1
00:00:00,000 --> 00:00:04,880
Welcome to the Crypto and Privacy Village on this nice Sunday morning.

2
00:00:05,200 --> 00:00:08,060
I appreciate that you got up or stayed up.

3
00:00:08,680 --> 00:00:12,780
And we've got a good lineup of speakers today.

4
00:00:12,940 --> 00:00:15,380
And we're starting with Ryan Lackey.

5
00:00:15,480 --> 00:00:20,500
And he's giving a great talk on Cypherpunks history.

6
00:00:21,880 --> 00:00:23,360
Great. Thank you very much.

7
00:00:23,460 --> 00:00:25,000
And, yeah, definitely. Thanks.

8
00:00:27,160 --> 00:00:27,760
Thanks.

9
00:00:27,760 --> 00:00:30,280
And, yeah, Sunday morning is always a fun day at DEF CON.

10
00:00:30,960 --> 00:00:32,760
11.30 is pretty early for me, too.

11
00:00:33,700 --> 00:00:35,980
So, yeah, my name is Ryan Lackey.

12
00:00:36,080 --> 00:00:43,040
I've been interested in cryptography since probably 1990 when I first discovered it when I was like 11 years old.

13
00:00:43,180 --> 00:00:50,620
It was just the thing that immediately drew me to being really excited about the possibilities of mathematics, computer science, everything else.

14
00:00:50,900 --> 00:00:57,080
And fortunately for me, I discovered IRC and then I discovered the Cypherpunks mailing list really early on.

15
00:00:57,140 --> 00:00:57,720
Like a couple.

16
00:00:57,760 --> 00:00:58,580
A couple months after it got started.

17
00:00:59,580 --> 00:01:02,920
So there's this mailing list that we're going to talk about called the Cypherpunks mailing list.

18
00:01:03,780 --> 00:01:05,080
It was founded in 1992.

19
00:01:05,580 --> 00:01:08,780
There were three guys that are individually really famous for a lot of other things.

20
00:01:08,920 --> 00:01:10,660
Eric Hughes, Tim May, and John Gilmore.

21
00:01:11,180 --> 00:01:12,480
They've gone on to do a lot of things.

22
00:01:12,620 --> 00:01:14,340
They'd actually done a lot of things beforehand as well.

23
00:01:15,160 --> 00:01:25,660
So it was really probably the most interesting place on the Internet to discuss cryptography, privacy, politics of the sort of techno-libertarian front.

24
00:01:26,320 --> 00:01:27,340
All sorts of other stuff.

25
00:01:27,760 --> 00:01:32,160
And it was really interesting for the whole 1990s, which was really exciting for me because I was a teenager and got to see all this stuff firsthand.

26
00:01:32,520 --> 00:01:40,960
I actually ran one of the first mailing list archives for this on my machine at MIT when I was a student, which became really interesting legally later.

27
00:01:43,220 --> 00:01:48,240
Just as a quick question, who knows about the Cypherpunks, by a show of hands?

28
00:01:48,680 --> 00:01:49,940
So maybe about half the people.

29
00:01:50,120 --> 00:01:52,640
Who was on the mailing list in the 1990s?

30
00:01:53,640 --> 00:01:54,360
One person.

31
00:01:54,640 --> 00:01:57,740
So this is going to be something that people hopefully are going to be interested in.

32
00:01:57,740 --> 00:02:02,720
They're going to be really excited about and then go look into after the fact because it's definitely worthy.

33
00:02:04,340 --> 00:02:12,400
So the reason you probably haven't heard of it as much is that it had this sort of like golden age in the 1990s, probably from the list founding in 1992.

34
00:02:12,860 --> 00:02:18,580
I'd say 93, 94, maybe 95 was really the high point of the list where lots of stuff was being discussed.

35
00:02:18,880 --> 00:02:27,180
But just as you've seen with other forums on the Internet, a lot of stuff came up later and sort of made it so that today it's essentially non-existent.

36
00:02:27,760 --> 00:02:28,800
All sorts of ideas.

37
00:02:28,960 --> 00:02:31,000
We'll go into these individually and talk about them in a minute.

38
00:02:31,280 --> 00:02:36,080
But I just want to describe some of the other stuff that happened.

39
00:02:36,340 --> 00:02:37,940
There was a lot of politics on the list.

40
00:02:38,140 --> 00:02:50,460
There was bad politics, which I'd say were like internet scene warfare, who gets to run the mailing list, a couple of court cases, trolling and spam like in a weaponized way.

41
00:02:50,560 --> 00:02:56,880
Like anything you see on Twitter or modern stuff, imagine if you had a centralized mailing list that people were fighting over.

42
00:02:57,740 --> 00:03:00,160
So there's a lot of bad politics, but there's also a lot of good politics.

43
00:03:00,240 --> 00:03:04,140
It's where people were discussing a lot of the big issues of the day.

44
00:03:04,200 --> 00:03:13,620
A lot of the legal precedents that exist today with like DMCA, the downfall of the CDA, things that are still issues today, ITAR, patents, everything else, were contentious issues there.

45
00:03:13,760 --> 00:03:18,320
And we didn't really have anything that went to reference.

46
00:03:18,660 --> 00:03:20,560
Like there was no history of these things.

47
00:03:20,580 --> 00:03:21,260
So it was the first time.

48
00:03:21,380 --> 00:03:22,440
And then all sorts of stuff.

49
00:03:22,460 --> 00:03:26,200
This was sort of the founding time of the Internet becoming commercialized, going from like NSFnet.

50
00:03:26,260 --> 00:03:27,720
And a lot of other stuff.

51
00:03:27,740 --> 00:03:29,460
From academics to being commercialized.

52
00:03:29,560 --> 00:03:31,080
So there were a lot of discussions about that kind of stuff.

53
00:03:31,560 --> 00:03:36,020
Ranging from people that thought government's evil, corporation's good, free market, whatever.

54
00:03:36,320 --> 00:03:39,020
Or corporation's evil, regulation can help people.

55
00:03:39,220 --> 00:03:41,920
And there were like pretty serious debates there.

56
00:03:42,080 --> 00:03:43,920
And I wouldn't say that debates are...

57
00:03:43,920 --> 00:03:46,600
Debates are often very good as long as they're constructive.

58
00:03:46,900 --> 00:03:48,460
And there were a lot of constructive debates there.

59
00:03:49,260 --> 00:03:51,160
There were a lot of really interesting people there.

60
00:03:51,440 --> 00:03:52,240
I don't want to...

61
00:03:52,240 --> 00:03:54,860
I think at the peak it was probably about 2,000 people.

62
00:03:54,960 --> 00:03:57,720
There were hundreds of people who actively posted on a weekly basis.

63
00:03:59,880 --> 00:04:04,920
And of those people, I think if you looked at people that were active in the 1990s in crypto,

64
00:04:05,220 --> 00:04:08,400
a lot of the people that are still active today were people from that mailing list.

65
00:04:08,480 --> 00:04:09,120
There's a lot of professors.

66
00:04:09,360 --> 00:04:10,820
There's a lot of people that have gone on to do startups.

67
00:04:11,520 --> 00:04:13,240
I was on the younger side back then.

68
00:04:13,300 --> 00:04:22,120
There were a lot of people that were maybe 10 or 20 years older than me that have gone on to be like tenured professors or VCs or have founded things and even retired at this point.

69
00:04:22,280 --> 00:04:24,400
There were some really famous people that we can go into in a minute.

70
00:04:25,140 --> 00:04:27,460
But just as a quick step, I'll go back.

71
00:04:27,460 --> 00:04:31,780
I have a mailing list archive that I just about 30 minutes ago put live again.

72
00:04:32,380 --> 00:04:34,560
Embarrassingly, I had a web server that had a hard drive that failed.

73
00:04:34,640 --> 00:04:36,140
It's still a physical server, not virtualized.

74
00:04:36,380 --> 00:04:38,060
And I left it offline for a little while.

75
00:04:38,800 --> 00:04:39,740
I put it back online.

76
00:04:39,920 --> 00:04:40,960
It's free, accessible.

77
00:04:41,240 --> 00:04:41,920
There's a web archive.

78
00:04:42,320 --> 00:04:43,480
You can go per message.

79
00:04:43,660 --> 00:04:45,200
There's also raw archives of the entire list.

80
00:04:45,400 --> 00:04:48,080
So as we discuss these things, you can then go back and search.

81
00:04:48,260 --> 00:04:51,840
And I submitted it back again to Google, so it should be searchable by the keywords.

82
00:04:52,000 --> 00:04:55,800
So if you find a keyword that you find interesting, you should get links on this pretty soon.

83
00:04:56,240 --> 00:04:56,880
And I'm...

84
00:04:56,880 --> 00:04:58,500
I have most of the archives.

85
00:04:58,780 --> 00:05:01,300
Hugh Daniel gave me a lot of copies a couple years ago.

86
00:05:01,820 --> 00:05:03,220
I then lost some of those.

87
00:05:03,280 --> 00:05:04,280
Then someone else archived them.

88
00:05:04,360 --> 00:05:09,580
So it was like this crazy thing where 600 megs of data was like a big deal back in the mid-'90s.

89
00:05:11,060 --> 00:05:12,920
But it should be pretty comprehensive.

90
00:05:12,920 --> 00:05:14,560
And I have some other ones that I'm adding to it as well.

91
00:05:14,960 --> 00:05:19,520
So the thing that's most interesting are there's a lot of ideas that were discussed on the list.

92
00:05:19,620 --> 00:05:23,000
And they were discussed over a period of years in multiple stages.

93
00:05:23,160 --> 00:05:25,200
There were initial ideas.

94
00:05:25,340 --> 00:05:25,880
And there was really...

95
00:05:25,880 --> 00:05:31,760
Really, people would discuss things in short comments, like one- or two-line comments and, like, reply to a mailing list.

96
00:05:31,860 --> 00:05:33,620
But people would also go out and write running code.

97
00:05:34,020 --> 00:05:35,380
The motto of the list is,

98
00:05:35,400 --> 00:05:42,940
The idea was that you'd have somebody build a proof of concept or demo something.

99
00:05:43,240 --> 00:05:49,500
And you'd actually get to see how it works in practice rather than spending, like, years discussing theoretically how something might or might not work.

100
00:05:49,700 --> 00:05:54,980
And as a result, you got a lot of really interesting but kind of janky prototypes built that were useful.

101
00:05:55,920 --> 00:05:56,200
Somewhat.

102
00:05:56,540 --> 00:05:58,480
But then you got other people that said, oh, this is wrong.

103
00:05:58,680 --> 00:06:01,800
And instead of just saying, oh, this is wrong, this sucks, they would actually build something better.

104
00:06:01,920 --> 00:06:03,840
And it would be sort of this iterative process.

105
00:06:04,480 --> 00:06:10,200
Which was really interesting because it was back before startups and commercialization were really the way that the Internet worked.

106
00:06:10,320 --> 00:06:12,700
So you had people that would be just building these projects.

107
00:06:12,820 --> 00:06:13,500
Like, I was a student.

108
00:06:13,580 --> 00:06:14,640
There were lots of people that were students.

109
00:06:15,040 --> 00:06:16,680
There were lots of people that worked for big companies.

110
00:06:18,020 --> 00:06:21,120
Tim May, one of the biggest people on the list, worked for Intel for a while and then was retired.

111
00:06:21,120 --> 00:06:26,860
So it was a really fast, like, iterative cycle of developing stuff and everything else.

112
00:06:28,340 --> 00:06:31,660
And so, yeah, so lots of these, it was very, very fertile for these ideas.

113
00:06:32,780 --> 00:06:36,320
So lots of things were discussed then and then have happened.

114
00:06:36,520 --> 00:06:38,720
These are some of the things that have happened, a few of them that haven't.

115
00:06:38,860 --> 00:06:41,020
I'd say onion routing is one of the biggest successes.

116
00:06:41,280 --> 00:06:49,360
So the concept of onion routing was discussed on this list and a few other lists in, I think, probably about 94, 95 was the earliest.

117
00:06:49,600 --> 00:06:50,780
I've been, I was looking through.

118
00:06:51,120 --> 00:06:57,620
And there were some academic people, Naval Research Laboratories, Paul Syverson and some other people there were working on it.

119
00:06:57,740 --> 00:06:59,100
And this is what we now know as Tor.

120
00:06:59,200 --> 00:07:01,580
It's gone through a lot of evolution.

121
00:07:01,960 --> 00:07:03,160
The Tor project now exists.

122
00:07:04,220 --> 00:07:05,940
It sort of got separated out from government.

123
00:07:06,400 --> 00:07:07,700
But it's been a long process.

124
00:07:07,800 --> 00:07:13,220
But this is something where the seeds have been, like, they were planted back in the 1990s.

125
00:07:13,220 --> 00:07:16,020
And this is a tool that's still under active development, active use.

126
00:07:16,160 --> 00:07:18,400
And it's probably the best system today.

127
00:07:18,500 --> 00:07:19,780
It's a system to anonymously.

128
00:07:21,120 --> 00:07:22,760
Not attributively connect to things.

129
00:07:23,740 --> 00:07:27,000
Anonymous electronic email was discussed on the list a lot.

130
00:07:27,160 --> 00:07:27,560
Remailers.

131
00:07:27,660 --> 00:07:32,360
It was one of the most technically advanced things that I saw on the list.

132
00:07:32,700 --> 00:07:38,960
The idea was that you could send email to a server and then the server would have a pool of messages and would resend them after a certain point.

133
00:07:39,220 --> 00:07:47,680
And this is one of those cases of iterative development where the first version was called a type 1 cypherpunk remailer that really wasn't all that great and had a lot of problems.

134
00:07:47,880 --> 00:07:50,700
And then we had Mixmaster type 2 remailers that were a lot better.

135
00:07:51,220 --> 00:07:52,460
That were built on top of that.

136
00:07:52,600 --> 00:07:55,480
And then we had Mixminion type 3 remailers that were under development.

137
00:07:55,760 --> 00:07:58,660
This was something that Len Sassaman worked on a lot.

138
00:07:58,940 --> 00:08:01,200
Unfortunately, he passed away a couple years ago.

139
00:08:01,820 --> 00:08:06,100
The field has largely declined because email has become less of a thing.

140
00:08:06,240 --> 00:08:08,400
Like, it used to be everyone liked SMTP.

141
00:08:08,580 --> 00:08:11,520
They had a lot of separate systems that would interconnect via regular email messages.

142
00:08:11,940 --> 00:08:19,440
Now people use instant messengers or on-site messaging like Facebook Messenger or whatever else, which has sort of led to the decline of remailers.

143
00:08:19,540 --> 00:08:21,100
It's one of the things that I think is the most underdeveloped.

144
00:08:21,100 --> 00:08:22,160
It's one of the most underutilized technologies.

145
00:08:22,700 --> 00:08:24,280
Sort of message-based mixnets.

146
00:08:25,120 --> 00:08:26,020
Anonymous e-cache.

147
00:08:26,220 --> 00:08:29,160
So everything you see about Bitcoin had precedence on the cypherpunks mailing list.

148
00:08:29,860 --> 00:08:31,120
It was really interesting.

149
00:08:32,160 --> 00:08:35,860
This is the one technology that got me interested in crypto and in the cypherpunks.

150
00:08:36,100 --> 00:08:44,480
David Chalm, a professor, an American professor who was working in the Netherlands, developed this, I'd say, from like 1983 to 1986.

151
00:08:44,540 --> 00:08:45,880
He patented a lot of it.

152
00:08:46,160 --> 00:08:50,920
And everything you see about Bitcoin except for one feature, this stuff does better.

153
00:08:51,100 --> 00:08:52,980
Faster, cheaper, everything else.

154
00:08:53,200 --> 00:08:55,920
The only downside is it's an inherently centralized system.

155
00:08:56,280 --> 00:09:00,220
It's permissionless in that anyone can spin up a server and do whatever they want.

156
00:09:00,520 --> 00:09:03,120
But it lets you set up a currency.

157
00:09:03,240 --> 00:09:05,880
But every currency has a server that has to remain online.

158
00:09:06,160 --> 00:09:12,520
So for a lot of reasons, 20-year cycle of development, Bitcoin eventually was successful.

159
00:09:12,680 --> 00:09:20,940
But the whole promise of blinded transactions where you can anonymously pay someone a currency or a transaction in cash, in AppCoin.

160
00:09:20,940 --> 00:09:24,800
All the stuff that's being discussed today has been already gone over for years.

161
00:09:24,960 --> 00:09:30,000
Prototype built, commercially built through DigiCash Incorporated, through a couple other companies.

162
00:09:30,020 --> 00:09:32,460
Everything else from the 1990s to the 2000s and on.

163
00:09:33,840 --> 00:09:38,700
One of the most interesting things that has sort of existed in various forms is BlackNets.

164
00:09:38,840 --> 00:09:40,600
Tim May created something called BlackNet.

165
00:09:40,720 --> 00:09:42,300
It was sort of the prototype for it.

166
00:09:42,640 --> 00:09:46,340
The cool thing about all these technologies is you can combine them.

167
00:09:46,660 --> 00:09:50,740
You take re-mailers and anonymous cash and together you have a way to build a server.

168
00:09:50,740 --> 00:09:54,380
That lives somewhere that can receive e-mail that you don't know where the physical server is.

169
00:09:55,240 --> 00:09:57,620
Receives payment, does something, and sends you back a message.

170
00:09:57,920 --> 00:10:00,800
And that's actually more secure than an onion site in a lot of ways.

171
00:10:00,980 --> 00:10:02,760
Because it can be separated out through time.

172
00:10:02,860 --> 00:10:08,340
If you have a high latency operation, you can very easily send a message and say,

173
00:10:08,440 --> 00:10:09,780
Oh, it'll take a week to get a response.

174
00:10:10,080 --> 00:10:11,980
And that protects you from a lot of things.

175
00:10:13,120 --> 00:10:15,880
But he created something that was basically an information market.

176
00:10:16,060 --> 00:10:18,680
And the idea was that you could say,

177
00:10:19,460 --> 00:10:24,680
I'm willing to pay X amount of money for, say, the source code to Windows 95 or something.

178
00:10:24,920 --> 00:10:28,600
And people would be able to anonymously fund that kind of transaction.

179
00:10:29,660 --> 00:10:33,640
We saw that later happen with Bitcoin and then Silk Road and things like that.

180
00:10:33,860 --> 00:10:35,580
So it sort of has a precedent there.

181
00:10:35,680 --> 00:10:37,600
And information markets where people would...

182
00:10:37,600 --> 00:10:40,500
There were all sorts of exciting things like the street performer protocol

183
00:10:40,500 --> 00:10:43,760
where you would come up with a bounty for people to create works of art.

184
00:10:44,980 --> 00:10:46,100
It's basically Kickstarter.

185
00:10:46,400 --> 00:10:48,600
So decentralized cryptography.

186
00:10:48,680 --> 00:10:53,360
One of the weirdest things was this concept of assassination politics.

187
00:10:54,100 --> 00:10:57,420
It's probably the most inherently negative thing on the list.

188
00:10:57,840 --> 00:11:02,720
It's also the thing that I had sort of a personal connection to.

189
00:11:02,980 --> 00:11:07,640
It was discussed on the list as an idea that no one would actually want to do.

190
00:11:07,720 --> 00:11:11,220
The idea was that you could create a bounty and a bet.

191
00:11:11,380 --> 00:11:14,880
You could basically create an assassination market that was a betting market.

192
00:11:15,100 --> 00:11:18,660
I predict that a certain famous person is going to die on a certain point.

193
00:11:18,680 --> 00:11:19,400
Or a certain date in a certain way.

194
00:11:19,780 --> 00:11:24,520
Obviously the best way to win your bet is to be the one who affects that operation.

195
00:11:25,020 --> 00:11:28,140
So it's sort of a weird legal hack where you have sort of plausible deniability.

196
00:11:28,400 --> 00:11:29,160
Never really tested.

197
00:11:30,580 --> 00:11:32,520
Normal people would think this is a bad idea.

198
00:11:33,720 --> 00:11:36,460
Unfortunately, or well, it's a trait,

199
00:11:36,600 --> 00:11:39,420
that there were some fairly non-normal people that were attracted to this stuff.

200
00:11:39,700 --> 00:11:43,900
One of them, Jim Bell, was on the list.

201
00:11:44,040 --> 00:11:46,720
And I think mentally a little bit unhinged.

202
00:11:47,260 --> 00:11:48,500
I never met him in person.

203
00:11:49,820 --> 00:11:51,860
He really was a big fan of this thing.

204
00:11:52,080 --> 00:11:53,300
And lived in Oregon.

205
00:11:53,520 --> 00:11:57,680
And incidentally to all that, he published about it and all sorts of other stuff.

206
00:11:58,060 --> 00:12:03,060
Incidentally, he set off some stink bombs at the IRS building in, I think, Portland.

207
00:12:04,380 --> 00:12:06,680
And there was some prosecution that happened.

208
00:12:06,980 --> 00:12:10,940
And for me, this was really relevant because in that court case,

209
00:12:11,120 --> 00:12:12,880
they subpoenaed my mailing list archive.

210
00:12:13,220 --> 00:12:17,280
And they wanted me to testify as to the veracity of the archives and everything else

211
00:12:17,280 --> 00:12:18,660
where he described killings.

212
00:12:18,680 --> 00:12:20,400
Killing federal officials and all sorts of other crazy stuff.

213
00:12:21,640 --> 00:12:25,660
I was living in the Caribbean working on an anonymous electronic cash system at the time.

214
00:12:25,900 --> 00:12:30,620
And it turns out that you don't want to go to federal court even as a witness.

215
00:12:31,000 --> 00:12:32,340
It's just never a good idea.

216
00:12:32,600 --> 00:12:36,280
And they don't really have any power to compel you to show up if you're outside of the U.S.

217
00:12:36,280 --> 00:12:39,740
So I respectfully declined to attend.

218
00:12:40,100 --> 00:12:42,200
And he was prosecuted and went to jail.

219
00:12:42,980 --> 00:12:44,340
It was a pretty interesting thing.

220
00:12:44,460 --> 00:12:46,920
There was a bunch of fundamental security technology that was discussed.

221
00:12:46,920 --> 00:12:48,680
The capability security model.

222
00:12:49,000 --> 00:12:51,700
This was actually something that existed before the cypherpunks.

223
00:12:51,800 --> 00:12:58,560
It existed in the 80s from some cool people that were doing electronic gaming, virtual community stuff.

224
00:12:58,800 --> 00:13:03,940
And then turned it into a really exciting, really technically powerful,

225
00:13:04,100 --> 00:13:07,980
but different than the way everyone builds stuff security model.

226
00:13:08,240 --> 00:13:09,300
It was discussed there.

227
00:13:09,460 --> 00:13:10,720
Self-enforcing contracts.

228
00:13:11,040 --> 00:13:14,540
I'd say Nick Szabo, who's in the running for being Satoshi Nakamoto,

229
00:13:15,300 --> 00:13:16,900
I'd probably say is one of the top people.

230
00:13:16,920 --> 00:13:18,000
Five candidates for it.

231
00:13:18,520 --> 00:13:21,960
Developed the idea of contracts that you can write that would enforce themselves

232
00:13:21,960 --> 00:13:23,480
and would be machine interpretable.

233
00:13:23,620 --> 00:13:27,700
Which sounds an awful lot like Ethereum or Tezos or any of the modern systems like that.

234
00:13:27,900 --> 00:13:29,800
And this was all discussed in like 1997.

235
00:13:31,200 --> 00:13:32,560
And built as a prototype.

236
00:13:32,800 --> 00:13:33,500
Cool things.

237
00:13:33,620 --> 00:13:41,980
Data stores that were essentially turning the internet into a block device

238
00:13:41,980 --> 00:13:45,000
where you could pay someone to store a certain amount of data that was encrypted

239
00:13:45,000 --> 00:13:46,160
that they wouldn't know what it was.

240
00:13:46,920 --> 00:13:50,500
For a period of time with redundancy striped across a bunch of servers.

241
00:13:51,320 --> 00:13:54,340
Sounds a lot like the store coin or the other things that are built today.

242
00:13:54,620 --> 00:13:55,800
So cool things like that.

243
00:13:56,100 --> 00:13:57,500
A bunch of secure hardware stuff.

244
00:13:57,800 --> 00:13:59,920
Lots of discussions of HSMs.

245
00:14:00,500 --> 00:14:03,800
Lots of discussions of secure communications terminals,

246
00:14:03,960 --> 00:14:08,720
which at the time were, at the very end, were like palm pilots that people had ruggedized.

247
00:14:08,840 --> 00:14:11,620
So it was really before it was possible to do this kind of stuff.

248
00:14:11,800 --> 00:14:16,800
I remember walking around with a briefcase and a laptop and a handcuffed thing on it.

249
00:14:16,800 --> 00:14:18,800
And that was like the secure terminal I could use for cool stuff.

250
00:14:19,560 --> 00:14:21,080
The idea of Data Havens.

251
00:14:21,620 --> 00:14:26,640
I think Bruce Sterling, Islands in the Net novel from sometime in the 80s,

252
00:14:26,660 --> 00:14:28,900
was one of the first people to discuss this.

253
00:14:29,340 --> 00:14:30,900
The idea had existed previously.

254
00:14:32,200 --> 00:14:33,960
There was lots of discussion about where to build it.

255
00:14:34,100 --> 00:14:36,820
And I actually ended up meeting the co-founders for Havenco,

256
00:14:36,940 --> 00:14:39,160
the offshore data haven that I started on the list.

257
00:14:39,480 --> 00:14:40,140
Cool stuff.

258
00:14:40,740 --> 00:14:42,620
And then much more useful stuff.

259
00:14:42,760 --> 00:14:46,020
This was where debates happened about the SET protocol

260
00:14:46,020 --> 00:14:47,380
versus SSL.

261
00:14:47,480 --> 00:14:49,680
And you probably have not heard of SET unless you work in banking.

262
00:14:50,320 --> 00:14:51,920
So as a result, we got...

263
00:14:51,920 --> 00:14:53,980
And the consensus on the list was,

264
00:14:54,100 --> 00:14:55,940
yeah, this other thing is a little bit technically more interesting,

265
00:14:56,060 --> 00:14:58,140
but it's way more complicated, so it'll never get used.

266
00:14:58,440 --> 00:15:00,060
And that's in fact what happened.

267
00:15:00,360 --> 00:15:02,180
And then all sorts of secure messaging stuff.

268
00:15:02,800 --> 00:15:05,460
Voice encryption, secure terminals using WinCE,

269
00:15:05,640 --> 00:15:06,800
all sorts of cool stuff like that.

270
00:15:07,140 --> 00:15:10,060
So, yeah, it was a pretty exciting place.

271
00:15:10,260 --> 00:15:12,780
And now there's a mailing list archive where you can search.

272
00:15:12,880 --> 00:15:15,220
There's like 600 gigs of data where you can go and find

273
00:15:15,220 --> 00:15:16,640
the initial idea.

274
00:15:16,900 --> 00:15:18,860
One of the things I was thinking would be really nice

275
00:15:18,860 --> 00:15:21,460
would be if people found prior art for patents

276
00:15:21,460 --> 00:15:24,200
that people are asserting in the field.

277
00:15:24,300 --> 00:15:25,800
Because if something was publicly discussed

278
00:15:25,800 --> 00:15:28,020
and prototyped back in the 90s,

279
00:15:28,040 --> 00:15:30,160
it clearly shouldn't be patentable by a company today.

280
00:15:31,020 --> 00:15:33,780
Also, there probably are ideas that you could build today

281
00:15:33,780 --> 00:15:36,200
and turn into a working thing that haven't been built yet.

282
00:15:36,740 --> 00:15:37,960
So, yeah, lots of cool stuff.

283
00:15:39,380 --> 00:15:42,180
I would be interested in discussing any of these things with anybody

284
00:15:42,180 --> 00:15:44,100
if anyone has any questions at this point.

285
00:15:45,560 --> 00:15:47,700
Otherwise, I can talk about some of these

286
00:15:47,700 --> 00:15:49,700
or persons from the Cyberbonds list.

287
00:15:50,560 --> 00:15:51,440
But thank you.

288
00:16:02,740 --> 00:16:04,940
Yeah, I'll repeat the question or whatever.

289
00:16:07,940 --> 00:16:08,460
Sure.

290
00:16:09,980 --> 00:16:10,500
Okay.

291
00:16:10,680 --> 00:16:12,840
So secure hardware and HSMs are really interesting.

292
00:16:13,160 --> 00:16:14,140
The hardware...

293
00:16:14,140 --> 00:16:15,900
HSM is a hardware security module.

294
00:16:18,380 --> 00:16:20,560
So people used to...

295
00:16:21,140 --> 00:16:23,340
This was in the time when doing public key operations

296
00:16:23,340 --> 00:16:26,040
was actually a challenging thing for a computer to do.

297
00:16:26,280 --> 00:16:29,720
You would probably tie up your desktop computer.

298
00:16:29,880 --> 00:16:33,680
You could do maybe like three to five RSA operations in a second.

299
00:16:33,880 --> 00:16:34,920
And if you had a mobile device,

300
00:16:35,040 --> 00:16:37,060
it would drain the battery on like a Palm Pilot or something.

301
00:16:37,320 --> 00:16:40,740
So there was the idea of using an outboard dedicated processor

302
00:16:40,740 --> 00:16:42,460
to do your cryptographic operations.

303
00:16:42,460 --> 00:16:48,240
It would either be a card or a SCSI drive thing that would fit in.

304
00:16:48,840 --> 00:16:49,980
They still exist today.

305
00:16:50,120 --> 00:16:51,160
There's a lot of reasons to do them.

306
00:16:51,260 --> 00:16:52,600
They used to be crypto accelerators.

307
00:16:52,740 --> 00:16:58,160
Now they are really there for putting hardware protection around a CPU

308
00:16:58,160 --> 00:17:00,360
and doing two-factor...

309
00:17:00,360 --> 00:17:01,960
Two human control and things like that.

310
00:17:02,800 --> 00:17:04,400
These have been...

311
00:17:05,000 --> 00:17:08,160
They've gone from on every web server,

312
00:17:08,260 --> 00:17:09,460
every public-facing web server,

313
00:17:09,520 --> 00:17:10,240
you'd have a lot of them,

314
00:17:10,340 --> 00:17:11,920
to now they're...

315
00:17:11,920 --> 00:17:13,460
They're very limited in deployment.

316
00:17:13,700 --> 00:17:15,260
Like you can use a cloud HSM on Amazon

317
00:17:16,100 --> 00:17:17,600
because they're all at $30,000 each.

318
00:17:17,760 --> 00:17:20,300
So instead of having one big server,

319
00:17:20,400 --> 00:17:22,080
which used to be the model with this...

320
00:17:22,080 --> 00:17:24,660
It was at the time $5,000 to $10,000 box to do the crypto.

321
00:17:24,900 --> 00:17:28,740
Now you have like a hundred $2,000 PCs as your front end.

322
00:17:29,020 --> 00:17:31,520
And you might have one of these servers to distribute keys,

323
00:17:31,660 --> 00:17:32,740
but in most cases you don't.

324
00:17:33,740 --> 00:17:36,980
They are another one of these things that I think was a good idea then

325
00:17:37,440 --> 00:17:39,300
that sort of has had a 20-year period

326
00:17:39,300 --> 00:17:41,400
of not really doing all the stuff it should do.

327
00:17:41,400 --> 00:17:43,320
And actually makes sense to do today.

328
00:17:43,520 --> 00:17:45,220
Because now you're using cloud resources

329
00:17:45,220 --> 00:17:47,700
where you never actually see the computer you're working on.

330
00:17:47,900 --> 00:17:50,440
And there's this whole like matrix question of

331
00:17:50,440 --> 00:17:51,520
you're talking to a remote server,

332
00:17:51,640 --> 00:17:53,940
do you know if you're actually talking to a bare-metal server?

333
00:17:54,180 --> 00:17:55,440
Are you talking to some virtualized environment

334
00:17:55,440 --> 00:17:56,440
where someone's monitoring everything?

335
00:17:57,220 --> 00:17:58,980
And finally people have keys,

336
00:17:59,060 --> 00:18:00,340
like there are Bitcoin keys out there

337
00:18:00,340 --> 00:18:02,960
that are probably worth $100 million or more

338
00:18:02,960 --> 00:18:05,340
where people have a single wallet with lots of stuff.

339
00:18:05,580 --> 00:18:08,960
And I personally don't ever want to have a key

340
00:18:08,960 --> 00:18:11,380
that I have sole authority over with $100 million.

341
00:18:11,400 --> 00:18:15,260
Because if I did I'd have to have a level of physical security

342
00:18:15,260 --> 00:18:16,380
at all times equal to that.

343
00:18:16,480 --> 00:18:17,760
Because otherwise you'd just like kidnap somebody

344
00:18:17,760 --> 00:18:19,480
and say like turn over the key or we'll shoot you

345
00:18:19,480 --> 00:18:20,260
or shoot somebody else.

346
00:18:20,600 --> 00:18:22,980
So this hardware security module idea

347
00:18:24,280 --> 00:18:26,260
is becoming more relevant again.

348
00:18:27,420 --> 00:18:29,460
I was looking at building one of these things

349
00:18:29,460 --> 00:18:30,640
as sort of like an open source project

350
00:18:30,640 --> 00:18:32,780
where you could have an open source HSM container

351
00:18:32,780 --> 00:18:33,740
and put an arbitrary board.

352
00:18:34,000 --> 00:18:35,220
The problem is they're fundamentally

353
00:18:35,920 --> 00:18:37,440
a very niche product right now.

354
00:18:37,520 --> 00:18:38,840
I don't know how many are sold per year,

355
00:18:38,920 --> 00:18:41,260
but it's definitely under 10,000 a year.

356
00:18:41,400 --> 00:18:42,360
Because they're so expensive.

357
00:18:42,680 --> 00:18:45,780
And they're sold to banks, governments, CAs,

358
00:18:45,880 --> 00:18:48,200
people like that that are basically price insensitive.

359
00:18:48,460 --> 00:18:50,400
So the costs have just kept going up

360
00:18:50,400 --> 00:18:51,240
and they've become more niche.

361
00:18:51,480 --> 00:18:53,400
It's one of those things where if it were more widely deployed

362
00:18:53,400 --> 00:18:53,840
it would be cool.

363
00:18:54,260 --> 00:18:57,660
Intel SGX, trusted enclave stuff, all that stuff,

364
00:18:57,840 --> 00:18:59,800
is interesting on the client side for it,

365
00:18:59,880 --> 00:19:03,360
but unfortunately fails some of the hardware requirements

366
00:19:03,360 --> 00:19:04,780
if you have physical access to the device.

367
00:19:04,900 --> 00:19:07,160
It's pretty straightforward to attack an SGX.

368
00:19:07,180 --> 00:19:09,220
Not super straightforward, but it is feasible

369
00:19:09,220 --> 00:19:11,100
to attack a T or an SGX environment

370
00:19:11,400 --> 00:19:12,240
if you have physical access to it,

371
00:19:12,260 --> 00:19:14,260
if you're willing to do hardware level stuff.

372
00:19:14,580 --> 00:19:16,460
And with an HSM you're not supposed to be able to.

373
00:19:16,560 --> 00:19:16,940
Although you can.

374
00:19:17,600 --> 00:19:20,440
But yeah, that's the HSM market.

375
00:19:21,000 --> 00:19:23,420
The thing that was really missing the most

376
00:19:23,420 --> 00:19:25,540
from the Cypherpunks era was the mobile phone.

377
00:19:25,680 --> 00:19:28,100
I think if the smartphone had existed back then

378
00:19:28,100 --> 00:19:31,240
in any form that had wide area connectivity,

379
00:19:31,820 --> 00:19:34,420
even if it was very low bit rate connectivity

380
00:19:34,420 --> 00:19:35,860
and a thing that you could carry around

381
00:19:35,860 --> 00:19:36,920
as a handheld terminal,

382
00:19:37,200 --> 00:19:40,340
I think that would have pushed a lot of this technology

383
00:19:40,340 --> 00:19:41,880
about 10 years earlier than it did.

384
00:19:42,060 --> 00:19:45,220
And a lot of that stuff was held up for carrier licensing reasons.

385
00:19:45,500 --> 00:19:46,720
The technology basically existed.

386
00:19:46,960 --> 00:19:49,440
The Scion PDA from a long time ago

387
00:19:49,440 --> 00:19:50,720
had a lot of this capability.

388
00:19:50,980 --> 00:19:53,380
There were lots of weird political reasons

389
00:19:53,380 --> 00:19:54,100
why it didn't happen.

390
00:19:55,220 --> 00:19:57,180
But yeah, really I'd say mobile phones, smartphones

391
00:19:57,180 --> 00:19:59,020
have been the thing that was missing.

392
00:19:59,300 --> 00:20:02,640
And of course back then there were millions of people

393
00:20:02,640 --> 00:20:04,040
on the internet actively communicating

394
00:20:04,040 --> 00:20:05,540
and not billions of people,

395
00:20:05,660 --> 00:20:07,400
so the market for anything was a lot smaller.

396
00:20:07,580 --> 00:20:08,900
And the people were kind of boring.

397
00:20:10,340 --> 00:20:10,940
The other thing about the Cypherpunks

398
00:20:10,940 --> 00:20:12,820
is that most of these people,

399
00:20:12,900 --> 00:20:14,840
aside from being kind of weird,

400
00:20:15,540 --> 00:20:16,500
didn't really have,

401
00:20:16,700 --> 00:20:18,440
they were like Westerners living,

402
00:20:18,720 --> 00:20:20,480
they made like a hundred a year,

403
00:20:20,680 --> 00:20:23,400
they lived in places with rule of law,

404
00:20:23,580 --> 00:20:24,820
they were generally well protected,

405
00:20:24,940 --> 00:20:26,020
so they were thinking about these ideas

406
00:20:26,020 --> 00:20:27,460
as a theoretical thing,

407
00:20:27,580 --> 00:20:29,900
and a thing they wanted to aspire to.

408
00:20:30,100 --> 00:20:32,520
But in reality, if they had a problem,

409
00:20:32,600 --> 00:20:33,780
they'd have legal recourse,

410
00:20:33,820 --> 00:20:35,100
nobody would attack them, everything else.

411
00:20:35,560 --> 00:20:37,580
As the population on the internet has changed,

412
00:20:37,700 --> 00:20:39,740
we have people in countries that have no legal system

413
00:20:39,740 --> 00:20:41,200
or where they're targets of stuff,

414
00:20:41,480 --> 00:20:42,800
so it's a big deal.

415
00:20:49,820 --> 00:20:51,660
Okay, many of them lived in Europe,

416
00:20:51,700 --> 00:20:54,400
but they were still first world kind of not...

417
00:20:55,600 --> 00:20:56,120
.

418
00:21:08,600 --> 00:21:10,680
Yeah, that was actually one...

419
00:21:10,680 --> 00:21:11,800
Yeah, the crypto,

420
00:21:12,000 --> 00:21:14,880
it was a weird split between US and Europe.

421
00:21:14,980 --> 00:21:16,220
There were a lot of people

422
00:21:16,220 --> 00:21:18,960
that were major contributors from Europe,

423
00:21:19,020 --> 00:21:20,680
probably at least half,

424
00:21:21,280 --> 00:21:23,120
half by the number were Europe,

425
00:21:23,180 --> 00:21:24,040
and then by quality,

426
00:21:24,040 --> 00:21:25,920
I'd actually probably say more like 75%.

427
00:21:26,500 --> 00:21:28,400
We're outside of the US and mostly Europe.

428
00:21:29,180 --> 00:21:31,540
But there was a very restrictive interpretation

429
00:21:31,540 --> 00:21:34,040
of cryptography export at the time

430
00:21:34,040 --> 00:21:35,860
under ITAR, Vassanar agreement,

431
00:21:36,160 --> 00:21:38,780
arrangement and other US laws

432
00:21:38,780 --> 00:21:41,060
where it was basically impossible

433
00:21:41,060 --> 00:21:43,120
for a US person and a foreign person

434
00:21:43,120 --> 00:21:44,880
to collaborate on a project in a useful way.

435
00:21:45,240 --> 00:21:47,620
The only way you could do it would be by publishing...

436
00:21:47,620 --> 00:21:49,260
You could either do a restrictive thing

437
00:21:49,260 --> 00:21:50,180
like a 40-bit key,

438
00:21:50,320 --> 00:21:53,820
which is essentially breakable on a smartphone now,

439
00:21:54,040 --> 00:21:55,640
but it was at the time something that was feasible

440
00:21:55,640 --> 00:21:57,620
for a couple of computers to break in a period of time,

441
00:21:57,720 --> 00:22:00,720
or you had to go through

442
00:22:00,720 --> 00:22:02,220
the First Amendment protections in the US

443
00:22:02,220 --> 00:22:03,280
and actually publish something

444
00:22:03,280 --> 00:22:06,200
to at least 50 people in public

445
00:22:06,200 --> 00:22:07,940
and then have them download it,

446
00:22:08,080 --> 00:22:11,420
type it in, and then do it.

447
00:22:11,540 --> 00:22:12,460
And this is really interesting.

448
00:22:13,080 --> 00:22:15,020
Yeah, the PGP software was developed

449
00:22:15,020 --> 00:22:16,940
by Philip Zimmerman and a couple other people in the US

450
00:22:16,940 --> 00:22:19,160
and had to get exported from the US

451
00:22:19,160 --> 00:22:20,420
in the form of physical books.

452
00:22:20,620 --> 00:22:21,960
We have a lot of precedent for

453
00:22:21,960 --> 00:22:24,020
you can't restrict people's ability to publish

454
00:22:24,040 --> 00:22:25,240
and that's clearly speech,

455
00:22:26,820 --> 00:22:28,720
but there wasn't any real precedent

456
00:22:28,720 --> 00:22:30,160
for sending binaries out of the country,

457
00:22:30,260 --> 00:22:31,320
so it was a pretty exciting thing.

458
00:22:31,500 --> 00:22:32,900
So there was a hacker, I think it was HIP,

459
00:22:33,000 --> 00:22:35,420
like a place in 97 in the Netherlands

460
00:22:35,420 --> 00:22:36,960
where they had a book scanning party

461
00:22:36,960 --> 00:22:39,640
where they had, I think it was like 50 books or something,

462
00:22:39,740 --> 00:22:40,540
and they scanned them in,

463
00:22:40,600 --> 00:22:42,040
they had error-correcting code on the page,

464
00:22:42,200 --> 00:22:44,340
and that was how the code got out of the US legally

465
00:22:44,340 --> 00:22:45,300
to do all this stuff.

466
00:22:45,580 --> 00:22:46,820
But yeah, it was pretty weird.

467
00:22:55,900 --> 00:22:57,380
So compared to the past,

468
00:22:57,520 --> 00:23:00,240
I would say the mailing list is a non-entity,

469
00:23:00,300 --> 00:23:01,560
it basically doesn't exist anymore.

470
00:23:02,080 --> 00:23:03,900
The people that were on the list,

471
00:23:03,980 --> 00:23:05,260
as well as people that were inspired

472
00:23:05,260 --> 00:23:06,080
by some of the ideas,

473
00:23:06,300 --> 00:23:07,960
are the people building all the cool tools today.

474
00:23:08,400 --> 00:23:10,340
Like Tor Project, directly inspired,

475
00:23:10,520 --> 00:23:12,720
like the people that are running the Tor Project

476
00:23:12,720 --> 00:23:14,200
were people that were from back then

477
00:23:14,200 --> 00:23:16,160
or that were inspired by that.

478
00:23:17,200 --> 00:23:20,420
Everybody working on Bitcoin has a lot of history

479
00:23:20,420 --> 00:23:21,280
with that kind of stuff.

480
00:23:22,580 --> 00:23:24,020
I think some of the people

481
00:23:24,040 --> 00:23:25,380
are certainly like the Silk Road people.

482
00:23:25,520 --> 00:23:27,700
So it's definitely an inspiration for this stuff.

483
00:23:28,460 --> 00:23:30,180
In practice, a lot of the developers,

484
00:23:30,340 --> 00:23:31,360
like whenever I go to a developer thing,

485
00:23:31,440 --> 00:23:36,420
there's a lot of people that are in their 20s,

486
00:23:36,420 --> 00:23:38,920
and it's unreasonable that a person in their 20s today

487
00:23:38,920 --> 00:23:41,120
would necessarily have been on a mailing list in 1995.

488
00:23:43,000 --> 00:23:44,040
So there's a lot of people

489
00:23:44,040 --> 00:23:45,080
that weren't on the list in its heyday,

490
00:23:45,180 --> 00:23:47,280
but I think a lot of the ideas were discussed there,

491
00:23:47,380 --> 00:23:48,380
and it's pretty good.

492
00:23:57,560 --> 00:23:58,480
I'm not really sure

493
00:23:58,480 --> 00:23:59,980
if it was more about the technical side

494
00:23:59,980 --> 00:24:01,680
or the political or social side.

495
00:24:02,160 --> 00:24:04,200
I think you really needed to have both,

496
00:24:04,300 --> 00:24:09,300
because without the ideas of why you should build these tools,

497
00:24:09,400 --> 00:24:11,920
it was unclear why do you care

498
00:24:11,920 --> 00:24:14,640
about making tools like this work on cheap hardware.

499
00:24:15,280 --> 00:24:17,400
If you can afford to have an expensive PC

500
00:24:17,400 --> 00:24:19,500
and everything else, you don't really care.

501
00:24:19,660 --> 00:24:21,940
But then people discussed the activist use case

502
00:24:21,940 --> 00:24:24,020
where these people didn't have a lot of money,

503
00:24:24,040 --> 00:24:26,220
so the people that are at the most risk

504
00:24:26,220 --> 00:24:28,020
are actually the people who have the least resources to defend,

505
00:24:28,180 --> 00:24:30,420
and also the idea of disposable devices and everything else.

506
00:24:30,560 --> 00:24:32,840
So I think you need to have the ideas behind it,

507
00:24:32,920 --> 00:24:34,740
but you clearly need to have the technology.

508
00:24:35,080 --> 00:24:36,260
But none of this stuff is finished.

509
00:24:36,460 --> 00:24:37,180
It's been a long time.

510
00:24:37,680 --> 00:24:38,540
I have a question.

511
00:24:38,760 --> 00:24:40,600
What is the equivalent today?

512
00:24:40,760 --> 00:24:42,920
I'm aware of cryptography.com,

513
00:24:43,000 --> 00:24:45,560
but I imagine this list is still on.

514
00:24:45,960 --> 00:24:47,520
Yeah, so yes.

515
00:24:47,580 --> 00:24:49,780
The list pretty much split.

516
00:24:49,860 --> 00:24:52,140
There was the cryptography, the MetStyled list

517
00:24:52,140 --> 00:24:54,020
that Perry Metzger ran that was really popular.

518
00:24:54,040 --> 00:24:55,020
And it's still popular.

519
00:24:56,680 --> 00:24:57,680
P2P hackers.

520
00:24:58,260 --> 00:24:59,640
A couple of decentralized things.

521
00:24:59,880 --> 00:25:01,560
The individual projects got their own list,

522
00:25:01,680 --> 00:25:06,700
so clearly the Tor project has their internal stuff

523
00:25:06,700 --> 00:25:07,460
and a lot of other stuff.

524
00:25:07,900 --> 00:25:09,820
Twitter, a lot of forums.

525
00:25:10,720 --> 00:25:12,660
Basically things have moved away from email

526
00:25:12,660 --> 00:25:13,700
to other forums.

527
00:25:14,160 --> 00:25:16,360
But yeah, there's still a lot of active discussion

528
00:25:16,360 --> 00:25:17,040
in various places.

529
00:25:17,300 --> 00:25:17,800
Cool.

530
00:25:26,260 --> 00:25:26,900
Yeah, sure.

531
00:25:27,000 --> 00:25:28,100
I'd be happy to take questions outside.

532
00:25:28,460 --> 00:25:28,940
Thank you.