Why Gnosis needs a VPN

Transcript

All right, so this is not my first time here. I have been here before and today I'm here to talk about why Gnosis needs a VPN. Before we get there, I would like to start by addressing the elephant in the room. And that is, this room is somewhat more empty than it was last year or the year before. And I would therefore like to start by congratulating all of you for being here for not full -on narrative migrating to AI, still sticking to crypto. And yeah, I think this is good. I'm personally here because I think crypto has one value proposition, and that is to make us more free.

And that's what I'm going to talk about, and I'm going to kick it off by addressing welcome to 2026. Not the first time I'm here. What is new, right? Why is he still talking about privacy? I get it. Generally, I'm supposed to stand here and say things are good, things are getting better. But unfortunately, that's not the reality. Things are getting better, right? I can have a presentation where I can play Pong when I'm just bored standing here. This is all kind of fun until, of course, it's not. I'm not talking about just AI -slop software.

I'm talking about deployments of software in production that leaks critical access to personal identifiable information, right? Like committing the database access to GitHub, having it just plain in the open, having access credentials leaked. This is something that I do see and that does concern me because we see that being deployed at much larger scale than before. As we've heard from Richard, this is, of course, not new. right so but now this is available to pretty much anyone with access to cloud or whatever right and yes we've seen with fable i don't know if that was marketing or what but you know we've seen that uh yes you can hack stuff with access to ai

and i would like to take it like one step further and saying this is not just about the exploits right exploits have always happened right we've had a ton of databases a ton of databases where all of a sudden out in the open and you could see it. But what concerns me that all this database seemed unfeasible to make any sense out of it. Like you've probably, if you cared about your passwords, you've probably, you know, had some have I been pawn or something like that where you see where your data has been leaked, right? And all your data has been leaked and we all know it, right? If you didn't know that like some data has been leaked, you know, consider checking out these tools. Anyway, it has been completely unfeasible to

cross -correlate these databases to get bigger insights. Now, because of AI, we are able and effectively turn all these individual leaked sets of databases into one mega database that has your digital lives out in the open and visible. So, yeah, as I said, that is pretty bad, right? So, in the AI era, I do see more sloppy software deployments. I see easier exploitation of vulnerabilities, and I see this linkability of information that's out in the open, that is practically available to anyone here. Now, this is something I would like to drill down on.

How do you practically cross -link these separate, distinct databases? And my claim is, practically, you do that by metadata, and specifically, connection metadata. So, a little excursion into how this data is treated, right? Your IP has leaked. Okay, at least it's not my Gmail password, right? So, it's kind of okay. Well, it turns out that in a Prosper marketplace, for example, like 17 .6 million records have been leaked, which were highly sensitive information. This was a lending marketplace where you had banking -grade information of individuals.

And your IP address was in there. So your IP address is effectively your primary identifier of figuring out all sorts of stuff. So when I figure out your IP address, I link it to that. Maybe you're in a data set, maybe you're not. But you're probably in some other. Now, IP addresses are not just targeted by the bad people. They are also targeted by the good people, the compliance people, right? So, Chainalysis was nice enough to actually use IP addresses to trace Monero users. This is obviously not something that they advertised.

This is something that came out in a leaked training video of Chainalysis. So, yes, IP addresses are apparently highly important. Otherwise, quite sophisticated players like Chainalysis wouldn't use them. So, I make the claim that IP addresses are your actual primary key and identifier of you in your activities. And while I'm talking about the web here mostly, this applies to the Web3 in the same fashion. You can ZK all the things, you do interface peer -to -peer networks, you do interface other systems and networks, and your home address on the internet, that's basically what your IP address is, your unique home address on the internet, does

leak to all of these systems. Anyway, let's go back, just a super quick overview of the internet. So I access the internet also and in addition to working at Gnosis, I'm founder of HOPR, the privacy infrastructure that underpins Gnosis VPN. And that's a Swiss -based organization, so you do find me walking around Zurich every now and then. And that happened recently. I had just passed by the Google HQ in Zurich. Funny coincidence, I got a call from Google.

So I pick up and I'm talking to Kevin, a friendly gentleman working in the Google Platform Security team, informing me that there had been a malicious password reset attempt. Okay, I didn't reset my password. My password is also pretty secure. So that's strange, Kevin. What happened? Well, you know, we got a password reset reset to like mohammed94 at protonmail .com. Kevin, that's obviously not me. Yeah, okay, that was flagged because of an unusual IP address from Frankfurt, Germany, and I don't recall, you know, seeing you in our logs accessing Google from Frankfurt, Germany. You know, fair enough. I understand IP addresses.

That makes sense. Thanks for flagging. No, it wasn't me. Case closed. Kevin then told me that, okay, it would be nice if I could, you know, just close the case from my side so they could inform me what actually government -issued document, you know, was behind that. Apparently, a government -issued document of mine, you know, had confirmed this. Kind of strange, so I wanted to see the document. I couldn't because of data protection regulations. Funny, you know, I know that. Anyway, so yes, I was, you know, going to confirm that to close this case. In that second, I saw the following pop up on my phone, and I was literally two centimeters away from hitting yes, right? This would have actually released access from my Gmail to somebody else

out there, because Kevin, of course, was not from the Google Platform from security team, Kevin was a scammer. How did Kevin get me there? I was literally two centimeters away from hitting yes. How did Kevin get me that far? Kevin got me that far by establishing trust. And how exactly did Kevin establish trust? Kevin spoke to me in high German, my native language. Kevin did not have any funky accents, which I know from other scammers. Kevin knew kind of where I was. Kevin used some behavioral patterns of mine. That's pretty strange. Kevin also identified me via my date of birth that you do not find online. Kind of strange. So, I do not know how Kevin identified me. I do not know how Kevin obtained my information.

But what I'm describing here is a plausible way of how many Kevins could have obtained all that information about me. And to To understand it a bit more, let's go one level deeper. I am, of course, like all of you, accessing the internet. How does the modern internet actually work? Don't worry, this will be brief. So on my phone, I access some domain name service to figure out what IP address is google .com. I need to find the home address of google .com to access their service. That's what a DNS does. I fetch information from a cloud hosting provider.

There might be some stuff delivered to me via CDN. A bunch of other funny things happen online. Now, unfortunately, it's not that simple. The internet is, and sorry to pick up a Web 3 analogy, but it just fits too well in Web 2 and Web as well, a dark forest. In front of all these services, we have some weird creatures lurking that are out for my data. And they can get it because that is how the internet works. it's actually not just those. It's like a whole lot of more things between me and the services that I want to consume in an interface.

It's Wi -Fi operators, right? We all are connected to Wi -Fi here. There's ISPs. There's things that we don't talk about normally called autonomous systems that route package from you to Google or whatever you do. All of these players have access to the metadata that I just described. And specifically, if we talk about this metadata, about your home address, your IP address, that's actually two interesting things. So if you look at these two kind of about all these different providers, you can roughly group them into two categories. The upper ones are the ones who see where you are.

They necessarily need to see your IP address, because that's how the internet works. To send your data somewhere, they need to know where you are, where you, you know, that's kind of obvious. Then there are providers who necessarily see what you do, right? So of course Google sees what you do, but Google doesn't necessarily need to know where you are in that very moment. And I think most of you know what's coming now. There is, of course, a solution for that, which is a VPN. A VPN is basically separation technology that separates the where from the what. Now, legacy VPNs, your Surfshark, your NordVPN, and so on, are effectively again

just another database. They are one central place that sees both the where and the what. So you did replace, indeed, trust in a bunch of other providers. You now trust this one that has access to all this information in one convenient, centrally accessible place. So we have to ask ourselves, can we do better? Can we maybe have a new kind of VPN? A VPN that serves the purpose of this separation, the where from the what, without introducing a single central provider.

Yes, that sounds a bit like Web3. Okay, yes, that's what it is. So, how do we go about building this? Because this is exactly what Gnosis VPN is about. To unlink the where from the what, we introduce multiple nodes in between that relay your information. that take a request, for example, to get google .com, relay it to somebody else until you hit what we call an exit node that sends that stuff out to the wild internet. And now in that moment, the wild internet only sees this exit node nothing before, including not you.

Okay, I mean, that's the overview. Let's zoom in on this path of packets. packets traversing through this path are being sent from your device through a relay node to the exit, to the wider internet, usually there's a response because you don't just go to the internet and say, here I am, you want something back from it, right? So data traverses basically through these multiple kind of nodes on the way. Now, Gnosis VPN is not just relaying data like a normal VPN. What Gnosis VPN does is a bit more fancy than that.

We also do, now zooming in on the relay part, we do packet mixing. So what is actually happening in any of these relay nodes, data packets are coming in from multiple nodes, and they're kind of like shuffled, transformed, and sent out in a different order. That looks very complicated, and that's the point of it. We want to make it impossible, even for some passive, what we call passive adversaries. It's people who can have full network oversight and see every packet on a network. They can see everything going in and everything coming out. And this transformation, shuffling, and artificial delay is what makes that impossible. Even if I see every packet going into these nodes on the internet, because for example I'm one of these global multinational corporations that can do

that, or because I'm a three -letter agency in a so -called powerful nation state, I have access to this information. So even those players can be fooled when we mix up these packets. And that's why Gnosis VPN is running on top of this HOPR mixnet. Now that does sound complicated. That does sound pretty bad. We've all seen Web3 products. Not all of them are great. So how bad is it really? What is new now is that we have a version of Gnosis VPN that you can test. That you can test with a booth out there.

I'm going to just briefly demonstrate how that looks like. So, we have a Gnosis VPN app, which does exactly what is shown here. So, we have basically a node, which is... I should go back here. So on your device, you're sending packets out to this HOPR network, which are then relayed by multiple others, in the end hitting an exit. Individual packets glued back together, hit the internet, and the same stuff back. So this is what you see in this kind of UI interface here, which is currently syncing a bunch of data. Oh, there we are.

Because it was connecting to Gnosis chain to find out where is everyone else. So this is software which empowers you by having locally running, and this is something I'm very proud of for the team to have shipped, having everything in local state. We're not aiming to ping RPC providers, gateways which handle that for it. No. Gnosis VPN empowers you as users to have all that control locally. Now, we have that one running. So what are we going to do? So I'm just connected. I'm not yet connected to Gnosis VPN, okay?

So this is just Cloudflare showing me some information of where I am. This is my IP address. For people who haven't seen an IP address, this is how it looks like. And everyone here on the same Wi -Fi has the same IP as I do. I am, of course, correctly identified as being in Germany. So let's connect to Gnosis VPN. I'm connecting automatically to the closest node, or the best node right now, which I think seems to be in the US. So I'm connected to the US right now. So one thing I'm going to do here is, because I'm a weirdo running this in a weird version of Linux, I have to set a name server. So let's see if we can reach the Internet.

This is just me trying to reach the Internet. Internet says, yes, I'm here. So what you see on the screen here is just me pinging out one packet, what we had in the previous slide, right? One packet going out, one coming back. It's the same thing. So to answer the question of how bad is it really, you see an answer here. It's between 100 and 130 milliseconds latency. This is worse than your normal browsing speed. But still, it's about a tenth of a second. So, the next question is, of course, how bad is it load -wise, right?

So, let's see. The next question also then is, does it work, right? So, is Sebastian showing us here something that, you know, doesn't actually work? Oh, yeah, I see an IP address from the UK. Actually, I don't know why I said I'm connected to the US, but I'm connected to the UK. Right, so we are connected to the UK right now via Relay Note that I think is somewhere in Sweden. So my data traffic here, when I loaded this website, was going from Berlin, chopped up into little indistinguishable packets, mixed up, sent through Sweden to the UK.

All right, that's not maybe a normal page that you access, so let's see something else. Let's see YouTube. Okay, there's a bit of delay, but it seems YouTube works over Gnosis VPN. Cool. Right, so Gnosis VPN is in an early test version live right now. I invite you to come by the booth outside and try it. I also invite you to go via the confessional and get an access code to try it yourself.

What we have seen here this far was basically all this mixing. This is live right now. One caveat is the current version is not live for production use. Do not go to all your friends and say, hey, please use Gnosis VPN. This is a test version. You want your feedback to know what we should improve before we launch it publicly. The infrastructure of these nodes is currently operated by us. That is something that we're going to change before going live for real. Now, finally, I would like to dedicate a slide to Mulvat, Mulvat VPN, for standing up to bullying of the UK government, because governments around the world are, in my eyes, increasingly weird, doing things that I do not quite

understand, like banning access to technology. And, yeah, the people here who have followed the MOLVAD ads, especially in the UK, seem, you know, how they're standing up to that nation -state bullying. So, I think, and that's why I bring it up here, it is something that people understand. There are more people right now using a VPN than there are people consciously, intentionally using AI. So, with that, I'm coming to the closing, why does Gnosis need a VPN? People know of VPNs. People want VPNs. I think people should have access to the most private VPN you could possibly build, and that's what we're doing with

Gnosis VPN. So the VPN space, when we started this collaboration here three years ago, was a $45 billion market. Now it's 80. So, of course, not all of them use VPNs for maximal privacy. There's the corporate use cases. There's the I -want -to -watch -Netflix -when -I'm -traveling use case that I hope Gnosis VPN can also cater to. But it is actually possible to build a VPN that is values -aligned, tech -aligned, and product -aligned with Gnosis. And that's why we are building Gnosis VPN to give you access to a responsible intranet access.

And with that, I'm closing here. And again, I invite you to test Gnosis VPN at the booth, commit your privacy sins at a confessional, and in exchange get access to the VPN. And yeah, enjoy a private drink and a smoothie stand. Thank you so much. I'm open for some questions. Questions? Got one there. Here?

Yeah. Okay. Raise your hand so we can see you better. There was a question from here and some back there. I don't know if we have a mic for you guys in there. There's another question back there. I've got a mic here. Is there a mic here? Mic here? There's one there. Oh, okay, okay. Hey. Hi, Sebastian. What would you say to someone who's maybe a bit more of a Web3 skeptic and say something like a Proton VPN, where they have these sort of legal and governance protections, supposedly, where user logs can't be kept?

what would be the privacy case for a NoSys VPN that's a significant improvement over what in theory can be achieved through some very stringent Web2 architectures? That's a really great question. So I like Proton. I'm personally using Proton. I like MoVat. They're great. But the trust assumption is always that one provider does not keep locks. And it's a lie, even for those good providers. Why? Because they are building on, you know, corporations which are operating within the framework of nation states. And guess what? In a nation state, you do have to comply with the law and the police. And when you, for example, get subpoenaed to log and track people, you just have to do it. Otherwise, you go to jail.

These are your exact two options. And of course, they do provide that access to law enforcement as and where needed. And yeah, this is something that you just have to trust them to not do. So, in case of Gnosis VPN, your trust assumption is that any one of the relay nodes between you and the internet is actually, you know, mixing traffic effectively. As long as there's one honest node, you're fine. And this is, by the way, also better than Tor. So, some here might be users of Tor, also fantastic technology that's been around way earlier than us. The trust assumption of torres where you relay internet traffic via multiple like hops also is that the first and the last node do not collude which is also strictly worse than a trust assumption of Gnosis

vpn which is one honest note so that's the that's the kind of privacy case here there's a question back there and i think something over here so thank you for the talk you've mentioned that currently the infrastructure is operated by Gnosis and in the long run this will change, right? And you've also mentioned that all the data for traditional VPNs is kept by one company. What is the long -term vision for distributing the infrastructure and also how can you make sure that no bad actors get info that is relevant to users, right? Yeah, excellent question.

So I would say the biggest point is by removing ourselves from the equation. We do not operate like, again, this is not live, okay? This is a test version only. Once it is live, we do not want to operate all your nodes. There will be individuals who operate nodes. And in fact, the underlying infrastructure, this HOPR network, the mixnet traffic, is already live with around between 200 and 300 nodes that are operated by individuals on a DAppNodes. By the way, shout out, if you don't have a a DAppNode, get a a DAppNode, run nodes, and run Web3 infrastructure.

So yes, that is the way how we want to distribute that. So we need multiple relay notes. We have that already. We need exits. Exit is a dicey topic because you expose your IP address to third -party users. We will have some precautions in place to make it as safe as is somehow possible for you. But that's something that you have to decide. And to the last part of your question, who is a bad actor? Well, that is inherently subjective. I do not know what's a bad actor for you. What is a bad actor for a citizen of the United States is not necessarily a bad actor for a citizen of China.

So what is a bad actor if something that every operator in this network has to make a conscious choice on, and we want to give them the tools to do so and to do so safely from wherever they operate. Hi. So decentralized deep in kind of sectors like Gnosis VPN of what you're building has existed for some time already. So Nym is an existing competitor. So two questions. One, how are you competing against existing ones like Nym that are large at scale already? And the second question, I guess, is are you guys raising? What valuation you guys are at? Would love to hear about the

revenue model. Sure. So first of all, we're not really competing against anyone. No decentralized VPN made it absolutely anywhere. Nym is great. They also build a mixnet. We also build a mixnet. Our VPN actually works over the VPN. What I showed you just here was running over a VPN. I just invite you to try that for Nym. I'll keep it at that. And, yeah, so no, we're not raising. We are supported by Gnosis DAO. Gnosis VPN is built and 100% owned by Gnosis DAO, thanks to GIP-98 and 229... no, GIP-222.

And yeah, so this is a part of Gnosis DAO. You know, the product is being built right now mostly by the HOPR team, with support from the Gnosis team for Gnosis DAO. More questions? Alright, then I guess we can close just in time. Thank you so much. Stay private. Thank you.