Everyone is thinking about VPNs wrong

Transcript

[music] [music] >> All right. Uh welcome. My name is Sebastian and uh this talk starts with a dedication to Cubes OS and other alternative operating systems. So you know also in uh not support of [snorts] Google and Google Slides uh I apologize for the um visual offense in case that's what you expected.

So I'm here to talk about VPNs and some misconceptions and Abina already checked who uses a VPN. I'm extremely happy being in India and seeing everyone is using a VPN. I stopped asking. I know everyone who is at Defcon who is Indian uses a VPN. That's fantastic. But I'm here and I I didn't know that when I submitted the talk, right? I'm here to clear up some misconceptions on VPNs including DVPNs. All right, before we get there, let's set the stage. So this is you at home seeking to engage with the internet and all it has to offer.

And obviously on your way there you need an ISP, right? An internet service provider who provides an internet connection to your home. That's kind of obvious. Only that on your way there there is a whole lot of parties and specifically corporations who can see what you do. And that's not great, right? So specifically they see you. That's kind of obvious, right? But they see you. They see your home address on the internet that is an IP address and they see what you do.

And they can follow every single step on the way. And so people say yes, you see IP addresses. I reject the notion of you see an IP address. What these parties see is your digital lives, right? Everything you do, everything that you have a right to retain for yourself is what these internet service providers and other parties, as we'll see in a second, see. That's not great. Now, you know, I don't want to do this intro too long because obviously you know the answer, right? We should separate the link between this who and the what, which is currently in the hands of both the ISP and all those internet service providers.

How do we do that? Obviously by using a VPN, which is basically separation technology right? Only that that is actually not exactly true because what a VPN actually does is displacement technology. It displaces this one centralized corporation which can harvest all your data with another one. And if you look a bit more closely, and that's something that we don't typically talk about a lot, is it's not just about, you know, these VPN corporations or just about your internet service provider. There's a whole bunch of internet infrastructure. Specifically, there's these autonomous systems, which

is basically kind of little subnetworks of the internet that route your entire traffic. And they also see who is trying to access what. And if you have access to an AS on the left side of this VPN and on the right side, which guess what, this is multinational corporations, um they can link that, you know, and they're being connected in the same fashion as this VPN. So you don't just trust these providers that you see, you also trust a bunch of other networks that you don't think about, which is increasingly problematic.

Now, nobody cares, right? So I think we, you know, cleared that up because we figured out we're in India and everyone uses a VPN. Um you know, that's not just the case in India, but moreover this is a huge market. I get back to this kind of market numbers and what it means for us here cryptoland later on. Now, second mistake is VPNs prevent censorship. So, firstly, yes, right? In some regards, they are useful. If there's a blatant, simple geo blocking, for example, a service that you cannot access from India, but from other countries, a VPN helps. You relay your traffic via another server. That's what a VPN does.

You are being let in usually to services which are being blocked in India. So far, so good, right? However, VPN is VPN traffic is usually very easy to identify. So, you know, most of you know actually you can block VPNs pretty easily. And also data center IPs, you know, these these VPN servers that relay all your traffic, they not run somewhere at home than data centers, that's pretty easy to block as well. So, you know, VPNs prevent some forms of censorship, but then certainly not in the current form a golden bullet.

Now, why does any of this matter for Ethereum? We're currently in a bit of weird market here, right? So there's people like complaining about Ethereum not doing well, like this event being too small and what not. First of all, I don't feel that way. In my eyes, it's good that we got rid of a bunch of this kind of absolutely overhyped like token shilling and stuff. This is fine, right? Ethereum is doing fine. However, indeed we do need to find ways to make all of this sustainable. Mostly self-referential DeFi is certainly not the way there. But if we look at this like VPN is a huge market.

So I would just say comparing that to a bunch of like the big crypto venues, although most of them that I show here are actually actually centralized, you know, it's actually pretty huge slice of revenue that we should bring into our on-chain economies, right? So as we realize that while DeFi is kind of cool, but also all our friends are not excited getting up in the morning trading on a perp dex, you know. We need to find things that actually matter to humans. And guess what? VPNs actually matter to humans and bringing that revenue on chain is something that helps us get on a sustainable path for all of Ethereum.

Now, this is not just about the revenue, obviously. This is about bringing a gateway to privacy to the Web 3. Now, we're not the only ones there, right? So, there's regulators which claim the same thing. They want to bring a protection to consumers, right? And they want to keep companies accountable. And therefore, they come up with, you know, laws and regulations around data logging and like weird things that operators of all sorts of services have to do. And we see increasingly how that backfires, right? So, we see increasingly how this protection by laws and regulations is literally backfiring all the time. I don't need to bring

examples. I think we're all aware what I'm talking about here. So, luckily, regulation is not the only thing that tries to protect individuals here, right? We're in Web 3 land, so, you know, we should make things private by design. And now might be something that some of you find surprising. I'll talk about dVPNs, right? dVPNs are great. So, dVPNs is basically let's get rid of the evil corporation and replace it with a decentralized network. Only do you see a network here?

I see like something in the middle. I don't know what it is. That's a dVPN, right? So, a dVPN typically means you take some stranger that operates a node and you're relaying all your traffic across that person's machine. So, as I sometimes like to say, you know, dVPN stands for dude, I have no idea who runs that server or gets to see all that data. That is not a great idea, right? So, a dVPN in its classical form is basically the worst of both worlds.

You have a centralized intermediary, you know, just like a traditional VPN. And at the same time, you have no enforceable privacy rights whatsoever because you do not have any relationship with that party. Not great. Still, it shows us a path that we'll look into in a bit. So, firstly, this is not limited to the web, right? I talked a bit about like web examples. So, this is not limited to the web. Like let's look for a second at something that I care a lot about, which is Ethereum. So, the Hopper team was the first team that looked into validator privacy uh a bit over four years ago. Everyone on our team was running a validator on Gnosis Chain, which for the ones who

don't know, is basically a copy of Ethereum. And we could just by observing the validations on chain identify every single one of our team members within 24 hours, okay? So, we're mapping the IP address to the validator at the station key. Why is that bad? Because we can target in a very targeted fashion knock you out right? That is really bad. It's nothing new for the protocol researchers of Ethereum, and yet we have no solution to that very simple problem until today.

The second thing that we talked a bunch about before we kind of committed to the direction of of building a VPN is like wallet privacy, right? RPCs. When you connect to Ethereum, right, your wallet shows you you connect to Ethereum. That's basically a lie. You do not connect to Ethereum. You connect to an RPC server. An RPC server for the ones who listened here, no surprise, they see everything who you are and what you do in the Web3. And maybe, you know, just to make this example a bit clearer, this is basically the same thing, but one specific dapp that I'm concerned about are shielded pools. I love shielded pools, right?

Tornado Cash, privacypools.com, Kirby, you know, Bermuda Bay, fantastic innovation going on there and a lot of different flavors of shielded pools. However, if you connect from the same IP address with the same address to that RPC provider and dapps and other service providers around that, you know, indexers and all the great centralized stuff that we practically require to run an Ethereum dapp today, you are providing a link that you thought you went to great lengths to like sever in the first place.

So, cryptography alone doesn't solve network privacy, right? We're talking in Ethereum a lot about ZK all the things and that's great, right? So, ZK technology are fantastic for, you know, protecting, you know, your privacy and retaining information. However, privacy is just as strong as its weakest link and many times we're thinking about ZK all the things, we're not thinking about this plumbing underneath, right? This plumbing underneath is not just, you know, a like a wire through which you send your data. It is very often something that is used to fingerprint and identify and single you out.

We have to fix that. Now, how do we fix that? So, what we're working on here on our side at Hopper and with Nym VPN is a mixnet based VPN. And the direction of the VPNs is not wrong, right? It's just that we have to actually make it decentralized and we have to actually make it a network. So, instead of relying on a single server that relays your traffic, what happens here is that we relay traffic via multiple parties. I'll not get into too much detail of mixnets because I think Harry right after me is going to, you know, go into quite some depth of these mixnets.

In a nutshell, what's going on here is that instead of directly sending data to a server, you'll effectively shield it by a bunch of relays, right? So, what's happening here is your data is being sent, is being mixed up and shuffled and transformed on the way to an exit which passes it on to the Internet, and on the way back the same thing. And as there's more and more users, you see more and more data packets appearing, the more this gets messy, right? And it doesn't get messy just optically here in the slide, it gets messy for every network observer, even for strong adversaries, you know, who can see every packet going through this network.

So, yeah, that is a way how you can not just shield yourself from these providers in the middle, but also from stronger adversaries who see the whole network, and that is the strength of mixnets, right? Now, how does that change things? Instead of having a single provider who sees who you are and what you do, we now have separation here on the way. And an interesting property of mixnets is that you need one honest mix node along the path, right? So you don't need everyone to be honest, but you need at least one party. If everyone is compromised, I'm sorry, there's not much you can do.

Now, that sounds complicated. In our case, we uh try to make this accessible for you, and we have a, you know, very simple normal looking VPN on top of that. So all this plumbing underneath that, you know, sometimes people don't want to think about, you don't need to think about. You hit the connect button and under the hood, we are obviously connecting to this mix network that does what I just described, right? Now, currently there is, you know, we call it an edge node which you're actually running underneath your VPN that is taking your traffic already locally, and that's important, it locally breaks it down into these indistinguishable little packets, mixes them up and passes them on through a relay. So already your Internet service

provider, as I pointed out in the first slide, cannot really track what is going on here, right? So um that's good, right? That works already [snorts] today. Um every now and then we also have Internet here, so if that happens the moment you pass by our NymConnect booth over there, you can check this out and, you know, take a look at that. This is not the end, right? We will keep working on this. Um, so to improve these privacy posters of this network, we will add further mix nodes in there. So there's a whole lot of things that we can do to make Nym VPN more private.

For us, this is about the trade-off of making things not just private, but also usable, right? And that trade-off is obviously hard, but uh, yeah, you can convince yourself by checking it out that uh, yeah, I think we're not doing too bad already now. Now, no single party sees the identity and activity together, again because of this um, separation, which again for us in Ethereum land means wallet and app activity become harder to correlate and to track and to tie to your identity.

So with that, how does that address the mistakes and issues that we had in the first place? So basically VPNs solve this metadata linkage issue. Well, not really. We fixed that by not having a single provider that you have to trust. I also clarified that nobody cares about VPNs. Well, you know, maybe you don't care about VPNs, but that is a quite privileged perspective. Everyone here does care about VPNs, and that is not just for streaming Netflix.

So VPNs prevent censorship. Well, it depends, right? Um, I the the one part I did not talk about here is incentives. So in this Nym VPN network that leverages the hopper mix net under the hood, we have incentives for individual node operators and exits. So obviously there's, you know, something in in for you if you want to decide to run a node. Regulation improves privacy. I'm not fundamentally against regulation, but I'm against regulation which is imposing data hoarding on institutions which are absolutely not equipped to protect your personal information.

Also clarified DVPNs, D doesn't necessarily mean P like private. Um we fix that by having a separation of multiple nodes in the network. And finally, hopefully you took away from this talk that ND network layer is not just plumbing but is essential for network layer and therefore entire privacy for Ethereum. With that, I will close it up here saying, you know, you can join us. You can join this VPN as a user. You can join us at the booth to check it out already today. The product will otherwise launch in a couple of weeks.

You can join us as a relay, right? So if you want to earn, you know, money from participating in the network, you can run a relay node. If you're maybe a bit more unhinged, you can run an exit. You can run an exit which provides your IP address and monetizes your unused home internet, you know, bandwidth for other people to use. And with that, I would close here and I am open for questions on any of that. Thank you. >> Thank you so much. We have interesting topic and a lot of questions. So let me start first one.

What is the difference between Mixnet and Tor? >> Great question. So Tor, as many of you will know, is fantastic privacy technology. Roger, who, you know, is the guy, the main guy behind that is is also around here. Please do use Tor. Tor is the most anonymous way that you can access the internet today. It also has multiple relayers. It also has onion encryption that we also use. What we do different is that in Mixnets you do active mixing, right? So you have this active mixing and in our case we have incentives in there. So I hope that maybe some people here will decide to run a Tor node, but you just do it out of the goodness of your heart.

You have to pay for the server and except for doing something that's extremely valuable for humankind, you don't get anything in return. >> What Okay, let me the next one. Will Netflix still be able to detect these and block me? >> So you know, no. You know, I hope no. Now there's stronger adversaries than Netflix, right? Let's face it. There are some, you know, regimes on this planet which are trying to come after you more strongly than Netflix.

And they might as we see right now, even with advanced, you know, obfuscation technologies, it's a game of whack-a-mole. And yes, we will also level up on that front, but there is no perfect solution because, you know, repressive regimes will effectively take your device, put it in a lab environment in a VM, look at every packet going in and out and find a fingerprint of these packets. And many things are fingerprintable and finding one solution that fixes that for good is so far seemingly impossible, but yes, this solution will allow you to watch Netflix undetected.

>> Mixnets introduce latency to improve anonymity. How do you decide the optimal balance between latency, throughput and privacy, especially for real-time applications like video calls? >> Yeah, fantastic questions. So there is no free lunch, right? So firstly, there is no free lunch in the anonymity trilemma between strong anonymity, low latency and low bandwidth overhead. That is what it is. But in this triangle, a mixnet gives you choices. So our first implementation that we, you know, provide called Nym VPN, you know, which is free and open source by the way. If you don't like the choices that we make in there, which are not great as I mentioned, right? This is

the first version that we, you know, want to get out there. You can fork this thing and change things. So, practically speaking, I regularly use Nym VPN in our internal test version right now for video calls. That works. Our latencies that we get are something around 200 milliseconds, again, depending on the trade-offs that you make. Currently that is for, you know, you mix this locally, you have one intermediate relay, and then you have the exits. So with these kind of three parties in the mix, we get to around 200 milliseconds, which is okay for web browsing and so on. And, you know, it's also enough from the, it's not just latencies that matter, it's also throughput that matters, where you know, we we get to acceptable bandwidth that you can use for web browsing, for

your Ethereum transactions, and yes, also for watching Netflix. Not 4K yet. >> Are exit nodes liable for the exit traffic could could nefarious users lead to a lack of incentives to run an exit node? >> Yeah. So, um, let let me give some more context on this question. So the person running an exit, right, is the one who gives their home IP address, and again, like we hope to get many residential IPs because that is what allows others not just to access Netflix, but also a whole lot of other useful service is for humankind which are hard to block.

So, um, yes, if somebody uses you to do illicit stuff, what's going to happen, right? So let's say you are downloading a, you know, you're torrenting a movie that is copyright protected. What will happen is that there's some big, primarily US-based law firms, which then, you know, go to the provider, to your internet service provider and say, hey guys, we're going to sue you. What's your internet service provider going to say? Well, you know, no, I'm just going to, you know, usually rat out the user and forward a letter to you, which looks kind of nasty. But yeah, I mean there's, uh, you know, there's ways of dealing with this.

For the really bad stuff we have blocklists. So you know internet we do not support crime, right? So by default the exit node software that we provide which is free and open source has a cyber crime blocklist. So if you want to use that to you know attack I don't know um grid infrastructure in another country um you'll have a harder time doing that. >> Thank you so much Sebastian. There's a lot of many other questions but our time is up.

>> [music]