Alexia Lorenza, DevRel, Nym
Ade Head of Business Development, Nym

Clemence: Alexia, Ade, how did you end up in the Web3 world and why did you join a privacy project?

Alexia: Thank you. It's a pleasure to be here. So how did I join the privacy ecosystem and the Web3 ecosystem? So this started in 2016. It's a bit of a cliched story. But at the time, I was a student at a business school and I was looking into investing the little bit of money that I had. And I had a trader friend who told me to look into an emerging tech called the blockchain.
Through my research, I stumbled upon the Bitcoin white paper, I loved the rationale and the philosophy. And I decided to join the industry. This officially happened in 2017 when I started working for aself sovereign identity protocol - everything that has to do with the idea of a decentralised identity. While I was working there, I became increasingly more interested in the notions of trust, power and privacy. And I started working on a privacy-oriented project with a friend who's a cryptographer, which was called Enigma, which we managed later on to get incubated at Mozilla.
But we had issues monetising, which is something that we're solving at Nym. Because of these issues, I rejoined a full time job at Tezos, which some of you may know, which is an L1.



I stayed there a few years later, joined a DeFi protocol, as head of growth. But throughout time, and throughout the years, I wanted to take a deeper dive into the tech side of things and the privacy side of things as well, which were topics I was always fascinated with. I had been following Nym for a while. And here I am now as a DevRel. So you know, it's like a dream come true. It's been a wild ride so far. But I'm super happy. Because I love the team and I love the cause. So that's me.
Ade: Thanks for having me Sudo and Clemence. And also great intro Alexia. I've got a lot to live up to. But my story started in 2017, as well, funny enough. By that time, I had spent a number of years in management consulting, for my sins.
And I had been looking into Web3 as well. And I was pretty sure that it was going to change the world wide web as we knew it. I joined a VC firm to invest in in Web3 companies. I figured this was the best way for me to get my foot in, and to have access to a breadth of projects doing a lot of interesting things. Fast forward to today - as head of business development for Nym, I believe that privacy is very important because it's actually a right, I see it as a right for everyone rather than a privilege. It's important for everyone to be able to have control of their data and a say in where they share it and when they share it. So that's my story.
Alexia: So in today's presentation, we're basically going to talk about three things: Web3, privacy, and Nym. During the time that we have together, what we'd like to do is try to make you understand why privacy is increasingly becoming a necessity, not only in the digital and Web3 realm, but as well as how it translates into the physical one.
To do this I'd like to start off with a quote from one of the books that I found to “have invaluable impact on the matter:
“Personal information is increasingly used to enforce standards of behaviour. Information processing is developing, therefore, into an essential element of long-term strategies of manipulation, intended to mold and adjust individual conduct.” - .
This quote comes from a book that is written by Shoshana Zuboff, which is called The Age of Surveillance Capitalism.
Shoshana is a Harvard professor at the Harvard Business School. She's also a faculty associate at the Harvard Law School and a centre called the Berkman Kline Centre for Internet and Society, which is basically a research centre within Harvard University that focuses on the study of the crypto space.
And I think if I remember correctly, it was founded in ‘96.
So basically, to some extent, we could argue that this lady knows what she's talking about.
What the author argues is that surveillance capitalism unilaterally claims human experience as a free raw material for translation into what she calls behavioural data, which are declared as ‘proprietary behavioural surplus’, fed into advanced manufacturing processes known as machine intelligence, and used to feed what she calls ‘behavioural futures markets’.
The book takes us through the ‘70s and the ‘80s to understand where all that came from, how it developed, etc. The key message here is basically about prior changes to capitalism helped loosen regulations and change attitudes for the online age.
So hopefully, all hope is not lost. But we need to take action.
And how do we do that?
Well, you wouldn't be here if you did not have any idea on how to do that already.
As I mentioned previously, today, we're going to talk about three things, Web3 being one of them.
The first thing that we're going to focus on is the quick history of Web3.
For those of you who have been in the Web3 space for a while, you have probably seen this slide, or variations of this slides pretty much 100 times.
But it's still interesting to go through it so I'll quickly do so.
At the very beginning, there was web 1.0, which stemmed from 1980 to 2000. It's what we call the static web. It basically began as a collection of static web pages, with basic text and limited graphics, which was primarily used for sharing information and research amongst academics and governments.

We all know how the web started. And it was quite limited in terms of the feature or the creative capabilities for users. Slowly slowly in the year 2000 to the year 2010, we evolved and got to what we call Web 2.0, which is also called the social web – basically characterised by user-generated content.
But of course, with user generated content we saw the emergence of what we call data commoditisation, which is a topic that the author Shoshana talks extensively about in her book.
I was still a student at the time, but I remember how trendy almost a decade ago big data and analytics were. I was in a business school programme and I remember all my friends wanted to become data analysts. And I'm not arguing that data is a bad thing - I truly believe that we need data points to understand the world and to be able to improve ourselves.
But the relationship that we have with whomever uses that data and our data should be consensual, right?
Otherwise, it leads to cases such as Cambridge Analytica, and that data can very easily become a political instrument for manipulation, which is the whole argument that Shoshana makes in her book, which is very valid today, and especially in the Web3 world.
And so all that led to the Web3 world, which started in the 2010-ish years to today. And the idea of the Web3 world is that it's a semantic and decentralised world that's characterised by a more context aware web.
So basically, giving machines the ability to process and understand information, data ownership control, privacy and privacy by design.
So when we ask ourselves the questions: why Web3, why do we need it? We can't really answer them without looking at Bitcoin.
And so if we look at the birth of Bitcoin, we really start understanding how needs in the physical or real world translate into the digital realm and vice versa.
Because again, Bitcoin, and through its white paper, Bitcoin: A Peer-to-Peer Electronic Cash System, was meant as an alternative to the traditional financial system. Again, looking at its birth, it was birthed in the aftermath of the global 2008 financial crisis, where the idea of creating a trustless system - and this idea of trustlessness is really key when we talk about Web3.
If we want to translate this idea in technical terms, we could argue that trustlessness is achieved through the consensus protocol.
In the same way, we have adjacent ideas, namely, disintermediation and self sovereignty. In technical terms, we could argue that disintermediation translates into the network of nodes that we see in the different blockchain ecosystems.
The explanations are in the slides:



[Slide description:
[In his original whitepaper, Nakamoto hinted that self sovereignty meant pseudonymity – and acknowledged that it was difficult to achieve full privacy, but that additional privacy layers could be built on top of Bitcoin.
[Disintermediation meant the nodes network – the creation of P2p infrastructure that does not rely on a centralised authority.
[And trustlessness meant the consensus protocol – born in the aftermath of the global 2008 financial crisis, the first block mined by Nakamoto included a message referencing a headline from the Times newspaper that day, which read, ‘Chancellor on brink of second bailout for banks’.]
These three points I would argue are the foundational ideals.
I'm not saying that web three as it is today, is entirely and currently fully designed with these principles in mind, especially when we see everything that's happened with [inaudible] with Sushiswap, etc.
But it's slowly trying to get there.
***



[Next slide description: Web3 and its key characteristics.
[Decentralisation: Web3 is built on the principles of decentralisation. It seeks to reduce reliance on centralised intermediaries, such as tech giants and traditional financial institutions.
[User control: In Web3, individuals choose how and where their data is stored, and how it’s used
[Self-sovereignty: Web3 promotes the concept of self-sovereignty through digital identities, where individuals own and control their online identities, reducing reliance on centralised identity providers.]

***
We sort of wanted to clarify the key characteristics of Web3. Which are namely: decentralisation – Web3 being built on the principles of decentralisation meaning that it seeks to reduce the reliance on centralised intermediaries. User control, which we can especially see illustrated through SSI protocols so self-sovereign identity protocols. And then self sovereignty. Same thing as user control.

So this is a bit of another long shot that I took but I think it's quite interesting to make a parallel with the evolution of web three with societal development and the increased need for privacy that we have.
If we take the societal standpoint, we could argue that from barter and nomadic hunter gatherer-style economies, in which were basically hunter gatherers, we began cultivating crops and domesticating animals, and that led to the rise of agriculture-based communities.
From nomadic, we moved slowly into a more sedentary lifestyle, because we had more food so we could afford to. That led to population growth, later on to the agricultural revolution. Settlements grew into cities. And the cities formed the basis of the different early civilizations that we saw – Mesopotamia, Egypt, etc.
Slowly after that, we saw the specialisation of labour at its very early stages. And that basically led, centuries and wars later, to the Industrial Revolution.
After the industrial revolution happened, we started seeing a shift to a consumer-space society, given the new production abilities that we had.
What's interesting is that this consumerism exists both in the physical and digital levels. We could argue that to some extent, it is what has led us to the issues that we have with current data commoditisation and increased need for privacy that we see today.
This parallel can be drawn to some extent to the Web3 world, which is can be basically translated as, Bitcoin, by being a p2p electronic cash system, was like our early barter economies, in which basically, we traded things in a disintermediated, p2p fashion.
Ethereum came around and with the emergence of smart contracts, it allowed us to develop more complex verticals, such as the ones that we see today. So DeFi, NFTs, DAOs etc. So we can draw the parallel, where the industrial revolution happened in the real world, and now in the Web3 world we are at the point where all this data is aggregated into this immutable ledgers, because that's how blockchains work. And in the real world, we have all these big tech companies monetising our data.
So the main key takeaway here is just that as societies have evolved from basic trade to more complex data driven economies, we basically see the similar trajectory being followed by web three.
With all this, we justify a clear need for privacy.
Although decentralised, enormous amounts of data in Web3 remain unprotected.


The main point here is something that I see a lot of people being confused about when we talk about Web3, which is that decentralisation doesn't mean privacy. I think it's quite obvious to most of you, but it may not be to everyone.
Why should we care about privacy? Well if you didn't like what I've presented before, then I will hope and I will try with the next slides to change the approach, and go from a theoretical approach to a more concrete understanding of why privacy is important and why privacy matters in Web3.
Let's start with the DeFi vertical. Here, the list is much more extensive.
I've just focused on the examples that seem the most obvious for us. I'm not arguing that, you know, a technology such as Nym can target all of these. I'm just arguing that you know, due to lack of privacy, whether it's at user or a solution architecture level, leads to these attack vectors.
So the first one being transaction instability. As we all know, as all the transactions are recorded onto a public ledger, analysing transactional patterns becomes trivial.
Basically an attacker can link a user's wallet address to potentially a real world identity or any other wallet addresses.
This is the first problem.
The second, front running, which most of us are aware of. Front running happens when an attacker observes a pending transaction onto the blockchain’s mempool and try to execute that specific transaction just with a higher gas, ensuring that his transaction will go first and thereby confirming the actual user.
Then we have MEVs, so minimum ore miner extractable value.
The idea here is basically that miners and validators are looking for arbitrage opportunities between different transactions, reorder and prioritise the transaction that allowed them to make a profit.
There's been different ongoing discussions in different ecosystems about how to address these MEVs.
Again, these are not really huge level problems that can be solved, but more like architectural level, but still privacy linked. So pretty important here.
And finally, another type of attack vector is what we call the Eclipse attack. And basically, the idea of an Eclipse attack is that we're going to have an attacker that's going to target the connectivity between a victim's node, and the rest of the blockchain network, by surrounding his node with malicious nodes, leading to the compromised identity of the victim’s node, and potential financial losses.
If we look at similar attack vectors in the NFT vertical, we have three main points which are kind of interrelated to the idea of transaction linkability, but could be branded differently and have a few points of differentiation.
The first one being pseudonym deanonymization. So again, like a lot of NFT transactions are transparent and recorded in the public ledger. And that makes de-anonymizing trivial.
Tracking and profiling is a bit different, but basically, because the fact that belonging to an NF T community can reveal much more about yourself than a simple financial transaction. And thereby, this can be used for profiling purposes at a different level.
And it is actually currently being used by Web3 growth tools. I'll talk about that later.
Finally, transaction linkability, which is the same notion we were discussing when we were having a look at the DeFi attack vectors.
We can go to the next slide...
So now infrastructure: with this slide, we're taking a bit of a step back. We'll stay at a high level, because the details don't really matter and are pretty complex.
But basically, for L2 private chains – even if a chain brands itself as private, the zk-proofs or whatever they're doing are constructed after the user submits a transaction or interacts with what we call the sequencer and thus the metadata and the IP are leaked. So what they do afterwards doesn't really matter, basically, even by using a privacy-oriented wallet network traffic and meta data are still exposed and can reveal pattern about users.
And then we finally have RPC service providers. And that links back to the previous two problems. And what's interesting here is that we could potentially argue that RPC service providers could be seen as a single point of failure.
And that puts privacy at risk as they could potentially expose a user's IP address and reveal his or her online activity and location to third parties.
So how do these manifest in real life? Why should we care about online Web3 privacy?
I'd like to illustrate that with a few real life use cases.
So the first case - which I call the Venezuela miners hunt – which happened in 2018.
The main key takeaways here are that in Venezuela, individuals were turning to cryptocurrencies and to mining as a means of survival and as an economic opportunity due to the country's economic crisis.
What the article highlights is like are all the risks and challenges that were faced by these miners, including threats of violence, detention and extortion by the local government.
Which is why I've put this quote – from the author of the article, writing about Mr. X, who was his main point of contact when drafting the article.
The quote goes: as I read and reread his email describing Bitcoin miners being hunted, raided, extorted and arrested by local police and confirmations of the rumours of state-level Bitcoin mining going on, I realised the magnitude of risk Mr. X was taking.
The back and forth between Mr. X and I went on for almost three months. I feared everyday for his safety and still do, as well as the many Venezuelan people putting their lives at risk mining Bitcoin.
And what's even more interesting is that through the article, Mr. X, kept emphasising the importance of concealing any sort of PII (publicly identifying information). So, private information, and maintaining a low profile to avoid detection by these authorities. So privacy matters in real life.
If you don't think that was telling enough, there's a second case, in China in this case, which involved a lady called Elizabeth Bisbee, who was the head of investigations, attesting at the US Congress, I think, against another person called Roman Sterlingov, who was the alleged creator of a mixer called Bitcoin Fog.
And through her testimony, she kept mentioning that she was unaware of scientific evidence for the accuracy of the Chainalysis software they use, which is called Reactor.
They couldn't provide any statistical or scientific evidence supporting the software's accuracy.
Basically, the whole discussion highlighted the fact that at this point, Blockchain analysis is more an art than a science, which is something that becomes a big issue when these tools are used by law enforcement and governments to convict people for crimes – we eventually aren't even sure they've committed since we don't have proof it.
There's been other cases claiming to be able to deanonymise mixers, which is pretty difficult.
They all had to do with metadata, so metadata matters.
The last case I want to focus on is the Metamask IP scandal, which most of us are aware of, which involves recollection of more than 31 million user’s IP addresses when they were interacting with an RPC provider called Infura.
And I've added a quote directly from the consensus blog, which reads: “when users interact with Ethereum or other blockchains, such as sending a transaction or requesting a balance through an RPC provider such as Infura, the provider receives both the user's IP and the wallet address to provide the service. This is not Infura-specific and is consistent with how web architecture works generally.”
Here you see the key issues: IP and wallet addresses are linked. This is not specific to one solution it is specific to how the entire architecture works. And this is what we're trying to solve at Nym.
I think that by now we understood the importance, the needs and the current opportunities that privacy offers.
Again, privacy is the basis of self sovereignty. Privacy is a precondition for people to have control over their online identities, and eventually over their lives, as we've seen with the previous cases.
Privacy primitives are maturing - so what are privacy primitives? They are basically the fundamental building blocks that are used to build and enhance privacy-oriented solutions.
These are developing, stabilising and gaining popularity. We can see this through the weekly requests that we've seen go through a group called the Universal Privacy Alliance, for projects wanting to join in.
Privacy is even more critical in Web3 due to the existence of immutable ledgers. Whether we talk about layer one, layer two, or layer zero, which is how we position ourselves at Nym, you'll understand later why privacy is key.
Our solution: how do we address that?
Nym - what are we? We are basically a decentralised, incentivized network level privacy infrastructure.
I know this is a mouthful, and I will be explaining what that means.
Decentralised: we are decentralised through the architecture. We are a privacy infrastructure, in the sense that we leverage different technical components to create this infrastructure.
The first one is what we call the Nym mixnet. So a mixnet is a technology that was invented by David Chaum. The mixnet is basically a tool that can help prevent traffic analysis by what we would call a global adversary. So exactly what was happening through the real-life cases I was talking about.

This mixnet is incentivized. How is it incentivized? Through what we call the Nym token, which is a utility token.
This new token lives on a chain which is called the Nyx blockchain, which is a CosmWasm enabled blockchain.
This is why we say we are decentralised and incentivized privacy infrastructure.
On this infrastructure, we also leverage what we call zk-nyms, Nym credentials.
I'll get into the details of that later on. All this works on the network level.
So this slide is basically a simplified version of what's called the official seven layers OSI model. OSI stands for Open Systems Interconnection. It's a conceptual framework that is used to understand and standardise how different networking protocols and technologies interact within a computer network.
The idea here is that Nym works at the network level. And by working at the network level, we can basically be integrated or integrate into anything that's above – so any sort of application, anything that uses a network to route traffic.
What's important to understand here is that although in the OSI or the five layers model, we are at level three, so network layer,we brand ourselves as a layer zero in the Web3 world.
We could argue that any blockchain ecosystem would here and this model be at an application layer, which makes us layer zero for these ecosystems.
Being layer three in the OSI model, or layer zero for other ecosystem, explains why we can claim that you Nym can go beyond web three, as the mixnet can be basically used to power web 2.0 solutions.
And when we talk about Web 2.0 solutions, we talk about secure messaging apps, secure document sharing and collaboration platforms. Anonymous blogging and publishing, microblogging whistleblowing platforms, email services, file storage, etc, etc.
In Web3 wallets, Max, who is the head devrel, has been working on integration with libp2p.
And libp2p is basically like a library that is built on top of, and so that would give builders the ability to use the mixnet directly from libp2p.
RPC service providers, which we've talked at length before, privacy alters the same thing and IBC-enabled chains, since we are an IBC-enabled chain ourselves.
So broadly speaking, anything that has to do with any sort of network interaction, meaning sending data, sending transactions, payments, anything really.
Here is basically an overview of how as a builder, integrator, or just someone who's really curious about Nym could build, use or integrate with them.
With building, there are three tools we could leverage, the first one being the different standalone clients that we have, which for a builder, we would not recommend, we would only recommend as a last resort.
And we have three standalone clients which is WASM, WebSocket, and SOCKS5.
We have the TypeScript SDK, which can be arguably seen as a wraparound around the Wasm clients. That allows builders to use what we call mixfetch, execute and query on the Nym smart contracts, send and receive traffic over the Nym mixnet, and buy and consume zk-nyms.
Rust is very similar, the Rust SDK will most likely be called mixReqwest.
And so now, if you want to use as a user, not necessarily a builder, you're not necessarily really good technically, you will have the ability to use the credentials, buy the credentials to use our mixnet in the coming months, and also connect existing platforms through a tool that we've created, which is called NymConnect, which is basically a GUI app. So just an app that wraps around the SOCKS5 clients that we have, to proxy up traffic through our mixnet.
The last one, which we're currently using for different integrations with the partners that we're collaborating with, is called mixFetch.
So mixFetch is arguably part of the TypeScript SDK. And the idea of mixFetch is that it’s a drop in replacement for the Fetch API, and basically allows the builder to route calls through the mixnet.
We're done! I will let my partner Ade step in now.



Ade:
So the first use case here is data ownership. Ocean is doing this really well. It allows the user to own their data, to say where they want to distribute it and if they want to, they can even monetize it, rather than this being put into the hands of some private company.
Next is decentralised, decentralised identity and this has been done really well by Polygon ID.
A real world use case of this would be, say, if you wanted to make use of some health care services, you could expose just your name, and your date of birth to the health care provider rather than your whole ID card. Then this would give you access to the service.
Next is Brave and private browsing. For many years now, they have been pioneering private browsing, allowing you to surf the web without getting tracked or without being bombarded by adverts.
And all of these use cases need a layer-zero technology like Nym to provide the level of privacy that we can afford.
Right, so let's look at privacy and DeFi.
So stepping through this, from a user perspective this time, privacy and DeFi means reducing the risk of targeted attacks.
If a hacker cannot link your trades to your IP address, then it makes it a lot more difficult for them to target you personally with their hacking attacks.
In the same vein, privacy allows you to keep a hold of your strategies when doing trades, which means that you can now start to trade on the same level as some of the biggest asset managers out there who have their own proprietary strategies.
Avoiding front running, which Alexei already touched on.
Financial autonomy is also very important. So users should be able to see where, how, and when they want to make trades.
Something that we probably don't think about enough is regulatory compliance. With privacy and DeFi it actually makes it a lot easier for users as well as DeFi platforms to adhere to some privacy regulations that have been set by government bodies.
Okay, encrypted communication: so communication in messaging – we’ll start with data integrity.
Privacy allows you to vouch for where a message originated from, as well as the contents of the message. You can know for sure that the contents have not been tampered with.
You can also know for sure, who sends the message and you can choose definitely where that message is going to.



Last but not least, you have protection against surveillance. With privacy, your messages are not at the whim of nation states or private companies who want to see what you're sending to other users.
Very interesting is the recent partnerships that we have forged at Nym.
The first one is Aztec, and as well as Alephium, which is a wallet that gives you access to Bitcoin level security. Now, both these projects are doing really interesting things. But without the privacy and the IP address obfuscation, as well as the geolocation obfuscation that the mixnet offers, they wouldn't be able to provide the sorts of privacy that we are allowing to take place today.
48:41
Okay, so let's look at a recap of what we've learned today.


48:51
We’ve touched on DeFi, we’ve touched on messaging, and that brings us to the end of this session. I hope you've all gained a lot from it, and you found it useful. Over to you Sudo.



##################### Q&A ######################


What do you say about Web3 social networks in the context of privacy?
Alexia: Everything depends on how the architecture of that platform will be designed. And about how data, personal information, metadata, could potentially be leaked… I know that the idea is to leverage a lot of the self sovereign identity infrastructure and making the user sovereign over their own data. But again, it really depends on at the core, how these platforms are going to be designed. Because otherwise, it just doesn't make sense.

Ade: Yeah, and second, it's all about owning your social graph, but the ownership only goes as far as how much privacy you have over that social graph. And if you don't, then you don't really own it.

Can the Nym privacy protocol be accessible in countries where the internet usage is controlled and monitored by the government – i.e. Gulf countries and North Korea?


52:48
Alexia: It is a really good question. I mean, the mixnet has nothing to do with blockchains, it's just a technology that can potentially be leveraged anywhere. We had a use case in which we translated an article for users in in the Middle East that wanted to access Telegram through a tool that I've introduced, NymConnect. So basically, rerouting Telegram traffic through our mixnet via NymConnect. [Nym DevRel] Serinko and part of the team were involved in coordinating with the team to make sure we could post an article to teach people how to do that. So yes, definitely it can be done.


Is Nym layer-0 or layer-3? What’s the deal with that?
54:01
Alexia: Basically, if we look at what's called the OSI model, which is the model that I introduced, we are at the network level. This model looks at network infrastructure. So it has nothing to do with application level, which is, blockchains.
When we refer to ourselves as layer zero, we're talking about in the blockchain realm, or in the application realm, we are the layer zero.
There’s layer one, layer two, layer three, layer four, layer five,
55:18
This is the simplified OSI model with layer one, layer two, layer three. We are at layer three, networking, but blockchains would arguably be at layer five. Because blockchain ecosystems will be here at layer 5, we are the layer zero of an infrastructure that's here – that's above the layer five, if that makes sense.
55:46
Ade: another way to think about it is as two different universes. The OSI model is looking at the Internet infrastructure universe. And that's where we're at layer three. But if you're looking at the blockchain universe, where L1s and L2s are maybe the trains and carriages and so on, the mixnet would be the rails which these trains are running on. And that's why we're a Layer Zero in the blockchain universe rather than the layer three in the OSI universe.
56:27
Alexia: It's a bit more complex than this. I mean, it's not as binary as I introduce it, but that's the main idea.
In order to show the potential of Nym to protect our internet activity, we could address the controversial issues mentioned above. But what would be the easiest way to explain it to people who are not involved with this technology?
57:13
Alexia: Network level is important. I think the key is to make people understand that we work at the network level, which means that we're Web3 agnostic. We can potentially be integrated with anything that uses a network. And that's key with the examples that we've introduced, you know, whether it's whistleblowing platforms or microblogging, anything that sends data can use Nym basically. But it is a complex technology.



58:04
Ade: Okay, I've got an interesting analogy. You know Alien versus Predator? You know how the predators have this invisibility cloak? The way I see it is the internet is the predators without the invisibility cloak, you bring the mixnet in, and with the mixing the relaying and the encryption that goes on, your internet traffic now has this invisibility cloak and allows you to keep your privacy when you're using the world wide web.