"Size Matters"

Transcript

[Music] foreign hello that works all right hello everyone my name is AWA and today I'm going to keep a presentation about Size Matters so just a little bit about myself I actually used to work at chin analysis to analysis as a data scientist um back then I wrote a couple papers about apply machine learning to the anonymous Bitcoin and people still online pretty interesting but nowadays I work on Goods for the public particularly on anoma and namada so I'm giving this talk it's because

it's been more than five years since I've worked at CA um and honestly even after so long um privacy really sucks today and but the thing is that I actually realized that very few understand why premises sucks and this applies to people who build protocols applications even cryptographers and of course and users so today um I kind of wanted to give you the intuition why privacy sucks and I'm going to focus primarily on on-chain privacy so the first thing framework I want to share with you is to think like a chain analyst so first of all um there's a misconception around chain analysts being similar as investigators

detectives actually they're not um chain analysts only care about getting coverage and they care about some probabilistic um certainty they don't care about like for example the granularity of identity don't care about the specifics of their individuals they are analyzing and the most important part is that um really what the what success metrics they care about depends on um why they're doing the analysis for Sunday for fun others do it for science but mostly for profits and you can actually get paid a lot of money to help other people make money so you can help with your data Traders investors um to ensure that whoever has to pay money pays the money so compliance and

of course you can also use this data to help detectives law enforcements and investigations and this Market has grown a lot over the last years nowadays you even see the centralized stocks in marketplaces appearing like Arkham but what is a trend analysts that do um so it's actually quite simple you start from a very large data set large anonymity set and this can be all the transactions and accounts on bitcoin all the transaction accounts on ethereum you like download all of that and you have the stamp of every single block and your goal is to turn this large data set into a very small one and in the process you use primarily um two classes and methods there are active and passive methods

passive methods are simply just analyzing the data you have on chain without uh interacting with it so the data you have you just try to infer and then try to get for some clusters and try to reduce the millimeter set just by looking at statistics suggestion graph um timing and so on and other heuristics active methods are more interesting it is where the chain analysts actually directly interacts with the blockchain and then tries to gain insights that way in a very simple way of of an active method is where simply you go and deposit funds to an exchange for example and then you track online Explorer and see what's happening um and then also in the process besides

these two classes of methods you can also combine on chain and of chain data so Unchained data is everything you get from running full node um and of chain data is every other kinds of intelligence they can gather outside of the blockchain so this is include social media the open web um and everything else and once you have all these different methods and all these different kind of data you can also do website reducing unlimited sets you can also do clustering so this is about grouping the um smaller bubbles in the in a smaller set and then try to determine what is it that they're trying to do so here for example um the cluster 2 could actually be some kind of WikiLeaks or it could be this kind of a commercial activity

that's what I do um and what's interesting as an Insight is that when we only had Bitcoin and altcoins so when everything was just payments and transactions it was actually harder to tell um what people were doing because they had to write a lot more on on off-chain data to see like what kinds of activities we're doing but the Curious Thing is that with the appearance of ethereum and more specificity at a settlement layer you actually ended up having even more data on change so the difference is that because they're smart contracts and you can tell with the logic logic of the drama contract is transparent you can actually tell um what it is for just by looking at

what what it does so the ldr of channels is a work is that um it sounds really fancy but really you take all the data you apply some kind of Statistics you do some analysis and timing try to do patterns if you want to get really fancy you do then I give the tax so this is like a method an active method fingerprinting but the sad reality is that in program performance like ethereum and so on and um different very popular usages of an artist in the end you actually make the life of a chain analyst really easy especially if you on top of it adding the nft as a Twitter profile yeah so premises sucks because anonymity

sets are already small you compare this to traditional Finance comparators to the world of Fiat currencies it is really really small on top of it anonymity is actually even smaller because they're fragmented they're fragmented either by the currency but an application or by a platform so it even gets smaller um 99 of the of all transactions are still transparent they're still used um there's still interactions on changes do not support privacy natively and then that is combined with increased amount of data on chain with more nfcs um there are also other kinds of applications such as leverage the social graph around nfcs and social media as well

so yeah when you ask like okay in the over last years we've seen a lot of cryptography being developed and deployed that is the program nowadays like particularly is knowledge proofs right and that should just make everything better but actually that's not true um because first of all too much proofs does not equal to privacy the knowledge proofs are a cryptographic scheme that give you some properties and then some of the properties can be privacy but sometimes they also use it for succinctness data verification and so on um so there are system and an application or protocol uses much proofs doesn't necessarily mean that it provides privacy and it gets more complicated there are certainly systems that leverage the knowledge proofs zcash

is actually one of the best anonymity sets we have today The Leverage knowledge proofs but even in this case there are caveats here um so much proofs remove the transaction graph as in you do not get the information around the sender receiver the amount of time right but that doesn't equal to there is no data being leaked in the case of the cache in case of any other application the Julius knowledge proves so um every time there's a transplant transaction involved and it's obvious there's more information being leaked but even if you look at the box in the middle even transfers from Z to Z still licks on amount of information for example the fee this is due to how shell transactions work and also you can infer some statistics like how what is total

volume actually transactions um in the network so and what's Curious is that it seems like very little data but it's more than enough to really anonymize a big portion of the network there was a study that was published in 2020 by a few researchers and what they did is just apply very simple passive methods a little bit of like active um and leave it to Ocean as well and then we managed to actually anonymize nine out of estimated 9 out of like 10 transactions in the shield set so um that's not very good for privacy and active methods I mentioned before are particularly good to the anonymize transactions initial set so the way this

works very quickly because of any kind of cool is that you send a really small amount of um to a an account before you enter the sheller set you fingerprint it as in this sequence is unique and you bet on the fact that when this transaction leave social set you will be able to detect okay this was the fingerprint left so these two transactions entering and exiting are the set entity so yeah one takeaway is that most of the data is leaked when a transparent address is involved so the least data is leaked when interactions remain within the shield set and the other thing is that users today are multi-chain okay how many of you hold only one how many whole crypto

let's say can you raise your hands yeah let's say I think around 80 of this room um wholesome crypto how many of you hold only ethereum only Bitcoin only one kind of asset can you use these hands uh okay they are you know there are a few still like Hardware Maxes respect um into the Smoothie chain world but um I would safely say that you know the majority of users today hold different kinds of fungible and non-fungible tokens across security domains on ethereum um uh Bitcoin all coins Etc Cosmos customers like chains um so actually privacy is not real it's actually really bad in the case of the question domain because this is how a

transaction looks like when we talk about this is a transaction between osmosis and application chain that is a tax with Cosmos it's not application chain and um the way this works is there's a protocol called IBC that enables these connections to be done safely and permissionlessly but you look at this and to a chain analyst this just looks like a regular transfer transfer right so it reveals and Patch injection graph so not private at all even if we were to um make an interaction between a chain that supports negatively privacy and a chain that doesn't in the case of namara um necessarily just by how the how I would see and bridges are necessarily this design it will involve a

transparent address so like that interaction specifically will be um transparent and also that applies to when you make the interactions between two chains to support privacy NATO let's assume that earlier that that's private execution VMS and the Mata and there's like a bridge and there's a transfer then that actually that transaction will still be fully legible so yeah they still they are about questions previously is that it's not very good it actually just looks like analyzing Bitcoin so quick question for the audience um more than 80 of the audience version enhance the whole crypto what do most multi-chain users use today for privacy

foreign what do you use for privacy I'm not talking about custody right I'm talking about like actual the payment of like when you pay to remain private bingo centralized exchanges um is what the majority people use and um as a matter of fact I do pay a lot of services I will pay a lot of people in crypto and for a long time what I was doing was I subcasted it right I bought for example some um some some functional exchange and then I'll funded individual wallets that were for each kind of party so like assume that month I had to do 10

payments right only 10 payments so what I did was I created a account for every single um counterparty and every month I went had to pay I was super careful doing every individual transaction making sure that I was not taxing myself and others and just like really really tedious work um something they should have taken me 30 seconds to complete 10 transactions right we don't even need to scale with my visual MasterCard it took me more than an hour every time I had to do it so there's a sad reality of um of today's privacy sex so much that even though we are as an industry heading towards a centralization the sad reality is that um privacy is so behind that a lot of users actually use

centralized solutions to get to get privacy at least from external observers on chain privacy basically um so yeah the tldr is that people who break privacy have a super easy time and people who want privacy have a really hard life or just give up so how do we turn the tables around to make it really easy for people who want privacy and make it really hard people want to break privacy um so the goal is to maximize on-chain privacy and the secretary number one is that size Matters what does it mean Let's do an exercise here here are four different anonymity sets okay they're all all of them are shielded set so you

don't know what's going on inside from a to d the only difference is the size so which one do you think is the hardest that they anonymize see okay so actually it's quite hard to exactly calculate what is like the hardest to anonymize but I think we can get consensus around um D is significantly harder to download minus than a right so the size of the Schiller set actually matters a lot for privacy so this is take away the larger the Sheila set the stronger the piracy guarantees this is really really important takeaway 2 is remain remain within the shielded set this means that as a reminder of what happened before especially in the case

of busy cash what happens a lot is that even when there is much proofs involved in everything users tend to transfer in the Shell set and then leave there might be a reason why they wanted to do that they might want to use those funds Elsewhere for an application so on like that but actually if you do that um it's completely pointless that you actually win social set to begin with because there's no privacy if you do that and actually you just get much stronger priority guarantees if you just remain within the shoulder set antiguity number three is uni to boost privacy through ux and um to be fair when we talk about oh yeah privacy hasn't been adopted because ux sucks actually that is not the right framework to think about it

um I think most of the ux that is required to make privacy um accessible for a lot of people it comes from the restrictions from the design of the protocol but once you have achieved the you know the size part once you have achieved like to remove the need for users to leave the shielded set then comes something else that can easily improve about 100x privately just by default right and here's an exercise how you can do this and haven't talked about not protocol features anymore I'm talking about just interfaces so here are four Shiller sets um shows that a is just very small one it has size of one there's one type of assets inside of

Sheila set um and then this is a user a very naive user since one eth and it sends it out immediately so like T is one and then the other extreme is where all variables are infinite as large as possible when it applies and are randomized so I'm talking about Sheila City where we have a really large set and they are within the set a lot of different kinds of assets um and the question here is which one is harder to anonymize assuming that the difference between AED is the size as well but also we randomized values um when it falls out randomized times as well and we also randomize the asset so this is just a way of thinking about a lot of things you can do just at the

end user interface level that can just by default um defend against active methods passive methods and just by default give you a lot more privacy even to the user who doesn't really understand what's going on so yeah this is where we are today and the goal is to get to making it really hard people who wants to break privacy and just last takeaway is that in this remind ourselves that we're building privacy tech for everyone and not just for Cypher punks and yeah we have figured this out how we do this you can check it out later and there's an entire article about Size Matters you can take a look thank you thank you thank you I think we can have

one or two questions for for the presentation in the talk does anyone have a question okay again thank you [Music]