Privacy is not a crime, centralization is. Build self-sovereign apps! - Lefteris Karapetsas | rotki

talk about privacy my name is leis uh for those of you who don't know me I've been in etherum since 2014 um I created and helped clean the Dow in 2016 um either sorry for this or you're welcome it depending on which side of the argument you you stand um I was uh uh the te lead for the ren Network which is what um uh the lightning Network is for Bitcoin that is what um uh rder network was supposed to be for ethereum didn't really catch on and I am the founder of rodkey something about which I will talk a bit uh later so privacy this I talk about privacy so maybe we should start with the definition of what is it uh the medum webite um dictionary says that it's the quality or state of not being um uh apart from of being apart from company or observation so basically when someone cannot see what it is that you are doing um another definition freedom from unauthorized intrusion this is a bit closer to what um we consider privacy in the digital world secrecy this is a part of privacy that people associate with criminals with you know something bad something negative that you want to be uh you you want to do things in secrecy despite all that um it has been declared a human right in the United Nations Declaration of of Human Rights Article 12 actually mentions that no one shall be subject Ed to arbitrary interference with their privacy um in 1949 this is like eron ruselt holding the Declaration of Human Rights they said that privacy is indeed a human right but they were imagining more like U physical privacy so that someone does not um impose upon you someone does not come and um uh pick in your home as as we have entered the digital age we start changing our view of what private is according to the Australian information commissioner you have to be free from um interference and inclusion to associate freely with whoever you want and to be able to control who sees uh information about you so this with this we are getting closer to what we consider privacy in the digital age uh there are very many ways to look at privacy we all traveled many of us traveled here to to Belgrade like you can imagine Security check this is um an attack on privacy when you're being surveilled that is also an attack on privacy in the Digital World um how your personal information is handled this is my definition of privacy our definition of privacy here whenever we talk about crypto um AWA from anoma has written a very nice blog post that privacy is a mistake um I really recommend that uh you guys read it it's kind of short but it um the gist of it is that privacy is good it's normal to consider uh that we need to be private but the word is a mistake you don't want to hide something when you um mention privacy doesn't mean that you you're a criminal or that you're doing something in hiding um we are unfortunately building applications um on Rails that are um well not meant to hide um um not meant to respect our privacy so privacy is not about hiding but it's about Freedom it's always about Freedom the Freedom that we as users have to um choose who we share our information with specifically in crypto privacy is really bad um we we speak about crypto and say that it's all transparent it's great right everything is open everything is persistent and almost everything is auditable um it's a very strong point of crypto but it's it's not all uh rainbows uh unfortunately transpar is good if you are a public official if you are uh the government for example then you have this beautiful um transparent database that accessible to everybody worldwide uh using this uh for governments which unfortunately is not happening yet would be amazing for example um if you have ever dealt with bureaucracy in any European state or multiple ones so I I'm I'm from Greece I live in Germany uh I have a daughter who is half poish so I have to deal with three different uh um States and just to prove who I am or who my daughter is or what my relationship is to her I have to visit different embassies and do different things all of this would be solvable with a click of a button if um governments were actually working with a transparent Ledger even better corruption if all your Public Funding is on chain or is in any kind of public Ledger then it could potentially eliminate corruption because then you you can see where your funds are going where taxes are being spent how nothing can be hidden so transparency for government very very good this is something that actually is not being used for like crypto is not being used for this purpose and it's it's really a missed opportunity if you think about it um unfortunately for us end users all this transparency is bad it's actually not good so when everything is open that means that anybody can look you up um everything been persistent means that you have no right to deletion of data you want to be forgotten well no forget it it's there forever even after you die I will be able to see everything about you on chain and being orable means that anybody can connect the dots so in short there is complete lack of end user privacy in crypto all your history is visible on chain however much money you have tokens funds anything we will be able to see it on chain and and not only how much you have but how much you will ever have all your uh once H we associate an address with your name that's it you are done you cannot hide I will give some examples of how bad and how easy it is to um uh lose your privacy in crypto let's say that you um get an ens name and you want to get your name like this guy here dere Silva DOI I I don't know who that is I don't have any connection with him I'm sorry if I'm using your name as an example but um it's all public and on Sayan so you register the name and then let's say that you um you have some kind of action that there is a particular set of people that disagree completely random example from what I was trying to to to look at let's say spun chain is something that people don't like and you are a bad guy who doesn't like spun chain users and then uh you as the bad guy want to find and punish spank chain users then you will go through the list of all activities of spankchain and then see an enss name oh wait that guy has an enss name I can head him I go to his ens and see no that's his telegram that's his GitHub that's his uh website I can see everything about him and then I can have a field day I can do him harm um how do you hide your your um data online there are many ways but uh many of us have tried to use um uh the way that is not using tornado cast let's say would be to use an exchange so you deposit from a public address and then you withdraw from a private address and you are kind of uh breaking the link there the problem with that is that it's very very easy to dox so let's say that you want to deposit usdt from your public address to binance and sell it you do that good you sold the usdt then um few months past let's say three months later you want to sell some uni you go to binance press deposit get the deposit address copy paste sent and suddenly you realize after the fact that you sent it to the same deposit address from the private address as it was a public address that means that you have connected those two addresses it's actually very easy to see this on chain there are tools to do that um the addresses that you thought were private suddenly now are connected you are doxed my favorite signning with ethereum um we we love the ux of this it's so nice you go and your wallet says I'm going to sign in with ethereum here and everything will be accessible to me you don't realize though that by signing in with ethereum you are doxing everything about you your address your your location um uh associated with an evm address and a lot of other metadata what is wors and something that I have actually made a mistake many times is that um the wallets the way that they are right now you you're are connected with one address in One DB let's say private address then you're connected uh you want to sign in with ethereum with a public address to another DB and by mistake somehow the wallet thinks you want to use the private address and then you are suddenly uh signing with AUM with a private address in um um in an app that you never intend to more Sinister attacks nft metadata attacks let's say that you know someone's address and you want to find out their IP you can air drop them especially constructed nft let's say this uh IP address right click and saor and then they see oh someone gave me an nft nice how much is it worth I they will open it with their rod key or with their zapper or with the zeron and what the app will do is that it will ask a server that's malicious give me the image of the nft uh but while doing so uh the malayo server will gather the IP of the user and a lot of other metadata so basically this is an attack on on on someone's privacy there was even a block post that that was made about how easy it is to do this there are solutions but most tools actually don't care about this stuff uh RI the tool that uh we are building uh doesn't allow you um to render nft images from various uh domains and you can customize it you can only WID list specific domains that you want images from so what can we do how can we fight against this um well invasion of privacy we should be using privacy protecting technology so apps that are made uh so that they do their best to preserve your privacy like like Rodi uh we should use tools that can disconnect public and private addresses like uh mixers like tornado c um but perhaps use mixers that have not been sanctioned um worst case we should oh sorry worst case we should use um um this uh exchange deposit and withdrawal technique but be very very careful not to dox yourself I've done it many times by mistake there it's very very easy to reuse deposit addresses and really important support the people who are fighting for our privacy um especially in the legal domain because right now there are legal battles that are being fought that are going to define the next uh decades in uh crypto so about those legal battles unfortunately privacy is being criminalized uh we seen the sanctions on tornado cast we have seen the arrest of uh Alexi in the Netherlands and the Romans in the US and um another mixer the samurai wallet mixer also got charged and uh PV also um actually recently just got convicted talking about this a bit I don't know how okay maybe I don't know how readable this is but this is the conviction of Alexi PV in the Netherlands they gave an English summary at the end and this is part of this summary I was talking with some people from the Netherlands trying to understand how the Dutch law works because it doesn't make sense to me but they explained that it's just really a gap in understanding between the Judiciary uh that's old and people who actually create um uh decentralized Tech the main argument here being that is the last paragraph that if the defendant if Alexi wanted to uh do something about protecting the user of tornado cast um they would have put um a back door inside from the point of view of a judge that 70 years old doesn't understand how this Tech work it makes sense you want to protect your users you do not want to to do them harm so you you have to have put some kind of control why didn't you do that you have to be malicious it does make sense if you think about it from a completely non-technical point of view um but if you understand how this Tech works if you understand that it's open source and that anybody would see the back door and basically a back door in um mixing nullifies the the point of the mixer then the argument loses sense but unfortunately uh the judges made a different decision um what's worse the they argue that uh the developer continued building tornado cast even after they learned that it's being used by by by by criminals again a big gap in understanding because they do not understand that once something is out out even if you stop working on it it will still it it still exist it's it's it's permissionless and it's Unstoppable For Better or For Worse um this is something that hurt me personally when I read this um they say that uh there is no legitimate use case for tornado cast um all of the cases of uh privacy Invasion on um using uh crypto like beat Bitcoin beat ethereum or any other evm chain that I show aase before they are not a legitimate use case according to the judges um the only legitimate use case is crime so um the developer who created the tool is a criminal according to them like this this is probably the biggest gap between us and uh the people who who are creating this this legal precedents and um what's worse they even attack Alex's character and say that um uh he did he acted lazily by not trying to help the people even though as I explained there is no way you you can't help the people who had their cash stolen by a hacker and then just the the the crypto was just uh routed through tornado cast and he's so bad that not only do they um imprison him for five years and four months but they take his car and his crypto which is valued according to them to 1.9 million EUR so there is a huge Gap in understanding between what we are building and how it is going to be regulated and how the judges uh in any jurisdiction now here is the Netherlands it could be any other jurisdiction understand it uh so I would like to ask everybody who has the means to support the uh legal defense fund uh of the tornado cast devs it's um in this link here uh the QR code is a link to donate to uh their defense fund um and um I like to walk the walk not just talk the talk and this is like my donation to the um uh legal defense fund on through through Ry so this is about privacy and legal stuff so how can we as Builders um create something that helps the user have the freedom to choose what data they share we build self- soverign applications what is a self soverign application it's something that gives you the ownership and ability to control your data agency over how you share data so I decide how my app should share data and with whom and you have the ability to audit the code uh we build sover apps by making them local first uh local first is a term that was introduced by Martin kman in the seminal paper uh local fair software you you own your data in spite of the cloud and it's uh this Martin Clon by the way it's like these four bullet points very very simple you keep the majority of the functionality local this is important not um not web apps local apps going back to the roots the data is stored locally you own your data not some centralized server privacy and security are Paramount um when use the network I mean we live in an interconnected world you you you you can't it's not an offline up it's local first stop uh so the network is used but um it's not necessary for everything not every key store needs to go through Google server H key sorry key press so uh selfs apps are also open source because open source is Magic what is open source and why is it good um it means that the code is readable so this is transparency it means that whatever Lefteris says about roty it's something that you can actually confirm you just open the code or you have someone who can confirm read the code um open source also attracts uh Community talent and developers uh because in um in contrast to Source available so Source available means the code is open and that's it but with open source you can copy it you can modify it and you can build on it this is something that Source available code doesn't allow um so open source actually makes people want to build on it and it can attract both a community and and developers to build on it it's something we we have seen with Rodi for example um we are not building World Gardens so um there is lack of um um data capture so your data is yours and generally if everybody built open source then we would be living in a in a much better world because we all share knowledge and we all uh progress together in a for a concrete example I'm going to talk about roty which is um an application that um is a management tool for your portfolio uh the rafty ldr is that uh Rodi is um an open source app so this is how the dashboard looks like all data is local you own it um it gives you a b ey view of of your portfolio um it can track exchanges and also U multiple evm chains and non evm chains though people are asking for some that we don't support yet like Solana we we we are trying um and the point is that we want it to be a super app that tracks a lot of things so also traditional finance and it's customizable this is really important because each one of you is is very unique and has different needs and this is something that we really try to to put our heart into Ry because everybody says hey could you do this a bit differently okay let's customize this let's customize this this makes for a UI that sometimes can be too oldfashioned some people would say say but it's the functionality that makes the difference here we also have historical data and and and pnl the historical data is something really beautiful about rodkey we have um for all evm chains uh a very big set of Open Source decoders and many people actually are building open source decoders apart from our team so the the view of Rodi of uh evm chains is growing uh every day and it understands what you do it decodes it in human readable form and shows it something something like this and um it's customizable if something is not read correctly by RI you can just go and edit the event and then tell it okay this is uh I don't know sending a donation somewhere that RI didn't understand um and you you also see in the same history view exchange uh trades F staking evm events and so on and so forth so everything in one common history format uh and those events later they can be processed and you get a nice p&l um overview that probably needs massaging because Rodi is not a tax tool and then you can export it in a CSV and share it with an accountant the whole point of this is to take control you you can customize almost everything in Rod key so what nodes are going to be quitted uh for which chain and even with what probability um other example is you can customize where will rock your query prices from and and the order for example first manual prices then coino then defi Lama then crypto compare and so on and so forth again it's about owning data so all the data is local in your machine um nobody else can actually see what you are doing and what you have nobody else can track you you can back up your data um you can make various EXP you can export pnl um in a CSV but you can also take any event from the history event View and Export either a single event or or filter it like say I want all events in the last week that were done by le. on a and then export that uh if you have a premium subscription then you can also um use our server to uh have backups and then restore another machine all encrypted of course we don't see anything uh um a little bit about what the vision of the tool is um it is not a tax tool my mistake was um that when I first introduced it to the world I said it helped me make my do my taxes it still does for me but that's because I'm its creator it's not a tax tool I could spend another 30 minute talk on why and it could just talk to me later on why it's not a tax tool just take my uh word for it it's not a tax tool do not use it as a tax tool I mean you can but do not have expectations that it will be a tax tool and that um you have one day to do your taxes then you download R key and you ping me in Discord help me figure it out no this I'm sorry we cannot do but what is this vision for the ogs here do you remember Mist has anybody used Mist ah good good um so the vision is to sort of bring back the Mist browser the Mist browser was an app that allowed you to um explore the chain and interact with it so kind of a super app that um it's a local app that allows you to to explore U the various apps of um but there was no other evm back then of ethereum let's say and um interact with them in general One Stop uh app to manage both dii and CI and to better expl explore your blockchain activity this is something that we really take pride in because people have been telling us that once properly set up Rodi shows their stuff better than any other tracker and better than any blockchain Explorer and that's true because well we we have a lot more context for example monium right monium is a protocol that um you can transfer Euro from um a from the chain to a bank you just basically burn it on chain and it becomes a sepa transfer or the other way around you transfer um Euro to an iban and it appears on chain it has no fees at yet so if they put Fe don't don't kill me um in Rod key it's tracked with all the details so you see something like this is the history EV view that I was showing before and you send €2,400 to Rodi Solutions game Bea and iban and the memo is whatever memo you you have sent even even more Trad file and CI connection there gnosis pay it's a it's a it's a credit card that is essentially a selfs sovering Bank by using a agnosis save underneath and you can well spend Euro directly like buy groceries like from a you withdraw from a and you basically just get groceries in the supermarket sort of works in rki because it's a safe transaction we see it but if anybody from gsis pays here I'm still waiting on that API I will hold you to that promise so please give us that API so that we can um give that extra metadata there uh all the merchant um information the the the future of the app is um going towards active management so uh not just the portfolio tracker but actively messing with both Defi and CI from inside the app let's say that you want to sell um one e and because we're connected to all of your exchanges and uh the chain we can see oh wait so 1/ e would be this much in Kraken this much in coinbase this much in cop okay so execute through coin uh sorry through Kraken better integration with raty not only um like we would like you to be able to uh track your bank uh from inside Ry we start with monium but it can actually be your your your your your um other Banks or even your your um ETFs or whatever else you have so something that we we plan to do soon is like to have the the the the bank integration like you have the the iband what transactions you've done and even make SE a transfer from inside uh the app generally more change in protocols everybody is asking when XY Z in Rod key uh we are working on this we are like next talk is by mikon gearbox we are working with them to to help us understand how gear box works and and integrate it um and performance speed and Improvement uh being a python app we have uh some limitations and this is exactly why we are building some demons underneath in in Rust so we can um fully utilize the local first approach and really make um a very strong application for all of you so uh they will throw me out so I would should go to call to action um if you like what you hear if you like our values or the ideas that we are uh building for um we're hiring you don't need to start by you know applying uh for for a job with us the best way is to actually come as an next external contributor just join our Discord we have a channel dedicated for um open source contributions we will help you and then you can also see if it's a good Feit both as a team but also as as as a as a kind of work it's not for everybody it's it's uh it's not rainbows and and unicorns it's actually pretty hard um so we are a small team we don't have a marketing um uh Department we don't have a marketing guy now I'm the marketing guy I'm wearing my marketing hat so um if if you like Rod key if you use Rod key please um spread the word about it use it daily and talk to other people about it so that um we can get uh more exposure through this organic marketing this is indeed like the the best way for us everybody that I talk to that has used Troy has used it thanks to another person who is a very happy user that introduced them to it um we have a premium subscription buy buy it if you want to help us um keep Building open source for you uh and generally spread the word that's I guess all uh thank you very much okay do we have questions do you have any questions no questions oh I see a question back there or more like someone wanting to ask a question hey ltis uh first of all very happy Rodi user for three years something like that uh I really like the bank transfer thing that you also mentioned uh is this something that you plan on using stuff like psd2 or something else to pull information from the bank and to make the sepa or Swift transfers yes yes so we'll start as a proof of concept first with monium because it's it's already there like we we don't need anything else so we have the credentials for their API and we can just do it directly we don't need anything else for a more generic um Bank integration we would need to either use the psd2 that is um only limited to a few Banks or we would have to make an investment um and have it um use those those apis I don't remember the name but they are pretty expensive per month but then it would pass through our server but we would be able to get all of the information for any Bank worldwide uh I'm sorry I don't remember the name but it's um there are apis that that that can do that the problem is that they're expensive there there is one uh could you maybe uh first of all thank you very much it was very interesting and informative uh and recently I came across one concept uh where people were analyzing difference between privacy and anonymity could you maybe give some comments on your view where that differentiation is between privacy and anonymity or whether you think those terms are different or do they mean the same the same things what do you think I'm I'm sorry I cannot hear you you asked about difference between privacy and anonymity basically huh well that's that's a good question I would good question so uh I guess they are related but not um uh they're not tied together for example I am quite not Anon but I'm very big proponent of privacy and I do have my public Persona separated from my private Persona both on chain and and and um in other things but um so as I said privacy is about the freedom to share what information you want anonymity so an Anon like uh I don't know like pantek um it's taking things a bit further it's like completely separating having an online Persona I guess okay yeah so anonymity is like more implemented right than privacy privacy might be viewed maybe as not disclosing the information you don't need to disclose and maybe anonymity is a kind of the deeper level of privacy right or yeah anonymity would definitely be a deeper level I would even say they they are related so in the vent diagram they they they have a common space but they are also not exactly the same issue thank you very much hello um thank you for the great talk and thank you for emphasizing the importance of privacy um my question is actually quite practical um how do you manage the explosion of rollups and now there's also it's not just L2 anymore it's l3s and bunch of also then defi Services across rollups can project just write an adapter or how how does it work very very good question um it's not just rollups the explosion of everything in the space um a a a good way to handle it is to say to everybody just you know hold your horses weight half of them will be dead in a year uh I mean this is actually true we have had so many issues in in our GitHub repository that we just closed saying hey it got hacked it's it stopped hey that that was a rag poool hey that exchange actually declared bankruptcy we're not we're not dealing with it so one is to actually wait and not jump for every single new signing thing because 70% like totally taken out of my ass now will not exist in a year the other thing is uh we need um in general in this field a lot more um people don't like the word but o if ation we need standards we need standardization um and when there is standardization there is easy interfaces that are common between things so we try to support those that have these common standards first anything else that's completely exotic stays in the in the back and only if it gets really really really um a lot of users and people are telling us please support it please support it please support it then do we do we spend any time on it in general it's a very difficult concept and it will get only more difficult not only for us like this is a question for anybody that integrates anything in in crypto and defi uh unless there is standardization um it's going to become increasingly expensive basically last question okay no more questions all right so I guess that's all thank you all very much [Applause]