← All talks

Veilid, So Easy a Teenager Can Do It!

BSides Philly30:35838 viewsPublished 2024-01Watch on YouTube ↗
Speakers
Tags
StyleTalk
About this talk
Bianca Lewis Veilid, so easy a teenager can do it! At DEF CON 31 Cult Of The Dead Cow announced they would break the internet with Veilid, an open-source, peer to peer, mobile-first, network application framework. Come and learn how you can help cDc take back the internet, building distributed private applications. Don’t want to build an app? Spin up a node and help out the network! Veilid goes above and beyond existing privacy technologies and has the potential to completely change the way people use the Internet. Veilid has no profit motive, which puts us in a unique position to promote ideals without the compromise of capitalism. With Veilid, the user is in control, in a way that is approachable and friendly, regardless of technical ability. We want to give the world the Internet we should have had all along. Bsides Philly 2023
Show transcript [en]

in he'll tell you when

start

e

e

e

e tell me when I

start

okay

oh cool I'm Bianca Bianca which one is um so easy a teen right there yep I think so we are behind schu we are a little bit but it's fine Bianca where you from uh New Jersey New Jersey I thought you from Italy no I'm half Romanian actually oh half Romanian Roman have a lot of cook many friend would you prefer me to read through this um if you want to start I give myself a descrition oh that sounds great and I will give you we are AIT behind so I might as well yeah and I can give you 10 minutes five minutes and one minutes I'll be sitting there okay I'll be relatively fast don't

worry

Okay C in Boss me in Boss I can start whenever and I can describe myself if you want I got that so we can SK the int yeah I'm ready to start okay awesome okay cool okay okay everyone can hear me we're good ready to get started okay awesome no need to Heckle my dude okay veiled so easy a teenager can do it with yours truly be a syab so first off who am I I am 16 year I am now 17 years old as of a few days ago which is very exciting almost an adult a little scary now I'm going to be old like all of you I am an international speaker I have

spoken on all things cyber security security Etc this year I was a Defcon goon and next year I'm going to be running Defcon kids so if you have kids or want to kidnap some bring them to Defcon we have awesome things planned we have ctfs workshops badges Etc I am also the founder and CEO of my non-for-profit girls who hack our mission is teaching girls the skills of hacking so that they can change the future I provide free online and inperson classes on all things intro to cyber security so veiled that's kind of a strange name but it's actually made up of three words Veil valid and identity since it's covering your online presence so first off who created this

tool veid was started by Cult of the dead cow which is a hacker group that started in 1984 very old almost 40 years ago they built ve to take back the internet when the internet was first created it promised to be a free open platform for information and connection now large corporations and companies like Facebook monetize on our private information for profit though this is corrupt they are able to do so with the enduser license agreement that allows them to have 247 access to the microphone keystrokes camera Cera roll and more on your devices this way they can better Target ads at you none of us really read the terms and conditions especially not our moms who just want to

get on Facebook so they can see Aunt Karen's new post veid allows us to design secure and private applications on a new network veid needs you to help build its platform that's why it is open source and Community Based not only do they need coders they also need people to help with marketing and legal as well so what is the point of veed ved's mission statement is we exist to develop distribute and maintain a privacy focused communication platform and protocol for the purpose of Defending human and civil rights I cannot stress this enough privacy is a human right veid was built with that ideal in mind it also allows a platform for secure information communication and file

sharing while some may not mind Mark Zuckerberg getting their relatively unimportant search history out in the many War zones right now there are reporters trying to safely send sensitive images and information over the Internet they may inadvertently give away their location with their IP address and become the target of a hostile government or terrorist or organization veiled aims to provide these individuals with a safe way to communicate without compromising their Identity or their location so I keep saying veid this veiled that what is veid veid is an open-source peer-to-peer mobile first Network application framework this application framework is fully open source so you can see what's happening in the background and know that your data is safe currently there

are 10 to 15 people working on the project with over 20,700 people in the Discord that you can join as well like I mentioned earlier you can help build it too if this project seems interesting to you join us veid is a mobile first application framework let's face it most people spend more time on their phones and iPads than their laptops and Des Des toop nowadays the veiled team wanted to make sure that these devices were at the Forefront of the project which is a unique approach since most software is developed with mobile as an afterthought veid is thinking different when most developers go out to build an app they focus on how the app will look

and how it will function they typically don't think about privacy at all they just say we'll take care of security later spoiler alert later never comes and if it does it's bundled with an update that most users will say ask me later to veid takes privacy and security first and foremost and handles it for you allowing you to focus on what developers are good at building an app so what can you build with this framework practically anything let's be honest Facebook is great it allows family and friends to connect with each other easily and share their life experiences what's not great about Facebook is that they seal your personal information and sell it recently Facebook handed over a

message that a woman sent about going to another state for legal abortion now she's in jail they also allow evil companies like the now defunk Cambridge analytica to Target political ads and fake media to unsuspecting Facebook users the ad tools Facebook has makes it a perfect weapon for social media scops and I could go on a whole rant about this but that's all in the talk I did a couple of years ago and it is available on my bsil la.com website if you want to check it out little plugin there but back to the talk veid can be used to build any type of Network application you can think of a Facebook clone a chat

app we'll look at one later file sharing and pretty much anything you can imagine let's talk about what veid is not so you don't confuse it with anything veid may sound a bit familiar and that's because others have come before it veid is not a proxy like tour which is a proxy for anonymizing your online traffic but then again the NSA host thousands of monitored exit nodes so who knows what they may be watching the ipfs or interplanetary file system is a decentralized Content delivery platform which is pretty cool but also not what veiled focuses on doing it's also not blockchain because have you considered using a database instead and there is no kind of crypto

coin involved veid is meant to bring freedom back to the Internet it's quite a unique project and that's why I'm excited to discuss how veid works veid is built on Rust and it runs on all platforms Windows Macos Linux Android iOS and even web assembly the veiled team didn't make their own communication protocols they used the established ones TC P UDP web sockets works with ipv4 and IPv6 and it's an Allin Network so when you are on the veiled network no external services are required there is a splash of DNS on the first run which I'll get into shortly very importantly veid is decentralized most tech companies were started with good intentions in mind until they realized they had to pay for

infrastructure and storage since most of their applications started off free they don't want to just suddenly make people pay for their systems so instead they collect and sell user data veid will never run into this issue as they do not store or host anything themselves this also means they have no tracking no tracking H as proof of this let's read some of of the enduser license agreement together so in the end user license agreement a company will have to answer all of these questions and this is how veiled answered them first question what information do we collect veiled chat collects no information from you how do we process your information we don't valid chat does not collect your

information nor are we able to collect it what legal basis do we rely on to process your information veiled chat does not process any personal information because the veid foundation cannot access information entered into the veid chat in any way shape or form the veiled Foundation does not process your information when and with whom do we share your personal information in no way shape or form do we ever share your personal information we cannot share what we do not retain or what we cannot access I think you get the idea very importantly as well veid is accessible Not only was veiled designed for non-technical people like I mentioned before but the veiled team made sure it was userfriendly for those

with different needs as well let's talk about the cryptography behind veid vld d0 is the first cryptography bundle built into the veid framework but let's be honest crypto breaks and changes over time that's why veid is designed to scale and deal with these improvements the crypto system is upgradeable and backwards compatible that means if your node is running vld1 when it comes out you can still work on the network with vld Z nodes until they Sunset the older version encryption everything is encrypted in transit and everything is encrypted at rest at rest this is important because if you lose your device no one will be able to see your information you have the DHT keys on

your device so no one can access your stuff one of the members of the CDC who has worked on this project met us for made sure encryption at rest was included due to a personal experience she had to go through her ex partner lost his phone and Bad actors got their hands on it taking private photos of her off of it and putting them on the internet if those photos had been stored in an app built on veiled no one could have accessed those photos so now let's take a look at the veiled Network strap in folks that is you and those are the other people running different apps they made on veid and here is the other party you are

connecting to the first time you run an app it reaches out to the bootstrap server over here to get a list of all the other nodes it then reaches out to the nearest nodes to get on the network then those nodes find other nodes creating the network mesh once your application is running it receives an updated list of nodes and it shouldn't have to reach out to the bootstrap server ever again unless there is an issue as you go to your destination site you connect onto a number of nodes like a headless one like the one I run in the cloud a mobile app a desktop app and whatever other project people have been working on so let's take a deeper look

at this connection we have made because neither node knows more than a couple of the nodes around it the two nodes that are communicating build a private route together a on the left connects to N1 and builds a private route to B on the right now B knows about N5 and builds a private route back to a it's important to point out here that these are direct routes once you are on the veiled Network your traffic never leaves on most systems Network Pathways can be tracked and nodes can watch the transfer path of packets meaning your information can be captured and compromised in transit the way the veiled Network combats this issue is by making sure every node only knows the

node before it and after it that way both communicating nodes in this case A and B have a private route but what about the security of the packets themselves for those of you who know tour or the onion router this may seem pretty familiar as your message is transferred it has layers of encryption around it that get removed as it passes from node to node this is where tour gets its name the onion router and veid calls this ogre routing because ogres have layers like onions as I mentioned before veid is built on Rust which cross compiles meaning your code will run on multiple types of operating systems it runs practically everywhere and the crates

are available now and what easier way to dig into the ve API then with python a quick pip install command and you can start interacting with the veid API straight away given python is a relatively simple and Universal programming language this allows those with less of a programming background to utilize veid without needing serious developer skills as for mobile applications there is flutter and dart the veiled team used flutter to make the veiled chat app because it will cross compile to desktop as well we will dive into the veiled chat app in a little short while but first let's build a veid node there are two types of nodes an app node and an appless or headless node which is a node

that is running veid without an application on top as far as the veiled network is concerned they are viewed the same and equal all the code is available on gitlab slvd slid the readme markdown file has all the steps you need it's really easy to set up in just three short steps one get the veiled gpg Keys two install the packages and three compile and run once your Note is up there's a really cool Vapor wave interface but enough talking let's see how easy it is to spin up a veiled note in under three minutes

so first as you can see on the top there it's gitlab vvid then down here we'll go into the read me file so we can get all the information we need next it will have um a short desp destion about veid what it is basically what I've covered so far in this talk and then it has all the instructions on how to run a node then skipping over all of that we see the hyperlink to installing once we click on that we will get all the instructions step by step on how to install Veet so you don't have to figure it out yourself it also explains all the different commands and things you have to get into

so here is building a headless node like I mentioned before which I did in my Cloud Server that I have and now time to install it it's quick easy and it's all just copy and paste

commands so we'll copy in the First Command which is the gpg key that di menion once that goes next we have to figure out our architecture and I already knew mine and what it was but it's always good to double check even if you think you know so we'll copy in that command and get our answer that will help us out in our next step amd64 so we'll go to step three and see which one is made for amd64 that's the first command so we'll copy that and run

it now we need to install veid but only first after we've updated because always update your crap people which I sometimes forget to do guilty of that it goes by quickly next we'll install

Veil

bam in a matter of seconds we'll be ready relatively quickly and next we just need to uh start up our headless node so we have two options we can just run it or we can set it so it starts at boot as well so we're going to copy the start at boot command so we don't have to enter the same command every single time we want to open up and start up our veiled node enter that in and then again in a matter of seconds it should start up and it looks relatively cool like I mentioned the whole Vapor wave style okay

veid and there we

go and now as we wait for it to sort of boot up I just adjusted the size and then pretty soon you'll see all the traffic and all the nodes come in right now you can see all the ipv4 and ipv six and everything that's on the network currently that it's seeing and then of course we have a command line so we're going to type in help to be able to get a bunch of different commands and information on the veiled headless node that we've just created as you can see my node has been steadily and happily contributing to the veiled Network I only take it down about once a week to perform some updates building a node yourself is very

easy and again takes a matter of minutes you saw that and we'll help build up this fast growing network but what about an app let's look about the veiled chat app this is currently in beta so if you would like to check it out you will need to join the veid Discord and then get permission one of the things the veiled team wants to ensure is that anyone can use veiled applications even your parents and grandparents who have no super nerdy technical knowledge to test the ui's ability to be userfriendly I had my non-technical mom install the veiled chat app on her phone all she had to do was go to the Google Play Store download

and install veiled chat and launch the app to befriend her I clicked on the clipboard on my phone to generate an invite QR code and she simply had to click the center QR code Redeemer then bam we are chatting and as you can see in the app it's got a relatively basic screen it's got your chats it's got your contact list and again it's in beta but as for now it's working pretty well I'd like to take a moment here to say this let's imagine what the future will look like if we continue living living with the current information for sale model your kids now have their first real jobs and so they apply for

health insurance but the insurance company scraped all the Facebook data from your grandma's Facebook account and are now giving them higher insurance rates because they found your grandma's medical search history with all of our privacy Stripped Away there's no doubt that the future will be a scary place place and it already kind of is that's why we need you to help protect my generation and the coming Generations from this profit-based internet by contributing to this new security and privacy focused Network and other words let's take back the internet thank [Applause]

you thank you should together work and we can have like five of us together and I also um I have my booth outside like I mentioned before if you want to come because I'm going to be there all day like in the vendor area to to make yeah of course uh we won't have Q&A so if anyone has questions Bianca L will be available back at the Village thank

you