# Why Privacy Is Still Hard and Will It Improve - Panel Talk

- Channel: [ETHCluj Meetup](https://streameth.org/ethcluj-meetup)
- Date: 2026-06-09
- Duration: 1:09:50
- Watch: https://streameth.org/watch/yt-A-fvKfU-qn0
- YouTube: https://www.youtube.com/watch?v=A-fvKfU-qn0

## Description

Roxana Nasoi, Mike McCabe, Robert de Groot, Steffen Kux, and Gavin Birch discuss the current state of privacy in Ethereum, the associated trade-offs, and how technology, UX, and regulation may shape its future.

## Transcript

My name is Roxanna. I work with Logos. Um, and we've been here for the past few days with the Logos Lounge. Had a very nice circle, very intimate conversation and a privacy boot camp. Um, I've been in the space for a while. Well, I've tried everything and then I realized I just want to go back to privacy and try again. >> Yeah, I'm Stefan from Kobas. So mostly I'm known for the verification the status verification but we also are doing a lot in the direction privacy and especially we published some papers in the past about pragmatic with privacy and yeah to help to get privacy really being used in applications not only in on a theoretical paper but all also in real life applications. Hey everyone, I'm uh Mike McCabe. Um I work at Oxbow. We ship several privacy and compliance tools. Uh most prominent one being privacy pools. Uh we just launched our version two test net this week. So uh I encourage everyone to go and check that out. Uh yeah, happy to be here. Thanks. Hey, I'm Gavin Burch. I work with the team and uh community to build Armada. uh Armada's pluggable asset privacy. Uh and yeah, we're getting close to launching our test net and we're and also crowdfunding. Yeah, thank you. I'm Robert. I'm with webt privacy and I was asked to moderate uh this session and I realized three things. First, it gives me the opportunity to fully hijack this uh last panel. Uh two, uh we are the last panel before the closure of this event. Um so let's make it engaging. Also for the viewers at home um if you have any questions during the session please feel free to uh hold up your hand and we'll uh we'll give you a moment. Um and thirdly I also realized uh you have seen some of these people or all of them talk in the past few days at this conference already. So I realize that there's in front of you right now five human beings who each consider privacy a solid human right to fight for which might result in a panel where five people are all nodding yes to each other about every question. So in that in that light um I'd like to ask each of you because I know that obvious interacted also with different ecosystems beyond the one where we are at an event of right now to take um a broader view um in trading during market swings. Sometimes the um the saying is when in doubt zoom out to zoom out um about how ecosystems are innovating and performing beyond Ethereum as well. There were blockchains before and there might be blockchains after Ethereum and how can we improve specifically this ecosystem what we're all active in and what we're working on and um having said that the topic of course is why is it still hard and will it improve there's an assumption in that uh and then a question and as there's always reasons to or or you can find a reason to be a dumerrist let's say so I would like to start optimistic what do you see as the current u reasons to be optimistic in this space? What are the biggest breakthroughs that you're impressed by with regards to wins for privacy within this Ethereum space? Um yeah, I think uh the the distribution part of privacy is is really being solved, which is going to be I think something to be incredibly optimistic about. Um, privacy has historically been this kind of like clunky standalone application that you need to have a lot of like knowledge and um, interest in to actually like use, let alone use it correctly. Um, now we see things like Kohaku, we see things like cloaked wallet, people can just like oneclick shield their balances. Um, I think making this easy is is basically the most important thing for users to actually adopt it. Um and so yeah these these two things in particular um the Kohaku SDK is I think really going to be a gamecher for the entire privacy space. So I think the most important thing is what right now is happening is that our view on privacy is a little bit changing. So often in the past privacy was okay I have to hide something which might be a have a good reason to be hidden and normal activities seem to be not or no need for them to use privacy. But now more and more the understanding comes that privacy is something we really need for daily use for business applications. You cannot use blockchain if you have no privacy adaption in enterprise applications. You need it and privacy or the missing privacy is an attack vector for everyone who uses a wallet or something like this. So we need to understand and more and more it is understood that privacy is something we really need on the first line on the first priority. It's it's needs to be built on top of things we already have. We need all the technologies. This is a good thing. We have already implemented a lot of things. But now we have to go the next step. >> To certain extent I agree to another extent I don't. Um so I think I think it's nice to see that we still have the cypher punk values. Um and a lot of the old cypher punk values are coming back to the space. Um so it's sort of a we're we're striking towards a collective alignment on what is privacy, why we need privacy, uh who should benefit from privacy and so on. But in the same time um the biggest issue we have is that we in this desire to onboard 1 billion plus people into the infrastructure. We have um went beyond a an you know an automated uh smart contract uh infrastructure and connected that to the internet through the browser. So then um we're kind of exposing identities and we are sort of pushing this digit this this onchain identity component a lot across applications and and some of the um architecture. So that for me is a big issue because um that creates an attack vector uh that creates a lot of the security issues we have a lot of the hacks that we have. So I think um I think we we have the values but I don't think we solved yet. Uh and we we've been fairly afraid of telling people look this is blockchain native and this is how it should be used and this is how you have to do it and privacy is really hard. We're kind of trying to simplify things to attract um you know a new web of users and I just don't think that is the way. So you're saying um trying to simplify things is not the way to get new users. Could you could you repeat that last one? >> Yes. Because look, privacy is a journey. Yeah. You need to educate people on an invisible threat which is never easy. So if I'm oversimplifying things um I'm I will have to go through um you know kind of cutting corners, right? So I just don't think that is the way. I think I think if I go back to the way the cipher punk um movement started, it was just a few people and it was very difficult. However, 10 years later, 20 years later, we we are here um and we discuss about it and a lot more of us understand it and understand that it is it is hard and it is a fight. It's not it's not a right. It's a fight. It is our fight. So, a fight a war is not easy. A battle is not easy. Um do not oversimplify. You have to spend a lot of time and educate and share the knowledge and teach others and create something I spoke about yesterday. Create commitment mechanisms, create defaults. Yeah. So our generation will go through a hard battle. Um but then it becomes the standard. The next generation Yeah. Your kids will use it. It it will get there. It's just going to be like a very longterm vision. It's not going to be oh next year we're going to have 10% more of the people you know on boarded into privacy tool. It's going to be a very very long long process and we have to be ready for it. >> So one more word to the simple to make it more simple. So when we have applications which offer privacy in most cases this is very complicated. It is expensive. It's slow and most of the people decide to opt it out until they need it. This is often the case when it's too late or when we look at the developers, it's complicated to integrate. It's makes the application very hard to maintain and so they have it on their road map. they will implement it later when they have all the other problems being solved. So, and I think here is the problem which makes it very difficult to introduce privacy because if we expect people to decide to choose privacy by sacrificing convenience, I don't think that education is enough for this. So we need to start with easy to use things which increase the privacy. Now we don't need the same level of privacy for all operations. If I have a dashboard in my wallet to read some token uh values I don't need the same privacy when I prepare a important transaction. So and so when we try to have the maximum of privacy the gold standard in every application in every request in every transaction this makes applications too complicated and people will not use it. So we need to level it up so that we start say okay what privacy do we need for what operation and then we do have to do it level by level so that we can introduce simple level which are not expensive and not complicated to have more and more privacy. What am I optimistic about for for privacy in the space? Um I I'm I'm excited that I think it seems like we're reaching a turning point. um you know we we played on some of us have played on hard mode for quite some time and haven't really you know have have suff suffered for it and then other people played on easy mode and they you know they've made off very well um and I it feels like now that sort of crowd is starting to kind of question their future and uh you know I used to think are we going to bridge to the rest of the world like global finance or are they going to come to us and it really feels more and more like it's coming to us and uh and it's because we play it on hard mode like they're here for the you know for these what happens to be for I don't think they necessarily carry the same cipher hunk values right but I think that they're they're coming because of the things that we value there's a shared value um so uh yeah but they're going to need privacy because none of these businesses are going to you no no discerning organization is going to run on uh you know their operations transparently. So they're going to need privacy and I don't see why hard mode shouldn't stop uh if we're going to like we can't just I think it's not good enough to just say oh privacy is just hard. I think we do need to make it easier and I think I totally agree with Stefan that we need to like choose pick our battles there. Uh there is such thing as good enough privacy. So um you know it just depends on what it is that you know you're what it is that you care about what you're securing. Having said that I um want to recommend that each one of the speakers has also shown this weekend or this this past days um beautiful graphs and distinctions between levels of privacy in different applications. So do check them out if you're checking these videos. Um having said that um the difference here is you're all bu in your organizations are providing consumerf facing applications in some sense or form. Um as repy privacy we we don't let's say we don't have a product per se we're more of a movement. Uh so we are more focusing on the awareness as a form of um make a change at the earliest start of the supply chain in the human change let's say on the human level um as you mentioned Stefan the um there's one hand there's the change to make from the demand side we're creating from the other side on the other side it is privacy by default in applications where would be in your opinions the biggest win. Uh I mentioned in one of the previous talks that um let's say a passive way to increase privacy um outside of web 3 was the advent of of WhatsApp having providing end to- end encryption for users without them even realizing it when they started using it most of them would that be the way to uh increase privacy for all also in web 3 in such a sense just build it and it'll become a standard would there need to be a market demand And for privacy is the question or would you or is it also does it work to just offer it directly as a part of a product? >> Yeah, it basically it basically ties into what I was saying earlier with like the Kohaku Ethereum Foundation SDK. um you know like if if you are a MetaMask user and you have a public balance and a private balance tab and you can seamlessly switch in between those two then I mean maybe people that don't even care about privacy at all right they're like fine okay my entire financial life is broadcast in in public like I don't care um I think even they like would just do it to test it out the shield building. Like I think the closer you can bring it directly to where users are at, the more likely users are to actually go ahead and use it. And so like I think MetaMask has like a couple of hundreds of millions of of active users, right? And I think if they can offer a feature like that, like just, you know, go private by one click of the button. Um, no hassle, no fees involved, no secrets, no no seed phrases, no CK addresses, none of that. It's just one click, public to private. Um, I don't I don't see a reason for people not to do that. Essentially, I think if that feature is there, most people will use it. So I fully agree on this. This is what I mentioned earlier that we have to build it in a way that it's easy to be used. Now Kohaku is a good good example. You mentioned WhatsApp. Maybe not the best example but but they introduce when they introduced end to end encryption this was a good example because nobody cared about it and it was there and could be used. And in Guago we have now this way to shield it with one or two clicks. So it was possible earlier as well. So I could use real gun or privacy pools right there. So there the these defao side it's the same. If I have in interesting and good gold standard privacy protocols which are very hard to integrate the rules will not do it. So we have to integrate privacy on the protocol level so that our depths are written in almost the same way but the protocol level has beside other important things like verification also privacy in it. So that the the developer doesn't need to care too much about privacy because the protocol offers this opportunities. I think these simplifications we need now for the user that it's easy to be used and he must understand or he must understand that it might cost a little bit more and on the developer side you have to put it into the protocol level so that it's easy to be used and easy to implement it. The conversation sometimes is a little hard to follow simply because we use the word privacy so option uh so often and without specifying what we actually mean by it. And so an analogy like labor can mean gainful employment or it can mean abject slavery. and like having a discussion like is labor good or bad without defining what you mean by it is completely pointless. Um would it make sense uh like as a um as a organization as a ecosystem would it make sense for us to largely stop talking about privacy and actually talk about like the decision points where people uh would get benefit um by exerting power and educating them about the context and the tradeoffs uh involved in exercising power in a particular way. >> So you're proposing to change the narrative? >> I mean like um like there's a lot of people who um are like not uh down with kind of the privacy vibes and culture. Uh, and some people are automatically alienated when you talk about the war, the struggle, right? All this stuff. Um, but if you go to people like in the case of um like, hey, uh, did you notice that $5 wrench attacks are on the rise and people can see your entire linked transaction history on Ethereum? Um, if you maybe for major uh accounts use a technology like privacy pools which breaks the links between your different accounts, you'd become less susceptible to a $5 wrench attack. Here are some tools to do it. like that's much more concrete than encouraging people to be like striving towards this undefined ideal of being fully private. >> Okay. So for the for the longest of time um and this has been studied for for quite a while um society kind of balance between public and hidden transcripts, right? So, um, public public transcripts were things that were told, um, things that were communicated and a lot of the times things that, um, didn't necessarily reflect the truth. Um but hidden transcripts, hidden transcripts, uh such as uh folklore, theater, um you know, um any kind of written or sang pieces, um any kind of gestures where we make fun of something um actually provided an opportunity for people to be honest. Um, but they were they were designed as a hidden way of speaking the truth. So to your point, privacy has actually been our focus for a long time. We just had very different definitions to it, right? Because we've always had this correspondent correspondence between power and people that were not empowered, the powerless, right? So we had um uh chief captains leading the tribe. we had, you know, um um like kings, you you couldn't challenge that power directly, but you could challenge it through stories. You could challenge it through small actions, through kind of these hidden transcripts where all of us knew that we were making fun of the king, but we were not telling the king in his face that he was not doing something good. But we we had a dialogue that was hidden. It wasn't broadcasted. It was happening behind closed doors. It was happening in theaters. It was happening in small groups of people. Anytime we tell a joke, it is a hidden transcript that we are sharing. So, we're kind of losing that. And that's the bigger problem. Um, which is why I think in terms of privacy, in terms of having a conversation of privacy, we could talk about the concept of dark forest, the concept of not depending on algorithms, not depending on public displays or public information. It's a private space. It is a space where anyone can be themselves. Um they don't have to depend on any rankings. They don't have to be afraid that their content feeds an algorithm. So that's that's one way in which we can talk about privacy without necessarily going into oh this is web 3, this is financial privacy. It's just on the social level. But even if we are only talking about privacy in web 3, we also have to uh differentiate what type of privacy we we mean. So mostly when we talk about privacy, we simply talk about shielding some assets, shielding some transactions and so on. But this is only one part of the privacy we need. So there is also we privacy like when we ask for information if I run my own node I'm private because the node is synchronized with network and I have all the information if I'm using an RBC I have a lot of things I off sacrifice in direction privacy I sacrifice my identity because I have a user and I have my communication data and this transport offers information about my identity. There are reasons at some use cases that I should hide it or at least uh shield it a little bit. So then another very important thing is intent. So in in blockchain I have a lot of interest to have privacy in my intent. But if I read some data so maybe I am preparing a real gun transaction. So I read a lot of logs. I let I read some uh other information from from the state and with this information the RBC already knows what I'm going to do. It's it's not not complicated to use this information to reproduce what is the intent. So we need privacy for this as well. So that's why we have even if you are only looking on web three we need to think about not only about shielding some assets or shielding some transactions we have to see the full picture how can we interact with blockchain with the privacy we need to make business private uh transactions or business so that we can use it in a way that it really works without any interactions with others. Yeah, short answer to your question, no. Um, I don't think so. Um, I'm I'm happy to elaborate on a little bit a little bit though. Um, so if I do any talks and all the talks I have given so far, I basically talk about like privacy is like a multi-layered approach and it's not a binary, it's a spectrum and yada yada yada and all of that is true. Um, and all of that is important, but because like just to make that explicit, right? Like if I am like happily shielding my transaction on privacypools.com then you know that's not going to stop the government from tapping my fiber optic cables and knowing exactly whether I'm taking a or sitting behind my computer. Um I think it is really in that sense like pretty black and white in the sense of that like privacy stands against surveillance and the surveillance state surveillance in general tracking whatever is also very multi-layered right like it's such a huge concept in itself too um and it's increasing so rapidly and it's becoming so large and so dystopic that I think sketching that sketching privacy as just like a general term of like we are not surveillance is powerful. Um it it allows us to like basically collect all these different kind of things, all these different layers under like one umbrella and say like, hey, we are all together. We are for privacy. We are not for surveillance. And so I think it's actually pretty powerful to have all these different concepts all branded under, okay, hey look, we are privacy. uh because it allows for a pretty black and white differentiation which I think in these times is actually pretty important. >> No, just wanted to confirm you're right. Uh whenever I talk about privacy, I don't zoom in on the aspects of a private transaction. I look at tangible examples of where people are in their everyday life and what affects them and their mus. Let's say uh to make it directly tangible and based on that people change or adopt something. Um, yeah, that makes way more sense than going in depth about a social construct. Break it down into the impact. Yeah, >> I don't have a followup, but I'm uh glad that at least one person uh strongly disagreed with me. >> Is the huge amount of surve surveillance happening right now and increasing surveillance pushing us into privacy? You're asking if the the current surveillance is is is creating a demand. >> Yes. Because uh when blockchains were launched, that was not uh big concern. >> It wasn't that it wasn't a big concern. It was that um people were just not used to reusing the same the same wallet and the same addresses. So you could you could run your own node and you could spin up an indefinite amount of addresses. Um then I think after 2015 something happened and we started having this concept of of identity on chain. Yeah. We started having um wallets being reused. We started having um centralized exchanges that essentially attributed a a one type of wallet for you. Um then we started having um um ENS and and all all these kind of things that created a essentially it formed a sort of identity. Then we had NFTs and we all all of that. So I think um before that there was just people were not that interested in reusing the same the same address. Now even as a as a business for example um I I had to receive crypto payments for a very long time mostly Bitcoin, Ethereum and stable coins. So I had to reuse the same wallets and even with Monero I had to reuse the same wallet so that I could prove to the accountant and if there was even an investigation to the the financial authority that this this was me, this was my company and I didn't do anything that wasn't legit. So I think just things changed and now obviously you have um you don't have just have chain analysis which is essentially it's always been like a hocus pocus company that sort of guessed um they were never really capable of properly tracking and tracing but now it's coming it's becoming quite a big deal with some of the AI companies and some of the AI capabilities to um not just um kind of find the patterns but also create new patterns which again creates this this need for privacy. See, because you would spend so much time trying to prove your innocence that it is better to just say, well, you can't prove anything about me. It's either you accept what I give you, otherwise there's no there's no way you can attack me. Maybe to this question, the question was, is violence bringing us to have more to to the need for more privacy? I think we are we that we are working in this industry we have to think about our users. So users normally are not aware of these things but they they see I have an application it's nice to use it. So I think it's very important from the side of the developer for as us who are building these applications that we think about how can we secure our users and having privacy included is something we we we need to do for our users. Mike, I actually had a chance to think about your comment and I wonder so I do appreciate the strategic idea of like having an umbrella term to organize people and to provide kind of a counterpoint or a counter identity, a counter movement to surveillance capitalism uh or general surveillance. um in I wonder whether that's an effective strategy though because if we just read the room and I mean not this room but society at large internationally um there are a large number of people who are fairly comfortable with giving up uh large amounts of their data for convenience or for free services. And if you even go to the length of explaining to them about how their data is being utilized by corporations, for advertising, for political firms to sway opinions, uh to uh extend or circumvent the Fourth Amendment in the United States, um so that it's not technically a search for law enforcement to obtain your data. A lot of people will say, "Well, I don't really care about that particular type of privacy." And so I wonder if like bundling together these very different types of privacy, like preventing a $5 wrench attack versus giving your data to advertisers, um, actually brings fewer people into the tent rather than, uh, bringing more people into the tent. you might be right. Um this is actually a discussion we had yesterday in our in our logo circle as well. Um very fun to participate in. Um few things that that come to mind like especially when like a data leak or so happens now, right? And 2026 the cyber apocalypse like they happen every single day and the amount and type of data leak is insane. And then when I talked to some of like basically half of the Netherlands got like fully KYC docs with like bank account details and whatever and like I talked to my normie friends about it and they were like yeah but you know all my data is out there already anyway like who really cares. Um and then you start talking about like um yeah but actually it is really bad because if you combine it with these other data leaks as well and people just get like complacent and like they depressed maybe almost >> feel like they can't do anything about it. >> Exactly. Um and then actually if you look at it from a different perspective like why do people like to use Brave? People that maybe are not into crypto it's because YouTube has no ads. Um it's like YouTube premium for free. uh doesn't have any trackers, doesn't then like the privacy is just like a side benefit. Um so I think yeah, you're probably right. At the same time, it also just shows that like something like Brave, you know, a browser like that, um I do believe that they they like ide ideologically and I don't want to speak on behalf of them, so maybe I'm wrong here. Uh but I do think that they ideologically also are against like pro privacy against surveillance. Um so I do think that they themselves the builders there are ideologically aligned with um the let's say privacy versus surveillance narrative. However um the benefit that they're actually bringing to their users is no ads on YouTube. So I think that's uh yeah a way a way like maybe we as the builders could still fall under the umbrella but ship it in a way that is actually just like as you said you know like protecting your users giving the best user experience WhatsApp end encryption um yeah there's there's things to say for both sides. Yeah, I like the idea of the there being like unlocks that come from privacy like the actually just like data flow control, right? Like choosing what to reveal or not. Uh, I don't have like solid examples, but like we have great examples from our in-person uh, interactions like you know like surprise birthdays or like you know poker or flirting or you know these sorts of things that like a lot of fun or you know give you something you couldn't otherwise have if you couldn't control the way the information flows. And so there's you know there's probably some innovation to be done uh that you know unlocks that can be had that can only be had if you can control the flow of information but right now largely the incentives are about like um you know under getting market information to you know an ad model type stuff but you know I think that there there's I think there's stuff to be had out there >> uh based like you said about brave but brave for example doesn't allow doesn't have the same features available for everyone in the world. For example, in Romania, they restrict some of this stuff and therefore I mean they have a product that's supposed to be built for like privacy or like and stuff like this, but then like if you don't offer the same features for everyone and it's only for like the US or like for the first world, then what are we doing? >> And that's how we get to the topic of compliance. So that's how I thank Cheeky Gorilla, our impromptu volunteer. Thank you. Thank you. Okay. So may I have a question about the surveillance like for example facial recognition and this kind of thing or we can protect yourself for example the fact that I'm thinking is like I already have my data online and I feel sometime is a bit too late if I want to protect myself into learn tough time. So, how would I advise someone to protect yourself? Like an open question on it. Like, >> yeah, it's about that complacency, right? Um about like, okay, well, everything is out there already. Um what what does it even matter anymore? Um I think it also like using these kind of privacy tools, uh it's it's not a black and white thing, right? But I think once you kind of like start figuring out like hey by using this tool I can prevent this from happening in the future. By using this other tool I can prevent this other thing from happening in the future. It also gives back like a sense of agency to people um where they feel like they can get some of that control of like things that are all otherwise just like constantly happening to them uh back in their own hands. And then you know like maybe indeed like if if you start doing all these privacy tools like all these privacy things all these privacy tooling maybe within like the first one or two years or so you know like maybe it doesn't matter but maybe you're five or 10 years onwards and like you're still using these privacy toolings and like maybe you've moved house or whatever. Um you know suddenly it does make a difference right? Um it's it's not a it's not a spectrum where like you know like these surveillance companies have been collecting stuff on you for like your entire life. It's it's not easy to get loose from that. um it's a process and so I think it's it's incremental steps really and maybe on the compliance part right that was asked earlier um I think privacy devs as court cases have shown are in a in a particular difficult place when it comes to compliance um I think if you do anything that the state thinks really what the state deems going too far um it is pretty relentless less in the way that it acts to you against you. And um yeah, that is obviously something that devs just really need to keep in mind. And you know, there are ways to circumvent this. If you are in Romania, like even a free VPN could like port you all over the world. It is an extra step of complexity. Um but there are ways to circumvent these things. Yeah, I'd echo that about like get like that sense of empowerment. Um, you know, I use uh I started using Signal maybe three four years ago. Um, and little by little like I'd say 95% of my messaging activity is signal. Now, I don't know if that's meant that like all of the people I chat with have just one contact and it's me, but uh it's like I mean a ton of activity uh on my signal. And the other thing that I think is a great example is uh Google Meet. Like we almost always use Google Meet for the longest time. Um almost never use it now. uh sometimes will start and then it'll ask you know to switch because one of the neat features about Google Meet is that you can turn on closed captioning and you can actually see it'll like say who it is and exactly what they're saying on the screen in real time and for sure whether you have closed captioning on or not that's being logged on their servers and it just you know even if I don't have anything particularly sensitive that I have to talk about it's really nice to just know that every word that I'm saying isn't being logged on a server forever, you know? So, I think like bit by bit as we expose the game that's one of the best ways to like end the game is if everybody knows, you know, what what is the game just saying it explicitly. Um, so yeah, I agree totally with Mike like bit by bit and you know, feel the empower like feel empowered. I think people will I think people will start to take it on. It's just as long as it's not overwhelming, right? I think that's the feeling everyone's got right now is like just totally overwhelmed. >> We have a very um we have a very interesting principle we we we base logos on which is um exit um exit exile and access uh which is in the farewell to fail book um that you might have seen during this conference. The idea is the moment um a system or a tool stops serving your needs, you can exit it. If you can't use Brave in Romania, there are many other privacy preserving browsers. There's about seven of them. There's um Mulvad has browser now. It's pretty good. Um there's um Wolf Libre, which is a version of Firefox, which is really good. There's a tour browser that's really good. So there are the beauty of the privacy ecosystem is that there's always people that are building solutions and tools um for problems that shouldn't exist. No. So um that's the beauty of it. You can you can look for other options. You can use other systems. You can use other tools. Like a lot of us that come from early Bitcoin, we realize Bitcoin is not private. We're seeing that Wasabi is gone. Samurai wallet's gone. Um I don't know if you join market is still around, but it's quite hard to use. So Monero is an option. Um you know, private stable coins are an option if I don't want to use USDC and USDT and it's slowly getting there. So there are options. It's very nice that you can you can use them. You can exit the systems that don't serve you anymore. >> We have another question. So the you know the main part of my question is basically how we're going to deal with this in a world where your IP address is going to be fully linked to your identity uh due to compliance requirements. U it's it's possible to resist this a little bit with VPNs and just you know constantly change what jurisdiction you're connecting from. But uh very quickly uh in the course of I think what 4 months we went from one jurisdiction doing this now to it being law in I think over 20 now. Uh and we're rapidly accelerating beyond the EU and the US and Canada. So, uh, first off, we're going to be losing most of the privacy that you guys have been advocating for by your IP address being fully linked to your identity. Number one. Uh, number two, um, you know, can we have any tools that actually, you know, maintain that? Uh, besides VPN, because VPNs are also being outlawed in in some jurisdictions and it's it will be a crime to use one. um as is it is in China. Uh and then the third would be have you guys ever explored fully homorphic encryption which is a privacy preserving system on a spreadsheet because I haven't heard anybody mention it. >> So recommendations as alternatives to VPNs. Uh yeah, >> let's start with um running on tour by default. Running your node on tour by default having um so what we're building at Logos, we're building base camp, which is a an app. It's an environment that you you download and it's local to your computer. Um and you have the ability to run over tour, you have the ability to run over relays and mixets. um and that provides um some protection against IP leaks. Um the second one is there are a few um ecosystems as well that really articulate on this kind of private OS. One is Umbrell. Uh so you have a private OS at home. It's a it's a small device that you plug to your Wi-Fi and it it looks like a Raspberry Pi. This is super cute. Um, and you can run you can run a Bitcoin Monero node. You can um you're entirely on on tour. U tour project itself is running a crowdfunding campaign for over 150 projects that solve little by little the idea of internet freedoms and protect over 60 46 million users that are at risk. Um so that number may double by the next few months. Um, one of the projects essentially is looking to have like a plugand play of um of a relay. So you can just think of it like Tails, right? Tails is an OS. I can just Yeah, it's gone. Nobody knows what I'm doing on it once I unplug my USB. So the same concept applies to a tour relay. So they're building that one of the projects. So it's very interesting um on encryption. Um there are multiple forms of encryption, right? There's there's a ZK, there's fully homorphic encryption, there's TE, and you have um multi-party computation and a few others. No, >> those are >> those are all gone >> with the exception of polymorphic encryption. All of those gone. >> They're gone. Okay. >> The key had the private key extracted from a chip, so anybody can sign as Intel does. Well, um, that's a topic. I mean, I know we have a very good team of of researchers in Logos that are constantly aware of the quantum problem and what's coming. Um, and I know it's being looked up looked at. I can't tell you how much of that is fully homorphic encryption. So of course we we could go more deeper in all these topics. I think I don't know how much time we have left. So I want to repeat something I mentioned earlier. So we have to start with privacy now. If we decide to wait if we have all the gold standards for all problems then we put it on our road maps and someday maybe we will solve it. Maybe maybe not. But we should start with the things we have already available. And we can do a lot of things already and we we we must decide to start and then increase it level by level depending on the application what is needed. I'd like to agree with that because as we know currently of course anything you send which is stated as encrypted is being harvested at one point in the connection or by the applications that you're using to be potentially decrypted later if technology becomes available. So implementation time is now. Yes. >> Does anyone know how Zama is doing? They were supposed to have FHE on top of Ethereum. So, Zama has a very aggressive licensing model. Um, they have patented their technologies and they have been trying to sell fully homorphic encryption to smart contract developers at insane costs. Um, there are five other FHE platforms. Most of them are enterprise only, but one of them is MIT licensed and available. I'm attempting to uh work with uh a faster uh fully homorphic encryption provider and build it into the entire chain. So it's possible to have basically any two variables per circuit to be uh fully private and treated as a spreadsheet that no everybody can verify but nobody can see except the the owner. Um, Zama's system does not scale. Their patents are for a flawed implementation and they have to use enormous amounts of GPU compute in order to operate their their fully homorphic encryption. It is postquantum. However, since it is exclusive to Ethereum, the uh quantum attacks will be able to break the history and expose all of the records that Zama is using. ZLMA is not working with any postquantum cryptography chains. So, it is a temporary solution that is doomed. I can give you more details, but there's probably already too many. Is it the Is it Enclave or the Interfold? So J, you've heard of Enclave or the Interfold? I think they renamed themselves. Is that the MIT licensed one or is it something else? >> It's open energy. >> Oh, cool. Right now we are in the closing hours of the DAO security fund quadratic funding round. Uh there are I think 124 uh projects which are helping make Ethereum more secure. I would love to hear each of you recommend one project. Uh if I have $40 uh to contribute to projects in the QF round, who should I uh contribute to from a privacy perspective? Okay, there's there's over 5,000 people in the Ethereum security group. Um, so I wish I kind of wish some of that would be retroactive funding for some of the great work that people have done in the space like um Tai Tai Veayo who was let go by MetaMask because she was too good for them. So I would say maybe she's not on that list, but I would say there are some really good people that have contributed a lot to the security of Ethereum and are not recognized right now. >> What was the amount of projects you said? >> 124. Then take how much you are willing to donate, divide it by 124 for the maximum quadratic impact and donate to all of them. Um yes, you're right. where we're we're entering the last the final hours and and this is the final session of this uh conference. Um we we touched upon compliance of course which is uh on one hand is a threat to the let's say use case uh it's a threat to the privacy of the users in what they um in their autonomy to choose to when and how what to expose and in what sense. Um it's also a threat to developers. We've seen um some cases where developers are are being prosecuted uh for building applications that might be perceived as malicious even though they're not because they're neutral applications are neutral and you can use a tool for anything. My question would be as also developers will be watching the builders contributing to this ecosystem. What would be your recommendations for them? I mean you're all public facing for your organization uh but you you choose to do so and which also might be a risk now or in the future. What would be your recommendations for them? Is there room in 26 or beyond for anonymous developers who contribute to this space? >> I think there's always been room for anonymous developers. the the problem has always been that um funding anonymous developers has not been um really a topic. So like I I worked in venture capital for 4 years. We unfortunately we could never uh support or fund or invest in anonymous developers, anonymous funders. Uh so we had to KYC everyone and that was one of the reasons why I didn't really agree with the space. Um, but I think I think um it's definitely it's definitely needed. I mean, it it's also I don't know about you guys, but when I when I go when I go on a platform and I like I have friends I've never seen in my entire life. I've never met in person, but I trust them more than anyone else. Um, and they're fully anonymous and I don't care who they are. I don't care if they're, you know, male, female, non-binary, whatever. I don't care their political um alliance. Um I don't care how much they're making. What that they're knocking up really cool applications. I'm willing to use them. I'm taking a risk. So I just think developers will always be put at risk because they are creating essentially primitives and tools that um the world is not ready for yet, right? It's not something that the big corporations or the governments can control and they're always they will always reject it. Banks could have implemented Bitcoin or Ethereum a long time ago. They choose to have a you know they they bank of England for example chooses to have a private version of Ethereum to test CBDC's. They could have done it on on Ethereum on mainet. They just they can't control it. So they don't do it. Same with Bitcoin. They don't want to integrate Bitcoin into banking because they can't control it. Um so if they can't control it, they'll always try to uh shut it down. So the only way to shut down autonomous software is to try to go after the people that have built it. So that's always a risk we have to live with. >> Yeah, it's hard to uh give a recommendation what you should or should not do. It's you have to consider what risk you are willing to do. I want to remind so it's not long ago 20 years or something maybe a little bit more there was encryption handled as a weapon it was not allowed for private persons to use encryption the reason why encryption is now coming use is because a lot of people are using it so and the same is also with a lot of the mechanisms for privacy so if it's only using a small group it's easy to go against it. If it's getting mass adopted and lot of people are using it then it helps that that we understand as a society or a as as people that it is needed is part of our life. It's a it's a right we have so and we by spreading these technologies and putting in our applications we help to make the space bigger so that is not that easy to censor it. Um yeah I think um with regard to like anonymous development and compliance and these kind of things um with great power comes great responsibility. Uh I think we have to be realistic here as well like if you if a nation state wants to find you um no matter how anonymous you're trying to be they will find you. Um, and on the other hand as well, like with regard to compliance, um, I don't even think that the compliance in it is is necessarily like the worst thing. Like our space, our industry has a lot of enemies. Um, some of those are nation states as well that are just trying to take all our essentially. um receiving privacy on chain using a shielded pool uh is also giving privacy. If you use a shielded pool that North Korea uses, you are also giving privacy to North Korea. Um if you look at how much harm like how many of your friends probably have been exploited by these guys, um I think it comes back with great power comes great responsibility. I I I don't think we should be priding providing privacy to these guys. um they are actively trying to undermine everything we do. Um and yeah, I get that like privacy is a human right, but you also have the choice to not necessarily associate yourself with people that are actively trying to destroy everything we're building. Essentially, >> Satoshi Nakamoto was that went that went well, right? I mean, I think it it depends on what it is you're trying to do and um you know, is it possible to build a thing without having to fundraise? I think it's getting easier. Uh that's for sure. So, it would be cool to see a whole lot more of that. And I think that if you don't have to coordinate with so many people, um yeah, the coordination cost goes down to be able to produce these kinds of things, then sure, why why not be anonymous? Yeah. So, hi. Um, and I see we are over time, so I'm going to keep it short, but it might we start a bit of a discussion and bit on Roxanna's point from earlier and also on the gentleman on the back um with the idea of compliance um and what Mike also mentioned um compliance is mostly done just to not go to jail. Should we more as privacy developers more voice out that we are more reluctantly compliant just to voice that we don't agree with the surveillance state but that we just do it because otherwise we go to jail. But if we move on to say yes, we are compliant and that becomes a feature, aren't we implicitly caving into the idea that they should have control over us? I think it depends on the degree of complian degree of compliance that you're talking about. Like different jurisdictions have different requirements. Um, if we were forced to do full KYC on anyone that came into our pool, um, then I would definitely say we are reluctantly compliant. Um, I don't even know if I'd be building then, but yeah. Um, when it comes to like the previous example that uh that I mentioned of like we have the ability to keep North Korea out of our pool, would I want to do that if it wasn't required by law? Probably still yes, to be honest. Um, yeah, I think it's good to keep like adversaries out uh and like not to afford them privacy, but I guess it depends on how you do it, right? Like the point of this is disintermediation if we're putting in gatekeepers to decide who gets privacy and who doesn't uh and who keeps it and who doesn't. uh and you're saying like chain analysis, you get to be the one to decide and maybe we'll add more. Um that just becomes like a locust of power kind of defeats the point of at least what I think is the point of this uh technology. I think it kind of beats the purpose if we're just um building to be recognized or legitimized by some some nation state that changes its laws and agendas every four to five years when there's an election. Okay. So, I would say you build tools that are uh public good, right? It's fully open source. Anyone can review it, anyone can audit it, anyone can fork it. um whoever uses it. Well, the idea is that we base on the assumption that everyone uses it for an honest purpose, right? So the network is honest in the start. If it if it becomes used by other non-honest actors, then the network itself, if it's powerful enough in its honesty, it should essentially be able to battle against the non-honest parties. So that that is the standard. So to say that I'm trying to figure out where I park my car and if this parking spot fits my car kind of doesn't make sense. Um, and I don't care if I go to jail, right? If I'm I'm I have this ability to build something which is a public good, serves a community, serves a group, right? Not everyone in the room will be honest. But I have to assume that the people that are using it are honest and in their honesty they become strong enough to outlaw the non-honest. I think the the biggest problem will be explaining that. But mo most of the time um the regulators they come in after a very long time uh as a result of an abuse of a specific application or network or opportunity. Um so then they panic and they try to kind of box things. Um and without understanding that a lot of the times these are very isolated maybe like up to 5% of the entire 100% of events that are happening and so that turns against so we probably should have an honest conversation with regulator as well and explain look nobody is building it for North Korea okay we are building it for people that um are minorities for people that are activists for people that would they have no other way of using a traditional system because I they they are already locked out of the traditional system. >> I mean it's just like how no one built Ethereum for North Korea, right? Like I mean I might not want to associate with Ethereum because uh you know it hosts all these like stolen funds and the nefarious you know actors or whatever but I mean no one's calling to fork Ethereum to do like to disassociate right um and I think that's because Ethereum there's so much wanted activity on Ethereum that um that you know it's not even a question like we wouldn't want to to stop the unwanted activity. it wouldn't be worth undermining or destroying uh what supports all the wanted activity. And I think that we need to see the same kind of things in like privacy settings. Uh it needs to be normal enough and it needs to be we need to be invested in it enough that uh that it's not even a question, right? Like the way that I think of it in a thought of thought experiment, I think we've talked about this before where I was saying like if you've got like, you know, let's say we're this little room, we've invented the cell phone. it's brand new and we say like we're all like excited about our new project, but then one person goes and takes it and uses it to trigger like an explosion, right? Like causes lots of damage. I mean, at that point, it's time to put the cell phone project on the shelf, I think, right? Because it's just caused way more damage than good. And maybe pick it up again and try again later. But, uh, you know, if at this point if somebody did that sort of thing, we would there would be no way we would be questioning uh shelving cell phones, right? Gabbit, you're assuming that regulators are people that actually understand technology. They don't. They don't. Okay. Okay. Good. >> People care and that that is enough power or push back. It's regulation. >> Please repeat that for the street. >> Sure. This isn't about judgment from regulators. This is about judgment from the people. It's the social layer is really the where the real power is. Even if we forget it sometimes. It's the same in Ethereum. It's the same in like the you know how we govern ourselves. If the people believe that it's unacceptable to do something like you know there are places where that doesn't matter to some like government or regimes or whatever but for the most part the people are the ones who ultimately have the power and so if the people are invested and it's part of society it's integrated into society then those regulations won't be allowed. And there's been many cases where those regulations have been allowed even though there were you know there was a a mass of people that were benefiting from the use of a service and that is for example the OTC providers um that have been essentially the the way forward for many people and many businesses to accept crypto and and convert crypto to fiat without relying on traditional banking. um in specific jurisdictions, the regulators decided that if you're serving retail um and you are um enabling a a conversion, a transaction for a retail customer, if that retail customer is a and decides to put their money into a shitcoin and gamble and lose, you are liable for giving them their money back. uh and that is the decision of a regulator which essentially killed any kind of OTC desk that was just honest doing their job providing a needed service in the market with over 30 40 50 people hired to downsize to three four people and barely barely break even. >> There's been a gentleman in the back with his hand up for quite a while. >> I'm not sure if I'm a gentleman or a scholar. Um but earlier in this conversation I said that it's really important to talk about privacy in defined contexts not in general and I think this is a excellent uh case and point. Um there are certainly historically and currently many examples that you can point to where privacy advocates and regulators are antagonists and come down on polar opposite sides of issues. But there are also examples where the interests of privacy advocates and regulators are aligned. And uh just to give an example of this is encrypting the public memool uh which protects users against malicious me like frontr running and sandwich attacks in tradi on wall street in public markets. Frontr running and sandwich attacks are illegal and they were made so by regulators decades ago. In crypto we don't like regulation. So, the preferred approach is to use cryptography in order to protect users and prevent MEV bots from stealing their funds when making DEX swaps. This is a great example where regulation and privacy are definitely aligned. I could go even further and explain why institutions are aligned on this same thing as well. Um, but I'll yield the mic. If you have to give a user one simple advice to increase his privacy, what would that be? >> I think that would be the best closing question you can have for this discussion. >> I would say run your own node. It's the best privacy you can have. Self-s sovereignty is really good. >> Use applications which care about pricing. Yeah, probably uh Malad and Brave browser. I love Signal. >> Well, to answer their question and to anyone who had three, get off Telegram. >> Yeah, what I do is I offer signal first. >> I up your applause. I'm sorry. >> Um