EB89 – Greg Slepak: The Turtle Crawl Towards Internet Decentralization

Transcript

this episode of epicenter bitcoin is brought you by ledger makers of the ledger nano hardware wallet half peace of mind and knowing your private keys are protected by industry standard physical security go to ledger wallet calm to learn more and use the offer code EB 09 and check out to get ten percent off your first door and by coin cap do with over 500 all point exchange rates updated in real time coin cap is the authority for crypto currency market information all right welcome to epicenter Bitcoin the show it talks about the technologies projects and startups driving decentralization and the global cryptocurrency revolution my name is Sebastian future and my name is Brian Kevin crane here today with Greg

slapback he is the co-founder of the ok Turtles foundation which is a nonprofit that works in the sort of beneficial use of decentralized technology the deaf Inc that sort of comes to mind and that we were recommended to have them on for is DNS but they've they've broadened their focus since then so I'm really excited I've Greg gone to talk about some topics that I don't know that much about thank you for having me and we've broadened our focus for sure but we're certainly still focused on DNS as well so we have we it's not like we've abandoned it we're definitely still working on that I'm certainly glad about that well let's let's get started

with that topic of DNS if that's okay with you and then maybe later we can talk a bit about the ok Turtles foundation in general and also some of the other things that you guys are working on sure so with DNS can you tell some people who are you know technologically illiterate or semi-illiterate like myself maybe slightly exaggerating what exactly the NS is and what its role is in the sort of architecture of the internet today sure there's so much technology out there for for people to try to wrap their heads around so you know not

understanding one component is certainly understandable i have i'm fairly illiterate to how my car functions you know today for example and dns is this one part of one central crucial part that underpins how the internet works it's the purpose of dns it stands for domain name system it's the system that makes it possible for you to visit websites that's basically the a very rough description of it so it's specifically the system that is responsible for converting website

domains like for example twitter com into the digital address of the actual computers that are running it's it's how your computer is able to find those Twitter servers on the Internet so I mean DNS plays such an important role in just how we use the inner everyday everybody uses DNS all the time without even knowing it every time you type a URL and so it's my understanding that so there are multiple DNS servers sort of high-level servers around the world and that for every top-level domain there are also DNS is and so the top-level server is sort of pinging those so if you go for example a doc TV

domain name you know the DNS server that you're connecting to will then go and find a DNS server from the tuvalu islands and you know they'll send you back the IP address is that well I'm surprised you're going into such depth immediately because I do oh maybe we should just describe what an IP addresses first oh no no I think our guests our listeners know what an IP address is yeah well I think it's it's it's worth because I was actually going to ask exactly so the way he talked about it right so what's the role of IP addresses there which is basically write the address of those computers or servers that then either host host a domain or that maybe host on the other

side the users computer or some other destination is that correct so you can think of an IP address as just like the digital internet version of a house address so when somebody gives you your house address they are able to you know give it to people so that they can drive to your place and meet you well on the internet it's very similar they use numbers and when you give somebody an IP address your computer is able to through a series of networked routers find the destination that it wants to communicate with what IP address the problem with IP addresses is that they're very difficult for humans to memorize it's far easier

for me to remember twitter com than it is to remember the IP address the numbers that represent twitter com and furthermore those numbers change so and sometimes they change fairly frequently so twitter com may even you know change the IP addresses throughout the day based on load balancing or from where somebody is trying to contact Twitter so that's why it's really useful to be able to ask what is the IP address for twitter com and then communicate without a dress because the number that you get could be different won't that question what is

the IP address for twitter com that's the kind of question you would ask to a DNS server that's right okay so you saw your computer would sort of have hard-coded in it maybe or your router or something at the address of some of these DNS servers to go there and then ask where's this domain where is this domain where is this domain and that gives it back the address the IP address of that domain then the computer knows we're ready to pain to get Twitter or something at that right yeah and they're not hard coded they your computer gets the DNS servers IP address from your usually for most people from your internet service provider so for example

if you get your internet from comcast you'll be using comcast dns servers but that doesn't mean that you have to you can go into your computer settings and change the dns server IP address to anything you want and so you could use different dns servers right so for example like google has their own dns or you have open dns which sometimes faster than some of the dns is that or have other you know additional features of some of the the isp dns just have you can go in and change those yeah let's maybe pop the stack a little bit because I it's almost like becoming a computer science course or a networking course right now and maybe our audiences like wondering well you know why are we

talking about this what what is sort of the importance and the significance of discussing this internet DNS stuff and I mean what first comes to mind is censorship how an also security so those those two topics play a huge and significant role in DNS and it's why we why we really need to understand these systems and what's going on with them because if I for example in many countries they censor websites and they can they do that through the DNS system so they block Twitter just by making their dns servers refuse to give you Twitter's IP

address okay so but what does that mean if you know Twitter's IP address from somewhere else and you don't have to rely on the dns server to give you that p address you can then still access twitter that's right but in not in all circumstances so I believe in Turkey they were doing something along these lines where they were simply preventing their dns servers from telling people about Twitter's actual IP addresses but if people and so and so you might have seen also images of Google's DNS server IP addresses spray painted onto walls 888 it's very easy to remember number

just 84 times and so people were simply manually changing the dns servers they were using and then they were able to access these websites but in other parts of the world like in china they go a step further beyond the DNS system and actually block the IP addresses blocked communication to Twitter's IP addresses so the issue of censorship I mean it is an issue if you're in Turkey if you're in China or if you're in some part of the world where there may be some insurgency or some sort of protests and the government is trying to regulate and the sensor information that is coming out but in most cases for people living

in the developed world or even in in developing countries where there isn't necessarily like institutionalized internet censorship like in China for instance this isn't really an issue day-to-day but it can be a problem I mean I this is what I want to ask you is how can it be a problem then in in terms of being a vulnerability for just regular people being exploited by hackers for instance right so that's that's the second major problem that can occur with the DNS system maybe can I just so I think sebastes question is

great but i just wanted to sort of circle back here because the flip side of what Sebastian she said does that mean that you know for me living in Germany spending time newer etc does that mean that that first question of censorship is really something that personally I don't have to care about and maybe more from a sort of moral perspective because of other people of political reasons I it may want to care about but like practically it has it doesn't affect me well if it doesn't affect you it doesn't affect you if you care about the fact that it affects other people then there are steps that you can take to help those other people to get around the censorship that

they're experiencing and that's actually something that we were working on as well this sub feature of DNS chain call been block which we can get to but to go back to what Sebastian was saying the second big problem that can occur with DNS that has nothing to do with censorship is simply security issues and these are actually you know fairly significant where people in developed countries or you know in the so-called first world they can the DNS system can be used against them to make them visit malicious websites or simply as a form of surveillance so that that's that's probably a third issue that we should

bring up as well that every website that you visit you know that the fact that you visited that website is being recorded somewhere so that does that happen because like let's say i'm i'm at home i'm using my isp i'm asking them can you give me that IP address of twitter they gave me the IP address of twitter so now my isp knows I went to Twitter and they record that they can give that to the NSA or something is that what you talked about yeah yeah and then there's the problem where your ISP or somebody between you and your ISP could give you the wrong IP address to a website that looks like Twitter but isn't twitter com and they can perform a tax based on that so for that we have a

different system called HTTPS to try and protect against those kinds of attacks and so those are tax herbs man-in-the-middle attacks essentially where you have you and your ice PE or you in the ISP and the server you're connecting to its someone to sitting in the middle and is pretending to be the website you're going to but in fact they're just passing the data through their own system and potentially manipulating it or collecting it right right so just to clarify that so how if I if I was now the ICU someone someone like that how would I go about doing that because I i mean i don't i'm not twitter right i don't have for example

their server code is something so does that mean i would let's say you say bouncy I you wanted to access Twitter and I wanted to do a man on mill attack I would I get your user requests and I would we go to Twitter and and just get there HTML and JavaScript and show that to say vasya so it looks like Twitter but it's actually my and I can change it and then I I feed you responses back to twitter is that how it would work essentially well yeah so let me try to give some more details to what you're saying so for the purpose of this example let's just forget about HTTPS and pretend that Twitter was being served just over HTTP what does that

mean that means that the connections are not encrypted and they're not authenticated these are for for you know the purpose of I guess this is this conversation these are probably two of the most important themes that we should be kind of discussing in and periodically revisiting the two concepts of encryption and authentication so let me just quickly cover that encryption is when you take information that you know a human can read and understand and make it unreadable to them without some kind of a secret that's unknown to them and authentication is when you ensure both

the integrity of the data and that you're actually talking with who you think you're talking to so I can be having an encrypted conversation with somebody but I might not know who that person is I might think there's somebody else and that's and that basically makes the conversation not secure so for a conversation actually be secure it has to be both encrypted and strongly authenticated so but to go to the example where you were talking about men in the middle Inge sebastian's connection to Twitter let's just consider what would happen if Twitter wasn't using HTTPS they weren't

encrypting the connections to their servers all you would have to do is pretend to be Twitter so you could have a server running somewhere that it serves a website that looks just like twitter com you could even be passing traffic back and forth twitter com and Sebastian without even having to necessarily copy Twitter's interface or anything like that and then just reading what's with the conversation you know you would be able to steal Sebastian's password and then hack into his account or you could modify or you could inject like little you know pieces of JavaScript or

something into Sebastian's version of twitter com that could also do various malicious things and to do that you would have to be somewhere on the network in between sebastian and twitter com and so if we're bringing https into this mix so I mean I have a pretty good understand and what you're so if I just rephrase that so basically when you're when you're on a non secured connection even within your own house or when you're at a cafe for instance if if you're using non HTTPS it's just plain HTTP everything that's going out of your computer is in plain text so that includes logins passwords etc and it

then in that case it's really simple and pretty trivial to do a man-in-the-middle attack forget copying the the interface and feeding it back to the person you can just grab usernames and passwords from the from from you know the traffic now when you when you start having https connections that's where i start to you know not understand how it works so can you explain how in an HTTPS scenario let's say Brian and I are in a cafe Brian's men in the middle een me and I'm using Twitter and on HTTPS how would that work I'm going to actually explain how that

would work I would have to talk about public-private key cryptography and do my best to keep it simple basically to actually answer your question in other words so I apologize if this gets a little too technical but I'm going to try to keep it as simple as possible there are two kinds of cryptography one is called symmetric cryptography and the other is kind a symmetric cryptography or rather I should say there are two kinds of encryption I think I think we can assume that people you know you know this is a bit con papas and pop has the cryptocurrency so you know with public and private keys in with Bitcoin I think people are familiar with public and private key cryptography right right so the kind that's used in HTTPS is

asymmetric encryption and here's what that makes possible in asymmetric encryption there are two keys this is these are two pieces of data one of them is kept secret and it's called a private key for that reason the other one you tell anybody anyone who you want to be able to send you a message securely so that nobody except you can read and that one is called the public key so you give your public key which is just a piece of data to the people that you want to be able to communicate with you securely so in this case twitter com would send you their public key and then using their

public key you can pass all of the messages you want to send to Twitter you can encrypt them with that key and then send them to Twitter and that encrypted information can only be decrypted read by Twitter because only they have the private key that's the basic idea but in reality that's not entirely how things actually end up working or rather than that is how things end up working but there is a problem in HTTPS and this is kind of the same problem that happens in all secure communication applications which is how do we get the

public key to the user securely without that key being switched on its way there and that's the basic attack so if I wanted Sebastian to be able to send me a secure message I would have to send him my public key if I send him my public key over the Internet then somebody in between us can receive my public key and send Sebastian their public he instead without him knowing that so when Sebastian communicates thinking he's communicating with me he's first communicating with this man in the middle and so as he sends his message on on its way to me he's encrypting that message with the public key that belongs

to the man in the middle and then the man in the middle decrypted using his private key and re encrypts it using my key and so the man in the middle is again it's as if we were still talking in plain text the man in the middle is able to read everything and he's able to manipulate any of the data right so so neither Twitter realizes that they're encrypting the soft with the wrong probably p nor does Sebastian realize such easy encrypting stuff with the wrong public key until it may look like a perfectly fine interaction where nobody realizes that they're being attacked effectively well so HTTPS is that that whole system is tries to

address this problem but it doesn't do it very well here's how it tries to address this problem it says we're going to create we're going to trust these authority figures who are going to vouch for public keys basically everybody on the internet is going to trust these people these people are called certificate authorities I should they're not really people they're more like entities organizations which can have many people working for them and so web browsers actually ship with the public keys of these organizations built in so they're so web browser might ship would say 200 of these public keys like when you download

a web browser it comes with those keys packaged into it this technique is is referred to as public keep pinning when you pin something you basically ship it with the software so that you have that key already known beforehand and these 200 organizations are so they can actually allow other organizations called intermediate certificate authorities to have the same power which is vouch for the authenticity of some website so when Sebastian visits twitter com there's going to you'll see this little lock icon in the menu bar and if he clicks on that lock icon he can read

about all of the information that I'm talking about you'll see the name of the certificate authority there it'll show that information there if you click on the lock icon and you know view more depending on different browsers do a different ways but they'll all give you some way of seeing what certificate authorities said that this connection was secure and how do they do that the way that a certificate authority vouches for the security of an internet connection is they basically sign a message using their private key and they say and they're able to sign website public keys so twitter com can go to a certificate authority and say please

sign my public key and then they'll be given a document called a certificate that proves cryptographically that that certificate authority said that their public he is legitimate so the implications of that would then be if if you want to do that man in the middle attack but now we have HTTPS in the bold right if I'm the attacker between you and Sabathia I would need to get some certificate authority to sign my public key so I can pretend that I am Twitter to both of you exactly yeah that's exactly it because I guess there are a thousand of them well you know it's not added is totally not unfeasible that

some of them are at some point some of them will be corrupted and particularly if you are a government authority then you'll be able to force them to sign your public keys yeah and you don't even have to force them necessarily you could hack into them and without their knowledge sign a certificate in terms of protecting yourself against this there are different ways that you can do that I believe so we'll talk about about DNS chain etc in a minute but using a VPN you know most people think so i personally use a VPN when i connect on a public Wi-Fi or some like that and i I'm pretty confident it gives me a good level security but now I'm putting sort

of questioning that because if I'm using a VPN potent and I'm using DNS to connect to that VPN that is now a potential vulnerability in that in that connection well DNS so this is something that we should make super clear which is that DNS in the face of HTTPS actually does absolutely nothing for security it plays no role is what I'm trying to say so once you add HTTPS to the picture dns becomes totally irrelevant at least when you're connecting to a website over https because a malicious dns server

could give you the wrong IP address of some malicious server but ultimately if that server wants to be able to man in the middle you they're going to have to get this certificate from a certificate authority that's signed by that certificate authority and show that to you and your browser will be able to verify whether one of the certificate authorities that it trusts signed that certificate so DNS doesn't play a role there and in terms of VPN oftentimes the configuration for VPNs will actually contain the public key of the VPN that you want to connect to so that doesn't even depend on the certificate authority system

and that will secure your connection between you and the VPN but then when you connect to a web site over https over that VPN connection from the VPN to the website it can be man in the middle by a rogue certificate and here's the crucial point that people need to understand when you collect all of the root certificate all of the root certificate authorities these are those two hundred or so that web browsers trust and both web browsers and operating systems ship with these lists when you aggregate all of them and then when you aggregate all of the intermediate certificate authorities that those certificate authorities

vouched for according to some research that some people did you get a number that's over 1200 organizations and you are trusting every single one of those which means that the but you're actually trusting the rotten apple in that group the least trustworthy person and most people have never met these people most people can't pronounce most of the names of the certificate authorities because many of them are in foreign languages that they don't speak and any single one of those if there is any kind of a problem with any one of those if any one of them gets hacked if any one of them gets coerced that certificate authority has the power to create a certificate

that can be used to man in the middle any website on the entire Internet so each one of those that that's too much power to give to so many entities that people have absolutely no reason to trust and if people are wondering has this happened yes this has happened yeah this does sound like an awful security model no I like having any any system where you have to trust 1200 entities that they're all honest that is obviously not very secure yeah not only that they're all honest but that they're all competent I think another really important takeaway from is it and what I tell people constantly is that I mean just forget HTTPS and these certificate

authorities perhaps being corrupted or coerced or hacked I mean the when it comes down to it but people need to realize is anytime they use public Wi-Fi which is all the time they might as well assume their data is being manipulated read etc I mean and I really I mean most people have no idea you know they log into Facebook when they go to a cafe or their email or whatever completely unaware that I think someone may have said some time at some point that like in the u.s. you have two out of three chances of being hacked on a public Wi-Fi well but they fits with HTTPS then

you may still be secure right because I HTTPS reduces the likelihood that you'll be hacked but it doesn't eliminate it exactly yeah and one so they can give like a false sense of security to people because they will see a lock icon a green lock icon in their menu bar and they'll think that they're on a secure connection but as we've just discussed that might not necessarily be the case and there was an interesting article in ventureBeat this week that mentioned the proliferation of Wi-Fi in airplanes and how that's just a hot mess because now you have the situation where potentially for like five six seven maybe ten hours you have hundreds of people connected to this public Wi-Fi network and you know

one malicious person then that airplane could be men in the middle or attempting to men in the middle them for you know that having that extent window essentially to try to attack those people yeah be very careful when you're on an airplane I I recommend against using the public Wi-Fi at least if you're doing anything important let's take a short break so I can take you to Paris I dropped into lab mez on G Bitcoin the house of Bitcoin in the heart of Silicon santi a home to many startups including ledger and I spoke with le clash avec ledger CEO about the company's product philosophy we are taking a very important problem which is the security of the Bitcoin and we really want that all this hardware wallet and security solutions are

available for everyone our objective is that our solutions are running in all the bitcoin softwares and in the future we really see ourselves as the leading company in securing all the bitcoin solutions for customers but also for enterprises we want to be the cisco of the bitcoin with the technology such as the trusted execution environment which is some kind of trusted zone inside the android phone a lot of the hardware wallets will be in fact virtualized and available immediately inside your mobile phones I am pretty sure that we will see this Hardware wallet in fact distributed mainstream has some kind of software

six-year-old package for android phones ledger is building the infrastructure which will provide the best level of security for the Bitcoin industry you too can benefit from this technology and get an affordable secure setup for storing your bitcoins with the ledger nano so go to ledger wallet calm and use the offer code EB 09 to get ten percent off your first order that a fur coat is valid until September 30th of 2015 we'd like to thank ledger for the continued support of epicenter Bitcoin so let's uh let's move on to 22 namecoin and DNS chain can you talk about how these new technologies using blockchain can help solve some of these issues sure so when the blockchain came around this was one

Bitcoin was introduced vacuum around circa 2009-2010 or so some people noticed that this technology can be used to create a secure version of DNS and also fix the problem that we just discussed with HTTPS this one system would be able to solve all of these problems that we've just discussed in these two other systems it can be used to in fact supplant both systems and it's I think far more elegant and what it makes possible is ownership of digital information it makes it possible for the owner of a domain name to directly give you their public key in a

secure way without relying on you know some untrusted third party can you explain how this works sure so I think you guys have mentioned that your audience have is somewhat familiar with bitcoin is that true yeah it's more than that I think that that could be understated an understatement so yes okay well if they're familiar with Bitcoin then they've probably heard the term blockchain before which is effectively kind of how the name suggests a chain of blocks these blocks are chained

cryptographically to each other and they are generated using this random stochastic process around the world which is based on proof of work do you think I should give a brief description of proof of work no no that's fine okay so you can think of a blockchain as a secure decentralised distributed database and when we talk about it we should not we should not we should avoid making strong statements to the effect that there are no third parties involved at all because in fact there are third parties involved in the Bitcoin blockchain that people are relying on

but these third parties called miners actually don't have all that much power necessarily there are some attacks that are difficult to pull off and are detectable called 51% attacks they well they're there they're semi detectable most likely there is at least a chance of detecting it that can actually reverse history in the blockchain so if they start doing that that becomes a serious problem because if they can reverse enough blocks they can kind of rewrite history but what they cannot they they can for example in Bitcoin say if a 51-percent attack was to occur they

can say that a transaction to somebody never happened by reversing blocks this would most likely be noticed because people would see what are called orphan blocks they they're their own Bitcoin clients would tell them that oh this long chain that I had Greg decide where how does that relate to the discussion about sorry sorry I should relate it to it and I mean I think that I think people are familiar roughly 51% attack i think that's but i'm sure okay so what would the way that it relates to dns and https and everything that we've been talking about before is some folks noticed that you can take Bitcoin and

modify it slightly and introduce a new transaction type and this transaction simply says I'm registering a name using this public key fingerprint and so somebody sends this transaction to the block chain and this was actually the very first this feature was the very first fork of Bitcoin and it was called namecoin which allowed people to create these transactions that included names in them so you could say for example i'm going to register ok Turtles dot bit and then your client sends this transaction out to the block chain and that transaction is spread throughout the

Bitcoin network or sorry the namecoin network and eventually it will make its way into a block the miners will look through the previous history and see has anyone else registered ok Turtles dot bit so far is there an existing owner if there isn't then whoever just sent this transaction owns it it's made its way into a block and now nobody else can register it for some period of days until it expires basically so so does that mean you would put in the block the information for example ok Turtles thought bit and then you would put in there an IP address as well so that if somebody wants to go to that website you don't have to rely on a certificate

authority or a DNS server or something like that but they can ask the blockchain well yeah there can sort of more than just the IP address they can they can reply both of those systems that we just discussed putting in the IP address into that transaction replaces DNS and putting in the hash of a public key replaces HTTPS and I'm much more efficient with in DNS because if you can mine a block every 10 minutes and have the new transaction with your updated IP address that's much faster than what most DNS servers will take to update when you when you do a dns change that's right dns traditional like today's DNS whenever you change your dns information

there's something called a propagation delay in other words how long it takes for that change to spread through all of the DNS servers on the internet and that change can often take upwards of twenty four sometimes even longer 48 hours it depends on this thing called the TTL but but yes basically it's very very efficient ok that sounds great but i zoom one of the challenges is going to be how do you get people to use that or can you expand a little bit more on that so it's at this sounds like a superior

design I agree but what's where does DNS chain come in here so that's a very good question the problem with namecoin is that is kind of the same problem with bitcoin running one of these nodes where you store the entire block chain is very resource-intensive and most people aren't going to be able to do that on their laptops or on their cell phones or you know various mobile devices so that's where projects like DNS chain come in and what we started out with with DNS chain was doing something very

simple we said DNS chain will act as a secure proxy to an existing namecoin node and what it will do is simply relay information back and forth between the namecoin node and any clients that ask it and the way we're going to secure it is we're going to say people have to run these DNS chain nodes themselves or have a friend who runs one of them and then tell people what the public key is of that DNS chain server in other words it's a different model from how HTTPS works today instead of trusting the least trustworthy out of over a thousand entities you're trusting

somebody you know somebody you actually have some reason to trust and only that person and for people who can run their own DNS chain servers or people who have tech savvy friends who can do that this works fairly well but it doesn't work well for people who don't have that for people without a friend who can you know a trustworthy friend that runs a DNS chain server they're going to have to similarly like an HTTPS trust someone that they have no reason to trust and you can improve upon this you can say basically instead of trusting the least trustworthy of a thousand entities you can query to separate dns change servers and make sure that the responses match

and that improves the security but we can do even better than that and that's kind of like our future direction with this project is the development of something called thin client protocols so this is something that bitcoin has as well in bitcoin the best wallets that you can find on mobile devices will be wallets that support something called SPV which is a kind of a thin client SPV stands for simplified payment verification it was introduced in the original Bitcoin white paper ones that written by Satoshi and the difference between a thin client and a full node is that a thin client in fact you can think

of these things on a spectrum with a full node being on one end of the spectrum which has all of the information kind of like you can think of it as long-term memory it stores all of the history of a blockchain and then rusted proxy like DNS Gina on the other end of the spectrum which is not a thin client and it just basically you know you have to trust that it's giving you the accurate information the accurate current information in a blockchain a thin client is somewhere in between those two endpoints a thin client has not all but some of the information of a blockchain so it's kind of you can think of it as short-term memory so so what you're working on and that makes a lot

of sense and I think people have an idea of what SPV wallets are is that in the future people could have this dislike line which isn't too resource intensive that they run themselves that then carries the name calling or crazy DNA well do you query a DNS chain server or you query then directly namecoin blockchain so you can have reasonably secure in a retrieve information from there is that how it works well that it could work either way and that's why our next step is to focus not on an implementation specifically but to focus on a protocol that can be used at any

kind of like you know either a protocol that the dns change server speaks or a protocol that full nodes of namecoin or other block chains speak themselves because you can do a namecoin like system on top of bitcoin and in fact there is one called block store that the folks at one name are working on and there are other block chains that support name registration systems as well so what we're interested is working on a generalized protocol that can be used with almost any block chain and various different kinds of thin client techniques today's magic word is turtle T you are tle head over to let's talk bitcoin calm

to sign in enter the magic word and claim your part of the listener reward again this I think this makes a lot of sense right so this is this is a compelling vision for through an internet that would be more secure and more decentralized and where we wouldn't have some of these vulnerabilities and surveillance and stuff what about the issue of handling private easier right because one of the big challenges and I think we even see that with bitcoin is that people aren't very good at taking care of your private keys that's why people use a lot of hosted wallet such

as coinbase a circle and because if you get you a private key hacked well people can seal your bitcoin and what happened it seems like here as well it would be a very bad thing if you get your private key hacked or let's say a site like google would they have like one private key and if it gets hacked what happens then right this is a phrase that i've used previously to describe the situation which is that with real ownership comes the possibility of real loss so if somebody steals your car like you really own your car let's say you bought it if somebody steals it well you know now it's no longer your car it's

theirs for as long as they're able to hold onto it similarly with this ownership of digital information which is based on public private key encryption if somebody steals your private key they now own your information just as much as you do and they can transfer it to a key that they own and then you've suddenly lost your domain name so this is a double-edged sword which is why sometimes people rely on third parties to for the security of their keys could we not have a scenario where there would be certificate authorities that perhaps could act as a second

signer and a multi signature signing set up were even if you lose your keys yeah this is kind of the answer to this problem in the direction that many companies are moving toward is whether or not it's another company I've also heard some people trying to develop systems where it's you know other people it really doesn't matter what the entity is whether it's a single person where it's an organization of people the idea is splitting up your identity or you know you're I mean I get that multi c is of course a help here right and if you split Yuki and you have cosine use and they verify you etc of course that

reduces serious but it doesn't remove it and if we now imagine a world where domains that are secured that way and you know google has their domain secured by some private key and let's say somebody stole that the main and there's no way of getting it back I mean that that seems to be a hugely disastrous scenario and it seems like if it could happen even if maybe some people people able prevent it maybe most people will be able to prevent it with this kind of multi seagate cosigner setups isn't that's so big of a risk to essentially prevent that from happening I don't

think it's such a big risk that it could prevent it from happening because there's this counter huge significant risk which is that whole scenario that we described before which is basically that if somebody can pretend to be you did you really own your identity in the first place the answer is no you didn't so you know just as Google could lose their identity in this block chain world they can and sometimes do lose their identity in today's world as well it's kind of a trade-off I think that we will see different technologies coming about

to try and address these problems things like revocation so it's possible to create a system where if Google were to lose its keys they can still recover them because they created some piece of information a sign transaction beforehand that they keep in some sort of you know secure lock vault somewhere that they can then broadcast the network and override whatever changes were made recently that's one possible system and they can even reintroduce trust back on top of the block chain so it's possible I'm fairly certain it's possible to

reintroduce today's existing system in the block chain you could probably devise a system like that and if that's the case then today's then then the blockchain becomes kind of like a superset of today's system can you that although it look like I I think I think I'd have to put a lot more thought into it and the kind of this conversation allows me okay yeah so it would probably involve some kind of trusted permission blockchain thinking so that that's really hand wavy and I don't like that but but I'm guessing it's probably possible now i'm curious what your thoughts are on on hardware security so the the idea of trusted execution

environments being introduced now in mobile phones the idea of a chip cryptography like these little ledger waltz that we have and the ability that these technologies particularly the trusted execution environments the the potential for introducing really good UX around public/private key cryptography for to sort of everyone to have access to do you see that as a trend towards people being more sensitized to the fact that they need to encrypt their data and

potentially you know sort of invar Singh this this trend that we've had where get their data and stolen and read by the NSA etc well I think on this topic I am definitely in the open whisper systems camp there are a company a nonprofit that specializes in secure communication applications they've created probably what I think is the most secure secure messenger on iOS called signal and on Android the corresponding applications are there actually signals on Android is to applications one is called red phone and

the other one is called tech secure and their philosophy is basically don't talk about keys don't mention keys at all users don't want to hear that word they don't want to deal with it they don't want to think about it and I think that that's kind of where things have to go and that in fact is one of the great virtues of namecoin and the blockchain is that it can help do that using this technology using namecoin you can build user experiences that don't talk about keys that's one of the great things about it because for one of our interests in namecoin was developing a

secure messenger which we called the ok Turtles browser extension which would allow you to securely communicate in a man-in-the-middle proof way with your friends over any website it doesn't matter you know if the website was malicious you could chat with your friends over Facebook in a way that Facebook could not read and you could do it in a way that didn't involve you messing with any keys the software would automate all of that stuff for you that's because namecoin in effect solves this thing called Zuko's triangle which is this conjecture that in a naming system you can only have two out of three properties the three properties are the naming system can be secure

decentralized or human readable two of those pic too but not three well namecoin came along and it showed that you can have a system a naming and that has all three properties it can be secure decentralized and human readable so prior to namecoin we kind of had to deal with things like gpg where you had to go and find somebody's public key and then somehow verify and make sure that you got the right public key for that person and not a mistaken one with namecoin you can simply know the person's handle their identifiers like I'm Greg on namecoin and that's all the information that you need literally to be able to send me a secure message ok

so again I think this is compelling but I would like to talk a little bit about sort of the reality of where is this and how is this waste is going to go and how is this going to happen because we're we're talking about here is this big vision of an Internet that looks different and of communication that works in a different way and even if I agree that that is compelling in may it would be a better internet is there a road map for that to happen is that going to happen on on a big scale or on a small scale and do we need is that the sort of thing way you need this huge network effect so we need everybody to switch that new system otherwise it's

not going to work and if not a huge majority in chrome and firefox and everybody starts supporting that then it's just yeah it's not going to work how what does that look like the beautiful thing about it is that it can work on in kind of an individual level you don't need chrome to switch to the system to have a secure messenger that uses the system ultimately what we'll end up driving adoption are the applications that people end up creating and if those applications use this system well then it you know it will it will start spreading if they are actually very good from a user experience point of view and the block chain can result in a very in a much

much improved user experience so this I mean you see the first sort of Avenue it is can actually get used and get some traction in the kind of messaging apps and and not on the domain level side I think that's one area I think that there are many other groups that have a need for this technology this includes big businesses enterprises that need to secure their systems in a way that's simple for them to manage or you know simpler than whatever they're currently doing and it includes governments as well you know it could very well be the case that one of the you know biggest proponents of this technology could be

the US government or some other government because as we know they are not very good at securing their information from recent news let's move on to the foundation as you go founded ok Turtles why did you call it ok Turtles I the truth is is that I just really liked the word turtle for the period of 2012 ok I have no idea where it came from but i like the word turtle in both Russian which is the language that i was born speaking which is a shitty paha and I liked it in English as well and for some reason that word just

wouldn't go out of my head but other people have kind of put different stories on top of that i know that a receptionist at my orthodontist when she heard the name ok Turtles and heard about the project it made complete sense to her because to her the turtle is the spirit animal representing security and if you look at our logo it's a turtle with a shell that looks like the world and a shell is kind of symbolic of security so these are turtles that are okay because they're secure so you could you could you know you could make a story along those lines as well but you know that's actually the way that interpreted it when I when I first went

on the website and saw the logo etc so yeah I prefer that story if you could not tell the truth I in this case it'd probably be here for her of so can you talk about the the mission statement and what you're trying to accomplish I mean that the men should say women was the mission of the foundation and what you're trying to accomplish so the mission statement of the foundation evolved we were first very much focused on the secure messenger that used namecoin and to develop that we had to develop this other project called DNS chain and in exploring DNS chain we started looking at decentralization in general because namecoin is all about

decentralization and it turns out that decentralization as a concept is a great solution to many of the challenges that humanity is facing today in many different diverse fields because what happens with centralization is that the more centralization you have in a system the more it tends towards abuse of power and cronyism and the answer to that used to decentralize such systems so our new mission statement is supporting beneficial decentralization technologies and we throw in the word beneficial because we know that you know nothing is a panacea and we want people to

challenge us in the things that we support we want people to actually view this from kind of an egalitarian point of view we if we end up supporting something that isn't beneficial we want people to point that out to us so that kind of that word beneficial is an almost you know opinionated term that's thrown there precisely for the purpose of stimulating discussion about whether in fact these systems are beneficial are you working full time on this and this is there a team that's working full time on the ok Turtles project I am working I have been working fairly full time I mean mostly I volunteer for the ok Turtles foundation and so for the past many months even over a year i started

working on dns chain back in 2013 while i was at the university of florida as part of my senior project so the answer to your question is effectively yes I am working kind of or volunteering so to speak full time for it and there is a team but they're not working full time but so far we've managed to accomplish quite a lot with very few resources yeah I mean to be really honest i think it's a it's a really it's a really compelling vision in the long run and you know i was being a bit critical before we guarding the private key security of course that's a problem because also has right and i think it's a problem that will be solved

right because there are so many ways of solving that and it's not easy to solve and sometimes things will go wrong but but it will be solved and and yeah i think it says really really compelling vision and it's exciting what you guys are working on him thank you so there is a road map I mean I know you guys are working on this browser extension what what can we expect to see you in the next months and maybe years well the next thing that the next big thing coming is a crowd fund for work to finance us to be able to work on this generalized thin client protocol that I was talking about we want to kind of you know we worked on DNS chain and it's a

very important piece of software but now we kind of want to almost start removing it from the picture from a security point of view we want people to not have to entirely trust these DNS chain servers out there because we don't want to repeat mistakes of the past so that's the importance of thin client protocols and thin client protocols are important not just to name point but they're critical to Bitcoin you know if you're using a if you're trusting a company to store your keys for you you're making a huge mistake because we know that the bigger account the more successful a company gets the more likely in fact it is that it will be attacked it doesn't even matter in some sense how much

security they throw at it because the prize it's ultimately up to economics the more successful they get the bigger the payoff is for actually hacking them and you have more and more hackers trying to find vulnerabilities in there armor and then you have a mount Guk's and you don't want that situation to happen in terms of securing your bitcoins the best thing to do is to do it yourself if you can in a secure way and thin clients are a great way to do that can you tell us what's the the role that anna schwartz played in the ok turtles in the innovating yeah Aaron Schwartz was one of the first to

recognize the significance of the block chain and the role that it could play in naming systems he wrote a fantastic blog post called squaring Zuko's triangle and that blog post was the reason that I got interested in this entire field that blog post was the reason that eventually DNS chain was developed and it was because of that blog post that I got a chance to actually communicate with Aaron Schwartz I sent him an email shortly after reading that post asking if he needed help with it and we exchanged a few emails and eventually I got distracted and kind of went off did some other things but in 2013 in fact that was the the at the start of that

year that was one he committed suicide because he was being pursued by a prosecutor coincidentally the same prosecutor who had pursued a close friend of mine John James who also committed suicide because of that whole process and perhaps because of that event I don't know my memory is not that good but maybe maybe that played a role in kind of getting me back on this track and deciding to really devote a lot of time to this cause cool well great thanks so much for coming on I think you did a great job explaining this topic and I think it's extremely exciting project your work on and I really hope

you make a lot of progress and a lot of progress towards realizing that vision thank you Brian Thank You Sebastian and yeah so we will of course put links into the ok Turtles foundation so people if people interested they know they can check it out they can support or they they can get in touch with you and perhaps help in some way we can also put that I know you've given a few talks that go into more depth so we can put those in the show notes as well if people people want to get a bit deeper into the technical aspects of this now please follow ok Turtles on Twitter ok we'll do that so yeah thanks so much for

coming on Greg and thanks to listeners for joining us so we put out new episodes of eps and back on every Monday you can subscribe to show in itunes or in your favorite podcast app and you can also watch the videos on youtube and yeah so if you're loyal is Lou then you know do us a favor and leave us in our interview we would totally appreciate that and it helps a new users find the show and of course if you want but you can also donate to us and our tip address is in the show notes so thanks so much and we'll be back next week