{ "episodeId": "SLP611", "speakers": { "stephan": { "name": "Stephan Livera", "role": "host", "tag": "STEPHAN" }, "keith_gardner": { "name": "Keith Gardner", "role": "guest", "tag": "KEITH" } }, "segments": [ { "speaker": "stephan", "time": "00:11", "start": 11.35, "text": "Hi everyone, and welcome back to Stephan Livera podcast, brought to you by Bold, the best place to buy, save, and store your Bitcoin over at getbold.io, that's for the American listeners. Now, joining me today is Keith Gardner from the Branta project, and we're gonna get into this and what it's all about. But first of all, welcome to the show. Hello," }, { "speaker": "keith_gardner", "time": "00:31", "start": 30.9, "text": "Keith. Yeah, thanks for having me, Stefan." }, { "speaker": "stephan", "time": "00:34", "start": 33.52, "text": "So, Keith, let's, start with, start with a little bit on, you know, a background on yourself, who you are." }, { "speaker": "keith_gardner", "time": "00:40", "start": 39.65, "text": "Yeah, yeah, I can be short with the background. I wish I was an artist, but my background's in engineering. So, I worked at Bloomberg in the heart of Fiatland in New York City, London, both. And some point along there, you know, you're surrounded by so much complexity, and whenever you're surrounded by a lot of complexity, you kind of know And so at some point I found Bitcoin and decided to go all in on Bitcoin. So I did that, and then, I think this might resonate, but when you do go all in on Bitcoin, you quite quickly become scared about losing your Bitcoin. And so this kind of kicked off this series of questions to myself, like how would I steal my own Bitcoin? And Bronto was born from that." }, { "speaker": "stephan", "time": "01:25", "start": 84.93, "text": "Gotcha. Okay, great. And so I guess I'm gonna try to explain it simply, and you, you correct me if I'm getting it wrong, but as I understand, it's, it's a like an add-on piece of software that you use that helps you avoid some of these common phishing and address replacement kind of attacks And maybe helps you verify that your counterparty, whether that's an exchange or a merchant, that you're actually sending to the right address. Is that right?" }, { "speaker": "keith_gardner", "time": "01:55", "start": 115.25, "text": "Yeah, that's, that's quite accurate. So I guess the first thing is like the clipboard attack is quite small in this theory, but like the idea of phishing and man-in-the-middle is very, very wide. So that's like a huge attack space. And, Like when we use Bitcoin, right, what we're doing is we're storing value through time, and when we wanna spend that, we're essentially sending the Bitcoin across space. And so like if you're in the UAE right now, I'm in the USA, and I wanna send you a bit of Bitcoin, what typically happens is if you're a person Y, you receive this piece of information that says, \"Hey, pay this destination this amount of money.\" You'll be fine, we'll continue our business transaction. But it's actually quite sketchy to receive any piece of information that tells you to pay somewhere else. And so if you can't verify that easily, this is a huge problem. And essentially that's just a man in the middle or phishing, right? It's impersonation, which is one of the main sins you can commit. And so this is really bad, but I also think it's quite solvable. so yeah, yeah. Anyways, go on though, what you were saying." }, { "speaker": "stephan", "time": "03:03", "start": 183.4, "text": "Yeah, no, I, I just wanted to-- I was just sort of kicking it off. and I guess we should also talk a little bit about, you know, how many people are losing money to some of these kinds of spoofing. Obviously, it's a well-known thing in terms of scamming, many listeners and, and you're probably familiar as well, that there was a famous, let's say, podcast or call recently with Jon Suth and, a scam Take over someone's account and get them to, you know, in various ways these things can happen. So, let's just, I guess, yeah, maybe we want to start in that way, right? Like, what is the problem you're solving? What are some of the common ways that people get scammed and, spoofed into sending their coins to the wrong place?" }, { "speaker": "keith_gardner", "time": "03:50", "start": 229.73, "text": "Yeah, no, that's a great question. I mean, it can be anything from like a simple email that looks like, say, bold Bitcoin, but isn't bold Bitcoin, or it can be AI, right? And so like, I think the Jon Seth pod dropped this, maybe early summer, and a lot of people really clung to that, 'cause the story was told quite well. But really, like- What Bronz is doing is like, we're trying to skate to the park here, because the two, like, major techn- technological themes that are coming are, right, AI and digital scarcity, Bitcoin. And so AI is making the John Seth attack very, very cheap. It's like right now maybe this is some kid in their basement calling people saying, \"Hey, I am Coinbase, yada yada, give me your two-factor.\" Okay, this is kind of fun in games, it's these little gangs of kids doing this. But this gets quite bad when you can just click a button and like deploy an army of these kids via AIs, right? So like, if we just zoom way far out, like going forward, it's gonna be very, very hard to verify on the phone you're even talking to me right now. Right. So like for the listeners, how do you know this is, this is Keith speaking? You, you really don't. The, but the one way you can know that is if I signed this video call or signed a Bitcoin transaction with a really large number. Right. So like going forward in five, ten years, when you receive a phone call, an email, a text message, it's just, it's quite sketchy when that piece of information is telling you to pay somewhere else. And so, yeah, AI can't fake Bitcoin and, yeah, th-this is, it's quite solvable to, to build this out." }, { "speaker": "stephan", "time": "05:31", "start": 331.09, "text": "Yeah, as a and as I kind of- I'm not a developer myself, but the idea might be that y-you're doing some kind of cryptographic handshake or you're doing something where it's signed it with a, with a key that's known to you, and so exchanges may have a key, and what we might start to see is when, as an example, you are about to do a deposit to an exchange because maybe you're gonna sell some Bitcoin or whatever, they, you know, that the, these things are signed in a way that the- Everyday consumer, customer can verify that. Now, of course, they may not be tech savvy to do this manually, but the idea is that we're gonna have software that helps us do this for us. I mean, even now, things like, you know, firmware being signed or applications being signed, or I guess there's different approaches, right? That maybe that's also an interesting thing that people are currently relying on somewhat of a walled garden, right? Google's Play Store, Apple's App Store, the, the, you know, Windows and Microsoft might- curate their stores in terms of what apps are you gonna install because they're trying to keep the user from just installing malware or, you know, these, malicious pieces of software?" }, { "speaker": "keith_gardner", "time": "06:45", "start": 405.08, "text": "Yeah, yeah, exactly. And so, like, one of the technologies that's really good for this is two of three, Bitcoin multisig vaults, right? And you can do this with Vault or with, Unchain, for example. And, Right, like unchained in this case, where both knows all three of your xpubs, so they create the deposit address, and this is what people interact with. But the missing piece right now that doesn't exist and that can, for quite cheap, in fact, it's free open source, is like a client side piece of software that runs as well. And so what we're building is this software that anybody in the world can run and verify and download on any desktop computer and easily link their two of three wallet account to their actual Linux computer or their Mac. And so then If this person ever gets fished and like logs onto a fake bold site or even has some malicious JavaScript and, running on their client, such that like their computer's basically compromised or they've received bad info, by running Bronter, which is essentially we want it to be an invisible layer as soon as the user copies a Bitcoin address, they verify whether that address does belong to their two of three or not. And so essentially, like in this way, what we've wanted to build for quite a long time is like a wormhole between point X and point Y." }, { "speaker": "stephan", "time": "08:08", "start": 487.91, "text": "I see. okay, so yeah, so I mean, a few things come to my mind straight away. One would be around mobile, right? Because obviously the world, a lot of things are going mobile, so then what's the plan there? and then also, is there a privacy concern, right? That if somebody kind of hacks the Bronto thing, does they now know how many coins I have, that kind of thing? So, but, let's start with the mobile aspect. Do you have a plan on the mobile or is it just desktop only for now" }, { "speaker": "keith_gardner", "time": "08:38", "start": 517.59, "text": "On mobile yet. And so mobile phones usually have a camera, right? And the QR code is kind of the dominant piece of tech here. And so, yeah, users can scan a QR code and they get a Bitcoin address. And so most of the-- I guess the first thing is the clipboard is what we really hook into. We haven't really seen anybody else do this yet, so we decided, let's go and build this thing. On desktop that's quite easy, right? So like if I'm running the Brave browser and, let's say, an email client. on the desktop, these are sandboxed applications, and they can't, without explicit permission, typically communicate data between each other. So if you install a new app on your Mac, it's not just gonna go look in your notes. Or your contacts, right? However, on desktop, the clipboard is actually plaintext. So the clipboard is kind of like this, It's like this shared memory location. So any single application you install on any desktop, can read the clipboard and without writing to it. And that's actually what we leverage. So when you install Bronta, and you can trust this because it's open source, but when you install Bronta, you just pull on your clipboard. That's all we're doing. We do a regex match, we pull the clipboard, on desktop, and then if this matches like a SegWit address, a legacy address, an xPub, a seed phrase, et cetera, we let you know. Now on mobile, to get back to your question, on mobile the clipboard-- it doesn't work this way on Android or iOS. iOS, you can't just start an app on background, right, and pull the clipboard On Android, you-- Android's a little more open in it, it's been locked down more recently, so like the APIs are kind of annoying to work with, and, on the-- I think on the mobile, the QR code is much more relevant, right? So on desktop, it's very easy to look at the clipboard. Now on mobile Probably QR codes aren't more used, and what the design that needs to be built out is that when you scan a Bitcoin address or a Lightning address, Bronzecoin acts as the umbrella launcher. So if you scan a QR code, you see BC1Q, yada, yada. Bronter first opens, verifies the destination, and then you can actually shoot out to whatever application you need, whether that's Strike, Vault, Unchained, or whatever." }, { "speaker": "stephan", "time": "11:00", "start": 660.02, "text": "Yeah, okay. Yeah, and so I guess I'm understanding this as like, you would run this alongside your other things, right? You might be running Sparrow on your desktop computer, and you might also run Branta, and then the idea is that Branta will sort of help, help try to stop you from getting fished or man-in-the-middleed or spoofed in terms of the address. So I guess for listeners who aren't familiar, there's a type of attack known as like a clipboard replacement. Attack. And so the idea is, you might copy-paste an address, think you're g-- thinking you're gonna pay to that address, but actually in the background, you have some malware somewhere on your computer that takes that address and replaces it with the hacker's address. And so unbeknownst to you, you know, and if you don't check on your hardware device or wherever, and then you might actually send to the wrong address. And so that's one example. It could be that the software itself is, compromised. So, so I guess that's the main-- And then also, as you said, around the AI and spoofing and scamming, these kinds of things where you might think you are sending in to or receiving from, and so I guess in this case, is Bronta helping you on the sending and the receiving case, or is it only helping on the send case, or can you explain a bit there?" }, { "speaker": "keith_gardner", "time": "12:18", "start": 738.48, "text": "Yeah, literally we've only touched the tip of the iceberg. So Kind of what's out there now and it's, it's quite stable, although we've still labeled as pre-release, just to give some time to marinate. what's out there right now is kind of this tool, like you said, it's, it's not competing with anything, so we're not another Sparrow. Probably the closest adjacent that you could label Bronz as is maybe a watch-only wallet. Right. So like kind of, you could kind of think of us as we're a watch-only wallet. Right And so, excuse me. Yeah, so the use case right now is very personal. It's okay if you have Vault, Sparrow, Ledger, Trezor, you have-- so you have four wallets set up. You can link them all to your Bronta. Soon we're gonna be able to sync across the Nostr network, right? So you can take this between your Linux computer, your Windows Mac. but it's all very personal. This is basically if you're shuttling money around between yourself. That's okay, this is very good if you're opening up a new account and you wanna deposit one Bitcoin, it's useful. But, in fact, like money can go between any two parties, right? So what's coming next are these, these kind of cool use cases quite adjacent but, in the use of, commerce and merchants, right? So you can also do man-in-the-middle or phishing on paying merchants across the internet. And the reason we're both here talking about Bitcoin is because it's very raw, it's very direct. But because of that Like Bitcoin's irreversible. In fiat, you have all this mush, right? You have all these layers of settlement in between, wh- whenever a payment happens. In Bitcoin, that's not the case, and there's these great platforms spinning up, Pay with Flash, Zapright, ShopStir, all these new platforms are coming where you just directly send the merchant the money. And so in this case, what Bronto's doing is offering, kind of two tiers of, API support. The first one is, let's use the example of Ferrari as kind of a high-end use case, right? So if you wanna go settle for a new Ferrari Roma, I don't know, what, what do they cost? Three hundred thousand US, right? And if you're gonna," }, { "speaker": "stephan", "time": "14:38", "start": 878.07, "text": "okay, yeah." }, { "speaker": "keith_gardner", "time": "14:39", "start": 878.95, "text": "I don't know, I'm kinda making the price up, but if you go to pay Ferrari or your dealership three hundred K US, you want to make sure this is actually Ferrari, right? And so the way Bitcoin works is you have the, the public key, and under that you have many, many children addresses. And so what Ferrari can do is actually register either through a centralized party, which is Bronta right now, in the future this will be much more decentralized, but if Ferrari registers their xPub with a company like Bronta as we decentralize further the person paying can do a quick look up that respects the privacy of Farah but verifies the authenticity that you're actually paying the end merchant. So in this way, you can completely lock out and block out any man-in-the-middle or phishing attack. Right, because if you, you know, the consequences of sending Bitcoin to the wrong place are high, then what people currently do to get around this is send small test transactions. And that's okay, but it's kinda like, okay, we just had the best invention maybe of all time besides fire, but we have to send five dollars before the full payload. It's just clunky, right? So everything that we're talking about, this software that you can use to link your own accounts, soon Bronz is gonna be integrated in a way that lets you verify the end merchant as well. So that's, that's kind of the first tier that's coming next." }, { "speaker": "stephan", "time": "16:00", "start": 960.07, "text": "I see. And so in order for that protection to work, does that mean every merchant has to go register with Branta, and then I guess that's kind of like, you've gotta go and sign up all these, and, you know, there could be com-competing services, like, what's the idea to get uptake there?" }, { "speaker": "keith_gardner", "time": "16:16", "start": 976.03, "text": "Yeah, I mean, that use case is really-- it's mainly useful for higher end merchants, right? Maybe like real estate, yachts, cars. This isn't like if you're buying coffee, you're gonna use this, right? But, with Noster, this can actually be made quite cheap. So, right? Like, profits on this as a centralized company, it's interesting because yes, it makes Bitcoin a lot better, but at the same time, like, Bitcoin and centralization have a very interesting relationship." }, { "speaker": "stephan", "time": "16:44", "start": 1003.74, "text": "Right. Yeah. I mean, what happens is sometimes a service comes out, and, I mean, if some protocol thing happens, and maybe it's kind of done at a very low level at the protocol level, and it doesn't need the company anymore, but, you know, and that's- It's happened across time, but of course, protocol changes are a bit more rare, at least the soft fork kind, but non-soft fork protocol changes do occur also, and, do you wanna just explain a little bit on the on-chain versus off-chain aspect? Like, is there anything on the Lightning side here, or is he saying, as you are saying, is this mainly just an on-chain? Focused here." }, { "speaker": "keith_gardner", "time": "17:20", "start": 1040.35, "text": "Yeah, no, that, that's another really interesting question. So everything we talked about with the vaults and like L1, storage of UTXO, yeah, that's, we kind of covered that. Now, Lightning works differently, right? So," }, { "speaker": "keith_gardner", "time": "17:36", "start": 1055.81, "text": "When we talk about lightning, like it can be quite theoretical in the sense of all you're talking about is a string, right? The address, the LN, whatever. And so if you're at point X or point Y on Earth and you're receiving instructions to pay, say point Y and you're at point X The same still applies, right? So a Bitcoin address is an alphanumeric. Lightning is also an alphanumeric. So whether I'm having a counterparty pay a, an L1 or an L2, it's actually the same exact technical design here. So like one of the other platforms being built now is called Pay with Flash. They're doing Lightning stuff that lets you kind of spin up a quick, Quick invoices. And it's all like, so this is like the sort of, marriage that, you know, over time will probably unfold." }, { "speaker": "stephan", "time": "18:25", "start": 1104.72, "text": "Back to the show in a moment. This show brought to you by CoinKites dot com, the creators of the best Bitcoin hardware security devices, such as the Coldcard Mark IV and the new Coldcard Q. Now, we use Bitcoin hardware security devices to keep our keys offline, our private keys offline. Now, the way these work is you can do that setup Write down your twelve or twenty-four words on the, the seed word cards and keep that secure. Now you can use this device to interact with the Bitcoin network using software such as Sparrow Wallet, Electrum, or Becto Desktop or Nunchuk as a few examples. Now you have a range of security features that you can use with these devices such as passphrases, you can use Seed X or, or my favorite is multi-signature. Now if you're starting in a basic way, just start with the device and The USB-C cable, plug it directly to the computer and use it that way, and then later improve your setup. But I believe these devices are great at helping secure your coins, especially as you start to migrate up into multi-signature security. But don't be disheartened or don't be, scared away, they are accessible, and I think you actually do learn about Bitcoin in the process. So to get yours, go to coinkite dot com, use code Livera to get a discount on your cold card. The lead sponsor of this show is Bold, the best place to buy- Buy, sell, and save Bitcoin. For listeners in the US, Bold lets you secure your financial future with complete peace of mind by integrating a low fee Bitcoin only brokerage with next gen multisig vaults. With Bold, you can smash buy Bitcoin or set a DCA plan for only zero point nine nine percent fees and seamlessly deposit the Bitcoin direct to your Bold Vault. The Bold Vault is a two of three collaborative multisig where you hold two keys and Bold holds one as a redundant backup, protecting against loss or theft. You can use Trezor, Ledger Or cold card hardware wallets to spin up a Bold Vault in just a few minutes, and the Bold Vault is the only collaborative custody vault available with zero monthly fees. They're also offering zero fees on your first ten thousand dollars of Bitcoin buys and twenty-five dollars of free Bitcoin when you buy a hundred dollars of Bitcoin or more. Try Bold today and upgrade your stacking experience over at getbold dot io. And now, back to the show. I say, yeah. Well, I mean, the, the thing is, there are different, let's say different standards, right? Like even in the world of 11 invoice, it could be a bolt 12 invoice, it could be Lightning address, you know, so the-- and then some, and then even inside that, there's different Lightning addresses that are custodial Lightning addresses, you know, it could be offered by Blink or maybe some, you know, Bitcoin exchange or crypto exchange offers Lightning addresses for their customers or wallet of Satoshi Lightning addresses, and then even there, that's just Lightning, don't forget, and maybe in the future there'll be like Ark or some eCash thing, and how do you- You handle the, or is it just more like you're just gonna handle a certain type of lightning, you know, case until the other cases have become more popular or what?" }, { "speaker": "keith_gardner", "time": "21:26", "start": 1286.09, "text": "Yeah, yeah, that's basically right. Like, we really wanna nail L1 first. We really wanna dial in like all the BIP support, basically have this thing extremely battle tested on L1, and then Lightning following right after. So eCash, ARC, to be honest, I haven't looked at that much. And like unfortunately living in the States, I, I don't even use Bitcoin all that much. So it's like, L1 will never go away, and then on Lightning, like I said, like the alphanumeric approach of- Really, like the problem is when you have an alphanumeric that's not human readable, that's the issue. Right. So like cell phone numbers or home phone numbers are this interesting case where, like, yes, this is digits, but it's only up to ten or nine or whatever, so people can kind of remember them. Now with email, you can actually always remember your email address, right? Depending what you choose, but like a lightning address, no way. A SegWit address, no way. So it's those, it's those, non-human readable longer alphanumerics that Bronz is really catered to." }, { "speaker": "stephan", "time": "22:33", "start": 1352.72, "text": "Yeah. So I guess, do you see this then being like a power user tool, like the everyday Bitcoin user may not use this or what's, what's your intent?" }, { "speaker": "keith_gardner", "time": "22:43", "start": 1362.93, "text": "Yeah, yeah, the intent is, is, it's this. You, you almost hit it earlier, in fact. but the intent is for Bronz to be an invisible layer that is like a de facto tool. Now, because we're early, like trust takes time to build, but you, you already said like you run Bronter alongside Sparrow, right? Bronter doesn't touch your private keys, you can't on-ramp or on-ramp, on-ramp or off-ramp fiat with it. so just Bronta as an invisible layer is essentially built for our grandmothers and our grandfathers, right? Like, or our newborns. It's built for the non-technical user. So that's kind, that's kind of the view, is right? Like this invisible layer on desktop, on mobile, and whenever you interact with the Bitcoin network or the Lightning network, you get a nice little helper that says, \"Hey, you're paying the person you think you're paying.\" Or not. And so to me, like, that's this piece that's kind of been missing this whole time, because wallets are becoming more and more mature, right? Like, to come in and kind of compete with another wallet It feels a little bit strange. Like wallets may actually be a winner-take-all sort of product category. Like Sparrow's built cross-platform, it's phenomenal, you get more and more, tutorials, more and more reputation, et cetera. Now Fiat on-ramps and off-ramps are maybe similar, there's a lot more friction because of the licenses that you need to have. but something like a helper application that's invisible, that you don't even have a UI for, it's just running in the background, that is very cool. Because what you don't want to happen, right, is some AI calls you or you think somebody's calling you or texting you on Signal An address, and, you know, you're going throughout your day, you're at, you're at work, you're at lunch, and you just pay an invoice, right? And this has happened in our Bitcoin meetups, this happens on Twitter all the time, and it's like- This is solvable for quite cheap. So that's, that's the vision." }, { "speaker": "stephan", "time": "24:43", "start": 1483.05, "text": "I see, yeah. And so of course, there are some manual steps a person can take, but I guess the, the point here is to try to automate, right? Like it's as a- Let's say if you're working for a Bitcoin company, they may have policies that say, \"Look, before you pay any invoice, verify that address through another means, right? If that person texted you the Bitcoin address, well, you need to call them, or you need to get it in an email, or you need to get it in, you know, if they sent you on Signal, get it on WhatsApp or some, you know, some other way that, so that way it's at least more difficult for somebody to, you know, replace the address or- You know, man-in-the-middle if you've received it from two or even three methods of confirmation." }, { "speaker": "keith_gardner", "time": "25:32", "start": 1532.08, "text": "Yeah, yeah, hundred percent. And, Yeah, you know, like the world moves fast. People are just always doing commerce and deals. Like the velocity of money is huge, and like who has time to check? Right? Like that's the whole point. It's like you can have the best stack, you can have the best, self custody and security Anywhere, and like you can sign a transaction to the wrong place and just mess up." }, { "speaker": "stephan", "time": "25:55", "start": 1554.72, "text": "Yeah, and the money's gone, it's out. There's no bailouts in Bitcoin, right? There's no bailouts. Yeah. so let's talk about the privacy aspect. So we, we know, we mentioned it before, that could obviously be a concern, especially for a, let's say it's a high net worth person, or maybe it's a company who would rather not dock their coins on chain. Now, of course, people search online, and there's these on-chain analysts, and there's, you know, whatever, what is it, Arkham Intelligence, and some of these other places, or the likes of like a Zach XBT or someone like that, or an Ergo or these On-chain analysts who might look, \"Ah, see, that's Binance's hot wallet and that's Coinbase's cold storage and whatever.\" How do you thread this needle here from a privacy perspective of being able to protect the user or the merchant or the exchange without doxing?" }, { "speaker": "keith_gardner", "time": "26:46", "start": 1606.46, "text": "Yeah, that's huge. So I guess, yeah, the first thing is privacy is insanely important. Now, the first kind of use case that we talked about with like an individual linking their wallet account Right, like Bronta is-- can never, I, I guess the Bronta application can know the xPub's, but the people behind Bronta can never know the xPub's, right? So, yeah, the first thing is we never touch private keys. The second thing is the xPub's never leave the user's computer. So when you have xPub's, everybody knows, you can dox your entire balance. And so the example with an exchange is, when you log into an exchange on a computer and you're running Bronta, there's a very simple button that says \"Link to Bronta\". And this is what we're building, and when you click this button, those xPub's directly get injected onto the same PC. And so there's no server involved there. This is directly from- vaulted or unchained right to your computer, and there's all the privacy is taken care of in that way. So we're not shuttling xPubs over the internet, anything like that." }, { "speaker": "stephan", "time": "27:56", "start": 1676.45, "text": "I see. And that would be-- So what you're describing there is in the- User case where it's the user's own xPubs, and then what about in the case where it's, let's say, merchant xPubs or exchange xPubs for their own receipts or their own, let's say when you're depositing coins to an exchange or when you're paying the merchant?" }, { "speaker": "keith_gardner", "time": "28:16", "start": 1696.07, "text": "Yeah, so that's, that's, different. We actually haven't tackled that case yet. So like if you, sign up for the exchange and you don't have your own xPub, we're not handling that Now, the way-- I shouldn't quite say that, but the API that, we're building out for that is such that, right? Like when you're shown an address and when the exchange generates an address, it's actually possible to have an API callback on their side. And so by doing that, they can actually associate a single-use address with, say, a six-digit PIN. Right. And so this is the software solution for, man-in-the-middle or phishing. Right. So like, imagine this, like we don't want Bron to be a centralized lookup, right, beyond maybe a certain extent, but if you sign up with an exchange, and they show you a single-use address, what you're gonna be able to do Is copy that address or scan the QR code and see in Bronta that there's a PIN, say 123456. Now, the exchange would have given you that information ahead of time and you know that you're depositing to the correct place. So that's kind of a pseudo-anonymous approach." }, { "speaker": "stephan", "time": "29:31", "start": 1771.34, "text": "I see. Yeah, and so I could imagine for, especially for large amounts, this could make a lot of sense, right? Like if somebody's sending, you know, millions of dollars or even more. They really want to have very strong confidence that they are sending to the correct address. and so that's a really important problem, especially for, let's say, for high level commerce or high net worth kind of use, this kind of thing, they would really want to know. and I guess right now, it's kind of funny, but in a way, like a lot of people are just probably yoloing right now, or as you said, they, they might do a small test transaction, right? They might send, you know, ten bucks or whatever, and then if that" }, { "speaker": "stephan", "time": "30:12", "start": 1811.96, "text": "with the serious amount. You know, that's probably what a lot of people are doing now, and I could imagine, especially in quote unquote crypto world, there's probably a ton of people who are just kind of, you know, they're just trading this, this, that, and the other, and they're just kind of yoloing and just kind of sending, you know, huge amounts with, you know, maybe not a lot of verification. and so maybe this is, an opportunity to improve that, let's say." }, { "speaker": "keith_gardner", "time": "30:35", "start": 1834.93, "text": "Yeah, I think so. I mean Through phishing Bitcoin and a lot through these other coins, man, like it, it's bad out there. And in fact, I had a friend send me a video on Telegram, and it was, it was so, so wild to actually see, but this guy had like clipboard swap malware, and it was swapping Bitcoin SegWit address. And it, it's kind of silly 'cause like you copy this one and it looks very different than this other address. And then, like, you, you can kinda just see. And things like Coldcard or Ledger have a screen reader, so if your seeds on, like, a signing device with a screen, this isn't really a huge issue if you're going slow. Yeah, but, it's nasty. It's very nasty. And you, you can also see how, like, these attacks can get more sophisticated. And I- I won't go into how the attacks get more sophisticated 'cause we don't wanna spread that knowledge, but I expect they're gonna intensify and get worse." }, { "speaker": "stephan", "time": "31:34", "start": 1894.39, "text": "I see, yeah. Alright, well, I'm curious then if you have any interesting stories on, on some of these spoofing and man-in-the-middle attacks, anything people should be aware of, right? What are some of the common ways that people can get spoofed and address changed? these would be, you know, good knowledge for people." }, { "speaker": "keith_gardner", "time": "31:55", "start": 1915.34, "text": "Yeah. You know, I would say the number one way is guard your inbox. Like whatever email you use, be very careful of that and just don't trust. So like tattoo this in your brain, just any information you get saying \"log in with urgency, danger.\" That's the number one. The number two is probably in these larger like group chats if you're in any, Signal, Telegram, Twitter, whatever. be very careful of links, don't trust links. You need to like cryptographically trust, and unfortunately the tools are still catching up. So yeah, I would say those are the main two. I, I actually haven't seen any like deep phishing AI calls that are like personalized yet. we, like, in my personal life, I've known a number of people that, that got called by a fake Coinbase, right? Now, June, June Seth really killed that story, like, I think that really resonated. I had a friend who lost like five Bitcoin through Coinbase. He just handed over his email, his username, and then his one time passcode, and like, this was like late at night, wasn't even the right time zone. And this guy just like handed it all over. And so he woke up in the morning and I think four point nine Bitcoin were gone, maybe like point one was left as a favor. but yeah, that was, that was bad. So there's, there's a lot of cases here where education is really important." }, { "speaker": "stephan", "time": "33:23", "start": 2003.34, "text": "Ouch, yeah. I mean, a few reactions there. I think one Is in a paradoxical way or in a counterintuitive way, making your coins less accessible, right? Like if you have multisig, if you have coins, or your private keys are in a place that's hard to reach and offline, that can help you in a way, because then it, it stops this kind of time pressure, and that's a common scamming kind of tactic, which is, \"Oh, hey, hey, quick, quick, something's gonna happen, I need you to give me your password, give me your two FA, whatever.\" And if they sort of- Trick you and try to hurry you up, and this can apply both at the individual level and also at the company level, right? Because there are company scams where maybe they pretend to be the CEO and they're, \"Oh, I'm emailing from another address or I'm texting you from this other thing, but it's an urgent thing and I'm the CEO of the company,\" blah, blah, blah, send money here. You, you need to slow down, right? Because these are some of the time pressure tactics that are used on individuals or even employees of companies to make them, kind of act quickly, send some coin somewhere, and so that, that's an important, you know, just general piece of advice. the other comment I have is that Over time, as Ngu happens, as number go up happens, the value to do some of these attacks will rise, and we'll start to see more sophisticated attacks, like you said, like this AI thing. that said, it's also true to say that generally speaking, the criminals will try the low-hanging fruit first, right? They're gonna go for the easy stuff first, and, you know, generally, you know, because obviously, you know, you might as well take the easy stuff first if you're a criminal. So, yeah, I think that's kind of- Of, that's how I'm, I'm seeing it, but, yeah, do you have any thoughts on the number go up aspect and the lowest hanging fruit aspect?" }, { "speaker": "keith_gardner", "time": "35:13", "start": 2112.95, "text": "Yeah, yeah, I mean, those are both coming, like the trend is up, right? I, I love what you said about the friction, like friction is a good thing, you want friction, right? So like- Some of these like pseudo-intelligent, like people earlier have been saying, how when, when money comes quick, it goes quick, right? And like a lot of money is probably gonna come quick to a lot of people But psychologically, like when you receive money very quickly, you think you can repeat that. So like this is a falsehood that a lot of people get. So one of the most and, and this is also why like NBA players go broke, it's not because- Right. It's, it's simply because they have earned the money quickly, so naturally you spend it quickly. And so frictions are one of the best things you can do. So like if you come into money through Bitcoin or any other way, one of the, one of the reasons that 401ks actually- Are good for people, one of the few ways maybe, is that it's hard to access your 401k or a tax deferred account in the US, right? Like, it's kind of like handholding, but you actually should take the best of the fiat world for your Bitcoin holdings. So, you know, if you're still deep in fiat or if you've just been a professional working for many years in the States, you probably have a Roth IRA, you probably have your 401k, maybe some high yield savings, and a lot of these are like- Simulated time locks, right? So this is like such an under, mentioned topic in Bitcoin, but you can just time lock your Bitcoin and then how are you gonna send it to somebody? You can't, right? So there's, there's like many, many layers to this friction concept, but one of them is, you know, try and simulate perhaps your fiat setup, where some of your fiat was in your 401k, and, and these are all with different, like, fiat custodians, right? So then if you do get attacked, and say some of your bitcoins on Coinbase, like my friend there, if he lost five of his bitcoin, well maybe he had twenty five and they were spread out. Right? In this case, he had five. That's not great. So we lost all of it. So, you know, that's one approach, and it's also quite metaphorical, right? 'Cause like, where does gold come from? Like, it comes from the dirt. There's a lot of friction to dig into the dirt, but like, you can also metaphorically simulate that, with Bitcoin and just make it very hard to access and- So I think these are like highly, highly underutilized mechanisms that, you know, really should just be part of your mental framework with your custody is like, I have different accounts, this is my spending account, this is my deep storage, this account is time locked, can't even access it, right? This sort of thing." }, { "speaker": "stephan", "time": "37:51", "start": 2270.92, "text": "Yeah, I see. Yeah. And so I guess in that case with the, you know, Coinbase hack and things like that, often this is when, you know, users who are maybe a bit newer, they haven't learned to, you know, whatever, get their cold card and, you know, put stuff, you know, in offline storage, right? In a cold storage hardware wallet or ideally multisig once you've got larger amounts. so I think- It's a shame, but many of the people who most need to hear these kinds of things aren't the ones thinking about it, right? And it's kind of like, sometimes people have to touch the stove before they get burnt, and for some people, maybe they have to touch the stove multiple times, not just one time, right? And so- Hopefully, you know, we can get the message out there, but sometimes, yeah, let me put it this way, we can put the message out there, but there'll be a lot of people who unfortunately won't listen, and so that's just, you know, hopefully some of these things can be automated and protections and safeguards, but there's only so much that you can do, right?" }, { "speaker": "keith_gardner", "time": "38:50", "start": 2329.67, "text": "Yeah, yeah, there is. I mean, this is also a very, very long term game. Like, I, I don't know if people consciously think this, but Bitcoin is like a lifelong project," }, { "speaker": "keith_gardner", "time": "39:02", "start": 2341.72, "text": "Anywhere. Like this is a, this is a long term game with long term people, and I think eventually like the short sighted projects will fall out of fashion You know, a lot of people get burned, and there's been a lot said on that topic." }, { "speaker": "stephan", "time": "39:17", "start": 2356.97, "text": "This show brought to you by mempool.space, the world's leading Bitcoin visualizer, and now they've got an accelerator program. So if you have a transaction that you sent at a fee that was too low to get confirmed, now you can fix this with the mempool accelerator. The way it works, you can go and search your transaction, scroll down, click accelerator, and you don't need an account, you can pay with Lightning, and then it'll show you it's now in the process of Confirmed. And so this is a great way to help you out if you are stuck, and this can happen where maybe your wallet doesn't have RBF or CPFP, or it might help you in situations where it's impractical to go and re-sign. So for example, multisig with keys in different locations. And thirdly, even in some Lightning scenarios, perhaps a forced close, you might not be able to use RBF. And so in this case, the mempool accelerator can help you out. So keep it in mind, and you can find out more over at mempool.space/slash-ac Show also brought to you by Nomad Capitalist. Nomad Capitalist is a leading provider in terms of offshore tax and lifestyle strategy planning and implementation. They can help you go overseas and legally lower your taxes. As many of you know, I grew up in Australia, but I left. I was sick of it in terms of the taxes and the COVID tyranny and all these other things. And so that's why I left, and now I live in Dubai. But that's not necessarily the place for you. You have to think exactly what works for you, for your family, for your business, and Nomad List have worked across dozens of different countries. They've helped people get passports, residences, bank accounts, and all kinds of other things. And importantly, it's not just about choosing one place, it may be multiple places, and it may be also about making the pieces fit together in terms of how your business fits with your family and you as an individual. Nomad capitalists have helped many, many people in terms of going overseas, and if you're interested, go to nomadcapitalist dot com slash apply. This is applicable for people with a net worth above one million US dollars. That's nomadcapitalist dot com slash apply. Yeah, I, I think I, I really also resonated with what you were saying earlier about how, you know, there's athletes who are famous for kind of blowing all their money, and in some cases, that's because maybe they're a young guy, they didn't have a lot of personal finance knowledge, and maybe they had a lot of leeches, and, you know, whether that was professional leeches kind of glomming onto them to try to take their money, or maybe, you Sort of guard that wealth, right? Because, as you said, kind of an easy come, easy go mindset. sometimes people need to think about the concept of, it's, make hay while the sun shines, right? Like if you had that mindset of, \"Look, I'm, I might be making this money now,\" let's say you're a pro athlete or you made some money off Bitcoin or, you know, you, you bought Bitcoin and it went up, right? Like in purchasing power, you need to think of" }, { "speaker": "stephan", "time": "42:09", "start": 2528.8, "text": "that like, \"I, I easily, you know, that's something people, you know, sometimes you Lightning strikes and you're not necessarily gonna expect it's gonna happen two, three, four times." }, { "speaker": "keith_gardner", "time": "42:22", "start": 2542.17, "text": "Yeah, no, it's super true. I mean, that is like the, to me the number one benefit of the 401k as in, like a vehicle is the time lock, right? And there's a little slap on the wrist, it's, it's kind of silly, it's very childish the whole thing, but like, it is a slap on the wrist to pull money out of your 40 Right." }, { "speaker": "stephan", "time": "42:40", "start": 2560.32, "text": "Is there like a ten or twenty percent penalty or something like that? I don't know the detail." }, { "speaker": "keith_gardner", "time": "42:44", "start": 2564.03, "text": "Yeah, it depends, it depends on whether that's pre or post tax, and then, I guess, when you pull it out. But yeah, there's usually not more than a thirty percent, right? So like typically, if you go and cash out your 401k and slam that into Bold, yeah, you're gonna pay like thirty percent tax, probably on the higher end. it, it depends exactly what you do and how much you can write off, but, yeah, like the hand-holding there, it's very funny 'cause, like, ultimately, like, Bitcoin and fiat and all these other vehicles that exist, they somehow reflect on human psychology, right? And so I, I think a lot of the, a lot of the frameworks are actually quite mature in fiat. It's just that like the underlying settlement is wrong, like that area." }, { "speaker": "stephan", "time": "43:30", "start": 2609.85, "text": "Right. Or they can reverse it, you know, like that kind of aspect. Or, I mean, A bit more controversial, but I guess sometimes this is where fiat banks may make their customers whole, and now they might take a loss on their side, and, you know, in the future we might see that even in the Bitcoin world, right? Because at least from my perspective, I see Bitcoin as mainly challenging government control of money and more, more like challenging central banks as opposed to banking per se. Now, of course, I want as many people to self-custody as possible, I just know that not all eight billion will, so therefore there will be Bitcoin Banks, of course, ideal, in the ideal case, everyone can be their own bank, but, absent technical innovations and, let's say, soft forks, we're not gonna be able to get to eight billion self-custody, at least with today, with the technology of today of Bitcoin. So, you know, I think there will be Bitcoin banks, and some of those Bitcoin banks should ideally use some of these techniques to obviously minimize, reduce the spoofing, the man-in-the-middle, the AI attacks, these kinds of things, and similar- With the merchants as well, and so that's probably the future that we're moving towards. one other area I have, I thought of, is what if Branta itself gets hacked? Or, you know, I'll give you an example. in, I wanna say twenty eighteen or so, around there, around twenty eighteen, there was a very famous Electrum hack, where basically the website of Electrum got hacked and there was malware. And so then unfortunately, there were at least one or two users Who downloaded this malware and I think they sent their coins to the wrong address and then lost money. And I, I think it was even worse because I think they, I think they abused some kind of update mechanism in the Electrum software. So I think they turned it off after that, but I, I can't remember the full detail, but I think they clicked the link, they upload, they kind of upgraded to a malware. And unfortunately, this is one of those cases where if the users had done the PGP verify signatures, they would have seen, \"Ah, this isn't signed by Thomas V It might have been saved, but unfortunately it was, you know, a bit earlier and there were some users who lost coins that way. So I, I wonder, could a similar thing happen with Bronta that people think they're doing the right thing by installing this, but actually it's some kind of malware and it tells them the wrong address." }, { "speaker": "keith_gardner", "time": "45:50", "start": 2749.86, "text": "Excuse me. Yeah, it's, It's actually absolutely hilarious that you said that. So, I think in the beginning I was saying, with Bronter, right, we wanted to invent these ways to protect users that are new, that no one's built before. And in fact, the very first product that we built, which is shelved currently before reintegration, is actually just what you said. So it's an automatic layer that you can use on any desktop, that verifies manually the PGP signature of other software. So I don't know if you've seen this, 'cause this was, Kind of like winter timeframe, we actually pitched this in Portugal, and competed in the PlebLab top, top builder product, project." }, { "speaker": "stephan", "time": "46:35", "start": 2795.03, "text": "Oh, I didn't see it. Okay, go on." }, { "speaker": "keith_gardner", "time": "46:37", "start": 2796.69, "text": "Yeah, yeah. And so like, yeah, no, what, what you're saying is exactly correct. So any code is, is a bug, right? And some bugs are useful. Bitcoin, you can view as a big bug, like it's imperfect, but we really like it. Right? And so Sparrow's the same way. We love Sparrow, but it's imperfect. However, we use it anyways. Biology's like this, right? This just reflects the universe. And so what we wanted to build, and we're actually gonna be picking back up again, is, Bronta kind of, this is a different kind of line, but this layer where as soon as you download, right, the Electrum that maybe has been compromised or let's use Sparrow, there's actually a Sparrow dot com, there's a Sparrow dot net, only one of them's real, one of them's fake, right? But if you first run Bronta on your computer, what Bronta will do is we sweep your downloads folder, and if a file name matches Sparrow or Electrum we do the PGP check for you, right? Because- Oh, interesting." }, { "speaker": "stephan", "time": "47:37", "start": 2856.57, "text": "Okay." }, { "speaker": "keith_gardner", "time": "47:37", "start": 2857.13, "text": "Yeah. What Bronter can do is import the PGP public keys, right? So public key, private key, signatures are beautiful. That's all Bitcoin is, is a series of one-way doors. And when you download Sparrow, you can completely automate the PGP check if you run Bronter. Now, there's a couple things there, right? The first is installing the application in the first place. That's the PGP check. And so if Electrum, Electrum, yeah, I think is the wallet, if this gets hacked, right, and you're running Bronta, Bronta will just flag you, say, \"Hey, the filename says Electrum, but it's not signed by, I don't know how many authors signed Electrum, right? With Bitcoin Core, usually it's above five of the core authors will sign this, so Bronta can check all Right. So yeah, that's a complete, a complete valid concern. that is one of the few good things about the centralized app stores, right? Now, these aren't perfect because there's been cases of, I'll say, crypto wallets in the app stores that actually just ask for your seed and then rug you. So like the centralized app stores fail in this way, right? So there's kind of these, these hierarchies, right? There's like the Linux open source, maybe you run Bronta and it sweeps your PGP keys, then there's the centralized app- App stores. This kind of coincides with Web 2.0. and those are good, those are good, especially if you have a lot of ratings. Now, it's bad because it's not that hard to publish in the centralized app store, and you have this false sen-sense of authority. Right? Right. Now that's the problem. And so looking forward, probably Nostr will obliterate, all of these models. Right? So Nostr is extremely cool in the sense that You know, you have your password, right? So like when you log on to Twitter and tweet, like this is something Odell says, I think, well, maybe this is a bad example. You can cut this out if you want. But right, I think- No, go on," }, { "speaker": "stephan", "time": "49:32", "start": 2971.96, "text": "go on, it's fine." }, { "speaker": "keith_gardner", "time": "49:33", "start": 2972.68, "text": "Yeah, I think Joe Biden earlier this year tweeted that he will not be running for, presidency again in the United States in twenty twenty-four for our election. And so- Oh," }, { "speaker": "stephan", "time": "49:42", "start": 2982.14, "text": "right. Yeah, I remember. This is like a famous thing because everyone was like," }, { "speaker": "stephan", "time": "49:48", "start": 2988.41, "text": "On like a doing a press, you know, doing a proper, you know, press service or whatever about it, press, conference about it, yeah." }, { "speaker": "keith_gardner", "time": "49:55", "start": 2995.23, "text": "Yeah, yeah, a hundred percent. And so like, how do you verify that wasn't Elon or a dev at Twitter or, another person in the White House staff? You can't, right? But with Nostr, and I'll get back to the invalid software thing, with Nostr, you actually can do much, much better. So on the one hand, like in that case, Joe Biden could have just held" }, { "speaker": "keith_gardner", "time": "50:18", "start": 3018.39, "text": "His note and put it on every social media platform, right? Or he could have just done a video and signed the video. But what else Nostr can do is this web of trust, right? So if you go on Nostr, you see people like Jack Dorsey and Odell, right? And their web of trust is, i-is built up, right?" }, { "speaker": "stephan", "time": "50:41", "start": 3041.01, "text": "Right. And so I guess in simple terms, it's like who follows who, right? Like if- Odell and I follow each other or whatever, and then we can, some of the apps and other things might sort of help you de- determine a level of trust based on kind of how many degrees of separation you are, how many, let's say, well-known people are following this particular account, and then therefore, when you pay to the lightning address associated for that account, maybe you're a bit more confident, that kind of thing." }, { "speaker": "keith_gardner", "time": "51:09", "start": 3068.55, "text": "Yeah, exactly right. So like, if Pablo's building out these cool eCash wallets and GG's also in his web of trust Trust, and you go to download, like Bronta can tightly integrate with this on the client side to prevent mishaps, right? So like this sort of, paradigm is, it, I believe it's actually completely new in the world of the internet and computer science, which makes sense, right? 'Cause like we all get caught up in like, \"Oh, shiny app stores, now there's this thing called TikTok,\" but really like the internet's only what, thirty years old, ish? Like Alan Turing. Yeah, I" }, { "speaker": "stephan", "time": "51:42", "start": 3102.29, "text": "would say the World Wide Web is probably thirty years old, and maybe the internet predates that a little bit, but yeah, I get your point. Yeah, and, yeah, and like" }, { "speaker": "keith_gardner", "time": "51:49", "start": 3108.77, "text": "Alan Turing, right? Was only, not even a hundred years ago. Like, it's completely mind-blowing the acceleration that we've had. So, right, like Noster Web of Trust is gonna be absolutely huge. There's a huge opportunity for client-side software to integrate with that. And so, that's why we're open source. And in fact, if you're a developer, go look at our GitHub, because we have a bounty out right now. And this is all-- this is another cool thing that's coming, right? Is like, GitHub will be decentralized on Noster, so like, this isn't another centralized entity. Microsoft owns GitHub. Well, GitHub has actually been compromised once earlier this year, I forget the exact example, but NVK tweeted about this. But anyways, yeah, back to your point, like using additional software, definitely be careful and like better things are coming. So I'll stop rambling." }, { "speaker": "stephan", "time": "52:38", "start": 3158.16, "text": "Yeah, gotcha. Okay, yeah, so I mean, the kind of takeaways I guess from that also around the nostra aspect of it are that it might be, they might be able to build a really slick experience in that way too, right? That people might be- Maybe sort of using Nostra to-- in the background to kind of automatically check the, the, you know, the validity of certain things, and in terms of the Lightning address that you're just about to make a payment to, you can sort of be like, \"Oh, this matches, you know, Keith's Nostra profile Lightning address or something or Stephane's Lightning address or whatever.\" so those are a few interesting points. I guess let's sort of have, you know, final takeaways. I think we should reiterate those key points you made about, Maybe not just for listeners of this show, but let's say friends and family, what are, you know, the common things to think about to lower your risk of getting scammed and spoofed and man-in-the-middle'd?" }, { "speaker": "keith_gardner", "time": "53:33", "start": 3212.57, "text": "Yeah, I'll just do a short list here. What I would say is treat your Bitcoin like it's worth a hundred times of what it is. I would say move very, very slow with Bitcoin. I would say make it as cold as possible. So bring your Bitcoin offline, maybe separate it into a few different wallets, and, yeah, don't rush, don't rush. That's all I would say." }, { "speaker": "stephan", "time": "53:58", "start": 3238.29, "text": "Yeah, great. Okay, and so the website is, was it branta dot pro, right? obviously links will be in the show notes, and I was looking at docs dot branta dot pro, that's the documentation site. and, yeah, I think we'll leave it there. But, Keith, thank you for joining me today." }, { "speaker": "keith_gardner", "time": "54:13", "start": 3253.29, "text": "Yeah, beautiful. Thanks so much, Stefan." } ] }