# Why VPNs are scams and what to do about it

- Speakers: [Harry Halpin](https://streameth.org/speakers/harry-halpin)
- Channel: [Devcon 7 SEA](https://streameth.org/devcon_7_sea)
- Date: 2024-11-12
- Duration: 08:59
- Watch: https://streameth.org/watch/6732f66880d989c5b7ab5ce4

## Description

Existing VPNs are essentially scams. Free VPNs and most centralized VPNs (such as ExpressVPN, owned by Kape) are effectively data harvesting companies.  Decentralized VPNs usually have a few large servers and offer barely any more privacy than centralized VPNs. What is missing is 1) onion-routing packets like Tor 2)  adding noise (fake traffic) 3) censorship-resistance and 4) mixing packets from different users together. We'll explore how technologies work to defeat even AI adversaries.

## About the speakers

### Harry Halpin

CEO and co-founder of Nym Technologies, a startup building a decentralized mixnet to end mass surveillance. Formerly a research Scientist at MIT and Inria de Paris, where I led the standardization of the Web Cryptography API across all browsers. Postdoctoral studies under Bernard Stiegler in the philosophy of technology. Ph.D. in Informatics from the University of Edinburgh and also teaches cryptocurrency at the American University of Beirut.


## Transcript

. VPNs are scams and what to do about it. Hey, everybody. Okay, cool. Thank you so much for coming. So VPNs, how many people here have a VPN? Okay. Can people just have a VPN? Okay. Can people just name a few they have? What do you use? ExpressVPN? Mulvad? Not so bad. Proton? Free. IVPN? They take Bitcoin, which is cool. I don't know that one. Okay. So I'm just going to explain. I'm Harry Halpin. I did my PhD in language models, which are now very fun and a big deal. But I gave up on working on them because what I realized is that machine learning is very dangerous and can cause problems and basically identify who you are no matter what you're doing on the internet. And one particular source of data for machine learning and identifying people are VPNs. VPNs are scams. All centralized VPNs are scams. Some of them are slightly nicer than others, but it's still basically like protons, like, yo, we're Swiss, trust me, bro. Same with, you know, MoVad, we're Swedish, trust me. And a lot of VPNs, what you think are separate companies, such as NordVPN, Private Internet, Surfshark, they're all ran by like essentially malware delivery companies or data collection companies. They essentially honeypot your data. So they can connect your data. When I use a VPN, I simply connect to someone else's computer. That computer sees all of my traffic. They know exactly what I'm doing on the internet. And they can connect that to my credit card and my address. And they can bundle that data and sell it. Sometimes the government's to ads. It's just they're absolutely terrible. Decentralized VPNs have been going on for a while. How many Mysterium folks we have in the house or ORCID. It's just, they're absolutely terrible. Decentralized VPNs have been going on for a while. How many Mysterium folks do we have in the house? Or Orkid? But the problem is they don't provide actual privacy. An adversary can just look at the DVPNs and de-anonymize you. So what we've decided to do at NIM is we're trying to produce a VPN that's both decentralized and actually delivers privacy even against government level surveillance using AI algorithms. So we do this by adding noise to your connection. So when you connect to a normal VPN they kind of know exactly what you're doing. When you connect to a decentralized VPN a group of nodes knows exactly what you're doing. What we do is we encrypt each packet separately, similar to Tor, but unlike Tor, we mix the packets up, and that's a mixnet for people that are interested in that, and then we add fake traffic or noise. So this is a comparison. This is your normal VPN. You can see this guy can see everything you're doing and this produces a unique fingerprint of your data Nim on the other hand adds fake traffic and the packets come out anonymized and again It's a decentralized network as a decent network. Anyone can run a node you get rewarded and Nim tokens We use zero knowledge proofs to log in So you just send some tokens to a smart contract, you get back a zero knowledge proof, and you log in using a zero knowledge proof. So you don't have your address, but we can prove that you paid open source, so forth and so on. This is maybe a nice little overview of the differences. So again, decentralized routing, no single company in charge that can put in a backdoor, open source, mixing packets, adding cover traffic, and unlinking any payments to your session. And, you know, we have a lot of other cool stuff. We have APIs. You could, in theory, and if you look up my Ethereum ETH DAM or Ethereum Amsterdam talk, we even showed how to integrate against Ethereum validators to prevent various DDoS attacks on the Ethereum consensus talk. We even showed how to integrate against Ethereum validators to prevent various DDoS attacks on the Ethereum consensus algorithm. And you can hook up to like client software. Metamask is a bit tricky, but you could use Helios and whatnot and anonymize your transactions that way. So if you're interested, we would like you to give it a shot. It's on Google Play. It's in TestFlight, not quite an app store, DevCon, whatever. Just give us a shot. And I want to say when you install it, you get something that looks like this. You've got to download it, right? So when you go to, you go to nimvpn.com slash download. And then the confusing part is you have to enter your email. Don't worry. You can enter a fake one. We don't care. We don't, it's just like you enter random strings. And then you get a QR code or this. This is a small zero knowledge proof. And then when you start up the VPN, you can choose if you want to be fast, which is no mixing, or you want to be anonymous, which is a mix net, so we mix your packets up, and then you choose where you want to come in. The nearest nodes, I think, here is Singapore, or where you want to come out, and then you cut and paste that QR code in, and then it just works. So that's it. We have a lot of cool stuff coming. Please try it out. It's free for a month so we can defeat fucking authoritarians like Donald Trump and all these motherfuckers. Okay. So, yeah, that's it. Time for Q&A. Okay, Q&A time. So, in this stage we will be throwing this microphone so raise up your hand if you have a question. Oh, and I need opportunity to fuck the deep state Democrats as well. Just so you know. You're first. Okay, catch it. Sorry, I'm not very good at this. I just want to know what's the main complaint of your current users? It's mostly crazy cryptocurrency people doing beta testing. So we have a lot of people in countries which have some form of censorship, folks in Russia, China. We're still working on some of the censorship prevention techniques to get around certain kind of firewalls. But mostly it's just crypto people who are token holders who are just trying it out and having fun. I think we have about 5,000, 6 six thousand people downloading and using it so but it just started basically. But unlike a normal VPN the more people that use it the more anonymous you are unlike Tor or normal VPN so five thousand people is a reasonable size in a mini set. You mentioned earlier Mysterium and Orchid and they both are on the market since the time they both struggle really to get any significant amount of users. What do you think is something we can do about that to get more people to that decentralized world? Yeah, you've got to onboard the normies like normies. So the problem was we looked at Orchid. I like Seven. He's a cool dude. But the problem is that they said, oh pay as you go, so I want to pay for a gigabyte or megabyte. Normal people don't do that. And they also required like some weird token stuff to get the thing going and most people have trouble buying tokens, right? So what we do is we just have a normal fiat interface, Stripe, if you like Bitcoin, my BTC pay, and we take that payment in fiat or whatever and then an API converts that over to NIM token, and then we do an automatic buy of NIM tokens on the open market. So it's all invisible, the token part, and there's tokens that reward the nodes. It's all invisible to the end user. I think the key is to make it look and act as much as possible like a normal VPN, but also offer features that normal VPNs don't have. So we have this anonymous mode, a mixnet, which no one else has. We're the world's first decentralized, actually anonymous mixnet. You know, support Chelsea Manning works for me, Julian Assange is a big fan, and that's something that no normal VPN has. Okay, last question. I'm around afterwards, so you can grab me afterwards. Run, run, run. Throw the ball. Why doesn't Tor just add noise? Tor has looked at it. I actually had dinner with Roger last night. You can ask him this question. They are considering. But Tor is not a mixnet. So Tor optimized for speed, which is reasonable for them to do back when they started their code. And they weren't like, it's complex. You have to have like, figure out like, you guys have to do some form of traffic shaping. And at the time, this was a harder thing to do. Movad's also looking into adding noise. I think they have it working on iOS or one of their clients. It's actually really, it's a large amount of tricky machine learning. So mixnets, particularly what we are called continuous time mixnets, we actually do a default, what's called traffic shaping to Poisson processes. So you don't know when you're packet-arised, but you always know the average time, and that makes adding noise much easier. Okay, I think that's it. I'm sorry.