Data privacy in a digital age

Welcome to the Stephan Livera podcast focused on Bitcoin and Austrian economics. Today, I'm joined by Alena Vranova, the head of strategy from Casa, and we talk about privacy, the implications for individuals and businesses who are working within Bitcoin. But first, let me introduce the show sponsors, so Kraken. Over my years in Bitcoin, I've been impressed with the way- Where Kraken operate, they have a very strong focus on security and acting ethically in the space under Jesse Powell's principled leadership. They're one of the longest standing Bitcoin exchanges, they are consistently rated the best with a high quality platform, they offer some of the best liquidity in the, in the industry, they've got high trading volume and low fees, with no minimum or hidden fees. Kraken have twenty four seven support and on the institutional and business solution side, they're very popular with institutions too, ranging from funds and asset management to trading firms to crypto businesses. They offer the highest Last available API rate limits and there's a Kraken OTC desk. Kraken offer five fiat currencies and also offer margin and futures trading. So to learn more and sign up, go to the Kraken link in the show notes. Secondly, have you looked into Unchained Capital? They are a Bitcoin financial services company and they offer a two of three multi-signature vault product where you can use Trezor or Ledger wallets and you still maintain control with your two keys and reduce the single point of failure risk. So multi-signature helps protect you against that proverbial Five dollar wrench attack as you can distribute your keys. I've set up a vault with Unchained, I found it super simple and easy. Don't forget, if you create an Unchained vault, you also get three free months of access to SafedenaMoosa's Bitcoin Standard Research Bulletin, and Unchained also offer Bitcoin collateralized loans. You can get USD liquidity without selling your bitcoins, and this can also mean you don't trigger a capital gains event, so this might be more tax efficient for a hodler. You can keep hodling rather than selling bitcoins. While that loan is outstanding Dedicated multisig address under collaborative custody, so Unchained would hold one of the three keys, you would hold a second, and Unchained's independent third party key agent would hold the third key. To learn more and sign up, go to the Unchained capital link in the show notes. Now with that said, onto the interview with Alena. Alena, welcome to the show.

Thank you very much. Thanks for having me.

Yeah, I've seen you've been really campaigning hard on the whole privacy aspect, and obviously we have a lot of reason to be concerned. why don't you tell us a little bit about some of the privacy campaigning you've been doing?

so we launched, and I, I started a, a hashtag My Data, My Life because, we think I think we, we should be rebuilding, the way we live online and we should be rebuilding our systems, and that there's not enough awareness of what is currently going on, on, on the privacy field among, you know, our usual use-- internet users, such as my mom, right? And, we, at, at Casa, are extremely privacy focused, and we're trying to establish new- not just like systems and new approaches, but also a new, let's say standard, or help other companies, adopt a new standard in how they treat, clients' cust- clients' data. And their privacy.

Excellent. And now let's get a little bit deeper into why, why is this becoming more and more of a thing, and why are people not caring about it? Is it complacency?

It is, the free services, you know, that, that created products out of, out of, ourselves. whatever you know is free, then you know you are the product, and it is very comfortable, it is very, nice to have all this free, internet, and there is a kind of, this common notion that, that internet should be free, which is, another completely different topic, we sh- we shouldn't dive too much into that, but, but it's, it's basically a, a trade-off. You know, until recently, it's not been that much of a, of an actual problem. It's been, a problem for individuals when, you know, they got pounded and all of their accounts emptied or they found themselves in a, a difficult situation having some loans that they never signed. but these things happen kind of rarely compared to the, the mass, and, and that's why people would often say like, "Well, I'm not a bad person." person, I have nothing to hide, so I don't really care. Now that situation is changing rapidly, with new technologies, that, that we see coming up with, our AI, that is, you know, crunching huge data amounts, real, real time, and with the 5G technology that is able to transmit, those data real quick, And, again, have, you know, this AI evaluate, what's going on, real time. When you see at how strong the 5G lobby is, there's almost like zero hope for, for people not to, like, for us to, to prevent that from happening. I mean, private companies and governments, they are cheering for, for the 5G, and in fact, it can have very, a lot of positive, you know, effects on our life. lives, like, the science can move forward, health system, the way we treat, you know, our bodies and our minds. Yes, I'm, I'm a huge fan of that. At the same time, those tools are weapons, and we must be very aware of the consequences. And I don't even have to come up with some fiction to, to illustrate that, just look at Hong Kong and what's happening in, in Hong Kong, in the past, past weeks, where people Are completely aware of what the Chinese government is doing, and they go to protests against the extradition law, and they find ways how to protect their privacy because they know they would run into problems. They already had this experience with, with their Umbrella Revolution, and now they, kind of, stop using the Octopus card. They are deleting, Chinese apps on their phones. They're getting new phones. They're getting new prepaid SIM cards, they're putting masks and goggles so they avoid the surveillance, through the public cameras, and, you know, this is how How citizens can still protect themselves. Now, why is, why is, you know, China a problem and not just China, but, the entire combination of, facial recognition, survival, sur-surveillance technology,

even things such as DNA sampling, and creating huge databases of DNA, which by the way, Chinese- are supposed to have the, the largest, DNA database on this planet, including human, DNA. they work very focused towards a goal, to collect and to have the knowledge of everything that's happening globally, and whoever has the knowledge has the complete power, right? And so- When you look, to, to China, they have a huge governmental program, which ha-is supposed to have almost roughly two to four billion dollars, that, finan-that, that gives loans to other governments. That allow them to purchase surveillance technology, surveillance software, and even get training from the Chinese government on how to use that, to track their citizens. Now, Chinese are s-supplying the hardware, the cameras, right? The software and the know-how. I'm sure they're packaging a nice backdoor, here and there, to, to collect all the data. And come, countries like, like Germany This is a huge country, European strong, European economy, Ecuador, and a lot of, there's a huge list of countries that already have that in place. So what is happening now for the citizens of all countries is, is a this crazy dystopian reality You know, where we can have huge benefits, but, but the threats, are, are incredible, and where it can go, we can just again look back to China and see how they use the data, to, to stifle and to manage, the opinion of citizens and, and, basically Directing where, where the society goes. they have this social credit scoring, right? So once you have, once you have all the data, you know what you're buying, where you, who you meeting, you know, what, what's your likes and dislikes, what's your opinions, so they're getting inside your head. Now, the facial recognition on the street is becoming extremely precise and sensitive, so they can even see whether you're in distress, whether you're, You have high blood pressure, whether, you know, you have some maybe, criminal thoughts, I don't know if they will eventually be able to, to do this. But, but the, the, the point being here that is not healthy. That is not healthy if it, if it is in, hands of, of a government, that doesn't care about, you know, human rights and liberties, and it just cares about complete control. And it's, we're on the verge, of- Of is this going to go the good way or the bad way? And let's hope we can build systems that help us out, right? But that's maybe, that's maybe a little bit, too far ahead. So, yeah.

Let's hope so. and I think one interesting thing here is, it's not just about the intellectually understanding why that's a risk, it's also about a, a certain emotional connection that people have. So a quick example, I have some friends who are Chinese here in Australia, and sometimes when they talk of their Chinese friends back in China, some of their parents think of the government as, "Oh, the government is on my side. I want the government to have these powers." how can you, how can you communicate the risk there?

Well, the government's on your side, as, as long as you're a nice citizen and as long as you behave according to some norms that they are, that, that are expected, right? once you start, for example, social posts, that you're not happy with, with their decisions, and if you have a big followership, you know, they start to use this social crediting system to, to have your friends Police you, okay? So, for example, we are befriended on WeChat, right? And I, I'm, sharing all these Hong Kong protests, right? What happens is my social credit goes down, but so does yours, right? So you come back to me and say, "Look, Alena, I, I have to unfriend you because I need, you know, we're expecting baby or whatever, and we need to get a loan, and I won't ever get a loan if, if my score is too low and if I'm- Associated with this kind of people. That is very scary and that shouldn't be happening, right? another thing is what, what several countries do, but, China is, is a master in this, is, creating these concentration camps that nobody talks about. the, there is a huge Muslim community in the north of China, the Uyghurs, and, well, they're not fitting in the Chinese, Ideal, right? China needs everyone to behave in a uniform way, be a nice citizen, behave, listen to, and, and auto-autocensor, you know, self-censor, self-censor, so that, you know, you're not sticking your head above the crowd.

Uyghurs, in northern China, it's like, it's, it's a humanitarian disaster what's happening there, and it's a place where Chinese were testing all these surveillance, technologies. W- and as a result, they created a, a, a concentration camp where, supposedly over one million Uyghurs are. Now, what they're trying to do is a cultural genocide, right? So they, they basically couple Uyghur men with Mandarin women. Once they have a child, the child goes to a specific school where they get, get brainwashed, and they are like good, good citizens of People's Republic of China. Now we're circling around Chinese all the time, but it is very important to realize that all this technology is being implemented all around the world by, by most of the governments.

I'll let that sink in. Okay. so, and we want some freedom, we don't want this, so we need to really, really build, encryption, by default systems, we need to build new resilient systems, and Bitcoin is just amazing because Bitcoin can help, a lot of these people, Circumvent, you know, the surveillance, circumvent the, the restrictions, you know, if you're not a pleasant, person, if you're too intelligent and too loud and you have your opinions, well, the first thing to do is to close your bank accounts and prevent you from transacting with the world, prevent you from earning money. Absolutely destabilize your private life. so it, it was an amazing experience. I, I just re-returned from Oslo recently, from the Oslo Freedom Forum. and I want to, once more, thank to Human Rights Foundation for inviting me and a few other bitcoiners, because there we met so many, so many groups of people from so many different countries that struggle, with- With, with these issues and when they heard, they, many of them heard about Bitcoin for the first time, they had no idea. They were coming up to me afterwards with huge eyes, saying, "Oh my God, I had no idea, this is extremely helpful, how can we use it?" Right? yes. So I was, I was very happy, Bitcoin is one of the, one of the tools that can help, but just really, really one of them.

Even if, let's say, you're a very private person and you don't have a Facebook account. You can still get leaked, your data can still be leaked by your friends who tag you in things or your friends who post a picture of you, and it might be enough such that the government or whoever is trying to do this stuff can still create or construct some sort of social graph and figure out who's friends with who. So it's almost like you need to get enough people to take this seriously and not just kind of the fringe two percent, because they will still just get caught by the standard, you know, social media.

That's right, and, and like there's, I would love to see my, for example, my, complete personal picture online, what's out there? I think if we saw that, it would creep us out, real realizing that, that some companies may know more about yourself than, than you do, because your memory is, you know, fading away, you don't remember, who you emailed with a couple of years ago, but Google does. They have all the data, they have all your, all the way back, and they have machines that are crunching the numbers. so, and, and with- implementation and, and like, evolution of, AI, we will find ourselves to be, knowing less about ourselves than the machines, and then that's, you know, no, that's an inter-definitely an interesting place to be and, definitely interesting to follow where that's gonna take us.

Yeah, that brings to mind an example I remember, and this isn't even that recent, this is a while ago, I think it was like one of the first few ex- Examples of things like data analytics being run by companies. I can't remember if it was Target or some similar company where essentially the company started running analytics and they found an example where this teenage girl, they found out she was basically pregnant before the father of that girl even found out because of the analytics and the p-purchasing behaviors. Yep. Yes. So it's, it's a, it's a scary time.

It is a scary time, and it, it's also scary that a lot of these sys-systems are just human-created and human-dependent. And, right? now, is it good or bad? It's definitely good because you can't write a perpetually good code that will, auto-deduct, you know, auto-deduct, auto, auto, correct itself. So you need human intervention, but then you have, you know, for example, all these social engineering, attacks that are actually not that difficult to, to, to do. So, A huge, you know, re-just recently in Bitcoin there was a huge SIM swap, wave, a lot of, crypto folks have lost money, and it's basically just picking up the phone and calling, an operator, and convincing, be, be convincing enough To just, swap the SIM card to, to port the SIM number, to, to port the phone number to a new SIM card. And so you have, you know, network attacks and social attacks, basically. And we need to figure out, some help for both. Yeah. For the network attacks, we need to rebuild the system. We need, more resilient systems. we need to get back from the mainframe cloud computing, to home computing, and I just recently gave a talk in Berlin about That and Jeremy was talking, Jeremy Welch from Casa was also talking about this, that we're basically going through several waves of, we've gone through several waves of computing, right? Starting in the '60s with, with the huge IBMs, you know, in one room, running, local apps on local computers, and then, we switched to personal, computing, with Apple and, and, Microsoft, running, again local apps. And right now- Now we switch to cloud computing, to mainframe, computing that runs all these, network apps, and that's a problem because it's a huge honey pot of data It's managed by people, it's like, you know, there's so many potential attack vectors in the system, and what Bitcoin brought to us, and I started my talk with, like, beyond the price hype, is an actual computing revolution, what, what Bitcoin is showing us that how we can treat the risk, and, and the system on, in a decentralized way and, and basically distribute the risk to the end nodes where it's It's not that, beneficial for, for an attacker to target at all, because the, the, the risk reward is much, much smaller than at-at-trying to attack some servers. and so this is, this is something that we are focusing on at, at Casa, to basically help building a new type of home computing where you can take back your ownership, take back your data, take back the ownership of your, of your Online cy-cyberspace life, you know, that you're, that you're having. this and key management, which is a, a crucial component, is basically the two main pillars of what we do at Casa right now.

So Alena, with the idea of the computing revolution, I suppose there's a few things there. So with Bitcoin, we typically speak of it, it's funny because it's like we typically speak of Bitcoin as like a, a verification machine rather than a calculation or computation machine, and we're typically, when we think of like world computer, right? That's more of like an Ethereum idea, right? And then I think another thing is just around one challenge that people will face with this is sometimes- Sometimes they want the fancy features, because obviously the convenience, right? They want the crazy machine learning photograph processing of Google, or they want the, that kind of natural language processing available in these big servers. And so maybe that's part of the challenge is finding ways that people can get something similar to that, or like only at a slight degradation in the quality, but done locally. Is that a fair sort of idea that you would think of?

That's a great idea, but how to achieve that? Right?

Or, or people just have to be comfortable giving up some of those things that they are currently reliant on, say, Google or Dropbox or whoever for.

so o-one of the things that we can, focus on is, our, digital identity, right? And, and, encrypt it, have it stored locally, and do some kind of selective disclosure, to, to use it very selectively and very lim-in, in a very limited, scope. so instead of, you know, signing up to a, to a Bitcoin exchange and submitting all your IDs and, and proof of home address, instead of that, just like really focus on limiting the amount of data that, that the companies, collect and need and, in order to be able still to provide the service or in case of, you know, mass, mass computing on, on or using a lot of data, just, just figure out ways how to- to anonymize the data, and still use them for scientific purposes. I don't want to be the person to call like, let's go back to trees, and let's forget all the computers and, switch off the, the Wi-Fi, but at the same time, you know, there must be balance and there must be an, a rather an opt-in. a solution saying, "Oh, do you want to participate? Do you mind, you know, if we use this data?" And you say, "Well, I don't mind, no, thank you, I will keep my privacy as it is." we need to establish, you know, easier ways even for companies to do this. they, they are struggling and some com-companies will struggle a lot, especially companies that are, based on ad tech, collecting all the data and now to kind of remodel their approach, it's, it's, it's almost like a Mission Impossible, you know? how do you ask Google or Facebook to stop, using data and selling it to advertisers and, and recreate their models, right? I'm, I'm definitely interested in, in seeing what Facebook's gonna do with their coin, and whether they're gonna like approach this particular topic, but, knowing how Facebook was behaving, in the past I rather think of Facebook coin or however they call it as a surveillance coin, right? As something that when you couple like owning all this huge amount of data, personal information, with, a financial tool, super controlled money flows,

yeah,

you have, you have it all. And it's like on one side we have, Tencent and, and WeChat In China, and I think Facebook will try to, to replicate the success of, of that surveillance machine, you know?

Yeah, especially with things like, governments trying to move away from the ability for people to use cash, high level or large cash transactions being banned in certain countries, whether that's India or even Australia, that's definitely all pushing towards this idea of the cashless society. Well, the

cashless society, in other words, using digital money, I don't see I don't see this as a, as a problem, but, but, it's important to, to see what kind of digital money are you using and who issued it, who controls the issuance and who controls the flows, okay? So Bitcoin isn't cash per se, it's not paper, some call it a digital cash, but, because it's, it has some properties, right? but in fact, it's a digital form of payment, okay? so this is one- Something I was trying even in Oslo to, to, to explain, like I'm not per se against cashless, what I am against is, is cashless society that is created to surveil, people and to have complete control over the, the monetary flows, the financial flows.

Part of it is also the difficulty because I, as I, the way I view it, it's sort of like Banks would probably not-- I mean, look, there's two different ways to think about it. Obviously, banks in some sense are being deputized by the state, right? AML, sanctions laws, CRS, FATCA laws, all of these laws are kind of-- they push them onto banks, and then bank compliance departments have to set up the systems to surveil you and, okay, ask you, okay, show me the ID, who is the person you're sending this money to, and so on. It's almost like there's just not- Necessarily a way that you can participate in the standard banking license regime and not take all of these details.

You know, my friend was, was joking, but he, he was actually right, that, the banking license is actually licensed to launder money. and, and- yes, w-without a banking license, you can't do money transmission, and what, what, what's happening in reality, that, all this KYC/AML is, is basically just burdening the entire system with a huge amount of, of, of work, Spending hundreds of millions in implementing all these, systems, blanket surveilling the average user, so people who aren't trying to, you know, do any, any criminal activities and, and they're just normal people, so they've been, they are being surveilled, data is collected on them, no bank and no private company, not even government Can protect their server houses. So you have, for example, in case of a Bitcoin bank such as Coinbase, you have thirty million user data with home addresses, with their, with the transaction histories and everything in one place. So should that, I hope not, but should that be leaked and, and, and stolen, you have a great list to target people. So KYC is actually very dangerous. And so it was designed to prevent banks from money laundering, but the reality, when you look at Deutsche Bank, you look at Danske Bank, just Danske Bank, one little tiny office somewhere in the Baltics, laundered two hundred and thirty billion dollars. It's a mind-blowing number. So, so you see that all this KYC/AML is, is a wannabe, kind of security. We, we all say, "Oh, we've done our best, we've put policies in place, we've put, you know, new systems in place, and we're surveilling and we're trying to prevent," and, and then, you know, a normal person wants to make a bigger purchase or withdraw money from the bank account, and you have to- Feeling a, a huge, like, almost apologetic form saying like, "Why do you want to withdraw your money? But then you have actual organized crime. They just go and, and, and bribe those bank officers. So does it work? No, it's

not. Yeah, and it becomes this sort of, whack-a-mole game, right? Because the governments will try and shut down certain banks, and then certain banks that become more permissive, let's say, tend to be- The ones that the criminals try and move all their money through. And so then it just becomes this weird sort of game of, you've got kind of the good, or not good, but like the banks that are trying to be very strict with AML compliance, and then the other ones that are less so, less so, who might win a lot of business because they're actually less strict about it.

And then, well, and the, the scary thing is that they, you have the Bitcoin companies that are doing this KYC, and, you know It's, it's a little bit worse than the usual traditional, fiat system, because to steal, to attack a person in Bitcoin and try to steal, Bitcoin from them or otherwise, you know, threaten them, is a, is much more interesting for, for the thieves, right? Than, than targeting someone who has everything in a bank account and bank transactions are, easier to, to roll back than, than Bitcoin transactions. So, so when I see, crypto companies offering free services, brackets, okay, free services and doing KYC, AML, I always go like my alarm goes off and, I would love all the Bitcoin and crypto companies to just adopt a different style and, and really, and there's, we, we, we coined a, a, a slogan for this saying, "Don't collect what you can't protect." Doesn't make sense. If you can do verification of the customer using something else than his ID, then do that. We, we put a lot of thought at, at Casa because, you know, we're providing this multisig service where a Casa holds one of the keys that is never used to co-sign actively, the transactions, but it is used, it can be used in case you lose more of the keys than you should, right? and we've been really thinking a lot, a lot, a lot, a lot about About how to do a recovery without invasive KYC. We don't ever want to store your names, we don't want to know where you live, after placing an order in our shop, and, and dispatching the order, the order and everything gets deleted. We don't store data, we don't store cookies on our website. So we, we do a lot of things that, try, that, that aim at, at putting Casa into a place where it can't be right. And, and I don't-

Look, I absolutely, absolutely appreciate that. I think that's a good focus to have as a company to try to not take data from the customer that you don't absolutely need. but let me just slight hesitation. Obviously, I'm not defending the government, I'm not defending AML and all that, right? but I just, I, I wonder how feasible is that, because ultimately, if people don't have ways to buy Bitcoin, and typically any-- there are very few no KYC options, right? Unless you're talking- Like Hoddle Hoddle or Bisk or maybe like Fast Bitcoins and Aztec, those kinds of options. And even those, if you go above a certain threshold, the government will probably come down on those companies too. And so then it becomes like every-- the only way to actually get bitcoins will be, well, theoretically, it could be, it, it could work out that way that it's the only way to get them in any sort of serious volume is through a KYC exchange or broker or so on. And it's kind of, is that- Fair, it's con-sort of controversial, but it's like, is it fair to say, oh, no Bitcoin company should do that when it's kind of difficult for any other way right now for people to buy a lot of Bitcoin, for example? I

know, it's, it's difficult and, it requires a lot of thinking, a new ways of thinking, Well, what you can definitely,

try to build up is how people can earn Bitcoin and earn Sats, right? Because that's, in my opinion, like you can mine Bitcoins, you can buy them And you can earn them, and this earning part has been neglected, a lot or neglected, has been very, underdeveloped, in my opinion. you know, everyone's talking about merchant adoption, but they forget that, well, merchants can set up, accepting Bitcoin, but if their customers don't have Bitcoin, well, they won't spend it. And if customers are buying Bitcoin in order to invest, they are much more likely to hold on to those Bitcoins, so the merchant adoption won't happen. The way It can happen is when people have a constant flow in of Sats, right? When you, when you're earning coins and you know it's a, it's a constant flow, then, it's a, it's a tool that you can also be spending. Right? So th-th-there, th-th-there needs to be like a shift in, the, the frequency of, of your Bitcoin earnings or otherwise it's investment and you want to hold on to it. Yeah, I, I just,

I guess for me, like obviously I'm all for that, right? Like, and I'm sure Sergey Koltsov is cheering right now, and he's all about earning Sats and so on, and, you know, absolutely, I'm all for that. I'm just, I guess to me, it's, how feasible is it right now? I, I suppose it'll take time for people to kind of get to that level where they can actually earn in Sats, because it, it just, not everyone has the sort of job that can enable

that Fiat and how else are you gonna buy it? And I, I guess you could just constantly do little small cash deals and buy, but it just, I guess if you want volume, there's, there's kind of right now at least, and maybe part of the answer is to build the volume on some of these other alternatives.

Well, I'm hoping for some better systems that allow you to just, tell to your employee, hey, I want, you know, fifty-fifty for example, or I want twenty percent of my, of my income to, to be in Bitcoin and the rest

you think you, you think you need. there have been several services I've been using and I've been trying myself, I still think the user experience is quite bad and has a, has a lot of-- but that's positive because there's a lot of space to improve.

some middleware, you know, could be developed, that just makes it super easy for the companies to process that. So instead of sending your usual transaction Action to your bank account, they would send it to this service account, right? And that service, would distribute the money. It isn't centralized, it isn't, you aren't known who you are, but that just happens in a typical employee-employer re-relationship. so-

So at least you're minimizing the number of people who have KYC'd you, right? Because if your employer already has the KYC, well then, there's not much you can do about that, right? Well,

your employer knows who you are, or should know. Yeah. I, I know very little, companies that have, have anonymous employees. I know of, I know of one,

w-which is basically my, my friend's business, and he, they are doing, white hat hacking, penetration testing, and a lot of his employees are just pseudonyms, em-uh, hackers, right? That he employs are somewhere in, living in the cyberspace. And, and- And so basically that, that business is completely running on, on crypto.

Well, I mean, that's fantastic. Obviously, that's the, that's kind of the future, the promised land, that's the future that many of us Bitcoiners want people to be able to, you know, to be able to live in. But, I suppose it's, it's about, what's the best way to get there? And part of it, I think part of this discussion is also how can companies change or change their practices such that they are a little more- Friendly to this idea of maintaining your privacy, and I think you're, you're getting to that as well with this idea of the privacy policy that is, you know, not like thousands of pages of legal gobbledygook, right? It's easy enough for somebody to read, but it also is minimal in the amount of data that is being collected.

Yep. Well, the easiest thing is, well, if you're trying to put up a, a new project in the space, just go to GitHub and fork our, fork our data protection And, and privacy policy. We made it, open source for anyone to reuse and adapt as they wish, trying to show at least some, some path, forward and make it easier, just start there, start evaluating, do I really want to use cookies on my website to, to track, customers and to serve them advertisement elsewhere? can I achieve my goals in a different way? and, you know, at Casa, for example, we have, several plans, that, that our customers can subscribe to. One is completely free, because we want everyone to, to start using multisig and get used to the technology and, you know, feel how it is to have a good multisig, for example. but then there are paid, subscriptions, yearly subscriptions that, you know, w- Also say we are a company that sells you a very high quality content, tools, hardware and services, and this is what we charge you, and you know exactly what you're getting, and you know exactly, what we are not taking from you. Right? Which is the power over your, your keys and your data. We will never sell your information to any third party, we will never track you down, we will never serve you ads. And there's a trade-off, of course, because if we could have, you know, AdWords and Facebook ads set up, we would probably have, a wider reach, and maybe make more money, but we consciously decided to not go. That way.

Excellent. Well, I definitely appreciate the approach that Casa are taking. I think there's a lot that you guys are doing that is a good example for many, many people in the industry, and I think, you're also kind of writing some good material. Like I saw a good article by Carolyn from Casa as well about, some basic security tips. So look, let's talk a little bit about security tips for Bitcoiners, right? From a customer point of view, what should be, should they be thinking about in terms of, you know, protecting their email

Yeah. So there's

that, the blog post by Carolyn, it's called seven ways to level up your Bitcoin OPSec, operational security. And there's another one by Nick Newman, he wrote, what to do if you become a victim of a data breach. You can find both on blog dot kiss dot casa. and, and so, the, the, those two articles are just really simple, overview of what not and what to do. We also developed a small application, that's, that's- At app, a p p dot keys dot casa, and it's a security, security health check where you can just click through a few simple questions, answering yes and no, and then you, you get a report on what is wrong with your operational security as a Bitcoiner. And so what can go wrong? Well, you can reuse passwords, and that is a very typical mistake. you generate the passwords with your own brain, that's not advised, okay? because we used to, we, we are used to thinking In patterns, right? So even if people think, "Oh, I have a unique password for, each of my services," and for example, I would say for Facebook, I have, Facebook and my birthdate, and for, my Gmail, I have, well, Gmail and my birthdate, and that's unique, right? That's different, but there's a pattern. So if you-- if your, e-email has been breached in one of huge, you know, hacks, data hacks, then, there can be some simple algorithms for, for To just go and try the pattern that you use, try to recreate the patterns for other services. so use, use unique passwords that can be ideally just generated by a password manager. Now, password managers Are a great tool because you get unique, passwords and you can store them safely, but they are all protected by a master password, and that's a single point of failure. Okay? In, in any behavior for a Bitcoiner, it's very important to think of single point of failures.

How to, how to go about it? So master password is one password that you use to unlock the entire database. Providing someone knows that you're a Bitcoiner, someone stole the Coinbase list of users, right? He can target you, right? He knows where you live, he could potentially target your computer or he could just, you know, disseminate, some keyloggers, over some, over some IPs and, and try to, to get in. They can, Basically keylog anything that you type in, so that's a master password that will give them access to all of your passwords. There are some, some cute things such as well, you can use an additional, validation, a, a second factor authentication, I will get back to that, or you can use cryptography instead of that. there's a Trezor password manager which is not widely used. not, not so much the, what I would love to, but the Trezor password manager is a great showcase of how you can go about, encrypting, data basically and, getting rid of this single point of failure, and that's the master password, because basically instead of writing it, tapping it out, you just connect your, hardware wallet and click a button, and you decrypt, whatever you want to decrypt, right?

Right. Is that similar to like the UBI key that some Google employees use and that kind of thing?

well, you can--

I think it's like a physical plug-in and they have to, they have to have that before they can-- Oh, yes, no, this

is specific for Trezor owners.

Right. Yeah. Trezor,

Trezor, the hardware wallet developed, actually it was still while I was the CEO, so we, you can say we developed a, a password manager that, that is showcasing that it can be done more securely, right data with the, with the unique key and so on. But this requires people to be security aware and already think, "Oh, okay, I can actually use a hardware dongle, a hardware thing, to secure my data." So the typical thing for people to use would be something like a U-Key. Or to have a second factor authentication via SMS. Now, that isn't, recommended, especially if you live in the US. for, for me, for many countries to, to port your phone number from one to another SIM card is usually, like you have to come to a place with two or three IDs and with the face on those IDs and, you know, go through a certain procedure. But because USA is such a huge market and people move all, all around, they, they allow to port, the, the phone number. So please don't If, especially if you're in the US, don't use, SMS as a second factor, instead use some UBI key or use, a Trezor, for example. I think that should be compatible with LastPass. And that just goes, not just for password managers, but, but for your emails, for any of your, accounts, of course, that, that you're using. What else? Well Stay away from exchanges as a storage. Okay, don't use, don't use exchanges, don't use, custodian services in general to store your crypto. For that, you have, much better, much better options. also, of course, sharing your home address, is something that you should consider not to do. And that comes back again to the KYC that all these, companies are trying to do, right? So once you give them a proof of address, I don't even know why they're, requiring that, to be honest. Like for, for providing most of the services, you don't need to know where the person lives, right? yeah, and the last one, maybe if you're not, using Casa's seedless multisig, then definitely make sure that you have a good backup of your keys, right? Jameson Lopp has written, has done a lot of research on this and has written, some good posts and, and recorded some videos on how to do that. yeah, but the best really is just go seedless, go multisig, try it out, it's for free, it's there.

excellent. I was curious then as well, when you're taking, say you're taking deliveries and you tr- wanna try to not disclose your home address, examples might be, I don't know, if you can take it to some kind of Or maybe to your work address might be a bit safer than taking it to your home address at least. that's a bit tricky one. That's a tricky one though.

It's a tricky one, but it's doable. I myself do it this way. I have a different delivery, address from where I actually am. I think many people can achieve that. They can either have the, their stuff delivered to the office or some PO boxes or some something else, it depends.

It's doable. Yeah, I guess a, a part of it is, just As well to go and take certain steps, and sometimes it's a matter of, well, like Matt O'Dell says, you know, you're like that, that kid who touches the stove and now you've been burnt, and now you know not to do that. And so, is, in your view, is that what it's going to take for people to start taking these things seriously?

Well, I hope not, but I guess it will. So, a lot of people have this thinking it, it can't happen to me, right? And I spent ten years of my Professional life before crypto in, risk management and insurance, right? And guess what? People hate insurance. People don't want to, and they, it's not a thing that they automatically desire. it is a thing that they desire to have when things go wrong, right? And only after things went wrong. so I hope people start to like learn from p- other people's, stories, and it's important that people, you know, once they- They figured out what happened and once they secured their funds, but they had some breach, they go and report about it, they tell the story. Now, there's, I know certain people in the, in the business that have been attacked on numerous ways they had a fri- a friend of mine, he had a treasure wallet, someone started to, to-- Well, they ported his, phone number, and they started to attack all his online accounts and empty his online wallets here and there. And he said, "Well, but, you know, I was, I was looking at what's happening, and I saw the money disappearing, but I was sitting there relatively fine because I knew that most- Most of my money is at home on my, on my hardware wallet. A few months later, the same person messages me, totally panicking, realizing that someone broke into his house. Okay? And was looking for the hardware wallet, and was probably looking for the seed, right? And now you come to a point where, okay, we are talking about this self-sovereignty or sovereignty and being on your own and protecting your keys. But how is that doable for an individual that, you know, has his life and has his other worries to, to deal with? And this is like, okay, it's important, but to be realistic How much time and effort does an average person dedicate to this, right? And so you would be either completely on your own as a Bitcoiner, or you have the chance to give up the keys to a Bitcoin bank or some, you know, custodial vault and then also run the huge systemic risk, with them, right? And For a long time there was nothing in between. People wouldn't know how to protect the recovery seed, which is by the way, the number one problem that Casais, solving, okay? and there was no company or no-nobody really that you could know that, okay, I will protect my keys, I will keep full control, but I have someone that I can call. When I'm in trouble. And, and so we're bridging that with Casa, trying to, you know, hold your hand when you want it, but never hold your keys. That's the, that's the mantra.

One other thing I was keen to just ask you about is, you guys recently won a UX award. Tell us a little bit about that.

Yes, that was a huge surprise, by the way, so Jeremy, got invited to this, COGEX, I think, is the name of- The, it's some, AI, machine learning, virtual real- reality and whatnot conference, I personally didn't know, know about it before, but all of a sudden he, he sends this video saying, "Hey, like, yeah, we're here, we didn't win anything," and then all of a sudden all the crowd's cheering, and it was a huge surprise for the, for the team and a huge validation, you know, when you work like crazy on something and then all of a sudden there's- There's another word. the award is great, but, not that important, I would say. It's amazing, it's, it's good, you know, to get this appreciation. but, what, what, what, what we're looking into is to really create some user experience that, that, that puts you at ease, and to create a user experience that would even breach certain security pitfalls that would, you know, Protect you from yourself, basically. And, we are lucky, we have some really, really good designers at Casa. We, the, the, the, the head of UX is, Scott Herve, who also wrote a book on, designing products people love. he used to be the head designer at Tinder, you know, doing this swipe left and right, and he invented the super like, which by I wish Tinder to profits. but this person knew nothing about Bitcoin when we hired him. Okay? And that's amazing. That's exactly the type of designer you want because he can see and cut through all the, all the nerddiness that we are just like, you know, this is our normality. he can cut through it and, and say, no, this won't work. And if we want to create Bitcoin accessible to actual masses, then we need to have this way of thinking. So we're like

fantastic. Yeah, look, I think that's, really interesting to, to get some of that outsider perspective in some sense and, make it easy for newbies. Alright, so look, I think that's just about all we've got time for. So just before we let you go, Alena, tell, tell everyone where they can find you and keep up with what you're doing and also where they can find Casa.

Sure. well, I'm best visible on Twitter, Twitter, slash or, yeah, Alena Satoshi or go to our website keys dot casa and we have our, beautiful blog where we're trying to post not just like product, product updates, but also, crypto one-on-ones, crypto two-on-ones, a lot of educational, blogs, just to help people navigate the cyberspace.

Fantastic. Well, look, I think that's been, it's been great. I really enjoyed, chatting with you, Alena. Thanks for joining me today.

Thank you. It was a pleasure.

What do you guys think? I think as Bitcoiners, we've gotta take steps to protect our digital privacy and security. So hopefully that episode was interesting for you. you can find the show notes on my website, stephanlivera dot com, and there's also a subscribe link there, so you can subscribe to the show. Any feedback, you can come and find me on Twitter, my handle is at stephanlivera, my DMs are open, or you can email me, stephanlivera at PM dot me. That's it from me, guys. Thanks,