DAPPCON 2025: Porter - Privacy Meets Cypherpunk

Transcript

All right, privacy meets cyberpunk. So, how do these two kind of interact? I actually I've given talks before on the um the cipher punks, including at uh DevCon was one of my favorite like talks that I've ever given. I read every single 1990s cippher punk email. Uh it was originally a mailing list. That's where the name came from. One of the first emails was the Cippherpunk Manifesto. There's actually like three or four variations as they like edit the draft. Um, so if you want to like if you don't know enough about the cyber punks and you want more like history or you just want to see like what they were really like, this is one of it's really entertaining. There's a lot of drama.

They like argue with each other. They're like a very fun, crazy, wild group. Um, so check out that previous talk. Um, I won't be talking too much about the cipher punks today. Actually, I think I agree with the previous speaker Wasim that like in my opinion, it was their movement like in the '90s and it was very cool and awesome and now we need to focus on like what's needed today and so all right I'll continue. So current events probably most of you have seen the photo on the right by now of Coinbase sponsoring the US Army. Uh we also have crypto Twitter popular people who are like very involved in the current events uh with the war going on

and there are also people involved in the situation who are like surviving basically by using cryptocurrencies because like most their bank access is cut off. It's a war going on like it's crazy but cryptocurrencies still work. Even the other day when Google cloud and everything else in the internet crashed, Cloudflare was down, cryptocurrencies were still running. So this is like one set of current events on the privacy specifically. Um there have been big donations for Roman and Alexi thankfully who are going through a big court case about tornado cash. Um and there's one more sort of like privacy cyberpunk news that's happened recently that I want to highlight which is Virgil Griffith

getting a release from prison. He's an Ethereum developer who u gave a talk called blockchains for peace in North Korea at a conference in Pyongyang and upon returning to the United States was arrested for like basically beating sanctions and possibly helping like North Koreans with moneyaundering. That was the accusation. But uh if you look at the whiteboard and you look at the title talk, I don't think he was saying anything that crazy. Um, if you like really were cyber punk, I think you would definitely count Virgil as someone who is actually out there helping privacy in the world. So anyways, creating privacy with crypto. Where do we go from here? This is kind of what I

want to focus on today. We obviously need more cryptography. This is my personal favorite part. I'm a mathematician. You've got all the ZK snarks, MPC, FHE, witness encryption, indistinguishability obuscation. There's even other things not listed here like oblivious RAM and oblivious transfers. Uh there's all kinds of crazy math involved, which I love this part. Uh but that's not what I'm going to talk about today. Uh I think this is all useful, but the question is like what do we use it for?

So I want to get to what are we missing? I'm going to start with the use cases that I think are covered pretty well by the industry and then I'll start getting to things that I think are less and less like talked about and deserve more attention. So number one, private finance. Almost every like cippher punk privacy talk at every crypto event is just about private finance. Banks and governments control like all of your savings. Everyone can see like all of your data on current blockchains. We need private tokens, private smart contracts. Tons of people working on this. um very excited for a lot of those solutions have either come to mainet like last year. I mean Zcash and Monero are like OGs but um Aztec and some of the other ones are all like coming kind

of coming to fruition now which is cool. Anyways, tons of talks about this already. A little bit less popular but still very talked about is private digital identity. Um we all know we're being tracked everywhere. This to me is like the biggest difference between web two and what web 3 should be which is in web two I see web two as being defined by the fact that these like web 2 data monoliths control and own all of your data. The Facebooks, the Googles, they own everything and web 3 should be about like you controlling your data directly and your identity directly. There's been like some hackathon use cases of like ZK identity solutions, ZK passports. Uh

there is uh one really cool project uh that has been doing ZK identity down in Argentina uh that called um well they renamed but they were Cork ID. I forget the new one. Um and so some of these projects are coming along there. There needs to be way more of these types of things if we really want to like replace Google and Facebook. public think of the size of those and then think of the size of the hackathon projects we have and that's kind of the distance we need to cover for digital identity to be real. I think there's enough conference talks about it though. Private internet connections. I think there's been a talk about this here today or later. Um this is probably not talked about enough in terms of private blockchain. So even if

everything that happens on the blockchain is sort of private. Um the nodes need to connect to each other and the users need to connect to the nodes and in extreme situations like this is not easy to like happen. You need to be handle this like very carefully. So, we need to avoid all kinds of trackers, browser fingerprinting. I actually used to work in cyber security. Uh there's a fun website called click clickclick.click where if you go on it'll like you can just drag your browser around and the website will start telling you everything like what browser version you're running, what operating system you're running. Like it just starts telling you things about your computer that you wouldn't expect like websites to know or figure out. And um yeah, so it's pretty entertaining in like a

creepy way that everyone's tracking everything about you all the time. So we need like much more private networking, private browsers, private hardware. I think this would also go a long way towards like crypto user security where like right now we have everyone monitoring every single thing. And then you want to put like your seed phrase with all of your life savings alleged like in theory like we want to move towards crypto and everything is on crypto and then like everyone's checking everything but this one seed phrase or like this one password you need to like keep super private and there have been tons of hacks and like my grandma's never going to keep her password safe and stuff and so we need much better

dedication to like keeping these things private and separate potentially with dedicated hardware, dedicated like browsers or networking I think that would be like much cooler and I haven't really seen that many people working on this yet. Private communications, this gets talked about a lot. Just use signal is like always the answer. Um I didn't change all my my slide points, but um yeah, mostly we just need public key cryptography and then easy to use software is kind of the two big points. So it's not like any crazy math innovations we need. We just need to make it much much easier. So the the famous example is PGP for email which all the cipher punks were using back in

the day but it was kind of clunky to use. So if you like encrypted an email someone else would like decrypt it but then reply all and it would like expose your entire message history which is not like great uh user interface and so and Signal has like tried but I would say it's not that popular even as a crypto industry. We're all using Telegram group chats, which I hate, but for work, I have to be there, I guess. So, I'm I'm kind of complicit and like not pushing everyone towards privacy as much as I should. Um, but I'd love to see more work on like private communications and what sort of like a peer-to-peer networking, especially from these like web 3 social media platforms. I think

they are like in a great spot to try and work on this. Private voting is something I've seen like two companies kind of announcing maybe that they're working on it or that they have like a series A or something. Um I think the current voting process lacks a lot of transparency and accountability. I was looking back in time at just the United States election history, which is where I'm from, and like almost every four years, there's been some election incident that has everyone mad where they're not counting the votes correctly. You know, somebody's cheating on some side. And like ZK verifiability would like make this whole process way better in my opinion and allow people to

like check a lot of things. uh you need just the customizable private identities. So kind of building off the previous thing and then a secure and verifiable voting application which seems like very easy and straightforward to build and so I'm curious like why we haven't really seen anyone do that yet. Private property ownership is the next big thing. So as I like envision how this field needs to move forward, it's like we need to start connecting it back to the real world too at some point. So, uh, if you've ever tried to buy like property anonymously, it's pretty difficult. There's all kinds of background checks and stuff. And so, and then like everything goes into public

records. And so, it's nearly impossible to like buy property, but I'm also referring to like cars or like anything else that you'd like to purchase. Um, things are getting better now that we can have like payments directly from crypto. Um, but I think private real world assets will be a really big field that like Zach from Aztec just mentioned it, but otherwise I haven't seen anyone talk about this too much. Uh, private jobs. This is something that I was really looking forward to. I think there were hackathon winners like a year or two ago and then it went nowhere. But I think you should be able to get hired without revealing your identity. I think you could have like a private LinkedIn would be a really cool situation. you

need some form of like private not KYC exactly but like identity solution and then also provable skill sets. So like digital credentials that you can sort of like prove to people that I have the background knowledge for this job and I prove that I'm not like a complete terrorist maybe or you could even leave that part out if you want. Um, and then you should be able to work like fully an a lot of crypto Twitter people even work like pretty anonymously. Anyways, I know like half the Twitter interns in the space go by like their Twitter handles both like in person online and like inside company Slack channels. Um, importantly there was a ZKYNC uh Twitter intern named Frog Monkey and I never

learned his real name. he was just always frog monkey and I thought that was really cool and we should have like more things like that um where you can get paid on chain, you can work on chain, get hired on chain fully privately. And this to me would kind of complete like being able to really use crypto for like your entire life. So you should be able to use it like for work, for like home, for like communication with friends, for like all your finances, sort of like every aspect of your life should have like privacy baked in. And crypto and like cryptography can help a lot. And there actually like are not

Yeah, not enough projects working on this or like they haven't made much progress. I'd love to see more people trying on these things. Okay, so all that was like a little generic. I'm just yapping. But here's Porter's opinions. I was going to title this section Porter's hot takes, but I think like everybody's like, "Ah, my hot takes." So, and hopefully people just agree with me. And so, none of these are hot takes. And so, it's just going to be my opinions. Cool. All right. None of the following makes you a cypher punk. Giving conference talks about cypher punks. It's number one, just because you talk about them all the time. Like, I' I've read all the emails and stuff. I don't really describe myself as like a '9s cyber punk because like they were they were I'm me. It's not the same thing.

It's different time period. Yeah. Uh corporate blogs and tweets about privacy. Uh these really make me cringe a lot of the time because it's never from the projects that I feel like are actually private. Like Tornado Cash didn't really write too many blog posts or tweets, you know, like we just knew they were private. If you have to write like a a 20page essay sort of explaining how in this technical niche way you maybe add some privacy to your protocol like you're probably coping a lot and like I I don't know it's not enough that's not like the blogs and tweets aren't really what make you a cipher punk. Uh asking governments or anyone for permission to be cyber punk.

surprised this one needs to be said but I have seen some projects doing this and say like oh we need permission from the governments to be able to build these things and the answer is like that's not really true like anybody can write cryptography um I didn't add it to the slide but I should add one more u if you like palunteer you're probably not cippher punk which I surprised that that's applies to several people in this industry u yeah palunteer and cyber bunk do not really go hand in hand. Cool. Uh, another porter opinion, compliant privacy isn't that helpful. A lot of the compliant privacy solutions I've seen recently are sort of it's almost fully

private, but you can sort of prove that you're not related to these other people who might be the bad ones. And so like you're kind of creating these out groups on purpose. And like as soon as you start creating these out groupoups and then they also will create out groupoups like against you probably and I think the whole thing kind of devolves and eventually gets like deanonymized. I think you really want just like full privacy flat out. I think that's way more useful. And yeah, so I'm calling compliant privacy kind of not going to make it.

Uh you should build privacy for people. Uh if you're building privacy for governments or for big corporations, I don't care that much. Um I think like we should really be focusing on things that help like real everyday people. That is like something that I'm very passionate about. And yeah, if your goal is just to help like governments uh do their thing more, that's fine. That's cool, I guess. But I mean, it's not cool to me. it. Um, yeah, I think we should build for people. Cool. Cryptography standards are not to be trusted. This is one of like I'm shocked that more people don't bring this up, but too many people just like

nod their heads with like, oh yeah, like cryptography. Oh yeah, like SHA, oh yes, like RSA, like all these things are like good. Uh, so like we're good to go because the NSA said that this one's approved. So, I don't know how many people know this, but um AES and SHA 256, they are on a standard that was originally called sweet B cryptography. Uh does anyone have a guess maybe why it was called sweet B and not Sweet A? It's because Sweet A has all the best cryptography and NSA kept that for themselves. And so, they kind of gave the second tier of stuff to the public for the public to use. And no one's ever

really kind of questioned that and here we are today. But there's also all these examples from history of the NSA creating backd doors in their protocols and otherwise just being very sneaky about certain things. And so I don't trust the cryptography like standards very much. And I'm a big fan of the next slide which is roll your own cryptography as much as possible. You should just be making up stuff. If you've never built a hash function before, build a hash function. That's a great place to start. I've met um I won't name him, but one of the creators of the Blake 3 hash function, which nearly won the Shaw 3 competition, and I asked him, it was like, "Hey, like you created like one of the best hash functions in the world. Like, what was

kind of your thought process going into it? How did you like get this experience?" And he was like, "Oh, I just mashed stuff together until like I couldn't break it anymore and called it a day." And so yeah, pretty fool cool to just like actually mess around like believe in yourself. I think a lot of people try and like think of cryptography is too much like moon math or like impossible stuff. You have to be some super giga genius to do anything. I think this is not true. I think there's tons of room for improvement in the field. Tons of room for cool new innovations. And this is like the biggest cipher punk mantra is cippher punks write code. And I think that's the the biggest takeaway that we should still do today, which is if you believe in anything, any of the talks you've

heard here today or this weekend, uh write your own code. Try and that doesn't necessarily strictly mean like literally write the code, but contribute in the way that you can contribute whether that's like marketing or business or uh writing the code. Um, however you want, but cyber punks write code. Cool. Thank you. [Applause] Any questions? So on the topic of u combined privacy uh there's uh of course a philosophical aspect about it puristic and a practical aspect which is you know lex if you build like tornado cache without

compliance or even they did something like compliance but wasn't like okay by them and now he's facing jail time. So, how would we deal with this in a cyberpunk way? Okay, so I'll I'll cop out first by saying like how do you deal with this in a cipher punk way? If you read the cipher punk emails, they had all kinds of opinions. Some of them were like super hardcore like anarchists and other of them were like more trying to work with the government. In fact, they did like a lot of big pushes for like legal privacy wins and things. And so there there's no like universal cyberpunk answer. Um, for me I think it depends on

kind of like what do you want the world to look like and kind of what's the balance of power and to me the big threat is like the surveillance states especially with AI are getting like extremely extremely powerful and I feel that like this miraculous and that puts a lot of power in the hands of like a couple small people in the world who control everything and this miraculous technology has come along at the exact same time called cryptography that gives control back to like regular people like you and me. And so I want to work on cryptography as much as possible and give as much control back to regular people. I personally have a lot of faith in just like average humans. That's probably my big philosophy point is that

I think like average humans are great and can make decisions for themselves and don't need to be told what to do. So there's my philosophy. More questions, please. Hey. Um, how do you feel about balancing um whistleblowing and personal privacy? Whistleblowing for what? Um, imagine that you are communicating privately in a messaging app and you say something stupid. Should the other person be allowed to dox what you said?

So there's something called deniable encryption where you can like built-in deny that you've even sent a message which for like certain scenarios can be really good actually for the whistleblowers themselves. If you have like say a really big company and you have some dark secret about it that you release, you probably want to deny potentially that you were the like specific person who leaked that information to the public. Um I'm thinking like Edward Snowden type of situations. And so like deniable encryption can help there. Uh in general like if you're communicating with another party, that other side's going to kind of have that information. And so yeah, you have to be careful with who you're messaging, I suppose.