Curing Compliance Psychosis

Transcript

Yes, my name is Jim Jim. Um, I'm a developer. Uh, we're building Warpto, the crosschain privacy protocol. And, uh, we've been struggling a lot researching what exactly do we do about this compliance issue. uh how do we comply and how do you make sure bad actors don't use our protocol uh and during that research we got some compliance psychosis so I want to go over the technical tradeoffs of each solution and rate them how psychotic or neurotic they are um so first of all what happened I need to that's all right so I want to talk about the chilling effect so there's one case

that probably all of you knows tornado cash uh I'm from the Netherlands and that's where Alexi Perzv got persecuted uh for money laundering and there's also a case in the US as well uh there's also Samurai wallet which is a bitcoin mixer um and uh well these are cases where the government convicted these developers for developing privacy protocols uh and what we see in this space is basically chilling effect. Uh all new protocols and projects live right now have some kind of uh compliance or have shut down or pivoted to something else than privacy. Uh and I want to go into more detail for that.

Uh yeah, and I've observed basically three families of compliance solutions. Uh viewing keys is where uh everyone sees everything. freeze functions where everyone just freezes your money and your money is gone. And proof of innocence, for lack of better term, is basically a blacklist of bad guys. Uh, don't be a bad guy. Prove me you're not a bad guy. Um, yeah, before we go into viewing keys, I would like to just say that viewing keys are not equal to compliance. They're kind of a misunderstood concept. So, most privacy protocols have encrypted messages that tell you here's your encrypted transfer.

Uh, here's how to get to it. Uh, and you need to, uh, try and decrypt every message on the chain. Uh, in order to do that, you need to try to decrypt it with your key. And if that key is, for instance, the same key as your spending key, like for say your Ledger hardware wallet, then you spend all that time on your little USB to decrypt something. uh which is not feasible at all. Um uh right and then we have like two flavors and this is going to be the trend of the whole presentation basically. It's like whether to enforce it onchain or offchain. So like with onchain enforcement you just make sure

that a transaction will never uh um uh skip the policy and offchain you enforce it on the wallet layer. Uh and for viewing keys uh basically uh you inside the circuit ensure that the admin uh will have an encrypted blob for you uh for them to decrypt. So there's no way you're going to get around it. Uh with offchain uh the wallet itself will basically leak all your data to the admin. Um, and if a user disagrees with this, they can fork it out or have some other admin. And this is more customizable and

decentralized. But still, you're handing all your data to an ad admin who reads everything and you're just going to hope that that's going to be okay. Uh so yeah like viewing keys basically need an admin and admins are bad because it's a one central party that uh does everything. Uh so there recently was um one big provider for RSA keys who put their private key as just four uh imagine that happening with all your private transactions uh and then leaking. Uh there's another problem is that once your data leaks, you will never know that that happened.

Uh you you can also not ask your admin to prove that they never leaked your transaction or done any misuse of your of their policy. So it's like completely unverifiable and centralized. Uh and then there's even worse uh solution is freeze functions. Now you need an admin to freeze your uh stuff, but um they can also take all your assets, right? Uh so this breaks everything that Ethereum is built for like credible neutrality, self-s sovereignty.

Um and it has the technical dependency of needing a VU key. Um I think uh privacy pools v2 got around it, but they broke fungeibility instead. Um I won't go into technical details but uh yeah a lot of stuff breaks and for instance darknet uses this you fix it. Uh and then we have proof of innocence and this gets a lot better even though the name gets a lot worse. Um what proof of the innocence is is a zero knowledge proof of a list. Uh so the admin makes a list of bad guys and then you create a proof I'm not on this list. So you're

not going to tell who you are, you're just going to tell who you are not. Um, but a lot of these protocols also need an admin, which is another centralization factor and uh a censorship resistance break. Uh, and there's also finality delay. So the admin needs time to respond. So if I deposit into privacy pools, I need to wait an hour or maybe a day uh for the admin to check what happened. of course uh and there's also some breaks in fungibility uh for privacy pools v2 um but yeah there there many tradeoffs uh and of course we also have the two

different flavors and this is where it gets interesting because on something like privacy pools they chosen for onchain verification of that proof uh and then no transaction can go through the contract which is really great for the devs because they'll be sure that whatever their policy is will never be illegal. Um, however, if they change their policy and make their policy something bad, like uh I don't want anyone who is gay to be on my protocol, then anyone who is gay is basically ruined and anyone who uh disagrees with that has to withdraw and redeploy the whole protocol. So that's why offchain is really cool and this is

something that rail gun does. So this is the difference between rail gun and uh privacy pools v2 and v1. Uh but in this case if you disagree with the blacklist that rail gun makes you can just fork a wallet and you don't need to redeploy anything and the anonymity set connects a heel. Um right and that's also another theme with uh proof of innocence is that the anonymity set fragments. So uh with offchain offchain proof of innocence in real gun the idea is is that you publicly announce for each transaction I'm not on this blacklist and then if

someone makes a transaction where they do not have the proof I'm not on the blacklist uh the rest of the public assumes oh you're probably North Korea you're probably the bad guy. Um, and if you do everything onchain, you have to redeploy the whole system. But if you do it offchain and everyone could just disagree with like a corrupt admin and heal the anonymity set. Uh, oh yeah, here's a little technical uh layout. Um, I'll just skip over this. I already explained. So yeah, let's let's put it on a spectrum of like how compliant is it versus how free how much freedom do

you have? How much privacy do you have? And I put in basically two lines where I draw uh the view keys, admin view keys and freeze functions. I think that is psychosis. I don't think anyone really needs that. Um I I feel like the devs are too uh neurotic about their choices with onchain proof of innocence. I see some use cases for that. I'll get go into that more later maybe. Uh but I do like the offchain proof of innocence uh that rail gun uses. I think that's the most fair middle ground. Um but there's also uh something that tornado cache did. They have a compliance tool and that's simply when someone asks, you

reveal them what your transaction was, what the data was, you give the hand them the keys, but only when someone asks, which is really great for freedom, but that doesn't block abuse enough. Uh, and it also has precedent uh legally of not being enough. Um, but I wanna I want to talk about the Ethereum world computer for a little bit because Ethereum right now is like realigning itself with censorship resistance, with privacy, with openness, uh, with crops. Uh, and Ethereum has been built for like almost a decade now, more than a decade, uh, to be so secure, so decentralized, so freedom enabling.

And I think uh, we need to respect that. uh and Ethereum is completely open for us to build. Um but they trust us that we build for freedom and that we build the right tradeoffs and we build with a nonzero game in nonzero sum game in mind. So I think we need to respect that more. Uh and I also want to talk about what the other flip side is of all these regulations. So we had the chilling effect where we become psychotic about all this compliance but we also have the hardening effect where basically most of the regulation focuses on what control people have

for instance in the EU you have CASPs and MA uh money transmitters they're all focusing on people who have control in the system who have uh ownership of money like centralized exchanges and they specifically exclude a lot of the times the sufficiently decentralized um and a lot in the verdicts themselves uh on tornado cash and samurai. Tornado cashache for instance has control of the UI of the relayers and Samurai with other things they pointed to that as in this is just decentralization theater.

Uh I of course disagree with this like I believe tornado cast and samurai is very decentralized and good. uh but they do see that they do see that as an issue. Uh I don't believe it completely shields me as a developer to be fully decentralized. I I do think I still have responsibilities but it is a good thing to have. Um right so now I want to talk to my uh talk about my solution uh I'm proposing is to do proof of innocence but do it peer-to-peer.

So, previously we would publicly announce to everyone, I'm not on this blacklist, which is great. Uh, but that has fragmentation issues and I aim to solve that by just sending that proof only to my recipient. Uh, and then you have no metadata leak at all. Uh, but that also unlocks a more flexible policy because we have no fragmentation anymore. So, for instance, if I buy coffee at a coffee shop, they might have like a very short list. They might have basically no deposit delays or um inclusion delays. Uh but if I deposit 10 million to Coinbase,

uh they're going to have a bigger list and more they need more time to figure stuff out. That is correct. Um so, I think in that way it's more compliant through its flexibility. Um uh but also no metadata so you have more privacy. Um uh and it is also I believe we can make this adaptable to basically any privacy protocol I've seen today. Uh you can because it's all offchain and on the wallet layer. We can define our own circuits and define our own proofs how to comply uh to these requirements.

Uh yeah, I will skip over like technical detail for now, but you can ask me questions if you want. Uh so yeah, let's put it on the spectrum. Now my solution is on it as well. I made it slightly more compliant than rail gun, but we I do believe it's less compliant than something like privacy pools. Uh simply because um someone could fork the wallet we're creating and change the policy, right? Um so is this good? Is this legal? Well, I'm not a lawyer. I have not studied law. So please don't um trust me on this. But from my why my assessment is

that this is a good opportunity for us uh as Ethereum developers. Uh but yeah there are different parties in this ecosystem have different requirements like a user or centralized exchange for instance users in the Netherlands or the United States it's completely legal for them to use tornado tornado cash without any compliance. And by doing so, they have the best privacy and security they can get. Of course, that there is an issue when they go to a centralized exchange. That central centralized exchange has KYC laws. So, does centralized exchanges need some proof

that they're not part of any uh terrorist financing or whatever. Uh so, I would say for users and centralized exchanges, a peer-to-peer proof of innocence proof is enough. They just need to know this is not part of the bad guys and that's all they need for privacy devs. It's um a probably for me. I think it's good enough. Uh but we'll see. But if it's not uh you can always make it more uh secure by doing something what rail gun does. Uh you can even combine P2P uh proof as innocence proof with the onchain proofs of privacy pools. Uh so like I think in total like creating

these solutions will only make things more secure. Uh but yeah now there's RWA and stable coins and I don't think they I think they need something like privacy pools. I think they need a more robust um gating mechanism that privacy pools provides. So I don't think the spectrum is completely like solved on one side. I think we need multiple solutions uh and see what fits. Uh but for me, I prefer like the most freedom enabling and most private solution I can get my hands on.

Um yeah, that's basically it. If you got questions, uh ask me. Feel free to ask me. But there's one more thing, uh I need to say. Uh a lot of people think that Tornado Cache is already in the clear and they're absolutely not. Tornado Cash is no longer a sanctioned entity, which is great. But both in the United States and in the Netherlands, there's still ongoing trials and appeals and uh yeah, there's a bunch of details. I'll skip over it, but uh yeah, please support Tornado Cash if you can and uh follow them on uh on Twitter.

Okay, thank you. Thank you. Reminder, you can scan that little QR code to add your questions. Uh you will have to sign in with the email that you have your ticket on uh to verify that you are you. All right, first question. Shouldn't our goal be to prevent enabling criminals and scammers rather than pursuing compliance with authorities we don't necessarily trust, such as governments? Uh the question is shouldn't we prevent criminals? >> Shouldn't that be our goal to prevent enabling criminals instead of trying to you know get compliance with these governments?

>> Yeah. Yeah. Yeah. Yeah. I I guess compliance is also a weird word where what are we complying to? I think yeah I don't like North Korea. So absolutely agree. >> Okay. Next question. I see your protocol requires some degree of interactivity, some action on the receiver side. Which problems do you see arising with this? >> Right. Yeah, definitely. First of all, there's encrypted communication you need. Like if Bob has a requirement for his list, he need to send over his list. Then I need to send over the proof and that needs to be encrypted. Uh and then there's also like once Bob has my proof, he wants to prove to the next person I've got money that is not on the

blacklist. So he then has to basically look up the new commitment he got, make sure the commitment he got is not on the blacklist and then also recursively verify my proof and then aggregate that and then send that to the next person. Right. >> Okay. And the last question, how can individual consent fix something that other people decide? >> Yeah, that's that's difficult. Um, and I think like, yeah, that's hard to have a clear answer to, but um, if you're interacting with someone else, that other person might other uh, might also have requirements for you,

right? So, if you're interacting with someone else, they need to consent, but you also need to have consent with each other. So um yeah I guess you could take the example as going to Coinbase again but uh yeah it's a difficult question. >> Okay I guess that is all the questions.