Think Like an Attacker to Stay Private - Jacob Czepluch / Lead dev rel Phylax Systems

[Music] Yeah. So my name is uh Jacob. I currently do deil um for fax systems which is uh as security focused uh company. So we are trying to just like fix security kind of in crypto so that uh crypto can actually move forward right it's it's one of the big challenges. Um but before that and how I got into to crypto was uh all the way back in 2015 I was writing my bachelor thesis um and initially I started out writing about Bitcoin.

Then my professor asked if I'd heard about um Ethereum uh and I was like I have not. Um started looking into it. I was like it sounds like someone who just tries to copy Bitcoin. Uh a little bit phony. Um, after some time I understood what the EVM was and that was like a game changer for me, right?

Cuz you can basically now write smart contracts and that was like it just like it clicked. Um, so I wrote my bachelor thesis about Ethereum instead. Send it to the Ethereum Foundation, got offered an internship in the in the fall of uh 2015, moved to Berlin um and went all in on Ethereum. Um, and back then the mindset I would say of Ethereum, of crypto, it was much more like cypher punk, it was much more like aligned values. Everyone was in it for the same reasons.

We wanted to build better technology. No one thought about making money. We just thought let's all move like work together, make this a success. um focus on on on like making this technology uh into something that can improve the world kind of. So that was like the ideology and why I was like really this is what I want to dedicate uh my time to.

Then um I started working full-time uh worked on the Raiden network which was back then it was u payment channels. So it was uh both scaling uh Ethereum but it also had an aspect of privacy because you were doing payments offchain. So you opened a a channel with someone but you could do payments offchain as many payments as you wanted and in the end it would only show like your settled balance. So this was actually both a scaling solution and a privacy solution. And I always found it very interesting to be able to do like private payments right especially digitally in in these days.

Um, and I think that's one of the things that most people um who are into privacy and who are into crypto, they they value they value the idea of being able to do private payments uh because like who who doesn't want to be able to buy things without like the government being able to figure out anything about you? Personally, I'm from uh a country like Denmark, Scandinavia, where we have everything that we want. Basically we everything works very well. We have it very well and we have really good payment infrastructure uh web through web two payment infrastructure um that works very well. It's super easy and I think in Denmark I have not paid with cash in the last 15 years maybe maybe more because it's so convenient just to pay with with card.

Basically the only time I pay with cash is at my hair cutter or like a hairdresser and they're definitely laundering money in the back. Right. So that's that's what you use cash for in in Denmark. Um so yeah, this was like where I kind of saw the difference between like we have this technology and we can actually get the full kind of cash experience but online. Um and for me that's one of the most attractive uh things that we can can build.

Then I lived in Berlin, Germany for a decent amount of time. And here cash is a big thing. And it's it's kind of uh beautiful like no one knows when you go to a coffee shop, uh restaurant, whatever, you just spend cash. And it's nice that no one can track you, but in Denmark where I live, anyone could just like not anyone, but if anyone got access to my payment history, they could probably figure out where I live, when do I do what uh stuff like this, right? So for me uh privacy is like just the freedom of doing what you want when you want without feeling that someone is like looking over your shoulder.

Um so yeah for me privacy enables um freedom I would say. Um okay that was a little bit of a of a derail. Um yeah so so since then um since 2015 I've also been running like Copenhagen Ethereum meetup group. Uh doing a lot of meetups there. uh always trying to invite invite different people to come and talk.

Um I met people like Amin who's doing like now privacy pools back in 2016. Um followed his uh path like followed his journey a lot as well and uh followed the toado cache. Um so like was an early adopter of the NATO cache as well. So know the value of of like these privacy tools and also understand why like the battle we are fighting uh to to to like make privacy normal kind of is is so important. Um sorry.

Um and in this and yeah and at the same time uh I think two or three years ago I met the guys from web 3 privacy now um and I really like what these guys are doing and I was like okay can I help somehow and I've helped a little bit with some of the events uh provided some like uh feedback to to different kind of things. Um, so I think like that's a little bit about like my journey into to like the whole privacy um thing. Uh, I think I could go on forever about why privacy is important, but if you're watching this, you probably already uh have an opinion about why uh privacy is important. Yeah, let's uh talk a little bit about like if you want to develop privacy focused uh applications. Um I think first off uh it's not an easy thing to do.

Usually uh doing privacy focused stuff also means using a slightly or significantly more complex uh tech stack. So you definitely want to be serious about it. You want to spend uh like time getting familiar with like the actual cryptography that is being used. Uh you probably need to know like some kind of knowledge. um one way or another some libraries there.

I think at the moment what I find the most interesting is probably like something like Aztec and Noah. I I feel like they probably have the best developer experience for building like truly privacy focused um applications, but it is still quite a learning curve, especially if you're not too familiar already with like the EVM and uh like crypto in general. Um, but I think that's where I would recommend uh starting out. Um, and just for learning purposes, I think it's quite interesting to yeah look at something like the tornado cache code base with smart contracts there. There's another project that I find very of it was very interesting uh a year ago is called Fern.

uh they actually implemented like full zero noise proofs uh on chain in solidity which allowed you to have accountbased uh privacy on chain whereas almost all the other current like private privacy solutions that exist at the moment are UTXO based. Um, so something I would really love to see is either someone picking up the work that the Fern team was doing or trying to find another way that we can have uh accountbased uh private payment solutions on chain because it is a better in my mind uh user experience. Uh so I think that's an area to to definitely uh look into uh and improve upon. Um, additionally, I would say there's a lot of stuff like privacy is a lot of things, right? It's not just crypto.

It's not just focusing on like smart contracts or whatever. It's also just about caring about your appearance online, so to speak. Um, right. So have have good like hygiene in regards to not sharing too much information about yourself, not posting pictures maybe everywhere you go or if you do then post it a couple of days later uh so that you still have this kind of privacy in in your life and maybe not like share your address with everyone all the time. uh small uh side story again is like in Denmark in Sweden we have like this kind of open registry where anyone can uh look up your name and you can basically get your address and your phone number and this is uh opt out so by default everyone is listed there and it's kind of crazy right there was uh two years ago I think there was a case with some guy who had been like showing off a little bit too much that he had Bitcoin in Sweden and some gang or something like that, they came to his house and tortured his girlfriend in front of him until he gave up his um his his private key.

Um so that's the kind of stuff that you should also think about, right? It's not just like uh having the the ability to do actually do private transfers uh on chain, but also just like care about your personal privacy life. Um uh so yeah, the first thing I did when I moved back to Denmark was to opt out of this kind of open registry. So if you're in a country that has something like this, uh check if you're you're you're listed there in the same way. Definitely recommend a couple of times per year.

Uh check have I been pawned to see like if any of your like passwords out there or just like Google yourself. Uh try to see if people can find information about you that you don't want uh out there publicly or like I don't know if you really want to go uh go deep into it. Um, still, okay, sorry, I deviated again. I'm not talking about the developer stacks anymore, but like if you want to go truly deep into it, you could get like a Farah Faraday uh pack for like uh carrying your phone around, stuff like that. So, people can actually not uh track you in any way.

I know a couple of people who who do this and I think it's it's uh it's it's pretty cool. Um, and yeah, in the same way, think about your like your mobile phone. Maybe disable location tracking when you're like out and about. Uh, you probably don't need all those things all the time. Um,

yeah. So, I think like that's that's like just some general things to to to think about uh that maybe most people uh don't care too much about. Um, yeah. And going back a little bit to like developing privacy stuff. Um yeah, I said it it's it's not easy to do.

Uh it's definitely worth doing. Uh it will take longer. You should be quite um cautious with like the let's say the GitHub account that you're using while you do it for example and all the other accounts that you are connecting to this project. If you're actually thinking that what you're building might I mean might be in a gray zone. I don't know.

Depends on where you live, right? But anyway, uh take the precautions from the get- go uh so that you're not like uh you don't have like a profile picture of your face and your cat or whatever uh just representing this project, but like build up an anon account that you can use for these kind of things because you never know when some government decides that what you're doing is potentially illegal. It's sad that it's uh come to this or that we're at this like um stage. Uh but yeah, just better safe than than sorry. So yeah, you have to think step a decent amount of steps ahead of uh of of uh of what you're doing for sure.

So it it sounds maybe basic but just make sure you have these things uh covered. Um so um yeah let's talk a little bit about uh hackathons some like general tips for hackathons and maybe a couple of like ideas uh things you could potentially manage to do in a in a in a hackathon and maybe also um tips for how you could potentially win them. Uh so I think in general if you're going to a hackathon uh privacy focused or or not uh it's a good idea to have like expectations for the for the weekend first of course uh and also are you going with a group of friends or people that you know or you going there alone you already have an idea or not. Um so I think there are many different uh approaches and options. I think one thing you can do can go there um just have the idea that you want to work on some privacy focused uh project go there check out what are the technologies available potentially the the sponsors and then see if you can use any of those to to build something uh if nothing else it's a good way to get familiar or with or learn a new uh technology um I think that a pitfall or something that's quite quite often happens is that people sit down, they look at all the rewards of the hackathon and then they try to force these uh technologies onto their project or as many uh technology as possible onto their project.

And I think in general this is a mistake. Um because it sometimes means that you end up building something kind of that the sponsor wants to see instead of something that actually makes a lot of sense. So in my mind you should come up with an idea uh let's say privacy based idea that you want to build and then build it and if you can use one of the sponsored technologies that's good then do that but try not to force it because it just means that you might build something that is not the optimal solution. you should always focus on how can I solve this problem in the best way um and not how can I build something that gets me the most bounties because in my mind if you build something that actually matters that actually makes sense then you won't really have to worry about like if you get a small bounty at the end of the hackathon because you might be building something that will make a an impact uh in the space in the long run instead. So, I've seen projects that didn't necessarily win a hackathon, but they are still around or people are still using them for something.

Uh, and it can also just sometimes be the fact that the judges didn't fully understand what you're actually building, right? Um, so whatever you do, my best advice is don't try to force technologies onto your idea, but build the thing that you want to build and then take it from there.

Um,

yeah. So, And how do you potentially win a hackathon? Um again uh it's like a fine balance as I as I said because like

do you build something that really um like matters uh then hopefully the judges will realize that um and even if you build it without focusing on any of the sponsor prizes or sponsor technologies the judges should still realize that you build something impactful and at least you can run away with the the main prize potentially. Uh, and I think that is better than trying to win three different uh, prizes. Um, and tips for winning. I would say like build something that's fairly easy to explain how it makes an impact. Uh, focus on telling like how you utilize some like privacy technology.

Uh so people want the judges want to know that you used and understood how to use the specific technology and also make it very clear how your project will potentially make an impact or how it can be used for something new or something that enables people to have um privacy.

Uh what else do we have? Yeah. So, and I would say like, okay, that was about winning, but like general tips for like hackathons. Um, of course, have fun. Uh, I think I think that's the most important thing.

Like, go there and don't just say, okay, it's a failure if we don't win anything. It's also about like having fun, meeting some new people, learning new things, just like sitting down and like heads down uh having fun. Um, personally, last year I actually joined the the FD DAM hackathon uh with two friends I hadn't seen in a year and we decided this is just how we are going to spend a weekend uh catching up. It was a lot of fun. Uh not a lot of sleep.

Um we ended up building something that was actually fairly useful. Um so yeah um it it's for everyone really and you should just like not take it too seriously. I think that's a a good advice. And um if you have this idea, I don't know, for a year or just for some time, something you want to prototype out as well. It's also not there's no shame in doing a hackathon just for the sake of prototyping something.

I I know people who just go to a hackathon to just do their regular work, but they just like to hang out and enjoy the the the vibe and the atmosphere of like-minded uh people. So um yeah, hackathon is not just about winning uh or not even maybe building meaningful stuff but it can just be about mind share with people who are also focused on privacy stuff. Uh so yeah, don't uh don't take it too seriously. Don't be sad if you uh don't necessarily have an idea when you get here. And if you're in the unlucky situation that you don't find a team, then just

take the opportunity to hang out and uh

learn about something new. But yeah, also interesting to talk a little bit about the potential intersection between security and privacy. Uh how they sometimes can go hand in hand and sometimes how they definitely don't go um hand in hand. um and how security sometimes uh work against privacy. I would say uh so for example there are some very big companies in crypto by now and some of them have like they have to care a lot about their security because they have a lot of users who could lose a lot of money if they got compromised.

Um, and that potentially means that the employees of these companies, they have to use company laptops with uh like running software that basically monitors what's happening on this laptop. Um, which is kind of very invasive, especially for someone caring about um privacy. So sometimes security is much easier to do efficiently when you have more transparency and not that much privacy, I would say. Um, So that is also one of the things that can make

things more difficult, right? We need to have better security in crypto so people don't lose their money, they don't lose trust in in in in what we're building. Um, and at the same time, we want to have privacy. Um, but privacy also means even less uh transparency, even less chances of recovering lost funds. It's like there's a reason why uh North Korea likes to use tornado cash to launder their money, right?

Because it basically uh kind of uh deletes the the trace of where they're coming from. Uh so as someone who loves uh privacy, I love to cash. But it's also one of our biggest challenges in the security space is like as soon as uh North Korea starts moving funds into tornado cash, it gets so much more difficult to like track it and uh further uh investigate what is actually uh going on, which is um kind of a dilemma, right? The how do we how do we how do we solve that? Um and I don't have like a golden answer to this uh except I will definitely tell people who are working on privacy solutions that you should very much also take uh security into consideration um and and do what you can to make sure that the users of your uh privacy solution are as safe as possible.

So yeah, focusing on best practices uh solidity devops uh all that kind of stuff. It's it's very important. Um and more so than than than anywhere else, I think like privacy really needs to to to focus on security because um when things go wrong in in in privacy solutions, they they probably go um very wrong. Uh I would say something like yeah, I don't know what a good example would be maybe privacy pools. Uh that's where all the all the fusses at the moment, right?

Like if you look at these guys, they they spend a lot of time getting audits and having like slowly rolling out their protocol to make sure that like security is in place and that it's actually working as it should work. So yeah, um I would definitely recommend that if you if you're building privacy solutions, uh privacy dabs,

prioritize uh security. Probably prioritize it more than marketing or anything else. Uh cuz uh yeah that's uh we don't want another um like tornado cash lazarus uh whatever situation. So um yeah I think that's uh very important to focus on and in general I think that we cannot uh bring crypto uh forward uh without good privacy solutions. Um, but we also need good security because we've seen so many times protocols getting hacked, billions being lost.

Um, and all of this just makes mainstream uh dislike crypto even more. So, yeah, we we we need uh we need both. Um, and there are definitely uh ways to to to focus on both. If you have, let's say in the case of uh like you care a lot about security, you get hacked, whatever, right? And then it's uh usually the privacy solutions that are used to to launder this money.

And I think this specific dilemma is is is a big thing to focus on is like how can we build

let's call like safe privacy solutions like I don't want to say censorship like I don't want to say like permission based but we need to solve that somehow. It it has to be a way that people can prove that they're like not bad guys. They just want privacy. Like privacy is not about privacy is not about like doing illegal stuff, right? Privacy is just about caring about privacy.

It shouldn't be illegal. Like you should be allowed to just say, "I don't want anyone to know what I'm doing with my money. I don't want anyone to know what website I'm browsing. I don't want anyone to know, I don't know, where did I drive Saturday evening?" I just want to be able to live my life and not have people like knowing anything about me.

Basically, like you should, it should be the default. I feel privacy should be default for sure for everyone. And then you can choose how much you want to share. Like if you want to share on Instagram that you're doing something in Dubai, whatever, like go ahead, be my guest, right? But it shouldn't be the fact like the the default that that that you do that.

Um, so yeah, I think if we go more into like the social aspect of of of privacy and why you should care or why people should care is like definitely about this like privacy,

it could go on forever about this, but like without the privacy, without the the the like idea that you can like do whatever you want when you want to do it without other people knowing, then that that's it's not sustainable. And if we go back, I don't know, 100 years, maybe more than 100 years, but like the default was privacy. Back then, there was no technology that allowed for surveillance of any kind, uh, you just knew like if you were in your own house, no one else would basically know what you were doing. If you're alone in the forest, whatever. No one would know what you're doing because there was no devices tracking you or anything like that.

Um, and I think that's how people like people evolved by having privacy because it enables for for freedom and for like doing what you want and having like freedom of speech is also like kind of related to to to this I feel like um because like you should be able to like say what you want especially be able to say what you want uh in front of your friends or whatever. But now when I'm sitting talking with friends like sometimes I'm thinking like even if someone could hear the joke I'm making right now assuming someone is listening like they would definitely like that could be used against me or they could misinterpret it like if you can't even sit with friends and make stupid jokes that you wouldn't be making in public then something is very broken in our society I think. Yeah. So yeah, it's um it's it's like human like privacy should be like a human right, right? and and I think most people not most people but if you're watching this you probably agree with that but there are so many people who either don't really care about privacy or they definitely don't want privacy especially governments right but um I've also seen many different countries like even just the difference between let's say Germany and Denmark Germany still loves cash uses it a lot Denmark barely uses cash and no one there cares about it like for many many years uh in Denmark people still use Facebook Messenger.

That's the default way of communicating. I think maybe it's encrypted now or you can enable encryption but people in Denmark really don't care about uh what people know about them. Um and in Germany people actually care in Germany people actually care quite a lot more um about the privacy and I feel like there are other places in the world where they care even more but it's definitely yeah it is a cultural thing if you trust I think if you trust your government quite a lot then you probably also feel that you trust the others like your your the citizens that you uh interact with uh more um and if you don't trust your government that much then probably also care a bit more about um private obviously. So there there are some interesting aspects in in how two countries for example that are bordering each other can have very different ways of of looking at the importance of of um of privacy. Um so yeah I would say maybe as a closing note that uh there's a difference between like depending on where you come from you probably have different needs for privacy and different things that like that you want to build privacy for.

So yeah, focus on that. Like again, if you're going to a hackathon in, I don't know, Germany for example, but you're coming from a place in the world with a lot of corruption, then maybe try to build a solution that would be for your country and not necessarily for the sponsor coming from Denmark or whatever that face entirely different privacy issues. So

yeah, try to build something that has an impact and maybe not focus on the um 10 different bounties that you can win.

I think to to wrap up things, um I'll just talk a little bit about like how I do privacy and some of the tools I might want to to see being uh built and some general uh recommendations I have. Um I think to start with some general recommendations uh there's a bunch of nice uh like resources you can check out uh go to the web 3 uh privacy uh website and and check out there they have great resources so you can read uh some different manifestos both cipher punk and privacy focused go to an event uh it could be meetup or hackathon by web3 privacy um but I also very much recommend something like uh uh hcpp the hacker congress pal police in in Prague. It's a really really great place to go and get like this real cipher punk vibe and a lot of people there care deeply about their privacy. Go there, talk to some people, understand how they have been living more or less off the grid for many years. Um it's it's very fascinating, very interesting.

Um, yeah. Uh, I think that that's like some of the things you can do to like level up a little bit and learn more and experience some of these things in in in real life. Personally, for like my stack of uh privacy focused tools, I use uh Signal for messaging. I've almost managed to get all my friends and family uh there. Um, and and it's just it's it's nice to have a little bit peace of mind that whatever you talk about like no one uh really uh knows what's what's going on.

So that messaging that's I feel like that's a a no-brainer. Um for private payment, I feel like that's still somewhat uh an unsolved problem. So I would love to see a good solution for this. uh currently if you would use something like um if you want real private payments and you do I don't know um what's called rail gun or something like that but to actually do the payments inside the system it's extremely uh expensive so I would love to see something that allows you to do this in a in a cheaper way that is fully private um I use if it has to be private I would use Monero um at the moment so I have Monero and it's a good way to actually pay people if you want it to to be private. Um, for like general tech, I use uh as a browser.

I know a lot of people use Brave, but I've just used Firefox for a long time. I feel more confident uh with that. Um, and yeah, anytime every anytime I'm I'm doing anything related to like uh crypto, doing it in like a diff um separate profile. will not do like cryptoreated stuff in the like browser window or browser profile that you use to I don't know look at pictures of dogs or cats or whatever right like keep things separate ideally maybe even have a separate laptop that you do that you have all your like crypto on or do all your crypto stuff on because here again we kind of get at the intersection of security and and privacy um you You never know if you've been compromised. You don't know what weird stuff is running in some extension you installed years ago or what app you installed years ago.

So like just make sure for the sake of your privacy and for the sake of your the security of your your crypto that you really separate uh concerns. So having it as a laptop uh just for for your crypto that's a good idea for example or having a separate phone um that's something I I set up recently. I installed uh Graphine on an Android phone, a Google phone and um I use this phone uh kind of as a hardware wallet. So I I sign transactions with it and I have some crypto on it. So if I'm out and about at a conference or wherever and people actually want to get paid in crypto, I only use this phone.

So this phone has nothing to do with my phone where I have like my pictures, my private life, all that kind of stuff. So like try to separate uh Yeah. Yeah. separate the the concerns. Um I think that's a very good um tip as well.

Um and try to use local um services when you can. So a good example I think is like uh key uh for like uh portfolio management tracking. A lot of people um a lot of people like to use I don't know Sirion or whatever because it's convenient, but don't do that. Uh basically it's not that difficult to connect your IP or whatever with uh with the the stuff you have there and then people would know how much crypto you might have. So do stuff locally where the data is stored on your local machine.

Um I think that's a that's another solid um advice. What else? Email, for example. Email is a big one. Uh I use Proton uh email.

I think it's nice. It's encrypted. It's based in Switzerland where they have very strong privacy um like legislation. So you have a lot of rights there compared to many other places. Um what else?

Yeah. Okay. Um again mix of security and and privacy but like if you go to conferences, if you post on social media, stuff like that, maybe don't uh just go out and say that you have a lot of uh crypto or whatever. Like keep a low profile. dress as a normal person when you go to a conference.

You don't have to stand out wearing your I don't know diamond uh golden something jacket saying bitcoin on the back. Uh just blend in be a normal person don't stand out that uh get you a long way as well. Um yeah, I think that's like the main things I have in my like privacy stack for like just getting around as a as a regular um person. Using VPNs, very good uh idea as well. Doesn't matter too much which one as long as you use one that is a significant uh improvement for sure.

and uh possibly also don't uh fill your laptop with uh stickers of different crypto companies because that's a pretty sane thing if you're sitting in a coffee shop, you I don't know, you're going to take a you're going to take a toilet break and you forgot to lock your laptop. I mean, I know for a fact if I was walking into that coffee shop and I had ill intentions, I would take the laptop with the crypto stickers on it first. Um, so yeah, spend a little bit of time every now and then thinking about like how could you get uh how could you get hacked, how could you get compromised and then like fix those uh issues in in your in your your um private uh personal setup. I think that's uh that gets you a very long way both from a security perspective but also from a a privacy perspective. [Music]