Keynote: Lessons learned from Tor by Roger Dingledine | Devcon SEA

[Music] the microphone is working the slides seem like they're working uh I hope we'll find out soon if they're I'm going to press the forward button okay I see them over here that means that they will appear pretty soon so hi I'm Roger dingledine from the tour project uh once upon a time I started uh a nonprofit called tour and uh and wrote the original code so there's uh a lot to talk about today I'm going to break this down into two pieces the first piece is giving you a crash course on tour and things to think about and then the second piece is uh advice and lessons for the ethereum and cryptocurrency communities that from what we've learned over the past many years so tour is a lot of different things it's a free software project open- source project uh from that you learned about from the last speaker uh it's also a bunch of different projects each trying to provide privacy in various ways uh it's a nonprofit as I mentioned and the fun part about tore is the global community of people all around the world who use it and rely on it and help to make it stronger and better so many people use tour uh in the form of tour browser which is a Firefox based browser that fixes a bunch of application Level issues so there's the underlying program tour but the interface that most people see is tour browser okay so what am I talking about here in terms of privacy uh I talk about privacy and security but really the phrase is Communications metadata it's the idea that uh I want to browse the web and I want somebody watching my internet connection to not learn what destination I'm going to and I want the website to be able to not learn where I'm coming from so how many people here recognize creepy NSA dude from uh back in the Snowden times so he helped to run the intelligence uh system for the US government and he has this uh scary terrible quote we kill people based on metadata and the important thing here is nobody in the attacker World these days is trying to break the encryption anymore the encryption works well instead let's build a social graph of who's talking to who when they're talking how much they're talking and then we'll look for who's in the middle of that graph and then we break into their house and uh steal their laptop or or whatever attack we have to do from there and there are a bunch of other Uh current events that are related to all of this here's a a news story from I guess five years ago now the US attorney general asks Facebook to stop doing endtoend encryption for uh their messenger and there's this terrible uh quote from the request we are writing a request that Facebook does not proceed with its plan to implement and encryption with without uring there is no reduction to user safety that drives me nuts imagine if they said we're writing to request that Facebook not Implement https without ensuring that there is no reduction to user safety that would be a a an uh an unbelievable thing for them to say but here they are saying it and then fast forward four years uh we still have the same arguments going on where England is saying but if we if you allow your users to have control over their own Information Society will collapse uh everybody will become criminals we'll never be able to to to track everything and uh another example from uh earlier this year apparently uh in the US law enforcement sent a YouTube video URL to somebody they were trying to attack and then they went to YouTube and said tell us everybody who watched that video and I don't know if YouTube actually answered them but uh that's the future of law enforcement where you you make use of the huge platforms that collaborate with governments and uh and that's it for your privacy so I'd like to live in a world instead where uh people individuals have control over who gets to learn uh about them and then uh the final example that uh happened a couple of years ago apparently there was somebody in the US state of Nebraska who wanted an abortion and talked to her mother uh on Facebook Messenger about whether she should get an abortion and now she's being prosecuted for conspiracy to want an abortion and that's the country that I live in now so that's another case where uh privacy the ability to have conversations uh of things that should be legal uh is something that the that the world needs to to keep okay so I actually only use the word anonymity when I'm talking to researchers when I'm talking to my parents I tell them I'm working on a privacy system because anonymity I don't know who needs that but privacy is an important value for everybody and then when I'm talking to uh Walmart and Google and other companies I work on communication security because privacy is dead says the Oracle guy anonymity is confusing uh but of course we need to uh protect somebody from learning who our suppliers are what we're investigating on the internet when go when uh Goldman Sachs is thinking about stocks to invest in of course they don't want their competitors watching their internet traffic to learn what research they're doing and then uh from the government side it's the same tools but for governments I explain that I work on traffic analysis resistant communication networks and again it's the same security properties but it's about figuring out how to phrase it uh for those groups and then there's a fourth category which we can talk about in this country but maybe not some countries nearby here on the human right side where there are people who can't reach bbc.com and they want to be able to read the news or share news okay so how do you build one of these the easy answer is you have some centralized system like a VPN and all of the users connect and ask for a web page uh and that's great except what about that central point of failure so imagine uh that relay in the middle it always starts off with we're never going to look at any of your traffic don't worry uh we promise to keep keep you safe okay actually we do look at all of your traffic but don't worry we won't write it down okay actually we do log everything but don't worry we won't tell other people okay well of course we answer governments but don't worry we won't tell other other people uh and I don't know where the the next uh step after that is the problem there is you can't tell it's a centralized system you don't know what they're going to do with your data they have your data they promise not to screw you that's not good enough and it's even worse than that uh even if that centralized system is somehow perfectly honest and really does want to keep you safe it's still one computer somewhere all the traffic goes in the same traffic goes out and if you're good at math maybe you can match up this data flow coming in matches that data flow going out so this user did that so even if the VPN provider is totally honest uh and perfectly secure for all definitions of that the fact that it's a centralized service is itself still a danger if there's uh some sort of network level adversary that gets to watch things so the goal of tour is to distribute the trust to decentralize over multiple relays so there's no single point that gets to know this user is going to that destination so it's no longer about privacy by promise it's no longer about I have the data I promise I will keep you safe now it's about privacy by Design where the architecture of the system means there's no place that knows what you're doing on it so that's the the summary of tor's uh goals and threat models in terms of the network over time we have about 8,000 relays around the world here's a graph of the the load on the network and the capacity of the network over time so we're continuing to grow uh the fun part of this is that if you look at like the Wikipedia bandwidth graph it looks like this just uh 5 or 10 years behind so we're continuing to go up as Wikipedia did back then okay so how do you actually think about security for tour there are two two big answers for that one of them is the diversities of where the relay the diversity of where the relays are around the world so as we add more relays in different places around the world uh it becomes harder for a given attacker to be able to see the traffic going into the into the chore Network and the corresponding traffic coming out and then the second one uh that's a bit more hard to quantify is diversity of types of users so we have a lot of users in Iran they're not all political dissidents most of them are using tour because Iran blocked Facebook and they can't read their pictures of kittens on the blogs that they want to look at and that ordinariness is really important for security if everybody using Tor in Iran were trying to tear down their government right now then the fact that you're using Tor would itself be dangerous so we need a whole lot of ordinary people in order to provide protection for uh all of the higher value users out there also okay so I talked before about uh the network level privacy hiding your IP address where you're coming from where you're going but there's a second piece that you have to do in tour which is the application Level privacy so we have tour browser and it fixes a bunch of uh of browser layer things like cookies what version of JavaScript what languages you prefer how many pixels by how many pixels your browser window is uh all of these ways that websites can recognize you even if Tor is doing its job they can still say oh that's the the guy running on Mac OS who prefers taii but Korean will be okay uh so there are there's there're two different pieces to what we need to do for safety and Tor Browser actually tries to keep you safe in a way that there are all these uh new private browsing modes and so on out there which are I mean they sound great but here's a uh duck. go did a study a few years ago looking at what what users actually think brows private browsing mode does and most of them misunderstand so private browsing mode protects against somebody looking at your hard drive after you've been browsing for a while it doesn't protect against somebody on the network watching you it doesn't protect against the website doesn't protect against an advertising company tracking everything you do so a lot of users thought private browsing mode uh is basically what tour browser provides it should actually protect you against advertisers websites isps telephone companies intelligence agencies and so on so here's I found this fun uh comic explaining the private browsing mode world so we've got the the the the huge Chrome saying which website would you like to see and we've got our sad user saying I don't I don't want you to know and then Chrome puts on a sock puppet and says how about you tell the hand and then the user is like okay great yes now I'm now now you've reassured me about your privacy so that's I want something that's more than just a centralized situation where uh they promise not to screw you but actually they're still getting all the data okay so transparency is really important for tour of course we're open source of course we're free software of course we have public design documents and specifications that describe uh what we tried to build and of course we are publicly identified hi I'm Roger I wrote Tor and the goal of that is to build a community of people who can trust us it isn't just about put the code on uh some website and uh and magically people will will will believe us it's about growing a community of people around the world who have met us and argued with us and thought about whether we should do things differently and collaborated and part of the challenge there is I always talk to some security person who says oh haa the Privacy people are talking about transparency that's so stupid it's not a contradiction you can get both privacy is about Choice privacy is about being able to choose who learns things about you so because I have privacy I can choose to be transparent and say hi I'm Roger uh this is what I built okay so that was the crash course on tour uh now let me talk about some um lessons learned from the tour world that might apply to projects you're working on so the first one uh make allies make allies even among your adversaries so yes you need to have good uses and you need to publicize those good uses so this is uh for the people who were here two talks ago uh don't be tornado cash figure out how to tell the world about your good uses and uh and maybe that means in your case uh not just having people who agree with you in the uh law enforcement groups that might be uh wondering if you should stay legal but also get users in those places so that they uh they understand why your your tool is important and needs to keep existing so we asked people for user stories about Torah a while ago and here's two U I'm a political activist part of a semi criminalized minority uh in my younger years I entered the public debate openly uh only by anonymizing means uh which which tour is key can I get my message out without having police come to check my papers tour allows me freedom to publish my message to the world without being personally persecuted for it so we have a lot of activists and journalists around the world who have this sort of story um or I'm in a doctor in a very political town you could imagine Washington DC or Brussels I have patients who work on legislation where billions of dollars are being spent when I have to do research on diseases and treatments for my senators of course I'm going to use tour because I know that uh somebody's going to want to learn about the information the medical information about the Senators that I treat and the same story also happens on the legal side where uh yes you're supposed to have uh client attorney privilege but the reality is that you need to use technical mechanisms to secure your communication you can't rely on the US government promising not to listen in on your phone call with your lawyer uh over and over we see cases where it turns out they do listen it and we've also had some other high-profile users over the years happy to talk afterwards about uh the whistleblowing side of Torah but the the bigger picture there is uh technology isn't neutral looking at this in terms of power imbalances if you already have power you have you don't need tour as much you've got a military you've got law enforcement you've got the laws you've got other options whereas if you're a minority dissident in Myanmar you don't have other options so technology is is inherently political think through what the changes are that you want to make in the world and make sure that the architecture and the projects that you're working on will steer towards those changes otherwise you'll just accidentally recreate the existing power structures of centralization and government control and things like that and uh a couple of other fun weird stories in that direction I had a friend uh who was in The Hacker community and he went and joined the FBI and he understood tour so I had a person inside the FBI who was a tour Ally and he was telling me a story of being in a Department of Justice meeting where they said you know what we should do today we should make a law outlawing tour and he got to stand up because he was in that meeting and say excuse me are you trying to make my job impossible I work for the FBI and I need tour so having him in that room meant that they didn't try to undermine my project that day so we need uh a lot of people not just who understand tour but who use it and rely on it in each of these cases okay uh lesson two how do you build a sustainable community so in the tour case we approach it with Organic growth and the fundamental building block that we have is altruism it's people who have extra resources bandwidth Computer Connections they're at a university or an ISP or a company and bandwidth is essentially free for them so they contribute that back to the tour Network or you could imagine the financial incentives world where the building block is capitalism you want to bring people in who are trying to maximize the the revenue that they get out of participating and there are some challenges on the capitalism side uh let's say the the that we built an alternative tour Network where uh everybody's here to maximize their revenue in that case shouldn't you minimize your costs and everybody should go to the same uh hosting provider in Germany that's cheapest and that would be a tendency towards recentralization or if you're in it for the money why don't you sell the user data on the side make an extra Buck um maximize your cost even more so that uh it's not just different ways to build a community that end up in the same destination uh you get different properties of your network scalability might be better on the capitalism side but uh attention to user privacy I think is better on the altruism uh organic growth side so it depends what you want out of your system and I want to be really cognizant here I don't want to show up and be like capitalism is inappropriate in every situation um though there is a part of me that that does want to say that but uh part of the the lesson here is think through what you want out of your network and make sure that you're building a community uh that has the values that are most important for you and in my case the thing that's most important is uh making sure that the users will remain safe against whatever attackers uh they might worry about okay so that said um there are a bunch of other incentive approaches which can uh potentially be helpful so gamification badges uh building Community making things fun like that leaderboards um and Community Building of having meetups like at various hacker conferences we have Relay operator meetups and a bunch of people who do contribute talk to each other share notes meet each other and it turns out that uh if if somebody tries to get them to take down the relay they feel like they're part of a community and they feel like they're letting their friends down if they decide to turn off the relay and another piece of that is there are nonprofits all around the world who get together uh and Run Tour exit relays in their Community there's one in France there's one in the Netherlands there's one in Sweden there are like three in Germany two two in Canada uh several in the US and the goal of that is first of all you have a nonprofit that's actually running the relays but also you can uh build you can put all the the donations together and get more economies of scale uh better bandwidth better isps and so on and there are some other options that that we don't do now but maybe we we should one of them would be uh maybe I don't want relay operators who are trying to maximize their revenue but maybe we could still take donations and subsidize their costs so they're not profiting it Just costs them less to do the thing that I want them to do anyway so that would be an example that that doesn't ruin the incentive structure but would still be helpful for growing the community and there are some other examples like uh maybe if you run a relay you get faster tour which has some problems that I will talk about uh afterwards so the the bigger picture here consider your ground truth so if you're trying to build uh in the economics world it's called mechanism design uh you folks might call it smart contracts but if you're if you're trying to structure a situation to steer people the way you want to steer them uh think about what you can actually verify how are you going to verify that the operators are doing the thing that you want them to do so for example if you're trying to incentivize bandwidth if you're paying people based on how much bandwidth their relay provides in the current tour design relays basically self-advertise how much bandwidth they've got and that's fine because they don't get paid for claiming a larger number but if we naively just set up a thing saying oh you're providing a big number here's your big check uh then there would be new opportunities for gaming and lying and we would end up uh with a weird arms race where the the the community is lying to us about what they're doing uh or another example let's say we want to pay people more if they're not all running at the same ISP in Germany so we want to incentivize based on location around the world how do you actually know where the relays are so here's a a fun example of uh somebody in I think Sweden set up a relay and he hacked all the goip databases in the world and listed himself as being in Antarctica and he did it because it was funny great I agree it's funny imagine if we paid him more by saying whoa that's that's a really diverse location the goip databases in the world are not robust they're not secure to gaming they're just people who are trying to help out on on locating things so that's a an example where your ground truth doesn't actually enable you to do the things you want so another lesson three U be critical infrastructure have other projects rely on you in a way that uh they need you to stick around so brave bundles tour we have a bunch of private messaging tools and whistleblowing tools and operating systems uh New York Times has an onion address BBC joy chll and so on and there's a whole ecosystem of pluggable transports for transforming your tour traffic in a way that uh makes it harder to censor that are reused and reusable by VPN companies and so on to let their users go through uh sensoring firewalls and another uh fun bizarre example more than half of the nodes in the Bitcoin Network are reachable as T onion addresses so the Bitcoin Network relies on the tour Network for their connectivity reachability privacy and so on so that's uh and if you know the people in the Bitcoin world who are who made this Choice please introduce them to me and uh not just the Bitcoin world there's also the ethereum world uh we have been talking a lot with the funding the commons people and about how to how to have alternative ways of sustaining the open source community and there are a bunch of Hardware wallets uh shout out to treaser um and we did U uh an nft a while ago shout out to pleaser and here we are at Devcon in a cipher punks track so there's a lot of overlapping values here already in terms of uh people wanting privacy people caring about decentralization so there are there's a lot of of overlap there and then the the fourth lesson uh learn from past winds so that https example that I talked about before just 10 or 15 years ago https was not pervasive I I was arguing with Google that they should turn on https for their websites and they said well we can't allow encryption by default because schools would block us schools want to be able to spy on their students and learn what searches they're doing so we can't allow encryption and now 10 years later it's normal of course you would never go to a website without https so we won that somehow and it became pervasive it became normal around the world so how do we do that again how so the next phase that we have is these and and messaging uh the the whatsapps of the world the signals of the world where there are real adversaries trying to trying to make it uh only criminals would want privacy on the internet so uh it's all part of the bigger crypto cryptography Wars uh of whether people around the world should have control over their own information and they get to decide who gets to learn what they're doing on the internet and this is especially Challen in because us and England and and Australia are the ones yelling encryption is scary Society will collapse and then when their foreign Ministry goes to China and says uh you're a dictator stop doing that China's like look I'm saying the same thing you're saying you're scared of encryption I'm scared of encryption so there's a there's a real challenge where we this audience need to somehow teach our uh our governments and our law and our our legal people U why encryption is should be a basis a human right and there's some weird stuff going on there apple is on our side for this round Facebook is on our side for this round so and that's because they know their customers actually want privacy so there's there's something we can we can leverage here um and then a couple of last thoughts uh before we get to the Q&A which I think we're ready for uh eff Electronic Frontier Foundation is running a campaign to get tour relays running in universities all around the world and they'll give you an awesome challenge coin if you do it so if you're connected to a university please chat with me afterwards I'd love to to get you involved in that okay and then last thoughts as we begin the Q&A consider what kind of incentives uh will lead to the network you want make allies make sure to teach them about the importance of uh encryption privacy Freedom around the world please join the tour Network as a relay or a bridge or a snowflake if you don't know what those mean happy to chat with you afterwards but but please help out in uh in providing privacy to people all around the world um and yes we're a nonprofit and I'd be uh happy to get your donations in whatever cryptocurrency you would like to provide thank [Applause] you thank you so much for that Roger a little reminder that our privacy should be ours to choose now to get straight into the questions what were the most challenging legal obstacles you encountered throughout tour's history have any of them ever caused you to wake up in a cold sweed night yeah um what a great question so uh a lot of it a lot of so originally we started out working with some government people and soon after that we were funded by eff Electronic Frontier Foundation and they wanted us to exist as a demonstration of a good example of privacy so if there were a lawsuit happening like the tornado cach one now they could say look you can't just make all this stuff illegal because Torah is one of those things and it exists it it already exists you can't just get rid of it in the world so I think uh in terms of the most challenging legal obstacles I don't want to say that we've had a a smooth ride but uh but we've worked really hard to try to uh to make sure that everybody knows about the good uses of tour and I think that's a really important piece of it which is challenging because there are governments out there trying to scare people about privacy and and say only criminals need to have curtains in their walls so we need to to keep fighting on that one um have any of them caused you to wake up in a cold sweat at night probably not the legal obstacles how do we scale this thing how do we keep Communities going how do we actually provide good safety uh even in the face of governments trying to attack it or some jerk in Russia trying to tear it apart so technically more than legally all right is it possible to track a user's tour activity by running a significant number of tour nodes does this this actually happen in practice uh theoretically yes if you run enough of the network then it should be possible to to match up the math looking at flows coming in and flows going out uh does it happen in practice not that we know of we actually know a lot of the people who run the relays around the world they're part of the relay associations that I I talked about earlier uh but that said so that's the good news probably people are not successfully attacked the tour Network by running a lot of relays if you've heard rumors like I heard the FBI runs half the tour Network that's garbage we know the people running half the tour Network they're not FBI that's the good news the bad news is the internet is too centralized there are not very many cables going across the oceans there are not very many websites web servers like cloudflare and aami uh so everything there are not very many telephone companies most of the internet runs in northern Europe so there's too much centralization there in general and that limits how much privacy we can actually provide on the internet if you gave me a more decentralized internet I could build you a stronger safer Tour all right how can ethereum help tour yes um so one answer is we're a nonprofit we'd love to have your donations that's the easy answer um another answer is we need the world to understand why tools like this can be used for good so you're in the same fight with the tornado cache situation trying to figure out how do I explain the value of these things and you've got some bad people using it and similarly Tor has something like 8 million daily users including some jerk in Russia trying to do whatever they're doing so how do we uh win the next round of crypto Wars and help the whole world understand the importance of these things uh while at the same time Hollywood is making a new story about a new movie about some dude in a hoodie and um and only bad people need need privacy so I think uh one of the big answers is we're in the same fight for the next crypto Wars all right we are out of time but maybe we can squeeze in this last one is it safe to run a tour exit node what are the potential security and legal issues on that yes so many people run tour exit relays all around the world and in almost every situation it is legal to do so there are legal safe harbors that make you in the same category as the telephone companies so legally it's actually pretty straightforward you're all set the the challenge is your relationship with your ISP because you run a tour exit relay eventually somebody sends an abuse complaint and your ISP says oh my God what's that and that's your point where you have to communicate with them and have that relationship built so that people so that they understand what you're doing so it's not a legal question it's about finding an ISP that is that that agrees with you that this is important all right thank you so much Roger can we get a round of applause for Roger [Applause] please yeah and I will be around I'll be around to answer your questions for as long as you have them I think there's nothing happening right here so I'll do it here eventually we'll go out there uh ask your questions as long as you've got them thank you all right