Panel | The Future of Privacy: Protocols, Not Promises | ETHDam III - 2025

Welcome to Ethan to Ethan to Ethan to Ethan to Ethan. Thank you. Hi everybody. So let's kick it off. Let's start from the short perhaps presentations.

Uh please share with the audience a bit more about yourself. What are you doing in the space and why you here? Oh me I'm distracted by the mic. Sorry. I mean, Aaron, perhaps we can start from you.

Okay. Um, my name is Aaron Day. For the last two and a half years, I've basically stopped everything that I'm doing to warn people about the threat of CBDC's. I ran for president of the United States as a Republican to raise awareness on the issue. VC Ramaswami read my book and in New Hampshire, pushed Trump to come out against CBDC's in part based on myounding him.

And now I go around the world uh doing workshops not only warning people about the threats but teaching people how to live on privacy coins uh as an alternative. Uh and in particular I've been focusing on Zeno and Monero. Hi, I'm uh Ruben. I am the project steward and founder of FIO. It's a privacy focused cryptocurrency that used to be called Zcoin.

We've been around since 2016. Um, I got into crypto, especially privacy crypto because I think back in 2007, I'm actually I was a lawyer for 10 years before I went into crypto. But back in 2007, I uh started a VPN service and you know, I was cut off from my payment rails. My bank accounts were frozen just because I was doing something seen as not even illegal. It was just something not quite liked.

And that's how I started turning into privacy cryptocurrencies. And uh with the fo project has been behind a lot of privacy protocols. I think we were the first ones that implemented zerocoin into the the main and different than zero cache. We've we've built sigma lantis lantis spark which has influenced other projects like even monero and also uh beam as well. So yeah that's me in a nutshell.

Yeah. Hello everyone. Um first of all thank you a lot uh for coming and thank you uh Etime crew for having this amazing event. Uh it's my second time actually. Um I've been in the blockchain for 3 years now and u I am originally from Mina.

Um Mina is world's first ZK L1. Uh as you know ZK is a very evolving technology and uh it has a lot of use cases. Um and I believe Mina's unique point is that they use everything about ZK. Uh so there is the scalability aspect of ZK coming with it. There is the sax aspect.

Uh there is the privacy aspect uh and today's the topic is privacy. Um I believe ZK's privacy is quite unique in some ways. Um and yes other encryption solutions are also very promising and uh for sure there are um different ways of achieving privacy. Uh but I think there's a lot to discuss about ZK. So today I'm here to actually you know uh explain uh ZK's point in privacy applications.

Well uh short intro about myself as well. Hi everybody. I am Marina Petrienko known as Crypto Marina. I'm in the space since 2017 and in the privacy space for over last four years I think and currently I'm a gross lead at the codex storage as decentralized storage network which is part of free technology a venture studio focus on tech for good and we have bunch of privacy preserving companies um in our portfolio. Um so let's start with the questions.

Let's be honest, uh the word privacy preserving been thrown around a lot and actually became even like some sort of like marketing term which lots of companies use uh including web two companies ironically. Uh but um if we're talking about web 3 uh specifically what are the minimum properties a protocol uh must guarantee to claim it uh privacy preserving one? I mean I guess I would say unlinkability, untraceability and confidentiality. Uh well at least for me it's I mean when we have a lot of experience in building privacy protocols but I would say it'll be the sender receiver amounts maybe even asset type and also the transaction graph at least when we're talking about transactional privacy and the privacy protocol. Yeah.

You mean financial transactions have Yeah. Like you know things like like Monero and and things like that you need to hide all this things in the privacy protocol. Yeah. Thank you. Um yeah like both of these are great answers.

Uh but personally I don't feel that wider about privacy. Uh I think it depends a lot on the application and um it's about revealing as much as you should. Uh and in some cases you need to reveal the receiver like if you are doing a fund anonymous funding uh it's a private application and you want the funders uh to be anonymous. Uh but the funded party should be public should be transparent verifiable fund amounts as well. maybe not individual um you know um helps funds um but in the end like in these type of applications I think privacy can be dependent um so I believe it depends a lot on the application um and I don't believe like general purpose privacy use cases I believe in general purpose privacy technologies uh where we adapt to our applications basically that's great and I guess like every project working with uh privacy has to balance a lot of things right in order to grow and be successful.

Let's talk about balance between privacy and composibility. Do you think it is possible to build modular systems without weakening the guarantees as it seems? I I do think it is possible. I mean, I think Zeno does this to uh to a certain degree um using the same underlying stealth and rigs uh ring signatures uh excuse me with the uh wallet integrated browser and marketplace. And so uh also what what will be launching soon with Zeno is something called confidential layer where where you will be able to use uh a bridgeless as an L1 and basically connect your Bitcoin, Bitcoin Cash and Ethereum and bridge right into uh Zeno and kind of swap from within that system.

That's exciting. Uh sure. I'm not an expert expert on composibility, but I mean from from what I know the systems in DeFi, there's always like this pools of privacy when you're talking about like things like tornado cash or rail gun, they all kind of like separate anonymity sets. And I mean, I've seen some work where, you know, they're trying to build uh anonymity sets that span across several different chains. Uh I haven't seen that in production.

I mean I'm been willing to be proven wrong but it's always like the conversion especially when you are building on the system something like Ethereum or Solana when it's not like you know built for privacy there's always going to be some leakage of data but I think probably unus on on this type of things yeah yeah cuz like with Mina actually it's impossible to do something without modularism if you want to build a meaningful application with Mina you need to go modular um and I don't think modularism um is a way to do privacy. I think it's the only way. Uh if you want to do something really private, I think uh operating this on different layers is the only way. Uh because otherwise at some point it converges to podity meaning that like uh independent stuff can be identified to be coming from one party. Uh and I believe modularism is the safest choice here.

Um and as a layer to combine all like in terms of providing interperability between different layers, I think it's client side which is the ultimate privacy layer. Um if you can make everything small enough uh verifiable enough to be inside a browser then you can just use client uh to bridge any knowledge between different modular layers uh and keep your privacy in the ultimate way. Um that's why you know Mina is designed to be 20 kilobyte blockchain so that you can actually adapt any privacy uh preserving applications uh results I would say the Merkel witness inside your browser so you can verify the entire Mina history inside your browser as a single proof that was the idea. Uh Reuben, I really like that you shared some real world example guys. Perhaps we can elaborate more because it's like more uh down to earth like can you share more real world examples where privacy was broken uh due to integration like poor integration between the protocols?

Um of course. Um so do I start or go ahead. Okay. Sorry. Um so I think a good use case um like I don't know if this is a good example uh but I want to make a comparison to tornado cache.

Um so you know that tornado cache is a pooling based privacy application. So basically there's this pool and you submit your funds into the pool and you receive a zero knowledge witness um so that you can prove without you know revealing your identity that you have some unclaimed funds in the pool. Um so you can actually transfer money uh to someone else offchain. Um that's a great application but there's a a big limitation is that the anonymity of the system depends on number of users using the system. If there's only one person joining the pool there is no more anonymity.

Everyone sees who received funds. Um and that's like a very easy way to break privacy. Uh you can be like okay if there's more than two people then there's no problem. It's not that simple because in the end like as the information is not infinite there's always something that you can extract from a limited set. Um when we say we are breaking privacy we don't necessarily mean that uh it is fully broken and everyone knows everything about you.

Um think of the use cases of like client side encrypted messaging applications uh signal or telegram I don't know uh in these applications yeah messages are client side encrypted so full privacy no because in the end the fact that you submitted a message the messages size maybe and this type of information can be known for instance think of there's a legal case and the uh prosecutor says that like there was this message arriving at uh the victim at 2:00 a.m. morning and that signal can prove because the message is encrypted they don't know what was written in the message maybe but in the time of message is there um so I think the best way of solving these type of issues is using different layers um I want to name an application that we recently designed um it's actually a very basic problem voting uh but we approached it from a very novel perspective uh where we targeted this specific problem and we said how can we improve this to the highest point possible uh and the solution was again modularism Um in this voting application uh which is called zk vote by the way uh but without the e in just a tweak. Um so yeah in the zk vote we are enabling full modularism and you can actually integrate any layer in between or just take it out. The submitting of votes happens through a DA layer.

Uh you can use any DA layer you like or multiple DA layers at the same time even. uh for instance we are sporting celestia avail and while submitting your transaction to the DA you can anonymizing by putting any layer in between just like a VPN for instance uh there is namada a privacy preserving token um there's padumbra a privacy deck maybe you heard um so you can actually use these type of applications where it's not based only on pooling but there are other solutions to make sure you know you are accessing a full private state uh you can make your vote fully randomized uh and I think like that's a good example of real life use cases where privacy is even better for some type of applications. I just like to quickly add on that. I mean I think the the question was like you know where where the leakages happen. I mean I think tornado cache is a a great example especially with the early versions where you had to sort of mint or put your notes in fixed denominations.

On top of that uh the asset types were were kind of exposed. So like for example if I wanted to launder stuff you know if there were not many people that were anonymizing in USDC uh then that anonymity set was smaller uh you know you know that's why and especially when you're trying to do big amounts when you have to break them into denominations you know maybe there's not many people in the 100 e denomination and stuff like that obviously a lot of these issues have been I would say mitigated like the newer systems also hide the asset types But obviously, you know, there's always going to be that leakage as long as there's that transparent layer that you have to kind of bridge in and out even from within a privacy system. So, I mean, that's why we kind of built like uh systems that can kind of built for privacy from the ground up. Yeah, 100%. That's a great example.

Aaron, what about you? Do you have some examples on your mind? No, I don't have anything to add on that one. All right. Uh let's talk then more about uh ZK.

uh Ununus you was mentioning you really wanted to talk more about this so this question is to you uh do you think we are sometimes over edexing on zero knowledge proofs what are the tradeoffs uh compared to MPC mixnets and the trails hold crypto um very nice question um so first of all I have a talk after this one about like different privacy solutions and I actually touched there about ZK a lot so if you're interested more uh you know I'll be talking 15 minutes about only this um but we don't have that much time. Yeah, I know. Um as a short answer, um I think ZK's power come from its um limits. In the long run, uh ZK converge to a world where proving something is as easy as doing it. And if you have that, then everything becomes private just because it's easy.

And ZK's privacy does not depend on some hard problem. So in most of the private solutions there is this hard problem that you can't crack. Um but there is no guarantee that this problem won't be cracked at some point. Uh last year in April um like about a year ago there was this paper uh about um quantum computers attacks on lettuce based problems. It was actually you know attacking against the security of FHE.

Um it was disproved like two weeks later. uh but even the very existence existence of this paper and the fact that it took two weeks for scientists to you know disprove this I think shows us that we can never be sure that hard problems will stay hard in the future um but with ZK that's not the case and it's quite easy to see there's nothing cryptographic about it um the ZK proof size uh it doesn't depend on number of inputs that you have that clearly shows that there is no privacy breach because like if privacy was you know be breachable so I could have you know extract some information from the proof this would mean that I can actually converge infinite amount of information into a single bit which is impossible by definition so it's very clear that ZK's privacy can never never be broken because there is no hard problem there's a very physical limit that can never be breached uh because of like very logical limits um so I think that's the big advantage of Zika over some other technologies um I don't think that like encapsulates all other technologies but I think for most of them I can you know state this one can I quickly add yeah sure because I do think that the question talking about like you know is there over reliance on zk versus mix nets and and uh what's mpc methods they're quite different because like they they're each privacy building blocks that are trying to solve different things it's not that we're overrelying on zk it's just that we're finding the thing that does it well like mix nets It's like network layer privacy, you know, it's you don't really need ZK kind of there, right? And you're talking about like MPCs, yeah, good for like, you know, some sort of secret dating app or, you know, some sort of auction data, but it's not that the appropriate tool for let's say transactional privacy. So yeah, I don't think we're overrelying. And I think you know we just have to be cognizant that you know sometimes they're like especially among some of the less educated privacy proponents that they'll be like yeah in this tech zk is the best FHE is the best everything else sucks ours is superior and that's kind of silly like we pick the two and see how it performs there not like oh this technology is necessarily superior or not like yeah so right sometimes it's in some cases also like a buzzword and like lots of companies using this technology like in the wrong way in not necessary way.

So it's great that you actually mentioned uh mixnet because anyway even if you encrypt uh the data like there are still leakage like in terms of metadata and you can track behavior patterns uh and so on. Uh do you do you want to give first of all some examples about the companies and protocols that's solving this issue and uh second question here would be do you think it's obligatory if you want to be a privacy preserving censorship resistant protocol uh to have it uh in the data layer or it should be an optional add-on. Who wants to take this one? Well, I mean, I think with something like that, it's it's probably better to be optional because we need people to be able to actually use these tools and if you put too much of a barrier up front, it makes it almost impossible to use. So, I know with Zeno for instance, you can use VPN, you can use tour optionally, and you probably should, but it's not an absolute precondition.

And I think we really have to focus on the ease of these tools because I go around the country introducing people that have never used crypto before and that's actually most people. I mean in the US last quarter I think.5% of Americans actually made a transaction. And so imagine you're in front of a 100 boomers and you're trying to on board them all at once to a privacy coin. That's truly an experience that you've never witnessed before.

You'll you'll learn that what we have accepted as natives, digital natives, is completely foreign to the overwhelming majority of people out there. So, we really need to focus on usability and making it easy to get people in the door. Good point. Um, when it comes to like metadata leakage, I don't think it's possible, especially when you have a blockchain to eliminate it completely. I mean examples of metadata is like all right what time the transaction was posted on the blockchain.

I mean sure you may kind of offiscate it, delay it with things like misnetss but there's still like a band of time that's going to there's going to be something there or even like the size of the transaction how many inputs those are metadata that's quite tough to remove completely but that's why you know it's like with all these things you know sometimes cache is better like there little metadata that's being uh transferred there obviously I mean like you like the good work that NIM is doing with MixNet and you know I think that at least on the network layer does I would say provide sufficient level of like metadata protection at least on the network layer um and do you actually require I mean I take the point that especially when when when you're dealing with privacy preserving cryptocurrencies there should be some sort of b layer network layer anonymity I mean that's just my point of view I mean a lot of projects for example a firo We use dandelion plus+ Monero also I think had it in the last few years. Memberwimber all relies on all these type of things. And although it's not like a super high level of privacy that can stand against like nation state actors, it's relatively like low low latency. It's quite easy to implement and it offers like a pretty good like you know base layer of privacy for everyone. Well, if you don't have it, then you know it's quite easy to tie a transaction to a particular IP address, which to me is a huge metadata leakage.

I mean, yeah, we can choose to use VPNs and tall, which is but most people aren't going to choose that. And I think when you get people too used to that, then that can be a bit dangerous. So, yeah. Yeah. Um I I actually agree on this point and u uh yeah of course everything should be optional.

Uh you can never force people to do anything. Um but my understanding of privacy is a bit different. I want to put the emphasis on something else. Um I think with private solutions on boarding companies is easier than onboarding users. Users they don't know that they need privacy until they lose something that matters to you uh to them.

Sorry. Um so privacy is not something that you are born with. You need to learn it especially in the online environment. Uh but with companies it's different. Uh especially in like developed countries uh legal side of things is really hard and companies actually need privacy because it costs some a lot not having it.

For instance, let's say you are storing data. Uh if you don't have good privacy guarantees, you can lose everything. um or better if you don't have data you can actually save all this money uh costing you because of you know storing this data even if it's encrypted um so that's why I believe in some use cases having forced privacy can be an option for companies so that their costs decrease um think of a data tracking use case for instance uh the company want to track the data but they don't actually need the whole data they just need to learn something from data let's say they are training an AI. What if they can privately train the AI in user's own computer? Then they don't need to even access the data inside their own servers.

They don't get the data. There's full ultimate privacy. Data never leaves client side. And this is much more profitable for the company because they don't actually uh get build for because of this storing of this data. So it's much cheaper for them.

So in this use case, it's really a win-win situation. Legals win because there is no more like legal problems. Companies win. They are not paying this extra cost because of having this very sensitive data stored in their servers. And users win because they're not sharing their data data.

And in that kind of a use case, in order to have this win-win scenario, the privacy should not be optional. It should be forced. So good point. And you was mentioning actually AI in your answer. Coming back to this topic a bit.

What does futurep proof privacy look like in the face of quantum threats or powerful AI based surveillance? Um yeah I think again referring to the previous point um the ultimate privacy is client side. There is nothing better. If data is online then it can be decrypted at some point. You can never learn.

No sorry. Um and there is this attack that we call store now decrypt later. So big companies they can just store the encrypted data as it is and once the decryption method is available they can decrypt it. So if you really want to stay private you don't you should not put anything online. Um because once it's online you can never delete.

Um I think it's the same for quantum and AI and these type of problems. Um if you really make sure that the data stays with you uh keep it on you all the times especially biometric data. Uh, don't put your biometric data somewhere. What do you think about this guys? Um, I'm not so comfortable with that answer.

I mean, like, you know, like, oh yeah, don't put anything online. Don't store everything yourself. I mean, of course, that's correct, but also not very helpful, I guess. Like, um, I think one of the things that when we're talking about quantum adversaries, we're talking about the cryptographic primitives that quantum computers break, right? like a lot of us use the discrete log problem.

So a lot of existing cryptography along that is that all I would say privacy cryptocurrencies use currently uh maybe the exception of like coin join or or meimbo maybe a bit of that but I would say that all of that cryptography breaks but it's not it's not a a a problem that you cannot solve. there are uh you know quantum resistant algorithms you know like stuff that that like stark way are doing as well uh you know as as he's mentioned latis stuff uh lampot signatures I mean we are still quite far away from it and if and a lot of people say why don't you do it now the problem is that all these cryptographic primitives that are quantum resistant are not performant today they really suck like you know you want to use you want to have a transaction that takes like 20 seconds to verify or something like that, right? So, we are moving there. We are, you know, moving towards quantum uh resistant cryptography, but we're not quite there yet. And I think even Monero has been like uh I know Luke Parker, Kayaba has been really pushing for quantum resistant thing and we should be really looking into those things, but we're not there yet.

But yeah, that's just my point that we have to to standardize those things. Yeah. If you had asked me about this two hours ago, I would have said, "Yeah, you know, we've got a lot of time to think about it. I'm not worried about it." But I had lunch with this guy.

I don't know if he's in the audience, Richard Carbach. I He's not here. Well, he pointed me to a website that he just created called Quantum Doomsday Clock. Now, I haven't looked into this in total, but apparently this is his area of expertise, and he spends a lot of time understanding what's going on in the industry and and what's going on with cubits and all this other stuff. And so basically his analysis says that quantum computers will be able to steal all your keys by March 8th, 2028 at 11:23 a.

m., which is pretty specific. So apparently we have 2 years, 9 months, 26 days, 20 hours, 32 minutes, and 38 seconds to figure this out. So I I'm now more worried about it than I was, as I said, when I got here today. That's very insightful.

Thank you for that. Sounds like a cult doomsday. No, but like if they can steal everything, then they can steal nothing, right? So, yeah, it's very curious. Um, okay, we have five minutes left, so I guess it's going to be last question and then maybe we can have Q&A, right?

Um, so I mean there is like this misconception that I think that lots of people think that all the privacy protocols are censorship resistant. Do you believe that that's the case? No, not at all. uh censorship resistance is really misunderstood in the ecosystem. Uh being censorship resistant doesn't mean that your transaction will eventually be included.

It means that your transaction will be included without any important time delay. And important that depends on application. In a financial use case, important is a few seconds. If there's a censorship of a few seconds, then that's a problem. um and making a protocol fully deterministic uh without any way of censoring transactions that's quite quite hard uh and honestly I don't think many people are working on this uh people are usually neglect neglecting this issue because they feel that this is not a problem up until someone sees something big um this is the for instance this is the case with single sequencer rollups like all single sequencer rollups they have full power over the like order of transactions that they receive.

There's no limit or actually all protocols that have one block producer setup logic. So at each block there's only one block producer and that block producer has 100% control over the ordering of transactions inside that block. These are very important powers and right now we don't feel them uh because not too many people care about blockchain. Uh so yeah, I think censorship is an important problem. uh but it's something to tackle about in future.

uh even with the limited number of people that are using blockchain today uh privacy is an issue uh but I guess we don't feel effects of censorship that much so that's why we don't discuss a lot uh but yeah it's an issue um and just a quick note uh we solve it for the voting case in our voting application that was the main point of the voting case uh so please check out the white paper uh it's like a very long explanation of how a censorship problem can be solved in terms of voting yeah so I think sensor ensession resistance. I mean, the word itself is resistance. It's not like impenetrable. I mean, there's always going to be ways to censor it, but and I don't think privacy protocols alone address it. It can help.

It's part of your design, you know, like do I do proof of work or do I have a very limited validator set? Obviously, that affects censorship resistance, but the privacy protocol itself cannot necessarily account for that. But you know I mean things like oh even you have the network layer censorship resistance right like oh what happens if like China starts identifying this type of uh you know cryptocurrency transactions and starts censoring I think not many people are dealing with that yet but it can be done uh so all I would say is like it's never to you cannot say censorship impenetrable it's always a spectrum and it's a constant battle when they when they try to impose these things we generally have tools to answer them but it often results in as you say additional latency additional UX drawbacks so yeah we have to be careful there I mean I I think censorship resistance is extremely important particularly given what's going on with CBDC development or in the US stable coins which are backdoor CBDC's one of the things that drew me to Zano is the fact that it's a hybrid proofof work proof of stake and it's actually private proof of stake and I think moving more to proof of stake over time and I think that's that consensus method is going to actually be beneficial for censorship resistance 100% can't agree more with you guys uh so now you guys know except if you didn't know it before privacy protocol doesn't mean the censorship resistance protocol there are lots of dependencies starting from like storage like physical infrastructure and other points that guys mention uh but yeah let's build the the future privacy together anyway Uh let's be aware of the latest uh tech updates. Now we know when quantum computer will become us. So yeah, thank you for having us here today.

If you have if you have questions, you can send them here. I see we already have three. H take one. Okay. Um yeah, let's take the first one.

You know the first come first serve. All these different types of privacy. How are I supposed to make a decision as a normal user? Different types of privacy guys. I think a good product I mean it depends what kind of privacy that you want right like if you want transactional privacy as a normal user just use what works right I mean like although I'm from Pharaoh like Monero kind of works today for most cases right so you know Zano also can be used but it you don't really have to dive too deeply into like the details just find a bunch of experts that know what they're talking about and use what works I don't think you you have to be like oh should I be using something that uses uh you know this type of ZK and stuff like that leave that more to the experts but there are a lot of like you know decent uh solutions out there uh today.

Yeah. Yeah. Like I don't know but personally I would say that as a developer do your own research but as a user like use every use the thing that everyone uses you know like probably it's the best at the moment and in the worst case scenario the privacy is breached and there's a huge issue then you are affected with a lot of different people and it's okay like the risk is minimized. Um, so I think, you know, if you're not that knowledged of a user and if you don't like doing research a lot, just use what everyone else uses. You know, it's the developer's job to make it easy for the user, right?

Yeah. Exactly. Yeah. It's not yours. Choose the good UX.

I mean, people use banks, which in the US are already monitored by 13 different federal programs and agencies. And so people obviously don't spend a lot of time focusing on it. But in the end, it's going to come down to user experience. that's going to be what drives the actual adoption of of privacy. I would say like depends of level of your needs.

If you just you know summer in Russia and you want to access some website which is basically forbidding your country maybe like well maybe Russia is best bad example but uh generally if you just want to access some you know website and which is doesn't have like big tries you can just use a VPN right if you want to make some deeper research and you maybe don't want your government to know it maybe use uh tour right but if you for example activist and it's a lifethreatening deal for you. Maybe you should have a look into the mix nets. Um, that would be my advice. Well, thank you. We can't take more questions, but you can catch guys or myself afterwards.

Huge shout out to Aaron who just finished a 40day fast and still on the panel. So crazy. [Applause]