Alex: I thought that today we would talk a bit about what happened with Revolute and this whole idea of the honeypot attack and how Richard: Mm-hmm. Alex: it just keeps happening over and over again, right? That there's the cases are coming thick and fast. And you know, maybe we can untangle this this this question of Having the same thing happening over and over again. And it it's it's this whole idea like we just need to make things more secure. And it it it Richard: Mm. Alex: got me thinking to you know, I don't know if it was like the quote is attribute attributed to Albert Einstein, and it's like stupidity is the conviction of Richard: Mm. Alex: doing the same thing over and over again, expecting different results. And it kind of feels a bit like that. What do you what do you make of it? You know, why is this happening? Richard: I think there are a lot of reasons that it's happening. So one is obviously that that there's an industry and there's known methods to vend and sell stolen identities, right? So there's money in it. That's one reason it's it's happening. but I think the more, you know, kind of obvious interesting things to pursue are like how come no one's doing anything about Because obviously, you know, if you've got money in a till or gold in a bank vault, you know, there's got to be interest in trying to get people trying to get their hands on it. So we should be thinking about how and why this happens. And to me, the big thing is why do we keep building databases full of people's personal information? Like why so many of them? Why in the hands of such a variety of companies? when we know that like this is immediately just creating a lot of targets for, you know, people who are interested in stealing this stuff. And I think that's really the the the the big thing to be thinking about. And I think a lot of people kinda think it's inevitable. And I think that's also not true. So to me that's that's the real heart of what we should be talking about when we think about these things. Alex: Okay, so what I'm you know tr reading there between the lines is that there may be some incumbent interests which are maybe not so interested in changing the way things are done. Am I Richard: Well yeah, I mean you have you have to ask like go back to the Einstein quote, you know, if a if this keeps happening and people keep, you know, being concerned about it, why are we not changing the way things operate? and I think the the number one reason is is unf you know, the classic thing of it's not a conspiracy, it's not evil or anything. It it's sheer laziness. And I think here we have a combination of assumptions from lawmakers that they have to collect this data or or wanting to collect this data for bureaucratic reasons. And then we have assumption on users' parts that it has to be collected. and that you have to put yourself at this risk. Right. There's no I know most people probably feel a little bit nervous handing over personal documents over the phone or over some video chat link or whatever. But we kind of pat it down and think, well we have to do this to participate. And I think that's based on a little bit of an assumption that, well, you know, the authorities are making these rules for good reasons. and then that the companies don't have a better way of, you know, there isn't a better way of of of collecting this information. And then thirdly that well, you know, there's not much you can do because these technical hacks, you know, like people break in with, you know, lasers and the internet and stuff and there's nothing you can do to stop this, you know, like data will want to be free. And so we end up in this sort of circle of laziness where there's not a lot of people stopping and saying, we don't have to have this happening and we can do something fundamental about it. and then I think that crashes into the flip side, which is there's a big industry around building thicker bank vaults, about slick KYC AML technology to make it really easy for people to record a live stream with their passport photos or whatever. And so there's a lot of lobbying for we can make this better, we can sell more product doing this. There's not a lot of lobbying for or anyone really out there saying maybe we just don't need to do it at all. Or maybe the solution is to do it in a very different way that, you know, basically deprecates that whole industry. So you don't have, you know, voices pushing for you know, the solution which is to stop doing it. Alex: Yeah, yeah, I th I think I think if if I would take a step back and try to say, you know, like what would be the I don't know what I s how would I say like not not just an analogy, but I guess it's partly an analogy but partly Richard: Mm-hmm. Alex: lessons from history. I would say that the the old world is dying and the new world is struggling to be born. And and it feels to me personally, at least like there are s All these interests that you that you've talked about, is like incumbent Richard: Mm. Alex: interest, and like I I have this company or I know this guy who that can can help us fix it in this way. So then you don't even look at any other solutions, right? Richard: Mm-hmm. Alex: And it kinda requires a regime change in order for new solutions to finally see the day of light. I mean, I I know they exist, right? Like Richard: Mm-hmm. Alex: even even Sato is is fixing some of these problems in its own specific way. But for that type of thinking to come through, it requires a change in the decision makers. And Richard: Mm-hmm. Alex: obviously they're not gonna make those decisions if it's not economically viable for them. And it it kind of like ties up into this whole idea of like, you know, reduced trust in authority, you know, this perception of of regulators not being effective. And you know, they're they're regulating so much that it they literally create a different world outside of their regulations because economic activity and just day to day life becomes impossible in that frame, right? In that work frame. Am I am I getting close to anything here or Richard: Yeah, no, I think there's a there's a huge piece of the puzzle in there where I mean it's sort of like I think there's there's a lot of what happens here is is is is creep or scope creep, right? So of course, say your mobile phone provider, in this case Revolute, you need to have a customer name or something, right? you need to have a customer record. and so that then can be augmented without anyone thinking. If you introduce a whole system From the s you know from the get go and said we're gonna go from zero to all of this, then people might freak out. But we've just added one piece of extra information at a time. and the reason that that's happened, I think, is you could do this other ways. There's a few other ways you could do it. One way, you know, that I think is flawed, but we s we don't see is that you know the state took charge of this, right? So the state could say, We'll have an office of verification. And, you know, the phone company or the bank or whatever can come to us and cross check something and then we'll give them an ID for you and they don't hold it. We hold that. That's not going to happen mostly because the state would then actually be on the hook. Like they'd love the data. They'd love to hold all of that data. And they do in in some cases. But nobody wants to be on the hook for, it actually got you know, it got leaked and I'm actually on the line. So the stu you know, the regulators love you know, a s a wrap across the knuckles to companies who are supposed to enforce and manage these systems, but they don't want to take on the risk themselves of actually being the ones in the firing line. So that's why I think we keep seeing it outsourced to to companies is that it's it's just not in my backyard, not my you know, sort of ass covering activity from bureauc bureaucracies and and and bureaucrats. And I think that's that's a really big part of the the puzzle is that it then causes like a desire to keep that solution in place. And that's something, like we were saying before, that's actually profitable to different people who are part of the decision making process or at least influencing the decision making process. So we've got a combination of, you know, money to be made and laziness pushing us ever further down the same path rather than ever actually stopping and saying Wait, these hacks are horrific. What's going on? Why is it happening? How do we stop it? And actually investigating, you know, alternatives like, you know, the state having a system for it or using, you know, better cryptography or, you know, not collecting the information where it's not strictly necessary. Alex: That sounds like a lot of work. I'm a I'm a bureaucrat, Richard. I can't I I clock in, I I take Richard: Ha ha ha. Alex: my 20,000 euros a month working for the EU and I carry around a lot of papers. You know, what you're suggesting is actual Richard: Mm-hmm. Alex: work. I I'm unsure if this is the right way to go forward, but you know, don't call us, we'll call you. I I agree, but it it feels It feels like if I would be like one of these British tabloids, I would say something going from KYC to CYA, you know? Know your customer, cover your ass. And Richard: Hmm. Yeah. Yeah. Alex: it's it's I see what you're saying, but is it is it like every system has this intrinsic, like let's say you start It's it's it's it's the best system we have, right? At the start is the best system we have, we do it out of necessity, everybody's on board. And then over time, right, you you have this idea of the lions and the foxes, and over time the lions disappear because they feel like they put in their shift and they've done their work, and then the foxes multiply, and the foxes find the deals, they find the loopholes. And what was once a system that was honest and had a purpose. Is now becoming a a a group of like special interests. And as these foxes you know go through the revolving door of moving between public sector and private sector, there are systems Richard: Mm-hmm. Alex: that are in place so that even if new people come in, their capacity to change is not high enough to change anything. And it becomes one of those, you know, like Why am I going into Lenin? But it's sorry, go ahead. Richard: you no, I mean you'd know you'd know I'm you're sure you have the picture of how this happens in your head in in Europe. I have the there's a a few Australian comedies, one called Utopia, which you know, it's ridiculous. They have a T V show which satirizes this very process and yet people tolerate the process going on and on, which is Alex: Right. Richard: w when something when people are making decisions in this area say there's a hack or something and so some minister or you know high, high level decision maker is on the hook to improve the situation, the first thing they'll do is invoke some kind of parliamentary committee or commission, etc. Now the most for the most part, the people who are then involved with that fall on a scale somewhere between seeing that as an opportunity to get lobbied. And at least get a few nice dinners out of out of salespeople or corporations with a vested interest telling them how they'd like it to play out. Somewhere between that and just too lazy to do the work to read up on this myself. So they'll go and find someone from industry who can advise and who can essentially proxy for them on the committee. So this means that the committee is therefore stacked from the start on needing to not just you know, look for a solution, which is a problem in the first place that they usually have to do an additional thing. You know, the very rarely are they set up to say, could we just get rid of A KYCAML or could we get rid of this regulation? Yeah, very rarely is that ever happened. Usually it's like how are we going to extend, augment, increase, improve? So that's built into the terms and c you know o of the of the inquiry or whatever it is. And then the people advising or working on or, you know, voting in the committee or you know informing the inquiry are coming from a place where they have something, you know, they're they're buttering their bread with this. So, you know, they're they're they're selling something. And so inevitably what you have is another industry solution, quote unquote s promoted as the way to fix the problem by extending or, you know, incrementing what we have now. And there's almost no chance in that process of anyone saying, you know, maybe it's just a bad idea to be collecting this information in the first place. or maybe we could look at like what's the minimum we could do? Like that that's usually not, you know, even vaguely at the table. Alex: I see what you're saying. And I would maybe go one step further and say that most of the people who are making these decisions are not affected by the decisions personally, right? Because they s by being part of the system, they have fast track in whatever they do through the system. So they they never like get Richard: Mm. Alex: hooked on all these bureaucratic you know loops that you can end up in as as a regular citizen, right? So you have People selling it that are never affected by the by the items on sale, and people buying which are who are never affected by the the same product. So they have very little skin in the game from that point of view, right? Because they can always pick up the phone and call and fix a problem because they know someone. And it's it's a it's it's a it's it's this continued disconnect between decision makers and the people who are actually forced to live with these the consequences of of these actions. But then again it feels like there's a there's like a system wide thing, right? Like the the system works this way. We can either add something to it or Richard: Mm-hmm. Alex: maybe pause something but the idea of changing it wholesale is is not is not even on the map. Richard: Yeah, well, I mean they're just nobody wants to stick their neck out and say, Here's something that was tech technically difficult to understand, that's new and different, not how we did it before, but I think it's an improvement and so I'm gonna I'm gonna put my career on it. and Alex: Yeah. Right. Richard: it's not something that makes people pleased, right? It's not like I mean, you people might do that for saying, Yeah, we want to go to digital television or something because they've got a feeling that people will like it when they see it or I'm gonna push for like broadband rollout or you know high speed internet to everyone because they sense people will like that. But this is something where if it goes really well, people will just not notice. And so who's gonna put their neck on the line for that for that? Alex: Are are we are we witnessing a a a shift in how security should be perceived or because it feels like a the attack side is one step ahead. You know, it feels these things happening over and over again, obviously it's it's economically viable to do these attacks, right? Richard: I it's an interesting one because I I'm not sure. you know, c cyber security has it has been a game of cat and mouse for the longest time. And I'm not sure when we see that, you know, these sort of increased number of hacks, etc., if there's a wave where, you know, things are shifting one way or the other. And honestly, we it's really hard to know because there's a lot of stuff there that's zero day that isn't, you know, isn't visible to people who aren't in the security industry. and, you know, the the black hats hope to keep their stuff secret as long as they can and then AI's making that more complicated. So I think that's definitely part of it. I also think that there's a stupider problem going on, which is that as we increase, ever increase the number of places that are doing KYC AML and what I'm thinking of is things like, you know, supermarkets needing to start a KYC AMLing people's you know w gift cards or like loyalty card is the word I'm looking for at supermarkets, etcetera. And so yeah, they're just sort of the regulation comes in says, sure you can have a loyalty card thing, but now we want to you know, KYC AML it or whatever. And so what we're seeing as well is an ever increasing number of places that are putting in databases like this. And it's a lowest common denominator thing, right? Some people do a great job. Some people have great tech teams. They're adept. They do things very well. They also have good HR and good procedures. So they have things like stuff, good staff training, to understand what when they should answer what kind of query, you know, to not just leak information in in brown paper bags or such or like just by leaving things on their desk. But not everybody does. And so the more people you have doing this, the the the closer and closer you're getting to the edge of like stuff just being completely, you know, unguarded because eventually, you know, you're gonna end up with asking some of the KYC AML their customers who barely has a a a functioning IT department or anyone on the on the you know, in the HR team who understands social engineering or, you know, how you know, infiltration might work, et cetera. And so, you know, I think it's it's it's actually probably mostly that ladder that we're just increasing the number of organizations that are supposed to keep this data and by normalizing it, it also un you know, undoes some of the sense of urgency and pride that organizations take in actually be doing a good job with things like security, because they if everybody has private personal information on their customers, then it's not a big deal to have it and it's not a big deal to be on the security team that looks after it. You know, whereas I think that's a big difference. Once upon a time, people at banks and certain other institutions prided themselves on, you know, I've had a career without an incident because they saw themselves as like one of the chosen few who was responsible for high level high security data. and, you know, when you make everybody store everyone's ID f for buying a train ticket or whatever it is, then you just you've got more and more like more and more guys who are the fifth choice in the hiring process doing doing security on it. Alex: there you said something very interesting there and and it's something that I also wanted to touch upon and and namely the fact that people used to take pride in their work. And now as as and I've noticed this in not just in in cybersecurity, I've noticed this across the board as as you multiply all variations of a of a job or of a career. you you allow you say we democratize the industry. for example in film they democratize the industry, which is why we have so many bad movies and it's so hard to find the really good movies because they get lost in this oceans of releases. Because we've democratized it and like every fifth, tenth I would say people that would not even get into film school are doing films now because they have access to technology and you know they can get their friends in Richard: It's it's Alex: and Richard: yeah, it's a film sorry, when you've got you've got technology that's cheap and effective, you don't you know, there's very little gatekeeping anyone can make a film if they feel like it, rather than having any kind of requirements to check whether it's worth doing. Alex: Right, and and I'm thinking that that when it comes to to both the people who are hiring for security and the people who who who get into the into the industry, it's well if they don't ask, I don't have to say. And it and it feels like things are just running along and we kinda like are used to the fact that the system should work and we just have to manage it somehow. And when Richard: Mm-hmm. Alex: we actually Are faced with a real issue, we're like, we just need to turn up KYC or turn up AML or bring in more regulation. I think that the capacity for introspection has kind of disappeared because the the the response is always a reaction and the response is always more. Let's double down on this, right? It's it's never of let's take a step back and maybe. see what's happening here because it keeps happening. And I think that the fact that it happened to Revolute, which is supposed to be this, you know, Decacorn, whatever you want to call it, who, you know, was known for running lean, was known for doing, you know, being on the edge of so many good things. And they got hacked for social engineering. So it's it's always a crack somewhere. And guess what? The black hats will find it. But having having it happen to someone like Revolute, it goes to show like what chances does the local hardware store have. Richard: Mm. Well, I think that's that's I mean a really good point is that we should not be putting this kind of responsibility in the you know, in the way of someone like a hardware store. but I think we also you made a few points in there. I think one of them is this is getting used to these ideas and this assumption that that things work, right? So I think there's a there's a there's a a lot of laziness and there's also a lot of abstraction in these systems, right? So People we talk about as mentioned before, like people taking pride in their work, like nobody gets past me. It's it i if you think about that, if you kind of imagine someone with that attitude, you know, kind of in a movie or something, it tends to be someone with a really direct connection, like someone standing in front of a locked door. Right? Like someone who works at a vault facility and they guard it and they've got a very strong connection to no one goes in there unless you know, they're supposed to be there and I make sure that happens. Whereas what we've got a lot of the time now is someone who's got a bunch of responsibilities and who probably gets way more of, you know, talking to if the website goes down, if customer, you know, load page load times go up above a certain amount. They probably get in way more trouble for that than if there's a you know, They're not up to date on things like security patches, et cetera, et cetera. and you know, the person who's managing w the security posture of the customer service team, same thing, right? They're much they give much more reward for cutting staff by three people and and replacing them with a chat bot than they do for making sure that the regular training is happening to have people understand how data exfiltration works at a human level and how to how to spot a scam, how to spot a you know a a break in like this. And I think what we've also seen here with the Revoluta one recently, is it was a it was a How do you put it? It was like a chain, it was a concertina attack, right? So the social engineering was an email just turned up saying, We're the Italian government, please give us information on these, you know, X hundred people, and Revolute handed it over. But it doesn't seem like they d did that unthinkingly. They did do some checks like, was that a valid email? Right? And it turns out it was. So somehow they're now gonna look at how did the Italian government server get an email address appropriated so that someone could send a valid request in and that'll be another thing. But what we're seeing here is that flaws in somebody else's security are now causing flaws in Revolute security looking after people's personal data. and that is almost unending like how far back that could go. and I think that's something where people maybe aren't kind of aware of of the these concertina risks that get get added into the mix when when people implement things like this. Alex: I think you hit the nail on the head there because it it it kinda puts you in a situation where you know you could do everything right on your side, but then you know, one lapse in concentration, and it it's it's like you kinda have to be suspicious of of everyone and everything, right? So Richard: Mm-hmm. Alex: so it kinda like grinds to a halt, right? Like if if I am to double check every email, every request I get, how much more, you know, Time will that take? How much more resources will I have to to put in there to like double check everyone else's security as I interact with them, right? So that's what I'm saying. That it it it it's starting to look like a systemic failure to me. Richard: Mm-hmm. Alex: and and it's it's I don't know, it I think I think that we're running in a lot of these places, we're running on inertia, like. This is how things are going, this is how we do things. And How do you fix this? You know, like that that's that's my question. Like, how would I and I know it's an it's it's an easy question, you know, in five minutes you'll give me a the right answer and another five will implement it, but you know, yeah, you know, no biggie. But because I'm sure there's there's things that can be done to towards this, and but I think that the idea of building insecurity in a in a higher level, like higher walls or thicker walls won't work. I think it's more of a question of how does the interconnectivity work and what also removing some of the the appeal of hitting hitting these databases, right? Because if if you decentralize the the the database so like identity becomes bit more like user side rather than server side, then it it just doesn't make sense. For the hackers to to hack a database that has only like 100 names or 100 addresses is maybe if it's like the best addresses and names in the world, then yeah, sure. But how do you know that, right? So Richard: Yeah. Alex: I don't know, like I I feel like there's something you that can be done with network-wide. I think there's there's something can be done by by decentralizing. But how would you if let's say you got the keys to the to the kingdom, Richard, you know? What would your first order of business be in trying to like rethink this the situation so that we can get out of it? Richard: So I think it's it's a bit a way that I see this is sort of like the way including the problems with it later on, into society. Back in whatever it was the seventies in most of the West, people saw it as vague probably slightly morally good to just burn fuel, right? 'Cause you were in you know it was productive economically, right? And it people weren't thinking about the fact, although it just didn't seem possible that that could have negative consequences. And I think that's kind of where we're at. We've had these systems which is like, collect data, that's good. You know, whatever. So If I'm imagining my kind of enlightened regulator who's thought thought about all of this, the the first thing they should do, it's kind of a bit like re reduce, reuse, recycle, right? So the first thing to do is to say, Well, like, where can we just stop? Right? Like where where where do we where right, where Alex: yeah, yeah, yeah, yeah. What's the endpoint? Hmm. Richard: c where no no no. So where can we just stop doing the collection in the first place? So mobile phones, do we really need to have people's full data driver's license photo kept on record and all of that stuff, you know? could we just not do it? Right. And so maybe you'd say, Well, we we we Do want to regulate or we don't. Different jurisdictions might want to know who owns mobile phones. Plenty of places don't, and they, you know, don't seem to suffer inordinately. But that's the question we should start with is do we need to collect this information? There's probably a whole bunch of stuff where we're collecting this kind of stuff for, like I said, supermarket gift cards or whatever. And it's like there's just not enough of a money laundering risk there to say that collecting and building these giant honeypot databases, because everyone has to go to the supermarket. you know, need to be there. So regulating stuff like not doing it where you where you don't have to, and then looking at how it it extends, right? So people don't mind collecting a lot of data on their customers. So one one, you know, thing that ca often happens is you say, well, okay, for the people who've got a gift card over a thousand dollars and technically that some AML rule means we need to get their personal data. Now we've got passport number in our supermarket database. Let's make sure everyone gives that that information to us or whatever, ID, or you know, so forth. So, first thing is like looking at saying, well, where do we just not have to do this? and stopping that and actually having a look at it, seeing it as a net negative to collect this sort of data in the first place, which is a big change, but that's starting point. then it's to look at minimization, right? So if we did conclude that for cell phones, because they could be used for certain things or for some kinds of account, we wanna, you know, we do want to have knowledge about people. What's the minimum data we could collect? Right? And and how could we, you know, be you know, do that in a way that keeps things safe? So for one thing, maybe we keep it on record on paper for a short period of time, right? Because it only it Alex: Right. Richard: you know it has an expiration date. So we don't expose it to the internet and we don't keep it for too long, right? could we change processes and things to look at it like that? and then you can get into technical versions of that where you could say, Well, we collected this information and then we encrypted all of that and we deposited it somewhere. and then the key is somewhere else. Right. So Alex: Yeah. Richard: if anyone happens to really need this information, there's a process where we can get it back, but it's not lying around on servers just waiting to be stolen, right? Like it's it's kept somewhere, but there's some method of, you know, the information is is encrypted. There's a bunch of different ways of doing this and then hand off the key to someone or generate it and somebody else keeps that record. So you've got some better security around it and you've ri recorded you know, maybe a minimum of the information that you actually had to. and then I think we get to the the really important tools we should be using, which are cryptographically based and so they can seem a little confusing and stuff because there's there's maths. But doing things like using PKI, private key infrastructure, which is what CIDO is, where people can create identities that they can prove are theirs. etc. so you could use that in all sorts of ways. S for instance, say we do want to have a regulated thing to open this kind of account, you do have to prove who you are. We could have a simple system where you sign using a wallet under your control at the provider. So you get your account at let's call them Revolution Bank and you have to give them a signed little mathematically proven thing, which you can be Be done with an app on your phone. It's not doesn't have to be complicated. Alex: Mm. Richard: You don't have to do maths or anything. You just sign something that says proves I have access to a secret that nobody else has access to. And then I could go to a government office somewhere where I I'm registered and I have my details there, and I could sign a another thing there. So I can scan something with my phone that I can send off to everyone that says. I've told the government I gave you this number when I opened my account, and they've seen that I've done that, and they can verify that me, the person with this with secret key, is the same person. Right? That Alex: Yeah. Richard: seems complicated, but there's a really big important thing that's happening there. It's is easy to do or easier to do than adding and remembering passwords and stuff like that. And it's personally under your control. So you can just cut those off and stop using them whenever you want. You don't have to do that. But also there's nothing to hack at either the government side or the bank side in that case. Revolution Bank can get hacked all they like. All they have is a bunch of these numbers. Right? The government can get hacked all that they like. All that they can do is say that we've got a bunch of proof that these numbers belonged to people. But they don't actually have the ability to expose that. Or they could have that information, but you have to put both of those databases together now to get anything that's starting to identify people. and so I think that's where we want to look at stuff and say these are the real ways to go about it. And so if you look at a network like CIDO, what you can do is say, and we we're having a chat about this on another topic, but I really like the idea of anonymous, pseudonymous, and me. Right? So if you're managing your own identity, You can do what I was just saying about data and information yourself, right? Anonymous. What activities do I have and do I interact with other people where it just doesn't matter that you know looking at reading a newspaper, wandering around the internet reading stuff, whatever. Like it's you should be anonymous. Like it doesn't you shouldn't be telling people who you are when you go and read stuff, right? Because who knows why you're reading it? You should have privacy about that. pseudonymous stuff where you can say, well, I want to build a reputation here. I want to be known for my work or whatever, but I don't want people to know who I am. So I'll use an identity that I can prove continuous ownership of, but nobody actually can tie it back to me. And there's some stuff where I want to put my name to it publicly. I want to post something and say, I said that and I want people to know that I said that. And I want prove that it was me that I said that. And we want people to have the ability to do manage that themselves. with simple apps that let them take control. And so then you could say, well I'm gonna do something like prove it's me, you know, to one person, to you, but to nobody else. And so we can then interact together where you're confident that you know who I am. Or I can go and do other things and I can be completely anonymous while I'm doing it. And it's up to me, you know, how I behave and it's up to you what you'll accept from me, how much information you want from me. But we can then actually start looking at that question of like reducing the amount of of times we give information away, and then only giving away the minimum when we need to, and finally like doing it in a way that's much safer. Alex: Some of the things that you mentioned are already available in some countries. in Sweden Richard: Mm. Alex: we have something called Bank ID, which which which does pretty much this. It it's it's a it's an ID that you can have for an app on your phone Richard: Mm-hmm. Alex: and you use it to sign into different services, whether they're like public or or private. Richard: Mm-hmm. Alex: And what you do is that you either use a code. To sign through the app, or you scan your face and that way you get in, or you scan your fingerprint and that way you get in. But the problem with that system is that it's still centrally controlled. So if Richard: Mm-hmm. Alex: you end up in a twist with the state, or with because because by the way, it's not run by the state, it's run by the banks. Richard: Mm. Alex: So so if you end up in a twist and the banks don't Richard: Yeah. Alex: want to do business with you. You pretty much end up without an identity. Now they introduced another one, which is open source or you know, like clear. But there there is a, you know, there is there is correctness to what you're saying, but I think we're like kind of like dragging our feet on the implementation, Richard: Mm-hmm. Alex: right? Because there's this idea of like it has to be centralized, right? There has to be some big brother control somewhere in that pipeline. Richard: Yeah, mean it's it's a combination between just not wanting to let go and then actively wanting to keep keep a hand and control on things, because it's profitable and because it makes lives, you know, of bureaucrats and others easier. But yeah, I think to your to your point, yeah, this is this is the the flaw and it's one of the reasons I think people are a little bit worried about this kind of tech initially, is because it is centralized and therefore, you know, that identity is handed out by someone else and managed by them. So in the end what you're doing is you're having again one of these Constantina situations where it's actually worse than it was because you've got multiple levels of of risk to yourself both being excluded, like you're saying, you know, if the banks decide they don't want to do business with you, your bank ID goes belly up and there's nothing you can do about it. You can't create a new one or or start again or anything. because you you know, you're not in control. but then also that you've got things like well if for any of those central providers are hacked, you know, what are you gonna do? Right? So if you know, how are you gonna prove it wasn't you if the banks administer bank ideas saying, you got all your money out and gave it to us like how are you w w what what power do you have in that situation? So if they are hacked, you know, you're then at a a at even more risk than you were Previously, it's not s it's not solving that problem for you. Alex: Yeah, and and and I think that, you know, usually the hacks that that happen on these kind of systems are more like denial of service. So they kind of put you in a situation where you because, you know, Richard: Yeah. Alex: like you said, they don't have access to the information, they only see a bunch of numbers, right? But what they can do is to overload that connection between the the centralized verifier and all the users. So that basically Richard: Mm-hmm. Alex: all the users lose their access to any form of verification, right? It's a it's like we didn't steal your identity, but we make it impossible for you to use your identity until Richard: Yeah. Yeah. Alex: we get our ransom. So it it just it the the situation is the same. Like you don't get your pants pulled down in front of everybody, but you still have to open your wallet. So it is like different d different degrees of embarrassment, right? But you still have to pay. And how do how do you like for example like when when I when I think of what Sido does in a very very cool way not only does it have this this PKY PKI aspect to it, but it also the way it thinks about how data fluctuates through the network is is much more different than how the internet works today. And that allows it to kind of see These things happening. So for example, I'm asking, let's say in the system where you have like the bank ID server on one side and the clients on the other side and and the server is getting attacked, would it not imply that on something like zero, like there's such a high surge in traffic would be detected by the network and the network would act to defend itself? Richard: Yeah, I mean it's gonna that's that's the other big issue here is like if you look through the attacks and I'm I kinda made a list of this kind of attack to get my head around what the bulk of them are. the actually the social engineering ones are quite expensive. They're clever and they're technically simple but they're expensive 'cause they involve human time and doing things like calling people until you know following someone till they mess up and they put their password on their on a post it on their monitor, etcetera. the the bulk of them and like that huge hundred and fifty-three million driver's license one in the US are are actually just brute force attacks on things like password servers and stuff like that. And so that's actually one place where yeah, Soto has a second layer of defense that people might not think about, which is by putting the fees for network usage in the right place, people aren't paying any more than they would. In fact, they're slightly cheaper and they're subsidized by an attacker. But an attacker has to pay inordinate amounts of money to try, try, try again. And so you end up with a much clearer, both clearer path to action. Like if someone's actually attacking, it's much more obvious. They're also giving everyone cash for trying. So that's nice. Like they're subsidizing everybody else's usage if they're if they're, you know, trying to to you know, randomly trying keys or whatever. I mean, aside from the fact that like, yeah, the the c collision rate, the ability, you know, there is a possibility when you create a Bitcoin wallet or any kind of crypto wallet that you might create one that already existed and find some money in it. But it's literally if you did if you did it a hundred times a second, you'd need several thousand universe lifetimes to to actually be likely to succeed at that. So you y you've got this kind of insane level of security in the first place, but then trying to brute force it is also very expensive. And so it kind of just takes out the value in a bunch of the attack modes that are there now because they're very cheap to do. You know, you can hire a ser you can rent a server and just plow away for a very low cost. Alex: But that's what I mean, because that that's that's what what for me personally is is one of these one of these aspects of SATA that it took me so long to understand, but when it finally clicked, it's like it was like a Eureka moment. I was like, this is so genius, because it it incentivizes how should I put it like friendly behavior and behavior that benefits the network, but it also penalizes attacks. And takes all that energy and money and redistributes it in the network, thus making the network even stronger. And it feels like such a smart way of dealing with all these problems without having to resort to thicker walls, more regulation, doubling down. You know what I mean? It's it's it's like the it reminds me of that story of the Americans spending a hundred million dollars to create a ballpoint pen that they can write within space. Meanwhile, the Russians are using pencils. Richard: Yeah. Alex: And it's it's such a solution Richard: Yeah. Alex: that solves all the problems and you know saves you a hundred million dollars. But because we have that industry, because we have the capacity to spend, we do it with a hundred million dollars, big big boy pants, you know, and it's Richard: Big pen. Yeah. Alex: so silly. And I feel like we are heading in that world, we are seeing the emergence of that world. And I I think that people are starting to realize that and by people I mean normal people because people in power I I still think that they're disconnected. You know, what they're realizing is that they're losing power, maybe, and that kind of panics them. But I think that normal everyday people are starting to see that, you know what? I kind of have to be my own man or be my own person and and think Richard: Mm. Alex: about these things, and they're not as complicated as everybody else wants me to think that they are. Richard: Yeah, I think there's there's there's definitely something to that. I think it's the classic, you know, if you owe the bank a million dollars it's your problem. If you owe them four hundred million dollars, it's their problem, right? The that there's a there's a definite sense, I think, amongst regulators there is a big disconnect that if you've got, you know, enough in your accounts and so on and so forth that you're valuable to the bank then they'll look after you. and so there is this disconnect, on like the implication of things like you know, regulations and how onerous they are and the risk they put people under, etcetera, because that risk is totally unevenly born. so I think that that that is a a huge part. But I think people are also just starting to see I think people are starting to ask questions like especially once it's the second or third time. I mean it it it it kind of was a blip in Australia, but it was a few years ago where we had Medicare hack and then the Optus hack. So there were two big there were two big kind of customer data breaches within a month or two of each other. from my understanding they're completely unrelated. But it did start people asking these questions. But of course, because it was medical data and because it was was like medical insurance data and because it was phone data, nobody asked the question of should we c collected that data in the first place? Which was really to me the ar you know, the the thing that I think people are starting to see now is like, wait a minute, why am I giving away all this information? Like why why do they need to know X, Y, and Z about me? you know, why do I have to tell people who the receiver of money is, et cetera, when I when I make a withdrawal, those kinds of things. Alex: And and I think that there's maybe like a s second degree thing to it as well. and now I'm like shifting the topic a little bit, because I think there are some connections here. how can government, let's say the American administration, the US administration, on one side they go to all the AI companies and they say, you know what, we're not gonna regulate you. you regulate yourself. If you want to slow down the pace, fine. Get along with each other, come to an agreement and do it. Don't ask us to do it. So they have the capacity to see through it when they want to, right? The capacity is there. But when because it's a maybe it's a new a new industry, right? So they're not incumbent, but on the incumbent side, they they're myopic. They cannot they cannot see, you know, like two centimeters in front of them. Richard: Well, I think it's it's a case of whether they decided to do it or not already, right? So there's a lot of things where th it's already part of an ongoing plan. So I think what we're talking about here is regulatory capture and the agreement between the state and different players in industries to pull the ladder up behind the key players, right? And I mean the extreme example is China where it's almost auctioned off that that you know, position and the trade off there is often that if you do the work o of the regulation for the state, then the state will give you permission to pull up that ladder. Right. So you have things like, you know, with social media companies, you have to be able to put in the content moderation, quote unquote, teams that they have to be able to compete. Right. So they've now set standards where you know you basically need, I don't know, one staff member per X thousand users or whatever. And that Basically, given China scale, that means nobody else can compete, right? It's a very, very hard to get in on the game because you need to employ a thousand sensors, you know, every day if you're growing. And and you risk getting in serious trouble if you fail in that task of regulation for the state, right? So they're they're the masters of this sort of stuff. And I think where their playing field is agreed. you like you say, they've you know, they can read the fine print at a hundred yards. Where the where it's not, so where the where the state and and these big players are not, you know, the state's not sure who they want to win or who they want else joining the party, or they don't trust that the you know, that the incumbents will be profitable enough for them in whatever way they want. If they do pull up the the ladder now, behind them they'll just say no. And I think it it it it kind of highlights how tactical and how little to do with the end result this is and how much to do with the you know, with things like capture the regulation is is actually about, right? It's actually about managing you know who's successful and who's not and who's allowed to play and who's not in the marketplace, not about safety or those sorts of things. Alex: Yeah, so if if I'm reading between the lines, I would say that i they do what suits them, basically, right? It's it that would be the my takeaway l as a as a layman. Richard: Yeah. Yeah. It's it's it what it shows you is how much you know, on the on a scale between designed to for the betterment of the society that's being regulated through to managing the companies involved and getting what you want out of them where that spectrum is, it's way over on the on the side of of of essentially profiteering or, you know, manipulating the market rather than actually looking at, you know where where the regulation should be. In which case it would be happening independently and without input from the companies. Alex: It's it's really funny how how technology was supposed to be this huge you know game changer for everybody's productivity and you know way of life and was supposed to simplify everything and and make our lives much more comfortable. And they it has done that to a certain extent, but in that process a new business model emerged and it's based on on tracking and control and Influencing your decisions way before you even think about them. And it got really ugly real fast. And I think that in this environment it becomes even more important to understand that it is inherent when you know Lord Acton had this quote: power corrupts, absolute power corrupts absolutely, and the more power gets centralized. the more they want it, the more it kinda goes sour. Richard: Yeah. Yeah. No, I think it's it's i it's one of those things where I think like you said, there was this kind of dream of openness and democratization, etc. and it's been subverted and it's been subverted because I think of the abstractness of it, right? So people get blindsided, they don't realise what they're signing away 'cause it's a digital idea, it doesn't feel the same as a as a physical idea, you know. it's digital money, it doesn't feel the same as as actual cash. And so I think people don't you know, we i it's obvious people don't have the same reaction to being told, you have to KYC AML with this new company. but if you're told and you know you've sort of fifties American town, anyone who you buys anything at the drugstore has to fill in a document saying who they are and provides their street address and their phone number. Why? because the mayor likes to come by and read that list and just check He knows what's going on, right? This just seems problematic and people say, that's like Soviet Russia was like that or something. but when it happens digitally, people kind of lose direct connection to to the kind of absurdity of that situation. and they're also placated by, we've got checks and balances. Right. And I think that's the other side is like if the drugstore is keeping a list of the customers, what they bought, where they live, for the mayor to go through, then and people they then say the mayor says, there's checks and balances. People are like, Well, can you look in the box or not? Right. They have a very direct sense of like, can you go through and read this stuff? whereas with digital, you know, people kind of, well, yeah, okay and you can say, there's an access regime and you know people okay it sounds like it's being managed. And it's very, very easy to ha you know well it's very, very difficult to have a clear picture of what's actually going on. And so people don't, you know, can be just sort of worn down and and lose, you know, track of of what what's actually happening quite easily. And I think that's that's one of the big things that happened that we didn't foresee is people thought it would be simpler and that people would have a more you know, nuanced understanding of what was going on and in fact it just made it easy to deluge people in information and that would all be abstract and harder to mentally model and so people just put up with things that they would never have in in the physical version they would never have put up with. Alex: Right. Yeah. Yeah. Yeah. I always always come back to this idea of of you know, if s if like twenty people would follow you down the street and log everything that you do, how you open the door to the store, which shelf you looked at, which product you picked up and put back down again, how long did you hold it in your hand for? Right. If they would Richard: Mm. Alex: do all of that, you would run away. You would literally like, I'm not leaving my house, or like I'm only going out Richard: Yeah. Alex: at night. But that's literally what's happening to you in the digital world and Richard: Yeah. If you g if when you got yeah, you Alex: Because you cannot see it. Yeah. Richard: got a b picture, you get home and you go in and close the door and then outside the door you hear different people who are following you talking to the people who followed the other people in your family home, cross referencing when everybody arrived, right? W wh which is exactly what the internet does w like, you know, to your information. but we don't have a strong physical sense of that. I think that's that's the difference. Like if we had the kind of creepy people hanging out your front door especially you know, sh well your kids got you know, someone's saying, the kids got home at this time, what time did Mum get home? Okay, dad got home at this time, grandma's still out, right? Like if you heard them taking that kind of information, y you'd be rightly, you know, creeped out about it. But it because it's it's it's digital and it's away from what you see and you don't hear it happening, it's people just don't really pick up on it. Alex: And that's the beauty of blockchain, because in in you know, to continue that analogy, it kinda reintroduces an aspect of physicality by by things like blocks, by things like you know, NFTs, by allowing you to keep certain information and and purge other information, it kind of brings a level of that physicality back into the digital world, right? Richard: Yeah, it's kind of a funny thing because in some ways it's more public and more open, right? So, the Bitcoin blockchain, just as it is, is horrific for privacy because everything is completely public, right? And there's there's times that's fine and there's times it's a problem. you know, the the network is public. You can be synonymous, but it's still a public network. but but on Saturday by doing things in public and knowing you're going to do them in public, right? It kind of it's like if if something like Twitter was the only way you could communicate, you would learn very quickly what are the ways of encrypting the data because everyone will be able to see it. I know everyone can see what I wrote. You know, it's there. So if I encrypt it, it's gibberish, but I know everyone can see the gibberish. Then that makes you think about the level of security in that encryption that you use, and it helps you understand. at each level, is this public? Do I need to, you know, make it private? What do I need to do that? And I think that's a big actually a big advantage in that because things are are so public, you're then responsible and and it's easy to think through what you need to do to make it private. Alex: Yeah, but what I well exactly. But what I mean when I talk about like reintroducing physicality, I'm also r referring to the aspect of let's say if there's 20 people that are following you, meet the 20 people that follow the le the rest of your family, Richard: Mm. Alex: and they meet outside your door, right? On the internet, the cost of all that tracking is down Richard: Mm-hmm. Alex: to zero. On a blockchain, that entire tracking scales in cost the more people are tracking you, right? Because it it it it's like every single individual kinda has to pay for for the for the traffic that they generate. So it's it's no longer like two cents to implement the system. It's probably a lot more than that. So it's the economic levers kinda change a little bit, don't they? Richard: No, it d it totally changes the economics of it, yeah. Alex: Perfect. That was the the short answer that we were looking for because we're almost out of time. Thank you so much, Richard. And thank you everybody for watching. This has been the Open Internet Pod. Don't forget, this Richard: Thanks so. Alex: is also available on YouTube and your favorite podcast app every Sunday, 12 p.m. UTC. It's a great weekend. Listen, share this with your friends, your family. You always try to make things understandable for everybody. And I think this has been one of our better episodes in that regard. So thank you so much, Richard, and see you guys next week. Bye bye. Richard: So thanks everyone.