Brave: Building the Private User-Friendly Internet - Kyle Den Hartog Ep620

Transcript

To put it quite frank, I think we're doing it wrong right now in the web 3 space. Email is actually a decentralized protocol by design. You look at Google, you look at Microsoft, you look at um Spamhouse. If you couldn't send an email to somebody using Gmail, then you stopped running your own server. And that created the natural centralization even though you could be doing everything in a decentralized way. >> There's tens of millions of users who use Brave, but there's a couple of thousands of websites that use BAT for for incentivization. If you look at how much you actually get for watching an ad, it's tiny. What do you think the challenges here are?

>> I think you're hitting at the heart of the problem. Excellent question. >> Welcome to Epicenter, the show which talks about the technologies, projects, and people driving decentralization and the blockchain revolution. I'm Fria Ants and today I'm speaking with Kaiden Hardog. Um, who is a security engineer at Brave. Um, you all know Brave, the privacy fast browser. Um, and uh, before I talk with Kyle this week, let me tell you about our sponsors. This episode is brought to you by Nosis, building the open internet one block at a time. Nosis was founded in 2015 and it's grown from one of Ethereum's earliest projects into a powerful ecosystem for open userowned finance. Nosis is also the team behind

products that had become core to my business and that of so many others like Safe and Cow Swap. At the center is Nosis Chain. It's a low fee layer 1 with zero downtime in seven years and secured by over 300,000 validators. It's the foundation for real world financial applications like Nosis Pay and Circles. All this is governed by Nosis DAO, a communityrun organization where anyone with a GNO token can vote on updates, fund new projects, and even run a validator from home. So, if you're building in web 3 or you're just curious about what financial freedom can look like, start exploring at Nosis.io.

>> Ka, thank you so much for coming on. >> Thank you very much for having me. >> Cool. Kyle, it's it's been a pleasure um using Brave for the last many years. We've had Brandon on ages ago, so we'll dive into kind of everything that's happened at Brave since then. But maybe before we do that, tell us a little bit about you yourself. Um, what's your background? >> Yeah. Um, so my background kind of comes from a little bit of a mix of like cryptography security. Um, and then expanding into web 3 uh is kind of the the niche uh specifics. So originally I started out as a penetration tester as

an intern right out of university and then expanded into digital identity with that uh from taking a computer security course. So I spent about 5 years working in that space and in that uh I kind of expanded my knowledge on cryptography and and web standards uh working as an editor of the verifiable credential specification and then through that and kind of the touch points of of digital identity to web 3. That's how I ended up at Brave uh to come and help on the security side of things uh within the wallet and within the browser and these days also helping a little bit on the search side. >> What was your take on web 3 uh when you came in? And I know kind of like it's it's a very divisive subject in the in the security arena.

>> Yeah. Um for me, I've always found it to be kind of uh user empowering and the concept of self- sovereignty I think is really embodied by the community. I think the way that we represent the principles at times uh doesn't always match what we say that we could do. But as I've learned with anything, nothing is perfect. Um you're always striving to be better. And and so I think that's really what I'm trying to contribute to the space as well is um how do we make sure we get closer and closer to these different uh principles that that we say that we're working on.

>> So at Brave kind of your work centers around identity and privacy. Um te tell us about what made you interested in these topics in particular. Yeah. So it largely actually comes back to the computer security course that I took in university. So when I was interning uh my my final year um my computer security uh professor presented me with an interesting problem. He said how could we build a voting system on a blockchain? Um and I kind of ran down a rabbit hole uh with that and started looking at digital identity from that perspective. And so it kind of opened my eyes to the idea of how identity plays

such an integral role of all of what we do online. We have to be identified whenever we're interacting with a website. And you know whether that's just an IP address so that they can figure out who to send a response to up to building authentication and authorization systems, passwords, pass keys, all of these sorts of things. They all come back to the concepts of stigial identity of knowing who says what about whom. Um and and so that really kind of led me down this path of understanding, okay, so if this sits at the base layer of everything, understanding it is very useful and and very impactful to everything that we do on the web.

>> Mhm. DID decentralized identity, it's been here since the beginning of web 3 as a dream, right? But so far all the solutions that we've seen have been pretty centralized. Can you give us an overview of uh what the ecosystem looks like? >> Yes. So I think what's interesting is actually going back before even decentralized identity as we call it today and looking at the history of digital identity taking a step back to open ID connect. Uh originally the design of that was meant to be more decentralized because it was um well uh it' actually technically be referred to

as federated because the goal of it was to be able to allow bloggers to be able to authenticate between their different sites so that they could add comments within their systems. So the original design of a lot of these pieces were designed in that sort of way. But what happens typically is that centralization is easier to implement and it allows you to provide better security controls and so the actual implementations themselves ended up going more towards a centralized approach and and creating like natural hubs of of centralization over them. So >> like sign in with Google and sign in with Facebook and kind of all the likes, right?

>> Yep. Yep. and education. And you know, the the main problem that really kind of drove this was actually enterprises doing single signon systems within all of their services that they wanted their employees to be able to log into. So, it's kind of really trying to take that concept further today, but do it within a more decentralized approach because what motivated the concept of of DIDs actually came back to web payments. Um, so one of the problems that was encountered with web payments was that it was built on an email. Well, if you, you know, lose your email address or your email address gets uh hacked, then you're able to basically steal access to the web payments. And so that's where we needed a different identifier. And

that's where the creation of the uh decentralized identifier specification came into play was creating this kind of alternative method to be able to control access to the identifier used for web payments. These days it's doing less of that and it's kind of expanded into many different areas but it's kind of that same concept of understanding the underlying aspect of the identifier itself. >> If you kind of look at the market segmentation today when people are on the internet what do they actually use to identify themselves with?

>> It all comes back to the email. What I find very interesting about this is email is actually a decentralized protocol by design. Um, if you look at the design of it, anybody can set up their own domain and anybody can send an email to anybody and anybody can run their own email server in the same way that anybody can get their own public key, anybody can run their own um blockchain node and anybody can send payments or assets around on the blockchain protocol. What's interesting is wondering how did we actually centralize email? Well, it really comes back to you look at Google, you look at Microsoft, you look at um Spamhouse, they were all trying to address the problem of spam protection. Well, they ended up winning out because they provided the best spam protections and

by doing that, everybody decided, hey, let me go use it. So then their implementations within the protocol naturally created centralization because if you couldn't send an email to somebody using Gmail, then you stopped running your own server. You just had too much maintenance headaches and and managing it yourself. And that created the natural centralization even though you could be doing everything in a decentralized way. >> Yeah, that that makes sense. Um I'm sure there's economies at scale here, but kind of they tape off, right? Kind of like whether you kind of scan 50 million emails or 500 million emails kind of at some point kind of your spam detection doesn't get any better. So, if kind of spam protection is the bottleneck, how many disjunct email services do you

think we could have? Or could Gmail kind of offer a plug-and-play spam filter to kind of run locally on your on your own server? How how do you think kind of we could uh we could end up in a much more federated email system? So I think this is one of the things that I'm still trying to figure out what the answer is. I read a good blog post recently and I can't remember uh who it was by but one of the things that they pointed out was that naturally over time as you add complexity you you will centralize because you gain a certain level of expertise and that node provides better guarantees than everybody else. So as you address more and more problems, fewer and fewer

people can participate and do it at a high quality level. >> Um, and so naturally, you're going to create these sorts of things. So I think the idea that you're exploring there >> is how can you do this like adversarial interop type uh plug-and-play approach where you create the openness of the protocol such that anybody can just go by instead of having to build it themselves. And then that pluggleness is what keeps the network more decentralized by design. >> So Brave was founded in 2015 by Brandon Ike and Brian Bondi and kind of the original mission was very much kind of to build a privacy first browser. How do you think that vision has held up over

the years? I mean it's been 10 years, right? >> Yeah. Yeah. Well, I think uh the numbers kind of speak for themselves. We actually just uh announced today that we have 100 million monthly active users. So, you know, the vision is is growing and it's growing. Um, you know, you can look at our growth rates to see how many more people are kind of moving in and what are the advantages of it. A lot of people don't think about privacy in the sense of like, you know, privacy nerds like myself do. They think about it in a practical sense of like, hey, I don't see ads on YouTube. That's kind of nice. uh like that's literally one of the the number one features, but behind the scenes, what they're actually getting is canvas fingerprinting protection, shields built in, all the different, you know, capabilities that we have. We have

a built-in VPN to be able to to do IP address blocking, proxying of services behind the scenes, um you know, like when we have to communicate with Google safe browsing services, we're proxying those communications. All of these things are things that people are getting by default because we care about making sure that people have those those capabilities built in um from the start and so we bring them in with the no YouTube ads but along the way we actually help everybody um to get better privacy on the web. Why do you think people don't care about priv I mean there are people who care about privacy right but the by and large the majority of people don't care at all right even for things that are clearly

exploitative in some sense so um people using Gmail despite the fact that kind of proton mail offers exactly the same service and is free also and kind of why do you think kind of like this privacy has to be shoved down people's throat votes. >> I think a lot of it comes back to what I refer to as the power user problem. Um, >> so caring about privacy requires toggling and changing a lot of things in a lot of cases. So that naturally comes into um the picture of I'm a power user.

I know how to go in. I understand what those toggles are doing and I configure them. Um, so this is where I think defaults come into play in a lot of cases is knowing that you get it, but that somebody else is taking care of it for you. Um, you know, going back to the email example, I could run my own email server today. I'm technically capable. I understand how it works. I could probably figure out ways to bypass the different spam restrictions that come into place. But my time is worth money, you know, like my time is worth the ability to, you know, have the the meme of touch grass. You know, I like to go out and I like to play golf and stuff.

So it's a choice between do I want to go play golf or do I want to manage my email server. So when you come into those sorts of restrictions I think that's the reason that so many people end up defaulting to that well I'll just pick the easy and convenient thing even if that means that you know I'm giving up some of my privacy or making some other trade-offs in in some sort of way. So, um, in that sense, I think that's where it comes back to, you know, the maintenance headache is really what it's about. And it's not about people not wanting privacy. It's about, uh, people wanting it as long as it's convenient.

Still, >> would you say that Proton Mail is less convenient than Gmail? >> In my experience, no. >> Billions of people use Gmail and uh, millions of people use Proton Mail. It's the the vertical integration that you know that you see with Google that you see with M Microsoft their ability to integrate their different services together to make them all work. I think that gives them a natural network effect that creates kind of their their walled gardens. Um and slowly over time everybody hits a friction point. Like the reason that I switched from Gmail to Proton Mail in the first place was actually because my free me Gmail account hit the 15 GB limit. And I was

like, well, if I'm going to have to pay some, why not just pay an extra $2 a month and I get, you know, free drive, free VPN, free Proton Pass. Like, I ended up saving money because I dropped my Last Pass account. I'm not paying for the Google Drive. I still get email. And so like the net benefits that I got from Proton Pass were better as soon as I uh kind of uh used my way out of the the free part of the the system of Google. >> Okay. Yeah. Initially kind of the idea at Brave was also kind of that attention should be monetized, right? Because kind of like every time you get something for free, you don't really get it for free.

you're kind of being squeezed in some way that you can't immediately tell. And kind of the way that Google does that, obviously um is it kind of it it data farms you um and then tries to sell you things or have other people sell you things. In 2017, Brave kind of did this ICO, um, the basic attention token, BAT. Um, and kind of the idea was that if you choose to kind of be data mind or look at adverts and so on, you would be compensated for that, right? Um, te tell us about what the idea was and how that has evolved over the years. So I think where you have to first start is back at

the economics of why did we go down the advertising path in the first place. What it really comes back to and some of the things that you see argued by Google within the web standard space is that the advertising model actually creates the open web. If you had a pay wall at every single site that you had to show up at, you would create a friction point where I have to decide do I want to spend a penny or not every single time I I visit some site. the advertising model has created that. But along the way, it's also meant that we need better targeting um because that's what the customer was demanding. The advertisers are demanding the ability to know that they're getting, you know, as as good a value from the dollar as they can. Um so that's the advertising model to

understand. And then what we looked at was okay, how do you make sure you maintain the open web, but you do it in such a way that it's actually privacy preserving. Well, we know that the advertising model works. It funds the entire open web today. But to achieve the privacy preserving principles, what we started to look at was, you know, how can we do this directly within the browser. So within the browser itself, we're able to do these confirmations where we can basically send the entire advertising catalog down to the browser and then the browser can do the selection of the ad advertisement and then using zero knowledge proofs um built on a modified version of the the privacy pass protocol, we're actually able to do the confirmations um to be

able to say yes, this ad was viewed. So then the question becomes okay so we've got the advertising we've got the the privacy model how do we incentivize users to move into the system well eventually when you are like thinking about the economics of this again the only way that you can go if you've reached the point of free is to start paying people and subsidizing them. Um so that's where kind of this this uh split model comes into play is that you know trying to take into consideration the equity and um the alignment of this but also taking into consideration the competitive advantages that can come into play. So I guess essentially what it comes down to is this is a natural

evolution of maintaining the open web uh and doing it in an economic way but also making it so that it's user first so that users can choose to opt into it if they want to and and so as soon as you try and tackle all three of these hard problems at the same time that's kind of how you end up on on this sort of model. >> How well do you feel it's working? because kind of like there's tens of millions of users who use Brave. Um, but there's a couple of thousands of websites that use uh BAT for for incentivization. If you look at how much you actually get for watching an ad, it's tiny, right? So, kind of to me kind of like I'm a Brave user. I use Brave as my primary browser even on mobile where it's gotten much much better, by the

way. Um but um uh kind of I've I've only watched kind of ads for test purposes. You you get such tiny amounts kind of like 0.005 cents or something. What do you think the challenges here? >> I I think you're hitting at the heart of the problem. Um this is a very tough problem. So first of all, excellent question. The way that I would address this is I think it comes down to who you're able to attract as advertisers makes uh the value of how much you can return to users a big part of it.

Something that's like not well understood within the advertising space and within that that vertical is that Google basically controls this entire market. you know, that was a big part of this antitrust case that came into play um is, you know, how do you create these sorts of um restrictions around these national monopolies and stuff? And so, um with that, you come into the question of like how do you attract in new advertisers and how do you, you know, make sure that they want to buy these different ad units? You know, they're used to selling search ads, but when you go in there and you say, "Hey, we've got this other type of ad unit that's built directly into the browser. Are you interested in it?" And then you also come in and say, "Oh, by the way, we can't give you cohorts of data about the

user because we're just doing that all locally on the browser and we're not sending that back." You run into this kind of restriction around capabilities. Um, and so what we've seen is that there's a certain number of people who really kind of get it. Um, and then for some of the the other companies, it's become a little bit more restrictive. So oftent times people will complain about, oh, you know, Brave is is showing me all this crypto stuff. I have um come to think that a part of that is because the crypto industry really understands this ad unit and understands the value of it.

And so because of it, you know, when we're dealing with a new tab page um advertisement, they're interested in it because they understand that there's a lot of people within the web 3 space that use Brave as a browser. Um, and so then they're able to attract people to their products and services based upon those things. Theoretically, it doesn't have to work that way though. I mean, Ford has been able to use these advertisements and and um been able to expand on it because they've understood it. And so, in that way, I think it really comes back to understanding that so that you can drive the value into the ad unit so that you can return more value to it. Because that's the the thing about the design of the BAT token is that, you know, we're doing essentially a a revenue share agreement

with the user. We're taking some of what we earn and we're passing it on to the user. So, as long as the value of that advertisement can continue to go up, then you can continue to pass that value on to the user. >> You think kind of like the crux of the matter is the the address of a market that's not quite uh ready for this yet? Because kind of like if I think about myself um I'm in principle I think I'm a juicy customer. So say for instance I book a holiday or something. If I were to be able to kind of selfescribe myself and say um I'm a 39year-old German. I'm a mother of four kids. I like going on holidays and I'm somewhat

price insensitive. um I'd like to go somewhere where the sun shines and uh where I don't have to be on the beach all day, where I can go on a hike or something. In principle, kind of this is this is something that um that's information I would be happy to dulge about myself if it led to a um targeted advertising where I'm not pitched things I would never consider going to and b uh if if I were to see some of the kickback here. um that would be even better, right? How much do you think we can modularize this and I'm sure there's probably an AI play in here somewhere.

>> Yeah. Yeah. I mean, you're already seeing it from everybody um on the AI space, but I'll cover that in a second. Um I think it's better to talk about like what we're actually doing um right now which is like um essentially we've we've pivoted more towards this offer wall approach and being able to to display these these offers directly to users to be able to offer discounts of being able to uh transact with BAT and and do things like that. Um that's been one part of our our consideration for this. We still have the ad units that are in play as well. Um but it's it's basically trying to figure out how do we add utility um to the model such that it's it's still coming back to that. Um

so I think that's the the first thing to understand is like how do you create an ad unit that is more attractive and I think what you highlight there is exactly um the theory that I've heard um uh promoted by Doc Surles. Um it's a a concept called vendor relationship management. He's had this for I don't know at least a decade. But it's basically to be able to intent cast and like what I mean by that is advertise to vendors. I'm interested in buying this. Can you compete for my business to offer me a better uh offer? So, you know, say for example, I say, I'm interested in buying a pair of shoes. Then Nike can go, hey, I'll offer you a 10% discount for buying my Nike shoes. And then

Adidas will go, I'll offer you a 15% discount for buying my shoes. And >> I love this. It's kind of it's intentbased advertising. >> Yes. Yes. It's exactly that. And so I love the theory behind this. Um, and I think that's kind of the vision of of where we're kind of moving towards with this offer wall approach is being able to do this, but doing it in such a personalized way that like you don't need to advertise your your cohort of information. kind of like the um uh the flock-based approach uh that's being uh tested out by Google Chrome. Um essentially what they're trying to do is they're trying to advertise different um three different flags or interests um to the site uh or to the advertiser and

then the advertiser chooses an ad based upon that. And the unfortunate reality is that um three interests are roughly enough to be able to still singulate or like isolate who you are and and uh identify you in some sort of way just based upon the probabilistic like bit entropy of this. So like to explain that a little bit higher level so that people kind of pick up what I'm saying. Um, if you were to take somebody's name, uh, date of birth, and their zip code, the likelihood of being able to, uh, figure out who that person is, comes down to like a 95 percentile, uh, capability.

You know, just by taking, you know, three pieces of information about them and combining them together, you know, that's just the way the math works. So, I think that's a big part of the question. Now to get to your your question about the AI side of things, I think this is where everybody's still exploring what can what can actually happen. You know, there's there's concepts uh that are coming into play with advertisers or or people who are creating rewards based systems uh wanting to have their ad shown within the actual um LLM and within the chat bots and stuff like that. And so we see advertisements coming into play in that sort of way. Um, one of the struggles that you're going to run into though is that essentially you're going to run into this rag model where you're

augmenting the actual uh chat through context of the marketing data itself. And so then how do you know that um what's actually being presented from the chat interface is not just marketing material um and that it's it's unbiased in some sort of way. And so I think this is one of the interesting questions that I'm trying to keep an eye on what people are doing with this because you know part of what happens when people are leaving search and and going to more of these um chat LLM approaches is that the advertisement potential number of advertisements you can show is actually going to drop over time. So that may be an opportunity for us because we're already kind of like repositioning the

entire advertising market in the first place because fewer people are visiting sites and you know more stuff is being done through the actual like LM and and chatbot interfaces and in that sort of way to an advertiser they're looking at going hey our previous ad units that we were used to being able to buy through Google AdSense and stuff are already being replaced. Maybe we should go consider exploring some of these ones that are happening in the browser. you know, the new ones that are coming out through the LOM. So, >> yeah. And I mean, we already see this that kind of SEO is being overtaken by uh GEO, so kind of optimizing for generative uh uh LLM. So, uh yeah, 100%.

Um I think kind of like part of um part of the appeal to me um is this zero knowledge component. So, in principle, I don't object to being advertised to, right? So, kind of like if if um I say, okay, um I'm here and I want to buy an buy a holiday. Um kind of I want a direct flight. Um I wanted to be somewhere somewhere warmer than here. Um and I want to be able to see an elephant. Um kind of this is kind of in principle I'm inviting people to kind of send me offers for that. What I object to is the fact that this goes into a um a targeted a targeting brief about

myself. Okay, this lady is is willing to drop um a pretty penny on a nice holiday. So in in in the future kind of target these things at her. And I think a lot of this can be solved by um zero knowledge technology. tell tell me where you are at there and kind of where you think um this is going to go. >> Yep. Um I think the way that we've constructed this system works quite well for this because you don't need to share the information to still get the personalization. So in concept essentially what you can do is be able to utilize the interests of things that are happening within the browser to do that classification and matching all

client side. So if you have the entire list of of potential ads and they've already been tagged as related to a particular topic um then you can essentially still do that that intentbased um model but do it all client side directly within the browser itself. Um so in that way like you're just changing the information model first such that you don't even have to share the information. Um and then the zero knowledge comes into play to do the confirmation aspects itself. And so I think that's what's more interesting about it is rather than going down kind of Mozilla's exploration path where they're trying to do all of this inside of um trusted execution environments and and still sharing the data itself,

modifying the information model is the the best answer here because the best way to guarantee your privacy is to never share the information in the first place. >> Yeah, 100%. Um so you guys have branched into offering a wallet uh which kind of also comes handinhand with um kind of having to store the that token somewhere um and talk. So how how do you connect all of these dots? >> Yeah. Um, so a big part of it is what are the features that people want to use on the web today and how do we build them such that they're uh user first in principle. Like that is the guiding light between all of our different product features and and capabilities is is really how do we do something that

focuses on the user and addresses the user's needs. So when you look at the wallet, it's essentially exactly that. We see that where the the web is going is that we need payments. I mean, this isn't new. Like the the first attempt of web payments is like PayPal if you think about it. Yeah. >> Um, you know, and then PayPal was kind of the first generation and now we've seen that we've got, you know, the Stripes and um the the blocks or Square uh as kind of the the second generation. Um, you've also got Google Pay and Apple Pay that have fit within this and and now crypto is kind of the third evolution of this. Um, so really we're we're addressing the same user need but we're doing it in a slightly different way. Um, so that's kind of where uh that comes into play is uh you know what's

slightly different? Well, it's designed to be more open. It's it's a permissionless system by design. Um, with the current design of of like you know the stripes and the PayPals and stuff, one of the biggest headaches that we run into is kind of the compliance factors and the regulations that come into play because uh traditionally you've had to extend the banking uh compliance uh regulations into these centralized providers. But when you're doing peer-to-peer payments, the application of the laws just doesn't quite work in the same way. Um, and so that's, you know, how the wallet comes into play. And, you know, it's the same thing with kind of the talk thing is like people are inherently social. They want to get together and meet. You know, we're we're on a video call right now.

Um, and so in that sort of sense, it's one of those things where you're wanting to interact with people. Um and so how do you make sure that that's happening in a way that uh is addressing their needs? So like some of the things that um we built into talk that was a little bit different was um NFT gating specifically around your community. So you know technically an NFT uh community could basically build a web call that you could present your your wallet itself to be able to show the capabilities of logging into the actual talk. So, like let's say I owned a um uh what is uh the well-known um NFTTS uh the Crypto Punks. Let's say I owned a

Crypto Punk and it was meant to be an online meeting of the Crypto Punks. Um I could present and and sign a message that shows, hey, I own a wallet address that owns a Crypto Punk. And then I'd be able to have access into that gated community because of the NFTts I own. And so a lot of this comes back to how do we build social communities and and build capabilities that the users actually want to be able to do what they're already doing today on the web? H >> how how do you tie in the wallet with um the identity? Because in principle identity is really touchy and privacy onchain is hard and kind of connecting everything then also with kind of this

monetary layer. How do you see that? >> To put it quite frank, I think we're doing it wrong right now in the web 3 space. What I mean by that is privacy is inherent um because what it grants us. Uh it is a means to an end. Privacy is a way to be able to achieve greater control over what you present to other people. Um similarly so uh so I I oftentimes refer to that as agency. Um I have the agency to be able to determine these things. Similarly, so you want to be able to uh segregate certain aspects of who you are and who you share with people. As an example, you know, I enjoyed golfing. Um when I go talk with my friends who are talking about golf, they don't have a clue about what I do

for work. That's that's not because I can't share that with them. It's because like it's not a point of common interest. Um, and so in in that sort of way, it's just kind of rebuilding um the capabilities that we already have today within normal life digitally. And I think that's where we get this wrong is that today on, you know, in the web 3 space and on on chain, we're actually assuming that everyone wants to share everything about them. Um, the reality is though, there's a lot of dangers to that. Um, and also that's not very well aligned with kind of just how things work. One of the things I love to point to is um you know the business aspects of this. If I'm a business and I'm receiving payments from all of my

different customers um I don't want it to be known like basically my real-time revenue data on chain like that's just that's financial intellectual property that I just don't want shared. So if the chain shares that by default that's a problem and I'm not going to want to use it. Um similarly so uh I don't want my c competitors to know who I'm um like buying my supplies from. You know if I'm buying from a service provider or I'm buying ingredients for a restaurant or something like that and I'm getting it for a certain price because I've negotiated based upon wholesale discounts and stuff. I don't want that to be public information. You know that's my competitive advantage is being able to produce at a cheaper rate and

being able to do those things. Similarly, so you know, if I'm paying my employees, um maybe I don't want the employees to know how much I'm paying the other people that are working there. So, this is all onchain data that's existing. Um and as long as you can link that data back to some realw world person, then you're basically creating a problem for yourself in some sort of way. And and that's the part that we can't really understand today because it's an emergent property of the data that exists. Um so that's where it becomes a headache like uh looking at the the web two space as an example in the advertising model. Um today we talk about data. Well, what is that actual data? Well, it's behavioral data. We

want to know what people are using. Uh what YouTube videos they're viewing. We want to know which sites they're visiting. That's what a third party cookie is doing. So, we're building these behavioral profiles of these uh people and then taking that behavioral profile and then using that in order to target them with advertisements. How would that work in the web 3 space? >> Well, essentially what people will do is not just the behavioral data, but also the economic data. So, I know where you're spending your money, not just what you're viewing. >> Um, and I'm taking that information and I'm building a profile around you. And then I'm going to airdrop you an NFT as an advertisement. That's the the world we're creating if we don't do stuff as a private by default system.

>> 100%. So kind of I see the um transparency that you have that we have on blockchain. Um this is not compatible with um a um with consumer behavior that I would want to endorse um at all. Um how do you fix it? I've got some ideas. Um, I can't claim that they're perfect, but they make sense to me and I think it's time that we start experimenting with them. Um, some of the things that I think uh should be done is within the wallet itself, I think the wallet needs to act essentially as a user agent on behalf of the user to provide the that privacy capabilities in the same way

that our browsers do today. So, our browser doesn't advertise our browsing history to every single site that we visit. the browser makes certain choices in order to try and protect the user on their behalf. I think it's the job of the wallet to be doing the exact same thing. So protocols are getting built in order to try and do these sorts of like private transactions rather than expecting the user to show up at the uh you know privacy pools protocol and and you know integrate and and make sure that they're swapping all the transactions into privacy pool themselves and then you know jumping over to the next site so they can actually spend the money and and you know jumping through three different sites. that should really be the responsibility of the wallets to integrate those features directly in so

that it's just happening on their behalf. Um why does this matter? Well, when you start factoring in things like what's happening with X42 protocol, uh wallet pay um and basically the ability to transact automatically through microtransactions. All of that is going to be linking um your browsing history on chain in some sort of way. So, say for example, I'm showing up at a news article and I'm reading a news article about some topic uh and I paid for it. Well, that's being advertised on chain because I made a payment. Then I show up at the next website and I do the exact same thing and then the next site and the next site and the next site. All of a sudden, the behavioral profile that we just got done spending like 10 years trying to get rid

of with thirdparty cookies is now permanently on chain until the rest of time unless the user figures out how to stop the foot gun by switching accounts every single time and and having to deal with the burden. So, you know, going back to that conversation that we had a little bit earlier of like privacy works when it's convenient. That's where I think it's the wallet's responsibility to solve these problems for the user. A lot of these um problems can already be addressed. Um it's a lot harder to kind of do so with um smart contract wallets which are preferable for other reasons, right? So kind of if you have an EOA um kind of privacy pools and it's it's it's much simpler than doing the

same with a smart contract wallet. But then kind of you you lose recovery and I mean in principle on a smart contract wallet you would want to have it such that um the the private key never actually leaves uh the the enclave. Um you don't actually have to f seat phrases from one place to the next. you just kind of add another signer. How do you see this from an um IT architectural uh standpoint? >> Yep. Um I think again it comes back to what do you expect the user to know if the user is expected to understand smart contract logic? uh or even that a smart >> no user you can't you can't expect any

user to kind of understand that right kind of like it it kind of h for the user it just has to work but kind of as the system architect you have to think about it right you have to think about kind of like can can I still kind of have recovery in some sense um kind of with an EUA or do I go smart contract and then kind of deal with kind of all the headaches that I have with privacy pools and the like um and where where as an IT architect where where would you fall on that spectrum. >> I think more of it needs to be done on behalf of the user by default, but they have the option to opt out when necessary. I think that's kind of the the user first principle that I would take. So, as an example of of how I

think about this as a as a toy today is if for example I wanted to send money to somebody privately from one chain with one token. So like let's say I have USDC on uh ETH mainet and I want to be able to send USDT uh on Salana. Um it it introduces a lot of complexity. So how do we make this work? Because a we're talking about two different smart contract systems. We're talking about a swap and a bridge that needs to occur. We're talking about different tokens. Uh and we're also taking into consideration the fact that the site which is probably like an e-commerce website really doesn't have web 3 expertise. So they're not going to be formatting that transaction for you in the first place.

So how do you make that work? The way that I think about this today is that like essentially the abstraction at the RPC endpoint of the wallet. So you know window.ethereum.est where you're actually the site's actually making the request needs an intent API built into it. we need to be developing highle APIs where it can say hey send some money to me uh of $3 uh in this amount um on this chain and you know maybe I provide three different things instead in the same way that when you're using a F-POS system it's like it's it's saying I'll take Visa or Mastercard I don't really care just pay me the money um so you you do that and under the the wallet is where all the

complexity is hidden the wallet takes that that RPC call that's being made to it and it goes goes, "Great. I could build a 5792 transaction that performs a swap and a bridge all at the same time and performs it through a privacy protocol so that it comes out on the new chain in the proper currency at the proper amount and it just ends up at that address. And then you send back as a response to that async call that came in from the site, here's the transaction hash on the Ethereum chain and here's the transaction hash on the Salana chain so that they can verify that the transaction actually occurred and once that happens then they continue through the rest of the business flow of the logic. In that way like the site is doing what it's an expert at which is

selling goods and services. It doesn't have to care about the design and formatting of transactions that are being sent to the wallet. Um, and you know, the wallet is acting as responsible um, partic uh, participant within this system, helping the user to make sure they understand what they're actually doing to be able to send this money um, to the site at the end of the day. >> Yeah, that that that makes a lot of sense. Do you think we'll continue seeing browser plug-in wallets in the future? Because kind of like to all my nonw web 3 friends, browser plugins seem really dodgy dodgy kind of as ways of kind of keeping money kind of go.

>> Um I think it will happen until the browsers decide to get into this layer. What I mean by that is part of the reason that web 3 continues to exist is because web 2 has not taken an interest in this space. Google and Apple, they're not playing in the crypto space. You know, they might have small teams that are operating in this stuff. Um, but the stable coins might change that. Um, you know, kind of the new legislation that's coming into play, like they're very adverse, you know, in the same way that like Google watches what we do and sometimes they'll copy some of our ideas. Um it's the the same thing that's happening uh you know within the entire web three space is when they feel like there's a legitimate use case where they can make money within that business

they'll get into it in the same way that you're seeing you know Stripe who started in the web two payment space and decided to get into web 3 payment space they're doing the same thing because they see advantages or they see that you know web 3 is starting to eat their lunch in some sort of way and so they want to make competitive play to to try and stop those sorts of things. So I do think that the browser um serves a role within this and I think this is why Brave is kind of early to that game um of showing what's possible especially when you start looking at you know X42 design where you actually need to understand the HTTP headers. Well, the extension doesn't have the easiest capability, you know, and and part of what we do within our design principles

for this is like we're not going to try and sit here in the center and and intercept every single communication. Like technically, we can do that with extensions today. We could be intercepting every window. Ethereum request and making sure that our wallet appears instead of MetaMask. We've intentionally not done that because that's not user first. That goes against our principles in that sort of way. So I I do think that there is a role that browsers play within this whether that's just simply at the security key management layer so that there's a competition that can exist between the different extensions or if they decide to vertically integrate further and kind of take approach more like what Brave has done of of building it directly within the browser to offer better security guarantees because we can

operate within the the browser process and be able to have a greater level of control over what happens with the memory and stuff. So I think it'll happen but I don't know when. >> Okay. >> Brave Brave is built on on Chro Chromium, right? Um like most modern browsers. Um do you see risks in relying on a Google maintain codebase here? >> Um no because like we have some advantages in that um like we evaluated different different aspects that came into play. I don't know if people know this, but originally I believe um this was before uh I joined Brave, but I believe we started on Gecko and tried it

and realized that there was actually limitations to building on the Gecko engine, which uh for people aren't familiar, that's Firefox. Um we pivoted away from that specifically because the Chrome uh model is is much faster moving. they integrate a lot more features and part of the the trouble within the browser space is most web developers are typically only building their websites to work compatibly with Chrome itself. So, the fact that it is an open-source um codebase and we can come in and modify it as we wish, such as turning off flags or um adding new features directly ourselves allows us kind of a competitive advantage to be able to play within this um space so

that we can focus on the things that we think matter most to users while being able to easily just toggle things on and off when necessary. Um so, I think it's actually more of an advantage rather than a disadvantage. And if Chrome decided to uh you know basically close the source of the code, it's not going to just impact us, it's going to impact Edge. You know, Edge is built on this as well. So like you know, just imagine you know, Microsoft and Google fighting that one out. Um so I think the likelihood of that is very very small that that actually happens because the way that Chrome works anyways is they build the open source layer, but then they also have a closed source Chrome layer on top of it.

Another danger that kind of looms is kind of from the regulatory side. I don't know how much you are in the loop with European politics, but kind of here we have the chat control vote that's kind of happening. Well, actually it'll have happened when this comes out. So, it happens October 14th. Um, and Germany currently is the deciding factor. And basically for everyone who doesn't know it would force any application to have a backd dooror to kind of give access to be able to give access to unencrypted um uh message messaging. So I mean obviously that raises really tough questions for the open internet and as

always it's done under the guise of I don't know child protection and what not. It's like I mean when whenever you kind of say I'm I'm pro privacy people going like well do you want kitty poo? like no it's that it's not about kitty porn it's about kind of like you know you know normalizing privacy um so how do how do you see Brave's role in helping users navigate these challenges >> yep I think it comes back to user first by design and I think this is where a lot of these things are in these tough tradeoffs um what happens when a user actually is malicious what happens when a user actually is a criminal you know and and who's responsible for for taking care of that. Ultimately, we're getting

down to the deeper philosophical questions. And what I actually like to do rather than focus on the here and now moral crisis of today is actually look at the history of the past. I think it's much easier to detach ourselves when we look at um history and be able to understand what's happened before to understand how we can apply those lessons to today. Um so the the thing that I like to cite is actually the Inquisitions. Uh so the inquisitions was basically the uh the Catholic Church being able to decide um what was considered uh within the boundaries of the religion. And so as a part of that uh the inquisitions basically allowed for a set of inquisitors to censor um uh concept within the the worlds and the

the different nations that they had influence within. Um that lasted for 700 years. Uh so you know like we just got done in in theory with a much bigger problem uh that that ended about the 1800s um where numerous generations occurred and it modified life as we see it today. So like what I like to point out to is um uh Galileo uh who was right by the way about the heliocentric theory um was considered heretic by the Catholic Church. Um what actually happened with that? Well, Deart became concerned about the impact of this. Um and so he modified his mind body theories because

of it. So what lessons can we learn from this? The the lesson today is our concepts of you know the mind um psychology mental health all of these things were modified because of the censorship that occurred previously and this is what happened you know 300 years ago. there is kind of this like butterfly effect that occurs where had um Deart been able to actually publish his actual theories, we might have a completely different historical record because of this. And so this is the impact of censorship that comes into play today. What I like to point to is actually a historian who I read all of this from. Like I didn't do this

research myself. uh Adah Palmer has done an excellent job of of basically citing all of this stuff and and it's kind of really helped me inform my theories on this particularly just because understanding the history of this and understanding the impact she also points out what we can take away from this and so um one of the things that she points out is most censorship isn't actually effective at scale so you know the inquisitors couldn't censor every single book they couldn't cross a line through every single copy of the book when the printing press came out. Instead, what they did is they utilized the enforcement model of scaring people away from participating or in other words, what we call the chilling effect today to create censorship through self

censorship. So, that's the exact same thing that we'll see with these different uh track controls and and age verifications and things of that nature is actually the goal here isn't to scale the censorship model in the same sort of way. it it certainly will scale better um than you know somebody individually crossing out lines and stuff like that. Um and that is something to be worried about as well is the algorithmic capabilities to censor. Um but ultimately what it comes back to is how many day carts are we going to have where people choose to self censor their ideas because they're worried about uh it not sitting within the Overton window of today's time even though it might fit within the Overton window in the next 50

years. >> Yeah. Uh yeah that that's that's a tough discussion to have isn't it? If you if you look at the discourse, the public discourse over the last say 10 or 15 years, it feels like it's become become a lot more divisive and kind of it relies a lot on self censorship and kind of things that are in my eyes completely within the realm of what someone should be allowed to say. um are in some way

suppressed by society. Um h what what's what's your view on this and how do we how do we um kind of revert this uh uh this development? >> Yeah. Uh so to get us back on topic, I'll tie it back to how it impacts the web. >> Thank you. >> You're welcome. Um so if we consider the thesis uh that Facebook originally started with and most social media platforms started with it's meant to be kind of the town hall of of basically everybody participating and sharing their ideas. So if it's meant to be speech um who gets to decide what is said ultimately it comes back to

there is a inherent social contract that exists between each of us as we communicate you know we all set boundaries when somebody talks about something we may say hey I don't I'm not interested in that conversation or we may change the topic how do we do that online is really what it comes back to what tools are we putting in the hands of people in order to do that on social media media today and who has the power to enforce those sorts of tools. I think Tim Berners Lee in his new uh book actually highlights this very well. One of the problems that exists is the fact that the engagement model and the business model of a lot of these social media websites um are designed in such a way that they create essentially like classification filters um or as he

refers to them collaboration filters. Um, so what that is is basically they build a profile on me um and they see what interests me and what causes me to engage and they represent that content to some other user. >> Yeah. >> So how as a user do I get to decide when I've had enough of that content and be able to enforce that? That can either happen in a centralized way where you know I can go to Facebook I can say you know disengage with these topics. I can you know manually go through and dislike it and try to modify my algorithm in some sort of way or one of the things that I have been exploring is this idea uh very similar to what um blue sky moderation lists are doing is essentially could you utilize you know

ad blocking lists or um some sort of filter lists or moderation lists to be able to automatically block this content client side in such a way that the algorithm sees it as well the user didn't engage with this so I'll stop showing them that content And then what you do is you naturally are going to create more unification within the collaboration filters on these different sites in such a way that um that will prevent the divisiveness because it'll just create this kind of like feedback loop of creating more collaboriveness as people choose to disengage with this divisive content.

>> I like this in principle. I think the fact of the matter remains that people like the divisiveness of it, right? kind of like some people kind of um they relish in this, right? So, kind of because you clearly know you're on the right side. Um, one thing that kind of one measure that I've always been a fan of is um forcing big social media companies to open kind of to offer an API um for other people to kind of uh come in and lay over other sort algorithms. So kind of like for Twitter, Twitter basically has two settings. Um,

one is kind of the for you and I don't know whether that's different for anyone else, but for me that's basically Tik Tok style videos that kind of like I don't want to be shown kind of it's it's kind of the con the kind of content that kind of you have to look at because it moves but you hate yourself for it. So kind of like I don't I don't have this. I don't I don't look at that tab. And then the other tab is following. And basically um that one shows you everything and kind of you want some sort of moderation because I don't want to know every time Reuters kind of publishes an update on something because 98% of them are not relevant to me and I do not want to be shown them. Um so kind of having um some modularity here where

kind of there are plug-and-play systems where I say okay I get to choose choose from these algorithms or I can pay for kind of a premium premium one or whatever. I think this is something where regulation can really come in and do something useful for people because kind of social media platforms are naturally emergent monopolies, right? Kind of like you can't say okay we split up Twitter kind of like you did with I don't know United Fruits sort of thing, right? Kind of like you can't you can't say you get this part of the country, you get that part of the country. it's doesn't it doesn't work because um it it's just much better if more people are on it than kind of like if you have two smaller ones. Where do you fall on that?

>> I think doing it at a regulatory level likely just shifts who decides the algorithm from private to public um services. And so then you're back to the question of do you trust the the public institutions more than the private institutions? Oh, no, no. I want other people to kind of be able to kind of offer these kinds of so kind of I I want to be able to kind of plug in the Kyle algorithm for Twitter. Um, and then kind of I get the Kyle I get the Kyle feed kind of like prioritized by what whatever kind of like your filters are. I don't want governments to kind of take over this part at all. I kind of I just want big social media companies to have to open source this API.

>> Yeah, that makes sense. Um, I don't know. Are you familiar with uh Brave Goggles uh within our search engine? >> And no, I'm not. >> So, we do exactly this. Um we have the ability to be able to uh do what's called boosting and disregarding uh different URLs within the the search engine itself so that you can actually modify your search results. Some people use them, some people don't. There are lists that are being built. Uh we put out some some public lists as well. Um but this is exactly that because in our view, this is userversed. you know, this is how you use a search engine so that you can be able to see it. So like the the best way to explain this is like um you can actually subscribe to a goggle that's for the left and then at the same

time you could turn off that goggle and then you can turn on for the right and so you can view political content in different sorts of like uh biases but you can see it in a transparent way you know like what the results of the engine are and you get to control it in that sort of >> show this out that's very cool. Yeah. >> Much perforced on everyone. >> So this is where I think um I I kind of am worried about that. Uh I worry that uh when governments step in and try and force kind of this uh requirement, there's this subtle push back that occurs between these different tech companies depending on if they're actually willing to participate or not.

So like looking at how Apple's chosen to engage um with uh open web advocacy and some of the um regulations around the requirement to open up uh WebKit and stuff like that. Um you know Apple's been maliciously compliant in the way that they've done it. They've they've met their compliance regards um but they've done it in such a way that's not actually given us the capabilities as users to decide what we actually want. Um and that's because their business interests don't align with it. Um similarly, so you know like what you have to take into consideration is how do you set your defaults? Um how do you choose these sorts of things for the users? Uh because the power defaults still do exist. You know, that's the

whole reason that default screens within the EU have worked well and has helped brave uh is because um no longer can Google or Apple say you have to use Chrome or you have to use Safari on on the mobile devices. Now we create these sorts of uh consent screens where uh or user choice screens where people can choose the browser and um so I think that creates the same problem with the algorithmic uh decision-m is who do I delegate that responsibility to um and you're going to see this natural kind of creation of like some lists are going to be excellent you know maybe I'm the dedicated person who just likes modifying my algorithm all the time uh and I do it for my own needs and then other people come complaining to me I'm

like sure I'll help Yeah, I'll build it for you. But then what happens when we have a business step in and go, "Hey, I'm going to be a full-time person who just builds moderation lists, you know, to protect uh safe search content, and then I'll sell that to the parents." And no longer is it about uh you know, trying to to help people um to regulate the content of what their kids see, but instead it's like, "Hey, as a parent, you have to pay for this." So, uh, you're probably not going to do that because you have a choice of buying your kids milk, um, for the week or buying, you know, the the online Tik Tok algorithm content that, you know, they're seeing behind the scenes and, you know, they'd probably want to eat before, you know, having access to Tik Tok, even though Tik Tok is where we

spend more of our time. So, uh, I'm concerned that it sets up perverse incentives. Um, but in principle, I fully agree that we need algorithmic transparency and we need user choice. I'm just not sure how you do it in such a way that aligns business incentives with that without going down the regulatory approach and introducing kind of secondary effects that we just don't understand yet. >> If you look into into the future for Brave, um say you look ahead five years, what would success look like for Brave?

I think a big part of it is user growth. We need to continue to see that that user growth. Um because you know the more users you have the more that we're able to provide better services, the more engineers we can have on hand to be able to build more capabilities and and more things. Um so continuing to grow in that sort of sense. Um I think is a big part of it. uh diversification of different um products and services that we see generating revenue. So today we have premium services. You know Brendan posts this on Twitter every month when we post our growth numbers. We've got premium services. We do crypto deals.

We've got search ads. Um you know we've got you know many different lines of business and being able to expand in those different ways helps us to be able to grow as a business so that we can focus on you know the user's needs. Um and then with that as well being able to utilize that user growth to be able to go influence what's happening within the tech standards and and those sorts of things today. So you know one of the things that we are very acutely aware of is the fact that we have more users allows us to step into W3C and be able to argue for different sorts of things. You know Google because they own a natural monopoly within the browser space. They also own a natural monopoly on the the direction the web goes. We can choose to turn off features if we

want, but the reality is if Chrome ships it, that's what web developers build against. So, being able to continue to grow and uh continue to get users using our stuff allows us to advocate on behalf of the user more to push back against the way that big tech is working today and kind of force a new competitive uh nature to exist so that um you know, we don't need regulators to step in. Instead, we can actually use um just kind of the natural marketplace uh to be able to compete and force Google to have to change how they act.

>> Yeah. And personally, what are you excited uh to be working on next? >> For me, um I love that the stable coin stuff came about. Uh I want private payments. Like that that is the thing that I care about most is like I want private payments on an open protocol. Uh, as Zuko put it best on Twitter, uh, permissionless private money with Zcash. Um, I want that to be the default for all web 3 stuff. And I want that to be to take the web 3 stuff and come back and meet the web 2 people where they're at and be able to show them the capabilities and and create a competitive advantage so that, you know, the credit card um, uh, natural duopoly

that we have today with Mastercard and Visa are being forced to have to compete against the crypto rails and stuff like that. So to me that's where I want to spend some time. I am also very interested in what's happening with social media. Um how can we help to build these things uh acting as a user agent to be able to improve these sorts of things. So I'm keeping an eye on what's happening in blue sky some of the new challenges that you know they're they're being faced with and how they're approaching the problems and and trying to reinvent it because those are kind of the two big problem spaces that intrigue me but also I think will have the biggest impact on users over the next decade.

>> Uh Roger that. famous last words. Thank you so much for coming on, Kyle. Uh, it's been a pleasure. >> Yes. Thank you very much. I appreciate it.