# Privacy on Ethereum Now: Key Challenges - Chat || Ethereum Privacy Stack, Devconnect 2025

- Channel: [Ethereum Cypherpunk Congress](https://streameth.org/ethereum-cypherpunk-congress)
- Date: 2026-01-09
- Duration: 23:10
- Topics: web3, privacy, now, crypto, cryptography, blockchain, data, security, human right, rights, tech, technology, internet, open source, free, freedom, ethereum, hackers, ethics, cypherpunk, dev, developer, dapp, decentralization, bitcoin, computer, surveillance, cyber, peer2peer, p2p, love, solidity, zk, zero knowledge, education, academy, w3pn, privacy stack, devconnect, 2025, eps25, pse, privacy stewards of ehtereum, ethereum foundation, ef, Education
- Watch: https://streameth.org/watch/yt-zbCOTnKFaR0
- YouTube: https://www.youtube.com/watch?v=zbCOTnKFaR0

## Description

Max Hempshire (NYM) and Alan Scott (Railgun) goes through doxxing, surveillance and challenges for Ethereum as well as questions and answers.

-

Ethereum Privacy Stack is a global privacy summit during Devconnect 2025 bringing together Ethereum builders, protocol maintainers, and advocates. 
Featuring Vitalik Buterin, Roger Dingledine, Andy Guzman, Polymutex, Ameen Soleimani, and 30+ speakers on 2 stages, celebrating privacy acceleration.

Ethereum Privacy Stack: 
http://eps25.web3privacy.info

Organized by 
Web3Privacy Now & Privacy Stewards of Ethereum

Web3Privacy now collective: http://web3privacy.info
Privacy Stewards of Ethereum: https://pse.dev/

## Transcript

[applause] Hey everybody. So, I'm Max and we, as we were just introduced, this is Alan and we're kind of going to be it's the end of the day, it's the end of the week. So, we're going to be trying to talk at kind of a high level and not get too in the weeds. Um, unless one someone has a question in the weeds, and I think we're also happy to like chat about that about the successes, pain points, [snorts] and some of the other kind of um yeah, just how building privacy on Ethereum is. >> Yeah. Like what what sucks, what doesn't suck. Uh, and you know, what we've sort of been dealing with, smashing our heads against the keyboards for the uh I don't know, it's been half a decade. It's crazy. It's been five years I've been contributing to rail gun. So, >> yeah. uh excited for the conversation. >> Yeah. And I think like um so I work for NIM, the company that makes MixNets. Uh Alan is working with Rail Gun. And I think like one one way that we're going to try and kind of approach this as a duo is that, you know, the the lossy abstraction is the difference between the network layer privacy stuff and maybe like the application stuff as well. Um just something to bear in mind or like the perspective that we're both coming from with it. So where should we start? Geez, I guess um I think I think the easiest place to start probably is um I guess on the storytelling side of things, right? Because that's sort of been like one of the bigger challenges of uh contributing to to privacy in the space. Um you know, for me the the why for privacy wasn't really on uh some sort of activism or like uh desire to uh help journalists in Sandy Nations and and this sort of thing. Albeit these are, you know, very valiant things and important parts of of the privacy ecosystem and these people deserve privacy. Uh but for me it was really really quite simple. Um you know I didn't want to be doxed on chain, right? There was like this really sort of like perverse thing that happens in in crypto when you do peer-to-peer transactions, right? You you send somebody some ETH and then you look at their Ether scan and then like you know have like this cute jockeying for who has like the older wallet or you know what centralized exchanges people use. And I I think that like we we really sort of like suffer from like a narrative problem. Um you know there's like a rail gun booth over there. There's a bunch of contributors. And I think that like one of the craziest things is like you know people immediately say like dude are you afraid of the cops? >> Yeah. [laughter] >> Like [gasps] you know are you afraid of the feds? >> Yeah. >> You know like why are you one? You know. >> Yeah. [laughter] Exactly. And then and then I mean it was I think it was Adrien actually in one of his talks he was like can you imagine if tomorrow everyone's visa transactions just went online. Can you imagine the absolute chaos that would ensue and also the amount of well the amount of damage that would do as well right and that's in that sense yeah public public transactions and all of this has kind of like lost the narrative war I mean like we were from from the perspective of like network level privacy then this um the narrative is is slightly different it's one of the ways like how do you actually protect the people that also really really need protecting and everyone kind of in between because this the need for privacy is a is also kind of a gradient, right? Is you could be you're going to be targeted for doing a particular thing all the way down to, you know, maybe I just don't want everyone to know what I'm doing, >> right? Yeah. And so I think like I think you have to generalize it, right? You know, like and ultimately, you know, we talk about things in like Dark Forest and anonymity sets and privacy sets and all that stuff. And like um you know, one of the things that was like brought upon me and somebody pitched this idea to me. They're like, "What if we had like uh a arc of privacy, right? And it would just be like institutions only." And they would have like an institutional darkpool. And it's like, "Well, that's like a that's really bad, right, for the institutions cuz now everybody's just going to watch that dark pool and be like, "That's nothing but banks. That's where all the smart money is, right?" Uh, and so like, you know, for for onchain, right? I think like having larger privacy sets that are inclusive of a lot of different people, uh, effectively what it allows you to do is is hide in multifarious activity, right? a lot of different actors and you know I think that like the same is probably true of like things like NIM and and MixNets right >> it is it is I mean if anything it's actually it's like a requirement on that level because um if you're talking just about surveilling a network then you know it's this question of like what's the biggest group of people that you're actually in if everyone is only using a network for even like just Ethereum transactions then yeah you can't tell exactly who's talking to who at what time but like you're still doxing that it's an Ethereum transaction, right? >> But I think one thing that then comes with having to >> to make this multivarious is like you then have to your narrative then becomes really generic, right? Like the or it has to appeal more broadly either in like a series of subnarratives or you're kind of talking like and this does come up to the technical level as well, right? How do you also make it so that you know this is a tension that we've we've kind of found in the development of what we've been doing. It's like how can you support your you know your power users your privacy maxis >> right >> but also at the same time >> make it easy enough for enough people to use it such that you can actually engender this like multifarious um you know basically like grow your anonymity set not just in numbers but also in the uses itself right >> yeah I think that like you you sort of like if you spread yourself super thin right the goal is like it's like a balancing act right you know it's like um you know sort of like a a give and take and you sort of try to like cast the widest net that you can right um you know I don't think that like rail gun is ready for like major adoption I mean I don't even think like Ethereum in most part is ready for like major adoption which I'm sure somebody's going to beat me up after stage you off stage here but like um I remember trying to explain like Ethereum just in general forget the privacy stuff to like normal people and they're like let me get this straight like I have dollars that I then have to have like separate currency that like I can, you know, pay to computers to do my transactions for me or something like this. And of course, like we've made like leaps and strides with like um, you know, 7702 and lots of other really cool things that are coming online with um, uh, with Ethereum, but you know, that stuff really takes time and like, you know, even like the trickle down effect into wallets really hasn't happened and like account abstraction hasn't come to fruition yet in in uh, large capacity, at least in my opinion. And so, um, yeah, you sort of want to like figure out the way to, um, get it close enough to like, uh, pitch black perfect privacy for your, you know, ultra tinfoil hat cipher pon who's in the woods with a Starlink and, you know, and, you know, maybe somewhere close to your mom can use it. Mhm. >> And I suppose following that then the question is like how much you want to engage in decentralization theater as well. Like what are you actually like meaningfully doing and why are you doing it? And that is >> I think always going to have some tension with like someone is always going to disagree with that because you have to essentially make like an opinionated decision, right? Like as a as a as a builder. Yeah. >> Um or you have to make an opinionated decision in terms of like this is the narrative that we're proposing. This is like the articulation of what we're trying to do and why, you know, like we try and [clears throat] >> the way that we essentially try and present it is that like you know um private like more privacy is good for everyone just because you're mixing everything else. So like even if you maybe don't necessarily like need to use a mix note all the time, the act of using it also helps out other people, right? Like this this privacy love company kind of phrase, >> right? Yeah. So I think that like with you know what I I think about it from like a rail gun context you know over the last like five years um it's been mostly like um well articulated whalebait right and so you get a lot of people who are like you know high netw worth individuals who are pretty well down the uh the rabbit hole if you will um and I don't think it's really like sort of captured broad market adoption like it's not a lot of uh average everyday users I think over time if we look at like the average transaction size that's like going and shielding into rail on it's it's sort of like you know drilling down over time but this is like a lot of work and I think that like if it's like a like a bit of a if we talk about the challenges it's it's it's like a it's like a war of attrition right you mean in 2021 a rail gun transaction was maybe like $175 right which quick show of hands who wants to spend $175 to do a transaction nobody I didn't get any hands um and now here we are in 2025 you know and uh you know gas is like 0.09 09 guay and it's $4 and that's uh thanks to Ethereum getting uh more efficient and cheaper in a in a in a gas economy but you know rail gun contracts and all that research right it's just it's nose to the grindstone hard work to make this kind of stuff like possible and then then you have like how do we make it better and like easier for like builders right like if we want somebody to like integrate this stuff like how hard is it for them to to do it the the reality of like DeFi like if you go around to the booths and things like this like they want you to integrate their thing, they don't want to integrate your thing. And that's like just the sad reality of it, right? If you're building some DAP like let's say a, right, which is wonderful and has billions of dollars of traction, uh it's very unlikely that they're going to try to figure out how to use the rail gun community uh SDK, which is over half a million lines of code. I mean, it's a it's an absolute nightmare, right? And so, like, how do we how do we deal with that and reconcile those differences? And then worst of all like and on top of that like we have uh this sort of like uh if we look at not just the DAP level like one of the bigger challenges to me is like the the wallet side of things uh we have um this sort of like pervasive need for like data. Um, you know, one of the fun things that, you know, we've done is like, uh, rail gun contributors and researchers is, you know, we forked rail gun or, excuse me, we forked Rabby, uh, and shoehorned, um, rail gun into it. And there was a ton of stuff in there. Like they had uh, Mtomo in there, there was Debbank, uh, G4, there was Sentry, uh, I mean, like the list goes on. And like all this stuff is just like Narwware, right? It's just tracking you. It's looking at what you're doing. It's it's it's dealing with you. And then like even with uh with things like rail gun like some of the information retrieval that's run by the community is uh done over GraphQL and uh it's it's a huge it's a huge problem space and like this diet tribe that I'm going on is like it's it's like a it's like a war of attrition right it's a huge elephant that you're eating a bite at a time and um I I I enjoy it but it's it's like it's like shoveling frankly. >> Yeah. I mean that's the because the the the question that's kind of there for you is do you either try and like start from the ground up again and I don't know you know in our case like build a browser or build some hardware or something like this right where you're you're working on a clean slateish but that's one huge pile to shovel and then there's the other pile which is kind of the way that we've done it and I think like what you were talking about and definitely what we've faced as well which is like the existing guard rails that are in place which are usually like security In our case, it's like a browser. How do you actually like tunnel traffic out of a browser? In this case, through a mixet. Um, in other instances, like most times >> trying to do that, you're doing it for like a nefarious reason. Like you're maliciously trying, you have like a dodgy website and it's trying to connect to something else, right? And that's what the browser is like kind of set up to try and stop you doing. And >> rightfully so, probably. >> Right. Well, you know, very rightfully so. Um but that's also the thing that everyone uses you know like you can you could also kind of yeah build from the ground up and build in isolation but then there's another question of how big can your possible anonyimity set of users actually be. Um, but that is one of the, you know, I've spent the last year kind of learning more than I wanted to know about how browsers work because they stop me doing stuff >> and trying to work out like how you can shoehorn a mixet client in there. >> Even though it's actually for a good reason, the browsers, you know, themselves don't care. They're just this is a bizarre security thing that you're doing and you hit a wall and hit a wall, right? >> Um, >> even though I think that is also like a very good way of actually working. Like you said, it is just a war of attrition. It's slowly chipping away at, you know, the obstacles that have been put in front of you for very good reasons previously. >> Yeah. I I mean, I guess for like we got like it's like a couple seven minutes left, which is sick. But I guess for a bit of fun and spice, I'm wondering what your thoughts are on like the like privacy theater in um especially on the network side of things, right? And I'm sure you might have some opinions on that, but like uh there's a there's a very clear difference in between something like uh ExpressVPN and then um I guess I don't want to like talk bad about them, but like it's not as good as like Nim VPN and like how do we how do we like articulate those differences in a way that's like appreciable to like you know average people? M >> I mean you know there's a couple of kind of easier points that you can make which is but it also partially what [clears throat] you really need is you need like a plurality of these approaches right because you're you're never going to have like a one-size all approach that actually works for everybody you know in the case of like something like express something centralized especially something that's free then it's quite simple you're like well they're offering you a free service >> what how do you think they make money they make money selling your stuff right totally I mean I use Express for like trying to get like uh streaming services um in other countries. It's quite reliable for that but not not for like important stuff. >> Exactly. I think the real educa like the kind of real education of the story there is like what are you actually trying to do with it because there is no one-izefits-all tool for for privacy. I definitely don't think so because it's and that's one of the things that also makes it so complicated because as soon as you are trying to do something very specific then you have to kind of know what you're playing around with or like there are also certain restrictions that come with that. Um, narratively though, [sighs] I suppose a lot of it and it's kind of like representative of this event that's here as well, right? Like you can either try and drive people by fear that will only get you so far or that will only talk to like a certain subsection of people and then otherwise it's the like positivist message which is a little bit looser but then I mean in a way that's also nice because there's more to play with, right? like kind of getting away from the, you know, from the notion of, like you said before, oh, it's private. Aren't you worried about the cops? Like immediately being the assumption in that regard, like generally speaking, then the crypto space is still kind of like >> behind on that narrative. >> Yeah, it's a it's a really hard challenge because you're basically dancing the line of like somewhere in between like the feds are out to get you and like um you know, you should use a VPN so you can watch Doctor Who in the UK on Netflix, right? >> Yeah. which is kind of the approach that you know we took with you know we have an app which is called anVPN app and it has like a decentralized VPN mode and a mixnet mode and you can switch between them and in a way that's kind of it's making the like the the gradient easier to actually introduce it to people rather than just being saying like here's a mixet and then everyone goes well what's a mixet >> um yeah it's your how to appeal to like your yeah your maxis and like bring and and also at the same time like be able to bring people in from elsewhere and they just go, "Oh, that's kind of cool looking." But it's not this immediate like slope of or not even slope, just a cliff face. It's just a wall that you have to climb up of like having to know the basic vocabulary that you otherwise like haven't had to engage with before you can even kind of meaningfully know what you're interacting with >> because you know there is like a fair amount of opuscation around this as well. And you need the education there for users and stuff so it's not just another form of trust me bro because otherwise you're kind of in a similar way doing kind of what express does which is just them saying don't worry about it we can't like no one knows where your traffic's coming from and that's not true. >> Yeah. Except for us. >> Except for us. >> Uh I think that like I think another big challenge in the last couple of minutes here like one of the things that we should appreciate is that like we're definitely still in like making like pickaxes and shovels mode especially for like crypto. um like there's so many things that like privacy mechanisms can't do that public like you know mechanisms can and like you know we have to spend a lot of time like researching and building that stuff out right I mean so like um we've demoed you guys maybe seen it maybe you haven't but like you know it took us nearly 3 years to figure out how to do like private multi-IGs inside of like uh like the the rail gun anonymity set and you know we announced that and that was huge research uh we figured out with uh the help of ZK Knox how to do hardware wallet support and that was really cool right uh but then there's others there's other stuff right I mean So like um how do you re how do you retrieve information from the the blockchain, right? So like uh if you're communicating with a with an RPC like how do you make sure that you're not oversharing with the with the RPC? Like are you proxying those calls? Like are you doing some sort of like uh PI? Um you know is is that even available right now? You know we talk about private information retrieval but like there really isn't like a lot of really clever ways to do that for Ethereum at least for rail gun at this exact moment. You know what I mean? So, like there's so many things still yet to be built, right? There's there's like a lot of really fun research things to do and like I think that that's like the the biggest challenge is like there's a lot of like really sensational marketing out there that says like this is the best privacy around and like you're going to be able to use this for everything, but like you know the the jury is still out on like a lot of the mechanisms. >> Yeah, I think there's two there's two things there as well. One is you know on the network side there is both like research which is happening but then it's also also more of a cat and mouse game as well because not only are you know anonymization techniques getting better but like deanmization techniques as well right it is just a cat and mouse game it's like >> you know you couldn't in like 2004 you couldn't really imagine the kind of like generalized surveillance dragnet that just exists today and is like very available and it's being done by private companies not even like governments it's just private companies that it's farmed out to. So there's that. And then I think one of the things that you touched on there is like maybe also like a nice place to wind towards the end which is I think one of the challenges really is that you have to make it you have to make privacy as like plugandplay as possible just in order to you know like you said before like the with trying to get you know someone as big as a to be like here's a 600,000line code SDK it's you know and we've we've kind of had the same it's like mixets work and they work in such a way that's very private, but because they're fundamentally quite weird. And you know, a lot of the work with the SDKs has actually how do you make it kind of look and act like something a lot more similar to how everything else works. You know, how do you make it as drop in as possible for the people that are actually wanting to use it? Um, and that again is like lowering the threshold of both required knowledge and effort to do it as well. >> Yeah. Yeah. I mean, it's uh that's been a lot of research in this year. And I guess like in the last minute that we have when we're up here, I I'll just say that like um it's not all like bad. You know, we talked about a lot of challenges, but >> Oh, no. It's going great as well. >> Yeah, it's going swimmingly. It's a lot of fun. >> And so like if you guys just quick show of hands, who's here building privacy stuff? >> Cool. >> Hell yeah. So there's about 50% of you who should start um doing that now because it's uh it's a lot of challenges if you're into like really complex stuff and you're trying to learn uh about like where the the next big like pushes in crypto. It is on privacy and so like there there's a lot of stuff that can happen. So >> please do it. >> Yeah. Start building. Come and find us and chat to us afterwards and thanks. >> Yeah. Cheers. [applause] Okay. Well, don't run away. Let's see if we have any questions. >> Oh, sick. Hell yeah. Right. Let me see. Do I need privacy if I'm just just degening shitcoins? >> So, um, send me your wallet address. I'll be the judge of that. No, I think that like um this is like a really interesting question. I think like the reality is yes, right? Uh there's like a classic adage uh in the land of shitcoining uh and that is fill and then shill, right? So if people can like watch you fill your bags, uh you don't actually get the best price execution, right? Um and if you look at like traditional finance, which is more my background, like the answer is always yes. Most uh transactions happen in dark pools. And so like if we want to have like really much deeper liquidity and like uh real opportunities to do this kind of investments and call them shitcoins, uh then yeah, I think so. Um, and hit wh hello. Uh, another one here. I used a privacy project and it was a fake private ERC20 rugpool. How do I tell the difference between real privacy and lies and scams? >> Ooh, I love that. Right. Okay. So, I think that like there's a lot of there's a lot of that in the space. Uh, unfortunately, uh, I won't hit anybody with uh a bus on stage, so come and find me after. I'll tell you all about them. Uh, but like I think one of the things that you could do is like try to find, you know, things that are being actively developed like a real community. Um, you know, I think one of the one of the easiest things to do is like find social capital in the marketplace that you trust. Um, and and and look into that. You know, if you're actually uh mechanically savvy, right, that answer changes, but uh that sounds like it's coming from someone who isn't. And so like I think what you can do is try to find some social capital out there to lean into and say, "Hey, like if Vitalic thinks it's cool, maybe it's not too bad." >> Yeah. I think also like because the spa I mean the space is small, right? The space is small and most of the time we all do public events and stuff. So generally, you know, if you're on a project, it's got no one on it, it looks kind of shady and the GitHub is really dead, it's probably a scam. But, you know, there's there's kind of there's metrics that you can also do and have a look at and you go, does this look like it's actively developed? Is it new? Has it just sprung up? Do you know, are they saying who they are and where they're coming from or not? Right. >> Yeah. >> Thank you. >> Yeah. Thank you. >> Cheers. >> [applause]