Roads Toward Ethereum Privacy | Andy Guzman - Ethereum Foundation

All right. So, our next speaker is going to dive deep into privacy. We have Andy Guzman from the PSSE team at the Ethereum Foundation. He's going to talk about the road towards Ethereum privacy. Let's give him a hand.

Close.

Thank you. All right. Good to be with you guys. Um so let me start by saying this will be a quick and trying to be provocative talk 13 minutes so see how much we can tackle. So let's start with the scenario.

Uh you want to exchange one ETH for USDC and let's see how many people would watch that transaction. So you start with your favorite like swapping tool. You just connect and very naively you just choose your one E and ch and see the price and the conversion and cry for a little moment and then um let's see what happens when you do that whenever you visit a website you're leaking your IP your browser the fingerprint like all the information how you can configure your browser your dimensions um if the website has analytics you're also leaking how much time you're spending there um basically what are you're seeing on the screen. Um, and the front end also like records the activity wherever you click. Let's move to the next part.

Let's say, okay, yeah, maybe I don't visit as often. I just do it within my wallet or sometimes I do connect my wallet. What happens um naively within like, yeah, this is only private. I'm not live streaming this. Right.

Right. Um, let's see. So whenever you open a wallet and it uh requests your balance and it's um or uses an API key to talk to different like RPC providers, you're leaking what are your addresses, where are you um calling this information from, what is your browser, it these all these things become identity identifiers. So it you're revealing what is your balance, when are you quering, what are you quering, what is your wallet version, the accounts, everything. So let's see this number on the bottom what is what it says is like how many entities are watching there's five already right so before there were three now we're five and let's see is the transaction continues how many continues to watch so let's talk about the gateways right like the proxies the the server the the RPC providers so whenever you want want to query a contract or want to call a function whenever you want to see the token pairs you're also leaking information and your internet savers provider can see that.

So if you're in a country where cryptocurrency is banned, good luck because it's very likely that this becomes data that can be used against you. Um and the same case with like uh domain name services. So whoever is resolving these IPs also leaking your information. Let's say everything of this goes well and then it reaches the memple and in the mele it's just like these unconfirmed transactions that are floating over there. Everybody can see it.

So everyone who sees the memple sees um could see where it came from. Me searchers can see your information where you're trying to do the block builders as well. So every you know there's more than nine entities already watching what you did and you have revealed and leaked and bleed so many information up to this point. And then finally what we think on privacy most of the time we always think like oh onchain privacy right like I want to make sure this doesn't get logged or it's not easy to correlate my action with uh my address well depending on the protocols you might be leaking uh your address the values that you're doing the cold data your gas uh you might be timestamping all the actions that you do onchain uh the swapping details and these are all almost like signatures um pseudo metadata identifiers that could be very easily use against you to yeah just uh dox you and finally consensus let's say you want to run a node and you want to be private right just run your own infrastructure I think this is great but um what if you whenever you connect your node to the network you are syncing with other nodes so those nodes also get to know your IP and they can see what transactions are coming from your IP so they can very lightly correlate also your transactions even if you're sending it through your own node and um yeah just thinking proposing attesting all of these leaks. So it's a very dire situation and the challenge that we have is like if we don't fix it if we don't solve these problems Ethereum becomes the biggest surveillance mechanism in the world full stop.

So it's extremely important even if people don't recognize it. So how do we fix it? Here's how. It's what I like to call Ethereum full stack privacy. Like we don't need to think only on the onchain elements.

We need to think of everything like all the layers the life cycle of these transactions. So the application layer, the wallets, the gateways, the meles, the onchain elements and the consensus and all of these wrapped in networking calls. So how do we really harden it and who is working on this? So um if you want to run like self-hosted uh websites, you can do it. There's more and more tools coming online and this increase security and this increase privacy.

There are like analytics free frameworks or that you can use tools not only like web 3 but also like web 2. And there's a ton of new teams and established teams trying to build mixets, onion networks, um DC networks and many others. Let's look at the wallet layer. There's been recently a big push to try to push real private wallets. My goal, my dream is that there's no difference between a privacy wallet and a normal wallet.

They're just like wallets. And in the future, wallets will not only hold your money, but it will also hold your identity, your private data, that you will generate secret proofs in order to access content online. So we really need to hit the nail on like how do we make all these wallets private secure that they don't track information that they use like by default all the privacy settings. These are the gateways. So how do we make sure that your traffic is hidden and your data is hidden and not only your data but the access patterns like what type of data at what time of the day in which slots are you trying to push?

So there's like great teams building PI mechanisms like more cryptography more like building on TE building maps or ramps many other like mechanisms that just help increase the privacy for the users and then uh the mempool. So um flashbots, shutter, many other like housew like protocols have been like doing a real push to make sure we're protecting our users. And here is like double benefit because it's not only beneficial to protect your your your your identity and privacy, but it's also useful for if you're a trader or to have better trade values because you're not getting attacked like messages attacks is a real problem from traders and for people in the industry. And I will say onchain is where we're doing the best. Like there are so many great teams.

This is just a little picture of like um logos of different uh teams building private transfers mechanism. This is not even complete. So there's more like 35 40 maybe even more. And they're using different techniques from like stealth addresses like one-time uh usage addresses for like obuscation, FHE based, homorphic encryption based, TE, MPC, and all these like little letters and uh you know acronyms that sound like very scary, but at the end of the day, they're just like a myriad of technology opportunities to build the best private transfer mechanism. And when people ask me like what uh is Ethereum private, what they really mean like most of the time is like can I send ETH or ERC20s from one address to another in a private way?

And there's so many great teams tackling that I have no doubt we're going to solve this. And this is just part of the picture, right? Like what about all the onchain anonymous or private uh voting mechanisms, right? Or private delegation or private Dows. All of these are like great elements that we need to be, you know, thankful there are so many great teams building on top of this.

But the challenge is that I don't think there's anybody really really tackling consensus level privacy. So if you want to run your own infrastructure or you want to have like endtoend privacy like full stack privacy, I think we are behind. So this is the concept that I want to introduce today to you guys. Ethereum needs to have full stack privacy. It's not enough to only have onchain.

It's definitely great. It's definitely a great first start and we're doing great. Like I would say like we're ahead of schedule. We're like building like one of the most diverse ecosystems of like onchain privacy projects, protocols and I think on the app layer there are options. Yeah, there are like many tools.

Um and we're on track with the wallets and networking more recent efforts let's say the last year year and a half maybe a bit more like more teams building online all of these. But when we are severely lacking is what I call like the gateway layer, the memples and the consensus. There's not enough teams, not enough funding, not enough attention uh on Twitter or discussions where where we're covering these things. So what is the road ahead? How do we stop the bleeding of information so we anonymize everybody online?

This is what we need to focus. You saw the the different layers like we need to make sure we create standards in the interfaces. So it's very easy for one of the higher layers to adopt or use or interact with the lower layers with maximum privacy. We need to make sure that the cost of adopting these privacy techniques is close to zero. And that is the cost for the users, the user experience, the cost for the developers, the cost for the infrastructure providers who are running this you know these uh techniques.

It needs to be as close as as zero. We need to make sure that the L1 road map also makes these changes. So makes it more like easier and more friendly to run these privacy protocols. We need to make sure that the layers get integrated between each of them. And we need to make sure that adoption happens.

Like it doesn't matter if we build the best research of the world, the best standards of the world, the best like proof of concepts or beginner you know protocols or that have the most if users don't use it. And this is the biggest challenge that the privacy ecosystem has which is how do we become more attractive and people will prefer to run this and use this instead of like the public and transparent mechanisms that already exist. And I want to finish by saying like Ethereum right now without a doubt is the strongest ecosystem driving programmable fullstack privacy. There is challenges. There are great ecosystems in other places building like private transactions, private, you know, money transfers, but I don't think anybody compares even close to what the Ethereum or the broader Ethereum ecosystem is trying to do, which is like all these affordances, all these like um use cases, utilities, and this is thanks for all of these teams that are in the picture and many other that I haven't captured.

So, yeah, thank you very much.