CC Liang：隱私真的變好，使用者怎麼知道？

0:00開場：數位皮夾、超商取件與選擇性揭露

0:00非常感謝，很高興能在這裡。這場我想把一些事講清楚，希望對各位來說其實很明顯。我會試著給一些普通的答案，只是想把那些你覺得理所當然的事講出來。希望這能幫我們一起想一想。Thank you so much, and very happy to be here. In this talk, I want to spell out something, like, very... I hope, like, they are very obvious to you, and I try to give some, like, mediocre answer to things, and I just want to, like, spell out, like, the things that feel very obvious to you. And I hope that will help us reflect on something.

0:46下一張。抱歉。好。下一頁。我看到朋友 Mashbin 的一篇貼文。他以前在 MoDA、數位發展部，幫忙做台灣的數位皮夾。但他沒機會把數位皮夾的完整願景做完。So, let me try next slide. Sorry. Okay. Yes, the next page. So I saw this post from my friend Mashbin, and he used to be in the MoDA, the Ministry of Digital Affairs, and he helped to develop the Taiwan Digital Wallet. And, but he kind of, he didn't get a chance to do the full vision of the digital wallet.

1:38他想要零知識證明這些功能，很多他想做的功能。後來他就 vibe-code 了一版自己的數位皮夾，把想要的功能都放進去。他為此寫了一篇貼文，我讀了很喜歡。我傳訊給我的 AI agent，說我想要 Mashbin 有的那些。他做的是 iOS，因為他只做了 iOS 實作，我的手機是 Android，所以我請 agent 做一個 Android 版。He wants to, you know, like, have zero-knowledge proof features and, like, a lot of features he wanted to do. So he ended up, like, he tried to— vibe-code his own version of digital wallet and have, like, all the features he wanted to do. And he wrote a post for this, and I read the post and I liked it very much. And I texted my AI agent and I asked, like, “Oh, I want whatever, like, Mashbin has.” His is iOS, because he only developed the iOS implementation, and my phone is Android, so I asked my agent to do an Android one.

2:32來講 7-ELEVEN 取件流程。你網購、訂一個包裹，可以請他們送到超商。現行做法通常是你要帶身分證，說我要取件，報姓名，再報手機後三碼或後五碼。你把身分證給店員看，他們再幫你拿包裹。但如果你很在意隱私，就會發現身分證上欄位很多，把證件交出顯得曝光太多。Okay, so let's talk about the 7-Eleven pickup flow. So if you go online shopping and you order a package, and you can ask them to deliver to a convenience store. And usually, like, in the old or current way, you have to bring your national ID, and then, like, you say, “I want to pick up my package,” and you have to say your name, and then the last three or five digits of your phone number. You present your ID to the staff, and then they pick out the package for you. But if you're a very, like, privacy-sensitive person, then you realize there are lots of fields, there are different lots of fields on your national ID, and it feels very, like, a lot of exposure to send out your ID, so.

3:29掃 QR code 能取件，密碼學用起來卻很無聊

3:29數位皮夾的一個使用情境是：你向電信業者申請一張憑證，電信業者證明你是這個名字、手機後三碼或後五碼的人，你再用皮夾做選擇性揭露。接著把 QR code 給超商店員看，他們再幫你拿包裹。One of the use cases of the digital wallet is you can apply for a credential from your mobile provider, and then the mobile provider will attest the fact that you are the person with this name and your last three digits of phone number or five digits of phone number, and you can do selective disclosure with this wallet. And then you present this QR code to the convenience store staff, and then they will pick out the package for you.

4:15這是我的 AI slop。你看我也有 QR code，畫面上還跳出一堆除錯訊息。超商店員看我很可疑，但還是掃了我的 QR code。vibe-code 數位皮夾的最後一步，是到真實場所測。我們真的去超商，出示我的 AI slop，店員真的掃了 QR code，然後And this is my, like, AI slop. So you see, like, I have a QR code too, and there are lots of, like, debugging messages popping up in the UI, and the staff in the convenience store, they looked very suspicious, like, to me, but he still, like, scanned my... scanned my QR code. Like, the last step of the vibe-coded digital wallet is to test it in a real place. So we actually went to a convenience store and then presented my AI slop, and then the staff actually scanned the QR code, and there's a...

5:04我的包裹出現在超商的機器上，所以某種程度能用。但同時也覺得很不驚人。就是掃一個 QR code。其他 app 也都這樣，整段流程顯得無聊、日常。我沒辦法在這整段流程裡表現興奮。如果你記得第一次用 LLM：發現電腦可以寫出像人的My package is showing up on the machine of the convenience store, so it kind of worked. But it also, like, feels, like, unimpressive. Like, it's just scanning a QR code. Like, that's what you do with, like, every other app, and, like... It seems like everything is so boring, so mundane. Like, like, like, I cannot show my excitement in, like, this whole flow. Like, if you remember your first, like, LLM experience, like, when, when you find out, like, a computer can write you a, like, human-like...

5:51像人的語言，電腦可以那樣跟你說話。看到電腦幫你畫出漂亮的圖，你會覺得這很驚人，這不一樣，這像是人類的進展。但密碼學多數時候不是這樣。送交易，如果你拿掉所有摩擦、網路 gas 代幣那些，感覺就該像銀行 app。你在網路上瀏覽網站時，human-like language, that, like, the computer can talk to you like that. When you see a computer can draw beautiful pictures for you, you feel like, oh, this is impressive. This is something different. This is, like, some progress in humanity. But, like, for cryptography, like, most of the time it doesn't, like, everything, like... Sending the transactions, like, if you remove all the frictions, like all the network gas tokens, and, like, if you remove all the frictions, it should feel like just a bank app. And then, like, when you browse a website on the internet, like...

6:39HTTPS 跟 Signal：安全做對了，使用者感覺不到

6:39你打開一個 HTTPS 的網址，那個 S 真正給你什麼？你不會感激安全性，也不知道細節，不知道背後怎麼運作。介面大概給你一個盾或鎖，告訴你這個網站安全，你就繼續走，不會真的注意網站。Signal，現場誰在用 Signal？好，不少人。你講得出 Signal 的任何密碼學功能嗎？你為什麼用 Signal？是因為You go to a URL with HTTPS, and then, like, what does the S really give you? Like, you don't appreciate the security, and, like, you don't know the details. You don't know how it works behind the scenes. You just, the UI just shows you probably a shield or a lock, like they're showing you, okay, this website is safe. It's secure. And then you just move on. You don't actually pay attention to the website. And, like, Signal—who here uses Signal? Oh, okay, lots of people. And can you name, like, any of the cryptography features of Signal? Like, why are you using Signal? Is it...

7:27因為它安全、隱私，或只是朋友在用？開源？開源。好理由。那你講得出 Signal 的任何密碼學功能嗎？端到端加密。很好，你有在注意。多數人大概知道端到端加密，大概也聽過隱私聯絡人發現之類，但我不覺得真的有人懂。所以我覺得Because, like, it's secure, private or something, or, like, just your friends are using it. Like, open source? Open source. Okay, that's a good reason, yeah. And can you name any cryptography feature of Signal? End-to-end encryption. Okay, it's very good. You're paying attention. And yeah. And yeah, but, like, most of people, like, yeah, they probably know the end-to-end encryption part, and, like, they probably know the private contact discovery something, but, like, no, I don't think anyone knows that. And so I think...

8:13我離開 Ethereum Foundation 時，帶著這類哲學辯論，來自很多私下對話，也來自公開座談。有一種我稱為替代觀：密碼學只是模擬出來的可信第三方。你能做的一切，用第三方的方式也能做。ZKP2P 很厲害，但它就是沒有第三方。你可以讓交易所支援 USDC、一筆 Venmo 轉成加密貨幣，一切都能用第三方方案重做。它沒有創造新體驗。I left, like, Ethereum Foundation with, like, this kind of philosophy debate from, like, lots of private conversations and also, like, public panels. And there's a, I call it a substitution view, like, cryptography is just a simulated trusted third party. So everything you can do and, like— You can do it with a third-party way. Like, ZKP2P is amazing, but it's just no third party. Like, you can have an exchange to support USDC, a Venmo transaction to crypto, and everything can be reproduced with a third-party solution. And it doesn't create a new experience, like...

8:59對使用者來說，根本上沒有新東西。另一種看法大概是：密碼學是真的，資料上有實際物理，對手能做什麼、不能做什麼。這是真的，但你可能要有一些知識才知道什麼是真的。如果把所有抽象拿掉，一個沒有知識的使用者，能感覺到任何新體驗嗎？從一般使用者的角度看，我還沒看過真正新的東西。There's fundamentally nothing new to a user. And the other view is probably saying, like, okay, cryptography is true and real, like there are actual physics on the data, things an adversary can do or cannot do. And it's real, but, like, maybe you have to have some knowledge to know what's real or not. But, like, can a user with no knowledge feel any new experience if, if we don't, like, if we strip all the abstractions away? And I don't think I've seen anything, like, actually new from a general user point.

9:55Why Johnny Can't Encrypt：不情願的使用者與抽象規則

9:55後來我找到這篇 1999 年的論文，叫 Why Johnny Can't Encrypt。它大概是說，密碼學軟體或資安軟體是很特別的一類軟體，跟消費端軟體不一樣。你不能用平常開發其他軟體的方式去開發密碼學軟體。為什麼？論文點出密碼學 app 的五個性質，我覺得該一個一個講，感受一下。And so I eventually, like, I found this paper, 1999, called, like, Why Johnny Can't Encrypt. And it kind of says, like, cryptography software or security software... They are kind of a very special type of software. They are different from the consumer software. You cannot develop cryptography software like the usual, like, other software you are using. So why is that? The paper named five properties of the cryptography app, and I think they are kind of, like, like we should, like, like talk into it one by one and get a feeling of it.

10:51第一，使用者沒動機。他們不想搞懂密碼學 app 的細節。安全有點像保險，只有風險夠大、保險夠便宜，才值得注意。例如烏克蘭的 Signal 下載量在戰前最低，戰爭開始後衝到最前面。你需要很大的風險，才有理由去用安全。使用者不想一開電腦就去管理自己的安全。So first is... Users are unmotivated. They don't want to understand the details of the cryptography app. Like, security is kind of insurance, and you only pay attention to security when the risk is big enough and the insurance is cheap enough to justify it. And, for example, like... The Signal downloads in Ukraine were the lowest before the war, but then it, like, raised to the very top after the war began. So you need a very big risk to justify, like, using security. And, yeah, the user don't want to just open their computer and manage their security.

11:41給各位看一張圖，不情願的使用者長這樣。這是 Moxie 貼文裡的一句：你不會穿盔甲去買早餐。這是第一個性質：不情願的使用者。再來，密碼學是抽象的。這很明顯。規則很怪，規則作用在資料上，對使用者很陌生。我們很依賴And let me show you a picture of what an unmotivated user looks like. So this is one sentence from Moxie's post, like, you don't wear armor to go grab breakfast. So this is, like, property one: unmotivated user. Next, cryptography is abstract. Like, this is very obvious. Like, there are strange rules. The rules apply on data, and they are very unfamiliar to users. And we kind of rely heavily on the...

12:27隱喻，才試著把密碼學語言翻給使用者。我們把加密講成箱子裡的東西，你有鑰匙去鎖、去開。數位簽章是什麼？我們用簽名這種隱喻，再用真實世界行動的心智模型，去感覺密碼學實際在做什麼。組合起來可能很怪。用你的私鑰在一張紙上簽名，是什麼意思？the metaphor to actually, like, try to translate the language of cryptography to users. So we're trying to translate encryption as items in a box, and you have keys to lock it, to unlock it, and you kind of, what is a digital signature? We are kind of using a metaphor of, like, signing things and then... And we're kind of trying to use a mental model for our actions in the real world to get a feeling of what actually cryptography does. So, and the combination could be very strange. Like, what does it mean to sign a paper with your private key? Like, it...

13:16沒回饋、穀倉門、最弱一環：錯了當下不知道

13:16看起來很怪。所以密碼學軟體很難用。下一個是沒有回饋。每次你用密碼學應用，你點的每個按鈕、做的每件事，你不知道自己做對沒有。因為你做錯了，例如把密碼洩漏給別人，你得不到回饋。你不知道自己在做錯事，系統也沒辦法把細節完整告訴你。It looks very weird. So that's why, like, cryptography software is hard to use. And then, like, the next is the no feedback. Like, every time you use cryptography applications. You don't know, like, every button you click, everything you do, you don't know if you're doing it right. Because if you do something wrong, if you leak your password, like, to others, like, you don't get feedback. You only, like, you don't know you're doing wrong things, and the system cannot tell you, like, in full detail. And, yeah, yeah, yeah, yeah, yeah.

14:03你要等後果來了，那就很糟。我個人最有感覺的是盲簽。你知道這筆交易在做什麼嗎？不知道？好。這筆交易我想把一些 ETH 換成一些 USDC。這個畫面沒顯示 USDC，但已經算進步。因為原本你要看一堆合約 bytecode，然後就簽名。You only, after the consequences arrive, and then that's, like, like, it's terrible. And, like, I think the most, my personal experience is blind signing. Like, do you know, like, which... Do you know what this transaction is trying to do? No? Okay. So this transaction, I want to swap some ETH to some USDC. And, you know, like, this screen doesn't show me USDC, but it's already a progress. It's already a progress because originally you have to see a lot of... contract bytecodes, and then you just sign.

14:51你拿出硬體錢包，對錢包上隨便什麼東西按同意。現在有處理盲簽的 EIP 跟標準，至少會顯示你要把 0.1 ETH 送到某個合約函式，哪個合約、呼叫哪個函式。這是進步，但還不完美，對只想換一點 USDC 的人來說也不是好回饋。我該不該按 swap？那是對的按鈕嗎？按了會不會有壞後果？你不知道。再來是穀倉門性質：馬已經跑出穀倉，現在關門沒有用。Just, you take your hardware wallet and just press approve for, like, whatever, like, whatever things on the wallet. And there are EIPs and standards for blind signing, and so at least it shows you, oh, you're sending, like, 0.1 ETH to some contract function, which contract and what function to call. It's a progress, but it's not perfect yet, and it's not good feedback for, like, if you just want to swap some USDC and you don't know, like... Should I click swap? Like, is that the right button to click? If I click, would there be bad consequences? You don't know. And yes, the barn door, like the barn door property says, like, the horse already left your barn, and it's useless to close the door now.

15:46金鑰被偷、資金沒了，你什麼都做不了，局勢救不回來。這就是密碼學的處境。最後一個大概大家都知道：最弱一環。這是有名的 XKCD 漫畫。資安專家會想：哇這台電腦有加密，加密很強。但其實你花五美元買一把扳手去威脅使用者，他就會把密碼給你。安全有多強，就跟最弱的那一環一樣。When your key was stolen, when your funds were lost, like, there's nothing you can do, like, nothing you can salvage the situation. And that's the situation of cryptography. And the last one is probably very well known. It's the weakest link. So this is a famous XKCD comic. It says, like, the security expert will think, "Oh wow, this computer is encrypted." "Oh, it is a very strong encryption." But actually, if you buy a five-dollar wrench to threaten the user, they will give you the password. So the security is, you know, as strong as the weakest link, and...

16:33密碼學是 credence good：用完也判不斷好不好

16:33另一個含義是：密碼學或資安的很多進展不會被感激，因為它們不在你的最弱一環上。它們比較像整套安全流程裡更強的環節，你不會覺得整段流程有改善。這五個就是 Johnny 的性質，我這樣叫。我個人喜歡把它翻成經濟學語言，因為那幫我們找出I think another implication of this is that lots of progress in cryptography or security is going to be unappreciated because they are not on your, like, weakest link. They are more like stronger links of your whole security procedure, and then you don't feel like that's an improvement to your— to your whole flow. So, yeah, so there were five Johnny's properties. I call it Johnny's properties. And, but I personally like to translate things into the language of economics, because that helps us to identify, like...

17:20這種處境裡的協調失敗是什麼。需要哪些資訊、哪些專業，哪些誘因沒對齊。經濟學裡典型有三種財。一種是搜尋財。你買之前就能檢查品質，像蘋果，買之前就看得出爛不爛、新不新。經驗財是用過才知道品質，像餐廳一餐。What's the coordination failure in the situation? Like, what parts of information are required, expertise required, what kind of incentives are not aligned? So. Typically, like, there are three kinds of goods in economics. One is search good. Like when you buy something and the quality is, like, you can check before buying, like an apple. You can see if it's rotten or fresh before you actually buy it. Experience good is something you know the quality after using it, like a meal in a restaurant.

18:08你走進餐廳、吃完，才知道好不好。Credence good 則是用完也判不斷品質。你去修車，技師說引擎有一個零件要換，你說好，隨便你。我不知道你在做什麼。你付了錢，修完之後大概也感覺不出差別。看醫生也一樣，醫生說你要做這個治療，但有沒有必要？Like you walk in the restaurant, you have the meal, you know it's good or not. And credence good, you can't even judge the quality after using it. If you go to a mechanic and the mechanic says, "You need to replace one part in your engine," and you say, "Okay, just do whatever you want." I don't know what you're doing, but like... You pay the money, but after, like, you know, after repairing, the repairment, you probably won't notice the difference. And same for the doctors, and, like, you go, the doctor asks, like, "Oh, you have to do this treatment," but is it necessary?

18:55你講不出來。手術做完、一切做完，你大概還是講不出來。我覺得密碼學有點像 credence good。那些 Johnny 的性質都指向：你在用密碼學應用時，例如 Privacy Pools。你用隱私池，得到某種不可連結性。如果你不知道不可連結性是什麼，你大概就是存進去、提出來，不知道自己在做什麼。你不知道這整套程序有沒有帶來好處。同時你在付 gas，也在付隱私池的費用。You can't tell. Like, after the surgery, after everything, you probably can't tell. So I think cryptography is kind of a credence good. Like all those Johnny's properties are kind of, when you use a cryptography application, like... Privacy Pools. When you use a privacy pool, you are getting some kind of unlinkability. And if you don't know what is unlinkability, like, you probably use the privacy pool, you deposit, withdraw, you don't know what you are doing. You don't know, like... Is it bringing you any benefits from all this procedure? And you're paying gas fees and fees to the privacy pool.

19:45先把人圈進安全迴路，最好的密碼學再把人圈出去

19:45我試著發展的一個框架是：把你的軟體產品拆成兩塊。一塊是經驗財，使用者有好回饋，看得到因果，用過就知道好不好。訊息送出、餘額轉帳，這些你看得到、驗證得到。Credence good 那塊是密碼學，你看不見、驗證不了，用完也不知道。所以我試著回看過去用過的每個密碼學 app。And so one framework I try to develop is you kind of try to decompose your software product. Into two components, like one is experience good, like user have good feedbacks, they can see the causality, they know it's good or not after using it. Message sent, balance transfers, like things that you can see and verify. And the credence good part, the cryptography, the things you can't see and you can't verify, you don't know, like, after using it. So, and... Yeah, so I try to, like, look into the projects, every cryptography app I used in the past.

20:33我排了一些時間軸，想找出用完這些密碼學產品之後，有哪些明顯看得到的事，以及能從中推出什麼。我注意到 AI 裡 human in the loop 這個概念，很適合借到安全這塊。我把安全專案的發展分成四個階段。一開始是脆弱狀態，人們用容易被攻擊的方式互動。I build some timelines, and I want to identify, like, what are some obvious things I can see from, like, after using these cryptography products, and what can we derive from this. And I notice, like, the AI, like human in the loop, the concept of human in the loop is very suitable in, like, borrowing into the security part. So I separate, like, the development of security projects into four stages. At first, you have a vulnerable state, like people interact in a vulnerable way; they could be attacked.

21:21接著密碼學家提出解法，開發者做出來，你有一些利基基礎設施，但沒人在用。然後發生了某件事，人們開始採用這個密碼學 app。但這個應用需要使用者持續注意。使用者要被教育，要知道自己在做什麼。例如密碼，或雙因素驗證。這些就是你需要教育使用者的：不要洩漏密碼、不要連奇怪網站，使用者必須留在這套安全程序的迴路裡。And then cryptographers come up with some solutions, developers build it, you have some niche infrastructures, but no one is using it. Then, like... Something happened, and then people start to adopt this cryptography app. But this cryptography application requires constant attention from users. The user needs to be educated. They need to know, like, what they are doing. For example, like passwords or, like, two-factor authentication. I think these are the kind of things that you need to educate the user: don't leak your password, don't connect to weird websites, like, the user needs to be in the loop, in the loop of this security procedure.

22:14但如果條件都對了，最後一步應該是看不見的。最好的密碼學應該看不見，人退出迴路，電腦在幕後把事情做完。使用者不必想，他們不會犯錯，也不必做危險判斷。為什麼要把你圈進來？因為威脅在。從利基基礎設施走到明示採用，通常是威脅發生、公眾意識被拉高。例如俄羅斯入侵烏克蘭。HTTPS 是在 Snowden 事件之後被廣泛採用。But if we get all the conditions right, the final step, like final step, should be invisible, like the best cryptography. Should be invisible, like human out of the loop, and like the computer, like, do everything for you behind the scene. And then the user don't need to think about it. They don't make mistakes. They don't need to do dangerous judgments. And so why... Like in this, this flow, like why loop you in? Because threat is present. So when we move from niche infra to explicit, it's usually some threat happened and raised the public awareness. For example, the— The Russian invasion to Ukraine, for example. HTTPS was widely adopted after the Snowden event.

23:18能委託機器或對齊的人，才能把判斷從使用者拿掉

23:18什麼時候能把你圈出去？我列了很多理由，總結就是委託要能成立。什麼委託能成立？你可以委託給機器，也可以委託給人。機器如果真的很懂你的意圖，就可以委託給機器。有時不行，例如你送一筆交易，必須告訴機器錢要送給誰、要送多少。這些是你的意圖，機器沒辦法自己知道。但如果是對某人的定期付款，意圖很清楚，大概就可以自動化。And when can we loop you out? And I listed many reasons, but, like, in summary, it's kind of delegation works. Delegation works. What kind of delegation works? Like, you can delegate to machine and delegate to people. Machine, if machine can know your intention really, really well, then you can delegate to machine. Sometimes you cannot because, for example, when you send a transaction, you need to tell the machine. Who to send my money to, and how much money do you want to send? And these are your intention. The machine has no way to know that. But if it's a recurrent payment to someone, you can probably automate this when your intent is very clear.

24:11下一件要交付的，是機器背後的人跟你利益對齊。我點名開發者、政府、標準機構。有時你知道，如果開發者來自公司，他們可能跟你利益不對齊。那就需要使用者更持續的注意。我注意到幣安的儲備證明頁：他們試著提供儲備證明驗證。整頁都是 Merkle tree 介紹跟很多細節，因為他們做了一個工具。你要用這個工具，就得知道所有細節，才知道自己在驗證什麼。So the next thing to deliver is, like, people behind the machine are aligned with you. So I named developers, governments, and standard bodies. Sometimes, you know, if the developers are from corporates, they might not be aligned with interests with you. So... It needs more constant attention from the user. One thing I noticed from the Binance proof-of-reserve page: they try to provide this proof-of-reserve verification. And the page is full of introduction of Merkle trees, lots of details, because they build a tool. And if you want to use the tool, you want to know all the details to know what you are verifying for.

25:03不能只給一個綠勾，說我們的餘額都有清償能力。他們沒辦法那樣做，因為是自己驗證自己。他們必須告訴你細節，告訴你怎麼驗證他們的餘額，必須把你圈進來，必須佔用你持續的注意。HTTPS 的例子：原本 HTTPS 只用在很敏感的地方，像信用卡交易、涉及付款的事。然後 Snowden 發生了，有 Let's Encrypt 推動大家用 HTTPS，接著 Google Chrome 把所有 HTTPIt's not just like a green check and says, oh, our balances are all like... Solvent, like, like, they cannot do that because they are the one who verifies themselves. They have to tell you the details. They have to tell you how to verify their balances, and they have to loop you in. Like, they have to have your constant attention. And yeah, here's, like, HTTPS example. Originally, HTTPS is only used in the very sensitive, like credit card transactions, like things involved in payment. But then, like, Snowden happened, and then, like, there's Let's Encrypt, like, to promote people to use HTTPS, and then, like, Google Chrome marks all HTTP.

25:55HTTP 網站標成不安全。有很強的威脅，才推動每個人採用安全措施。瓶頸不是技術，也不是跑 HTTPS 的成本，而是協調：要讓每個人都採用那套密碼學技術。我對自己試著發展的很多概念還是很混亂，但還是試著給建造者一些結論，請打折聽。HTTP websites not secure. There are very strong threats to motivate everybody to adopt a security measure. And the bottleneck is not technology. It's not the cost of running HTTPS. It's the coordination, like to ask everyone to adopt the... That cryptography technology. So I'm still very, like, like I'm still confused between many concepts I try to develop, but I still try to draw some conclusions for the builders, like, you know, like take it with a grain of salt.

26:43給建造者：別把 credence good 當功能賣

26:43我覺得做密碼學產品時，可以試著區分功能：這是經驗財還是 credence good？哪些該當功能呈現給使用者，哪些該藏起來、當看不見的事處理。我們不該把 credence good 那塊當功能來行銷。不該賣說我們的產品用零知識證明、用抗量子簽名之類。But I think. When we are building a cryptography product, we can try to distinguish the feature, like, is this experience good? Is this credence good? Can the user, like, you know, like, what should we present to the user as a feature, and what should we hide from the user as something like we can deal with invisible. And I think, like, we should avoid, like, market a credence-good part as feature. We shouldn't sell like, oh, like our product uses zero-knowledge proof. We use, like, post-quantum-safe signatures or something like that.

27:33這些像是在請使用者幫你做資安審計。但你還是得向某些人行銷，對吧？第三點是：想想誰該吸收使用者的判斷。如果使用者必須判斷這件事，能不能委託給機器？能不能委託給標準？該政府做還是公司做？如果能委託給對使用者利益對齊的一方，就可以讓它看不見，只給使用者一個綠勾，讓密碼學變得不驚人、然後看不見。These are like asking users to do a security audit for you, but I don't know, like, you still need to market it to someone, right? Like, and then, like, I think the third one is, okay, think about, like, who should absorb a judgment for the user, like. If users have to judge this, can we delegate to machine? Can we delegate to standard? Should government build this? Should corporate build this? Like, if we can delegate them to the right party with a nice interest to the users, we can make them invisible and, like, showing users just a green check, and then, and then, like, make the cryptography, like, unimpressive and then invisible.

28:27今天就這些。非常感謝。謝謝 CC 這場很好的演講，以及給建造者的 takeaway。現在可以問一個問題。誰想問？嗨，謝謝。你提到 HTTPS，那真的是密碼學早期的大規模採用。回頭看歷史，網路大概三十年前開始，但 SSL 安全連線大約十年前才真正大規模採用。早期郵購，信用卡是明文寄出去的，後來有電子商務。So I think that's all I have for you today. Thank you so much. Thank you, CC, for your great talk and your takeaway for builders. So now we can have one question for Q&A. Who wanna...? Hi, thanks. You mentioned the HTTPS, which is really the early... Mass adoption of cryptography, and looking back into the history, we see the internet started 30 years ago, but the SSL safe connection does not go into mass adoption until like 10 years ago, and at early time when we are doing, like, mail order, we put the credit card in clear text to do the mail order, and then we have online commerce.

29:30但當時只有信用卡頁才有 HTTPS。所以密碼學真正大規模採用，其實花了十年、二十年。我覺得接下來幾十年我們會看到類似路徑。這場研討會一直在講零知識證明，如果面向消費者的產品並不該直接用零知識證明，也許更多機會在幕後，給政府或給企業。我一直在想的一個點是審計。But only for the credit card page will have the HTTPS at that time. So it actually really took like a decade or two to— make the cryptography really mass-adopted, right? So I think we will witness a similar path in the upcoming decades. So I'm wondering that, for example, we talk about zero-knowledge proof a lot in this conference, and so if it's not really the case to build a consumer-facing product using the zero-knowledge proof, perhaps more opportunities behind the scene, I mean, to the government or to the business side. So one idea I've been thinking is about auditing.

30:16提問：審計能不能用證明漏洞，不必公開所有秘密

30:16我們這個世界的審計很多在公開場合做，但多數傳統世界、包括機構，審計發生在很私密的空間。我想帳戶審計、資訊安全審計、甚至供應鏈審計，能不能採用一些密碼學，提高透明度，同時不犧牲供應鏈的秘密。想聽你對用密碼學取代審計流程某些元件的想法。謝謝。謝謝，好問題。So in our world, we do auditing in the public, but in most of the traditional world, including the institutional things, they do the auditing in very private space. So. I'm wondering, for example, account auditing, information security auditing, or even supply chain auditing could adopt some cryptography there to improve their transparency, but without sacrificing the secret of the supply chain or things like this. I'm curious about your thoughts about using the cryptography to replace some components of the auditing process. Thanks. Thank you, thank you, thank you. Great question.

31:05我以前聽過一個跟這題有關的想法，用來處理審計問題，叫做 proof of vulnerability，或 proof of hack。證明漏洞，或證明駭入。你描述的處境比較像私密審計。但區塊鏈空間裡，很多審計發生在公開場合，比較像白帽審計。有人來找你說你的系統有 bug，開發者必須檢查，但需要時間驗證這個主張是不是真的。如果有 proof of vulnerability，你可以用 ZK 證明來證明攻擊真的成功了。And I think I heard an idea a while before, maybe relevant to this issue. To address the auditing problem, it's called, like, proof of vulnerability or, like, proof of hack. Proof of vulnerability, or like, proof of hack. Like, when you— so, but I mean, like, the situation you described is kind of a private auditing. But in blockchain space, a lot of auditing is kind of happening in the public. It's kind of white hat auditing. So when people, like, reach you, say, “Oh, your system has a bug,” and then your developer has to check, but they need time to verify the claim is true. But if you have proof of vulnerability, you can have a ZK proof to prove that your attack actually worked.

31:57那就會省下很多審查資安漏洞主張的時間。類似的想法，大概也能提供給私部門的審計服務。我不知道他們是不是已經在做類似的事。謝謝。好。謝謝 CC。再給他一次掌聲。And then that will save a lot of time to review the security vulnerability claim. And so I think, like, similar idea, like, we could probably provide to the auditing service, like, a private sector. Yeah, I wonder if they're already doing something similar like this. Thank you. Okay. Okay, thank you, CC. Let's give him another round of applause.