Securing Secrets: Inside the Privacy Infrastructural Realm | Panel | ETHDam 2024

[Music] next up we have a panel on securing Secrets inside the Privacy infrastructure and to kick that off I i' would like to welcome to the stage crypto Marina uh head of growth at waku thank [Applause] you oh I will be alone yeah you have to introduce everyone uh oh sure um can't see the Nam I'm sorry I think they know who they are I would like to invite to the stage my fellow uh colleague developer relationships at [Applause] waku Alex zerson SE of secret Network hael dban co-founder of obscura I hope I pronounce it well I'm sorry for and Oliver gaale co-founder and C of Panther [Applause] protocol let's wa is he's coming okay I think uh yes sorry hey Oliver sharing is Caren there's one hello so um thank you for having us here today and I'm happy to moderate this panel alongside such a bright uh Minds so uh let's start from short intros please tell the audience who are you what you do and what your company do let's start from Alex thanks Marina uh I'm Alex I'm CEO of secret Labs uh we're developing the secret Network secret network is probably one of the older uh confidential Computing networks we're using trusted execution environment technology for protecting all the user data so all the contract execution is uh confidential the state is confidential we are part of the cosmos ecosystem you know easily interacting with the other Cosmos chains and now we're also building out uh our evm developer Tok which allows evm developers to use confidential Computing features seamlessly that's us that's wonderful by the way waku had a spaces with secret network uh couple of weeks ago so if you guys want to hear it uh you can find it on Twitter so what about you hi everyone I'm Oliver I'm CEO co-founder of Panther we're building a privacy primitive for evm compatible chains uh the simply way to describe it is uh tornado cache with compliance wrappers around it and uh an ability to Route transactions into any third party smart contract execute and return the output to the protocol exciting hey all I'm Guru I'm one of the co-contributors of the vaku project and I'm focusing more on develop relations but a oneliner about vaku I would say it's a tornado cach but for data hi hi I'm hael davan I'm co-founder of obscura uh we're working on a Marketplace for confidential data services so primarily building tools on ZK based uh chains uh focus on making data more accessible whether it's onchain offchain or cross chain great thank you for this intro guys so as a thought leaders of the Privacy Tech world I would say uh I would like to start this conversation from the question what is on your opinion happening are we heading toward to the stopan Future where privacy is a reclick in the past or can we still reclaim our digital autonomy who would like to take this one s the understand a question uh are we heading at to the stopan Future where privacy not exist anymore or we still can uh claim our digital autonomy um so yeah my my prediction would be that we will claim our digital autonomy uh if you look at past in the past what happened with regards to cryptographic Technologies we had an era or comparable uh with HTTP where we first had HTTP and then we had https when https first came along there was a lot of resistance uh with the technology where as now it's essentially mandatory in all governmental websites um so that transition is what I see also happening to privacy Tech I I do think that there's a lack of understanding of the benefits and how to apply it in a correct manner but once yeah that becomes general knowledge uh I see it being adopted but we do have to go through that yeah that Valley of Death as we're going to right now I think I can add to this uh I think this event is an excellent example to show that privacy Tech is definitely progressing forward and there's a huge misconception in web3 that we think web3 is all about blockchains but web3 is a set of ethos it's about privacy censorship resistance and a lot of other ethos that culminate together to form what web3 it is today so yeah I think it's definitely progressing but the technology sector as a whole also progresses forward with multiple things like brain computer interface Ai and lot of data harvesting methods coming up so yeah I'm excited to know more about the Privacy Tech projects and it's definitely progressing you wanted to say something as well Alex yeah sure uh so I actually think that uh privacy or confidential Computing is inevitable and right now I think we're witnessing like the second uh coming of uh confidential Computing of privacy Technologies right the first coming was in 2014 to 17 with Monero zcash other projects I was also involved in beam which was a layer one privacy chain uh but these uh very dedicated uh uh privacy coin projects didn't really succeed hugely they didn't replace the others mostly probably because they were isolated and didn't have uh confidential Computing like any Computing any smart contracts execution so I think right now as the industry kind of matures although I mean I'm telling it to everyone all of our blockchain industry is smaller than Microsoft one company right the the market cap so so it's kind of still very very young very small but now the bigger players start to look at blockchain to see how they can leverage it how can they how they can make money and big companies cannot operate in radically transparent environment right they don't want others to see their trades they don't want others to see their data so the uh privacy Technologies are growing now and we see the number of projects here and there are a lot more projects that are you know not on on those Billboards here uh a lot of people realize that uh I think the Privacy industry also kind of matured in a way that uh there is uh there is still this this will for human rights and privacy but there there's also an understanding that we need to live in this environment that exists and that we need to somehow comply with what the governments require because we cannot live like in in constant fight uh so I'm very bullish on uh on privacy Technologies or confidential Computing we're actually now driving uh together with a lot of projects who are here we're driving kind of a Rebrand of part of the technology to decentralize confidential Computing DCC uh Oasis is part of that and and some other companies is secret as well uh just for for better understanding so uh yeah bottom line very bullish and uh even my statement is that privacy is inevitable without it we won't see blockchain get real Mass adoption well I'm so glad to see that everyone so positive about it uh I'm personally very positive about it too uh and actually by recent reports uh privacy concerns are concerns are raising especially in us but not only of course and I think the worser governments became uh well wor is the treatment of the government become the barri is for our sector and as we see just like getting worse and worse so uh there are high chances that uh people will realize it faster than we predicted and also even you can already judge by the size of the conferences if before it was just a small group of cyber an anarchist right now we have such huge events such as eom and uh others uh which collect in hundreds of people interested to privacy and willing to hug uh for the future for build a better internet so talking about uh building actually what do you think uh ethical consideration should developers keep in mind when actually building the Privacy Technologies privacy infrastructures yeah I'll start with that one I think think the first thing developers will be conscious of and teams that are Building Technology are really the Regulatory and legal environment that surround us at this time which is fraught with uncertainty and risk which is just not well defined so I think before we even talk about the ethics of building the there really there's this security and personal sovereignty consideration that Builders have to take into account and the generally accepted way in which you can build uh technology and mitigate that risk is to decentralize it to open source it and to distance oneself from operating that technology and so I think fortunately when you look at ethically the optimal outcome it is to make technology open source it is to separate oneself from the governance and the operation of that technology so there's this convergence between personal safety and the ethics of creating an open economy absolutely that's actually our vision as well right yeah absolutely that's what we think vaku stands for uh I think there's a lot of uh pain points surrounding the Privacy sector in terms of development and that is what we are trying to solve at this point just making the whole process frictionless but yeah we we stand for for the cipher Punk dream and we stand for what ethereum white paper was it was in 2011 we still stand for the same vision we still stand for the same Cipher pun dream do you want to add something on this one I find it a a tough question to answer um once you are questioning things like ethics uh cuz it's very broad right like what ethics from where from what time so it's very subjective in some sense um I think ultimately what you would want is to build tools that Empower your users while protecting them and that's what I see privacy um being a a middle for um so I guess that's the only thing I have to add to that well actually what I meant by the question is what um like we have kind of issue actually on the market where some uh startups some companies claiming they are that they are doing privacy protection when they are not doing that but they're really great in marketing you know and that's and that's uh unethical even web to companies doing that and we know that WhatsApp doesn't have anything to do with privacy but people still believe somehow that those messages are encrypted that's so funny so yeah I personally think that decentralization should be a must and uh so do open source and privacy should be by Design and while we're talking about privacy by Design um what do you think is the concept of privacy by Design achievable in our current uh technological landscape or it's mer a lofty ideal uh I can start well um whether we like it or not the dominant uh blockchain Technologies are radically transparent right uh Bitcoin ethereum all the ethereum uh derivatives salana uh Cosmos in general so uh I think uh replacing and and replacing those Technologies with something new seems to be uh kind of utopian right now and by the way uh I think that it may be kind of uh you know we some of us feel that you know this radical transparency is kind of a bug or like uh a problem that you know satosi did not solve uh but on the other hand I'm thinking that if Bitcoin were confidential were totally private in the beginning maybe the governments just would have strangled it or tried to strangle it really really hard right from the get-go right because that would be seen as a huge uh threat so maybe we're actually lucky that uh all the blockchain started like this so what I'm saying is that um I don't think we can replace the existing technology uh Al together but we can build add-ons uh to make uh all the ecosystem more secure so we should probably still be using and will be using uh the non-confidential blockchains as the main technology but we will add things that provide data protection privacy uh confidential Computing on top of that and create uh like additional layers like it's secret we're calling this a confidential execution layer and we're offering developers running on any chain to just store some confidential data with us or do some confidential computation I think Panther is doing something very similar right running on top of evm allowing some privacy and and other projects as well so my belief is that uh you know privacy was not baked into the original blockchain technology so it's kind of like an afterthought but there are so many different ways to build it and so many bright people work on that so that in the end we will have a diverse EOS system of solutions that will allow good and and seamless privacy to all the users and that will drive adoption that sounds great yeah and you're correct in the sense that we are looking at multiple different L1 and l2s and essentially the emerging rollup ecosystem and saying each of these chains is configured differently they have different use cases and uh every user and institution themselves has a different level of um a different need for privacy and privacy obviously comes with a cost and it exists on a spectrum and so the idea of absolute privacy is I I don't think that exists even cryptography has a LIF span and so uh encryption as a lifespan so you know the question really is what's the use case what is an acceptable level of privacy statistically speaking and then how do you deliver that to the users whether they're end users or institutional users and so you know I think broadly is a heterogeneous Marketplace and we have more options than ever and so users will coales around the services that they need and that that meet their requirements and where costs essentially supply and demand meet up and so we're looking at the dii markets particularly the finance markets and saying look 96% of the market caps of all cryptos are on suit Anonymous chains to to your point um and so do we think those Network effects are going to be overcome by fully private systems I mean uh probably not actually I think it will be a case of certainly there are other players ERS who will take market share and serve Niche cases but the objective from our perspective is to bring that tool in and the ability to have some level of statistical privacy to any chain any solution guys would you agrees that privacy but default is not possible uh I would say that's the beauty of web 3 uh in the initial days just like the others mentioned uh there was not not much of advocacy in blockchain because blockchain was uh supposed to be transparent but then over the years exploring all these use cases I think we've uh found the need for blockchain and there are so many projects amazing projects coming up and that's the beauty of blockchain that I personally find yeah to add to that I think so privacy we use it as like this umbrella term but it's you can dissect it into many different versions so you have input privacy output privacy privacy of your users privacy of function um and I think to add to the point that that everyone else essentially made is we will have a diverse ecosystems uh of different networks that contribute to the use case of the user um so with that in mind um yeah I do see the different benefits of the different networks um being combined together where a user doesn't really need to think about it but it's baked into the system entirely um so that's my point on Top yeah just to add a bit more to it like uh I don't see much of web2 projects doing uh you know giving custody of your data or your access control to your users but with web 3 I think it's more principle driven I can see a lot of projects doing it so I think that's like the unique selling point for this whole know web three domain that's curious um what about the actually metadata protection I mean there are startups out there I'm not going to tell uh names not to Market them uh that claim that can actually uh provide better encryption than torida that you can actually um decrypt Behavior patterns in tour and by protecting metadata you cannot so it does make it possible uh doing privacy by default in this case so um could it be like an option this or perhaps you have other options in your mind that uh this way we can ensure that privacy infrastructures are resistant to surveillance and censorship maybe I can start uh so you you mentioned tour and I guess you alluded to name and and other projects doing this um I have kind of a controversial view on that today most of the internet is is like what three four companies right so you always go to Google the older guys go to Facebook the younger guys go to whatever the young guys go to like Instagram so uh so the metadata is very simple right you go to Google you go to Facebook you go to Instagram right and and that's pretty much 90 I guess 90% of everything we're doing so uh so the real problem uh is not the metadata I think but the dat data right so you know using tour to hide the fact that I went to Google well it's obvious anyway but the problem is that Google knows exactly what I'm looking for and open AI more so right now knows everything I'm interested in right um and to me the data is a much bigger problem than than the metadata Just Because the Internet kind of shrinked to just you know a handful of companies who have all the traffic uh and all the user information so uh that's my take that that said of course the the the task of hiding metadata is a noble task you know I used to run a tour node at home for some time it's a lot of fun looking at the logs trying to understand what people are doing uh and but I could so uh so yeah so that's my answer what authors on this can metadata protection save us from surveillence can metadata protection save us from surveillance um in some ways I guess it it makes it a lot harder if you can't track it um but I think I want to reply to to his point um because it also Taps into the users like now we're freely giving out the data right everyone's just posting publishing their whole lives online users don't really care about privacy at this moment so it's like our responsibility ability to yeah implement it and bring it to them by Building Systems of value to them um which is extremely hard uh so I think that's probably the first thing we have to start building things of real value in the real world because currently in this space it still feels like a stbox environment there are no real world applications there are are no real world implications um so if you want to get this to the users we have to build systems of value with privacy baked in uh cuz they don't care themselves yeah I think data harvesting is definitely uh going to be a big thing in the coming years with Technologies like Ai and uh brain computer interface coming up because you recursively trained your models with this data and let's say a centralized llm like open AI uh they have data associated with these identities as well like open AI knows who is searching for this particular question or who is trying to you know what prompts you are going to send to their llm I think this is where we have the biggest privacy risk if they try to use this harvested data for Mass surveillance or mass advertising they are already doing it man they are doing it now as we speak it's not like they try they have the data they're using it yeah absolutely so I think that's where Technologies like Pro privacy Technologies can step in and be like take the data not the ident itty and I think especially for waku it's a good use case because we make sure that the data is getting to the hands of the right person without you know knowing the identity of the sender or the receiver uh I look at this as a I mean I'm not a Believer let me put it this way when I got into the Privacy space well I guess it started years ago with darkcoin but with Panther it was ideologic driven by the idea that our right to privacy is a fundamental human freedom and we need to defend that but it's been a four-year journey and I'm quite confident in sort of attesting to the fact that that's not really what users care about they care about utility and economic drivers make the world go around I mean this entire space is built on the principles of rational individual profit maximizing and so when we're designing products what we really have to think about is what's the utility function for the user and I think the biggest hope here is in self- custody in data and being able to monetize it um or access Services otherwise so when I you know break down something like access to a financial service uh in the real world to First principles what I'm essentially being asked to do is trade my data I my kyc for access to a network which is useful for me and that's a transaction I'm willing to make similarly when I access social media the the trade here is I give up rights to some of my personal data in order to interact socially with other people and so what we have to do as Builders is really figure out whose problem are we solving and how we entice the user to enter into this data exchange transaction and I think even in the case of llms there's a huge wave now of intellectual property rights enforcements and uh you know open AI sort of rolled out and scraped a whole bunch of information off of the internet without permission now they're rolling back those access controls because companies are saying hey this is our proprietary information we have the right to monetize it if you want to access it pay us for it in some form and so this is where as a privacy service provider we get to insert our s into the equation and say right here's some infrastructure to protect that data and access control uh it's it's release and I think the to add to that I think that like this the systems that we will be able to create that flips the switch where the user now has to Grant access to the service that needs the data that is where a lot of the value lies that is still untapped in the current web 2 framework so by leveraging privacy as a feature in what we're building to really reap of the benefits of web tree I think those are the things that will be the driving force behind this you've been mentioned here like one of the challenges is people like still do not care about the Privacy I think like uh a mission and a task and a goal of each startup who actually work in the Privacy protection should be also education like as much as education as possible uh to actually teach people that it's not about that they have nothing to hide but they have a right to choose what they can hide and what they can share which um same like in in your let's say offline um life and make sure that is accessible to everyone so the question is how we can assure that the Privacy infrastructure accessible and uh to everyone and doesn't depends on their social economical status decentralized sufficiently you know I mean the the this goes back to the challenge that Builders have sufficiently decentralize its uh I think former SEC chair prior to the famous um Gary Gensler made this statement as it related to ethereum and said that ethereum was sufficiently decentralized but that's never been defined and so we operate in this limbo of not really understanding I mean certainly in the US you have constitutional rights the freedom of speech and the right to privacy is the inverse the right to say nothing is the inverse of of saying something and so two sides of the same coin and so um you know I think we sit in a situation where what constitutes decentralization is unknown but there are these principles so open sourcing your codebase your documentation um is a great starting point not having ownership keys or having a sufficiently large set of key managers or owners uh when it comes to Smart contract implementation because of course there's two sides to that coin as well if your smart contracts are immutable and they're flawed there's a massive risk to users on the other hand if you have some Nexus of control then you're not operating uh independently and so you're subjected to the will of authorities who may have malicious intents which tends to happen so you know I think it comes down to really figuring out the Paradigm for how to build responsibly and publish your research and your code in your systems responsibly and then uh ideally step away from them because if they're useful the market will will do the rest we don't have time but if you yeah I want to add alliv our your Ted like from from the developer standpoint how developers uh and you know scientists and researchers should should should behave um I think to make privacy available we first need to really make blockchain technology available and easy to use to everyone right uh because right now it's still used by like most people use it like very little and so they don't care about the oh okay I bought a coin and then I want to sell it you know when it makes 10x I don't care if everybody knows about that because it's a very small part of our Lives of my life in this case right but uh when institutions start trading on the blockchain and taking big positions and and potentially moving the market then they understand that they need privacy so so what I'm saying is as we build more utility and defi is a huge utility right because you can make money and it's happening it's real but as we build more utility payroll applications banking applications games whatever and and more people come in then they will demand privacy moreover the applications will be impossible without the Privacy so so what I'm saying is you know we here are building uh confidential Computing Solutions privacy Solutions are getting ready but but they will become really used only when more people come and that will happen hopefully in this cycle as we have better user experience with the account abstraction and all the other things that that make everything easier so once it's easy and a lot of people come then when like when 50% of my life is on on blockchain or 90% of my financial stuff is in the blockchain then I as a user will just demand this privacy and and it will be there right but if it's only 1% then really I I don't care and and that's the fundamental problem I think the technology is there we still all have a lot of work to do but the ideas are there technology is there but the adoption uh of the blockchain is what will really make this privacy uh available and used by everyone thank you so much for this amazing closing note we unfortunately already two minutes late so the question is if uh Facebook uh so data to Netflix well there wasn't any privacy anyway right so Facebook had all the user data and like one huge Behemoth sold it to another huge Behemoth so I don't think uh most of the people um you know even care because they they they gave their data away to some some other guys anyway right so I mean they may be pissed off because they didn't get paid for that but you know still it's it's not like they it's not like it was published right were just sold to another Netflix and for that for for me like Netflix and Facebook it's I mean it's kind of the same I mean okay another guy in another suit running this comp but it's like two huge companies and sitting in the same place not really surprising indeed any other questions from the audience I guess it's no well thank you so much guys for sharing this super [Applause] [Music]