work for it you can't just passively wait around at the very least you can Outsource it give it to like eff or coin Center blockchain Association and they'll fight on behalf Money Matters in this world thanks for caring privacy not just for you but for everyone in the world uh you can follow me at ZK Lumi on Twitter as well also tadeo has a lot of shirts that he

needs to give out that he can't get out they're a bit plasticky but they look cool so talk to him afterwards she it doesn't matters it looks nice cool are there any questions do you mind repeating the questions so the audience here absolutely you talked a lot about privacy of payments what about privacy or data yeah privacy of data in the blockchain setting means privacy of payments right I strongly believe like there isn't much data you're storing on a blockchain that's

not directly related to finances right um and if you want to privacy of your data I recommend not uploading it to a cloud including a blockchain it's just waiting to be like extracted from there um of course I'm a huge advocate of privacy for data you can have in the future something like secret networks working on a fully homomorphic encryption protocol you could store data in in that protocol um and essentially well I won't go into explaining FHA right now but the blockchain applications right now are fairly limited for data storage any other question

thank you a lot cheers thank you good day [Applause] [Music] thank you