Cryptography is an inherently defensive tool; it hides your information from adversaries. This is crucial to prevent censorship or monitoring of your data. But it's often sold to consumers with fearmongering about all-powerful malicious actors, which is often ignored by all except the privacy-conscious. We explore real-life examples of offensive cryptographic affordances like interoperability, efficiency, and user consent as stronger motivations for the masses to migrate to cypherpunk tech.

Stage 4

Cryptographer and designer @ Cursive, working on cryptography for human connection

Vivek Bhupatiraju

Making defensive technology offensive: How to get cypherpunk ideals to the masses

 Cool. Hi, guys. So my talk is going to be about basically, like, focused on cryptography as defensive technology, because that's my area of expertise, how we can take various cryptographic tools that are super powerful and try to find ways to be clear this is more like encryption signatures EAPs this sort of thing obviously under the umbrella of like DIAQ and defensive technologies there's lots of other stuff going on and I think how I would personally define cryptography is that it's the art of making things hard to break in this definition it is like very inherently a defensive technology you're literally trying to make tools that is very difficult for adversaries to forge or break into or otherwise sort of damage the integrity of. And I want to look at just a very small set of examples here. This is not comprehensive at all, but at one really prominent use case of privacy-preserving technologies in the wild, which is VPNs. And VPNs, I think if any of you guys have been to, like, New York or Chicago or a couple other major American cities, you might have seen these, like, Mulvad VPN ads everywhere. For context, I personally use Mulvad, so this is not really a dig at them, but a lot of their ads are very sort of, like, a bit of both, like, hopeful, but also kind of, like, fear-mongery, and I honestly am not sure how successful this has been for them. I definitely know for myself, like, I got Mulvad before these ads came on, and, like, when I do see them in, like, the subway, in the train, I'm, like, I always think, like, is this, like, do people want to see this sort of thing? And, like, one reference point in my mind that I have is NordVPN, a lot of these other VPNs, this is not actually an ad from them, to be very clear, but if you're a big YouTube user, you know that Nord and Express, these sort of VPN companies, are major funders of every YouTuber. And it's really interesting to see how that marketing has changed over the past few years. I feel like initially it was very much focused on, oh, this will protect you from your internet provider seeing your history. And often that's still mentioned, but actually most of the time now, the emphasis of the ad reel is always on you can watch Netflix in other countries. You can do this new, you have this new affordance from using this VPN. And it's always kind of what they talk about for a little bit longer. And I feel like it is a very good representation of the fact that I think users will generally respond to things that are value adds and not purely sort of defensive measures against some sort of threat. And to be clear, I'm very much a cypherpunk, and I deeply believe in this technology. But at the same time, I also believe that if we're not able to do this sort of communication work, we're not going to be able to get users the defense and safety that they deserve. And so I want to talk through just a few different kind of like high level affordances that I think are worth leaning into and talking about more. The first is the idea that privacy is really ownership. And I think ownership is something that a lot of people feel all more viscerally with stuff like, you know, big social medias, like hosting all your photos. You don't own any songs anymore with Spotify, and I think there's a general sense of, like, this is something that people, like, don't have that they wish they did. And in general, I think, like, one really nice thing is that with cryptographic tools, with signatures, with signed data and all sorts of different things, you get to actually, like, own your own data and have it be verifiable. But then if you want to actually maintain privacy on top of this, it works hand in hand with other tools like ZK. And really, if you own something, it is almost to some extent private to you. You should be able to keep it to yourself unless you want to share it. And a lot of cryptographic tools give you exactly that. Another is the idea of user consent. And this comes up in a really interesting way with something called multi-party computation, which is this cryptographic tool where multiple parties get to sort of do a computation on their private data. There's actually a really nice feature where if one of the parties leaves the protocol or otherwise just decides that they don't want to be a part of it, no result is reached. And I think this is actually a very nice positive feature where it's usually viewed in a lot of protocols as like a bug where user consent is almost like mathematically required. And I think this is like an offensive useful thing that people would be able to understand. Another side of portability or interoperability or verifiability, like they're all kind of the same thing. And I think a bunch of really cool use cases of this, like one is like portable social graphs. This is like an app experience that I've been building with my team where you're essentially tapping different folks and building a private social graph that also you can take with you to other apps as you wish. And I think this is something that a lot of us are feeling now when we're like locked into sort of social medias that aren't really working for us anymore. Another really good example is just all personal data. Stuff like ZK email enables you to take things in your own email and basically make proofs about them, share them with other people in a way that means they don't need to just live in one service. And finally, I think an underrated one is efficiency. There's this new idea that we've been exploring called narrowcasting, which essentially, basically, if people do have their own ownership and privacy over their own data, you can basically send messages in a way that will only be read by the people who match this criteria. And so in a sense, you can actually use cryptography to more efficiently disperse information in a way that's privacy-preserving. Really quick, where you can experience this, we have a booth downstairs, my team cursive, where we're showing an app experience that has a bunch of these different features baked in. One thing I'll call out is something called private set intersection, which lets you see what you have in common with other folks. And, yeah, there's going to be some more features added in. This is where it is in the booth. And, yeah, that's the talk.

https://streameth-develop.ams3.digitaloceanspaces.com/transcriptions/6734a08f9dbb7a90e1469361.vtt