Latest / CRYPTO 101 / Ep. 752 Is Crypto Ready for AI & Quantum Computing Risks?

Transcript

Ep. 752 Is Crypto Ready for AI & Quantum Computing Risks? · CRYPTO 101

• 0:08
  [SPEAKER_01]: All right, everybody, we're back at the out east summit here, sponsored by the tie.
• 0:12
  [SPEAKER_01]: Really excited to have Mr. David Schwed, joining us from Sovereign.
• 0:15
  [SPEAKER_01]: Thank you.
• 0:16
  [SPEAKER_01]: Are you doing enjoying the summit so far?
• 0:17
  [SPEAKER_00]: I'm doing it.
• 0:18
  [SPEAKER_00]: This is a beautiful weather.
• 0:19
  [SPEAKER_00]: Today, hopefully we'll be about it in the S today, but it's gorgeous.
• 0:21
  [SPEAKER_00]: Yeah, I love it.
• 0:22
  [SPEAKER_01]: Yeah.
• 0:22
  [SPEAKER_01]: Look Sovereign, near Foundation, DAT.
• 0:25
  [SPEAKER_01]: Did you last at Treasury tell us why you chose near because there's a lot of there's millions of different cryptos, you know, you could have done Bitcoin, could have done Ethereum, you kind of went down stack and looked at near and I'm curious about that decision.
• 0:37
  [SPEAKER_00]: Yeah, I love what they're doing with the intersection of privacy and the blockchain.
• 0:43
  [SPEAKER_00]: It's not, you know, I wouldn't look at them necessarily as like a just another layer one, like, you know, again, there's tons of layer ones out there and
• 0:49
  [SPEAKER_00]: you know, competing against TPS and et cetera, but like the understanding from like an agente commerce perspective, the convergence of the importance of AI and privacy integrated with blockchain is really what Germany offers to it.
• 1:00
  [SPEAKER_01]: Yeah.
• 1:01
  [SPEAKER_01]: And you know, you've had a great background in crypto, working at Galaxy, working at BNY melon, and now it's sovereign and near privacy.
• 1:10
  [SPEAKER_01]: I mean, this is to me, definitely going to be the way of the future because with AI and with crypto,
• 1:18
  [SPEAKER_01]: not public, but public blockchains in nature have that trail, right?
• 1:23
  [SPEAKER_01]: That audit trail where people can say, you know, cryptographically verify that even though it's pseudonymous, it's still out there.
• 1:29
  [SPEAKER_01]: And with AI, a lot of people are querying these, you know, chat bots with their deepest darkest secrets.
• 1:35
  [SPEAKER_01]: And guess who has access to that, open AI, andthropic, you name it.
• 1:40
  [SPEAKER_01]: And Microsoft, you insert Mag7 company here.
• 1:43
  [SPEAKER_01]: And why to you is the privacy component so important because it's not privacy for the sake of privacy.
• 1:51
  [SPEAKER_01]: Is it privacy for a certain philosophical reason?
• 1:55
  [SPEAKER_00]: Yeah, I mean, honestly, from a...
• 1:57
  [SPEAKER_00]: From a pure technical perspective, like my approach at this really isn't from a privacy perspective, it's more from a security perspective security privacy is is a wonderful by product of good security that that's kind of how I how I do things so when we look at to your point the prompts going in and out of
• 2:12
  [SPEAKER_00]: But AI and Anthropic and Gemini and Grock and whoever, you know, there's a lot of from a regulatory perspective, you know, P-I-I or M-N-P-I data that's going in and out.
• 2:21
  [SPEAKER_00]: So from a security perspective, I want to protect organizations from data x-fill, you know, the nation states or threat actors having access to sensitive information information that shouldn't have access to.
• 2:31
  [SPEAKER_00]: And in order to do that, we build infrastructure in a certain way that ensures that.
• 2:35
  [SPEAKER_00]: And like I said, a wonderful live product to that is privacy because the best security is ensuring that nobody can access it.
• 2:43
  [SPEAKER_01]: And what's so interesting is it plays into quantum resistance as well.
• 2:47
  [SPEAKER_01]: And I want you to kind of talk about this, because I know near just recently had a release and update however you want to frame it of quantum resistance.
• 2:56
  [SPEAKER_01]: And is this because of privacy, because I know with quantum it's like if you've ever signed a transaction on Bitcoin with your public key, that is sort of publicized and people can see that, but then they could reverse engineer your private key.
• 3:11
  [SPEAKER_01]: what is the quantum resistant nature of what you're working on?
• 3:14
  [SPEAKER_00]: Yeah, sure.
• 3:15
  [SPEAKER_00]: So, you know, to kind of frame it, it's bigger than crypto, the issue.
• 3:19
  [SPEAKER_00]: Sure.
• 3:19
  [SPEAKER_00]: So, we have certain cryptographic ciphers that are not quantum, you know, I guess there can be broken with what's quantum computing.
• 3:27
  [SPEAKER_01]: And so like when you see HTTPS, that could be broken by quantum, just as easily as theoretically.
• 3:32
  [SPEAKER_00]: Like if the choice of using certain ciphers, they could be decripted.
• 3:35
  [SPEAKER_00]: So when we look at this for the lens of security and privacy, you know, there's a couple of different, you know, I guess foundational blocks to kind of unpack.
• 3:42
  [SPEAKER_00]: You know, first is from a privacy perspective, like there's this concept of store now decrypt later, which is going to be an issue.
• 3:48
  [SPEAKER_00]: Yep, I heard those.
• 3:49
  [SPEAKER_00]: A bunch of nation states, listen, you know, I'm sure our country does that as well.
• 3:52
  [SPEAKER_00]: U.S. does as well as, you know, we're storing tons and tons of encrypted data from nation states and from, you know, it, uh, different geographic regions with the hopes of one day will be able to decrypt that data and have access to nation secrets.
• 4:02
  [SPEAKER_00]: So like that is an issue that we're not going to be able to fix in the past.
• 4:06
  [SPEAKER_00]: It's only on a go-forward basis.
• 4:07
  [SPEAKER_00]: So we're going to have to deal with that as well.
• 4:09
  [SPEAKER_00]: So like, you can't fix that problem.
• 4:12
  [SPEAKER_00]: So organizations can start to think through if the last 20 years of my data somehow got leaked, what would happen to my organization.
• 4:19
  [SPEAKER_00]: So I think that's an exercise most organizations and nation state should actually be going through.
• 4:24
  [SPEAKER_00]: Going forward, if we start thinking about what is the potential impact of crypto, it is, again, digital signatures.
• 4:29
  [SPEAKER_00]: So if we're using a non quantum resistant cipher to do digital signatures, the entire
• 4:37
  [SPEAKER_00]: blockchain, the veracity of it, the integrity of it, and theory is God.
• 4:42
  [SPEAKER_00]: So that's why it's really important for organizations, not just crypto for financial services organizations, you mentioned HTTPS and all of the other protocols in which we exchange information to be quantum resistant.
• 4:54
  [SPEAKER_01]: And I've heard this sort of,
• 4:57
  [SPEAKER_01]: concept, I guess, this idea that banks are just as exposed to quantum as Bitcoin.
• 5:04
  [SPEAKER_01]: However, banks have a CEO at the top who could say, over the course of the next three years, here's your go-to market plan, here's your action plan, and they could dictate from the top down and get consensus with the snap of a button because they're in charge of us.
• 5:18
  [SPEAKER_01]: And people are like, okay, well, they're going to handle it.
• 5:21
  [SPEAKER_01]: they're going to get the quantum upgrade or whatever they're calling it.
• 5:24
  [SPEAKER_01]: For crypto it's like it's a lot more difficult because you have decentralized consensus.
• 5:28
  [SPEAKER_01]: You have no single decision maker and so you've seen groups like micro strategy and coinbase come up with quantum resistant think tanks let's call it our groups.
• 5:38
  [SPEAKER_01]: How do we actually get a quantum resistant bitcoin?
• 5:43
  [SPEAKER_01]: Because, you know, we could talk about Ethereum a little bit more centralized.
• 5:47
  [SPEAKER_01]: Other foundations that could say, okay, well, we're going to come up with our plan.
• 5:50
  [SPEAKER_01]: We're going to propose that we know the validators set so on and so forth.
• 5:53
  [SPEAKER_01]: But Bitcoin's really, you know, 80% of the, or 70% of the market cap of legitimate, you know, crypto currencies and I feel like if, you know, that's the one that maybe might have the most difficult time getting its full upgrade.
• 6:05
  [SPEAKER_00]: Yeah, I mean, like, there's the consensus nature of it, like to your point, there's no centralized authority, which is why we like it, you know, that's dictating here's the upgrade that we're going to have to do.
• 6:13
  [SPEAKER_00]: Yeah, from a technical perspective, it's absolutely on a drips and solvable.
• 6:16
  [SPEAKER_00]: I think it's just around getting the right parties and the right people in place to put forth the protocol of great work on the note infrastructure.
• 6:22
  [SPEAKER_00]: You know, again, we're going to have early signatures, if you will, that, you know, we're not going to be able to move into quantum resistance to mallets, which I guess there's a couple of different theories on, you know, how to take care of those potentially maybe, you know,
• 6:34
  [SPEAKER_00]: for sub-grade, et cetera, but it's solvable from a technical perspective, and I think it's just more of a governance mission.
• 6:39
  [SPEAKER_01]: And if you could kind of go a little deeper on those parties, right?
• 6:42
  [SPEAKER_01]: Are we just talking about the minors and the developers and the exchanges or are there certain individuals that need to be brought in on this?
• 6:50
  [SPEAKER_01]: Or how does that work?
• 6:51
  [SPEAKER_00]: I don't think it's individuals.
• 6:52
  [SPEAKER_00]: I think it's like any upgrade that we've done, like Ethereum, and we went to Ethereum 2.0 or Tap Router on the big.
• 6:57
  [SPEAKER_00]: Like whatever, there's going to be a protocol upgrade.
• 6:59
  [SPEAKER_00]: It's the same part.
• 7:00
  [SPEAKER_00]: It's the same process.
• 7:01
  [SPEAKER_00]: You know, we have cryptographers that I've talked to, is like, you know, we have years.
• 7:06
  [SPEAKER_00]: This isn't like an aduming thread over the next 12 months.
• 7:09
  [SPEAKER_00]: So we have years to figure this out.
• 7:10
  [SPEAKER_00]: Not saying that we shouldn't be figuring it out now.
• 7:12
  [SPEAKER_00]: Yeah.
• 7:12
  [SPEAKER_00]: This isn't going to be a rushed, you know, oh my god, the sky is falling up great.
• 7:17
  [SPEAKER_00]: It should be a very well planned and orchestrated.
• 7:20
  [SPEAKER_00]: And if we look at, in my opinion, you know, this should be viewed as somewhat critical infrastructure, just like we do with other financial market infrastructure.
• 7:26
  [SPEAKER_00]: So I think at a certain point,
• 7:29
  [SPEAKER_00]: banks that are involved, you have clearing houses that are involved, and you have, you know, or establish institutions, and you're going to be going to run these things.
• 7:36
  [SPEAKER_00]: I think this is a very solvable and I'm not personally worried issue.
• 7:39
  [SPEAKER_01]: Yeah, no, it's fascinating.
• 7:41
  [SPEAKER_01]: And kind of from like the wallet infrastructure, self-custodial standpoint, you know, I'm sure they'll have to, you know, push a bunch of firmware updates and all that kind of thing.
• 7:50
  [SPEAKER_01]: But, you know, do you have a recommendation on, you know, for the average retail investor who's watching or the person who's
• 7:57
  [SPEAKER_01]: you know, securing their crypto like a best practice for the future of security with their own crypto innocence.
• 8:05
  [SPEAKER_00]: It's a good question, right?
• 8:06
  [SPEAKER_00]: Like I think the world is divided into two camps and PC and HSM's to find those.
• 8:11
  [SPEAKER_00]: Oh, yes.
• 8:11
  [SPEAKER_00]: So like multi-party computation, so if you're talking about, you know, the
• 8:15
  [SPEAKER_00]: M event signing threshold signing, so you know, two out of three.
• 8:18
  [SPEAKER_00]: It's not multi signature.
• 8:19
  [SPEAKER_00]: It's like one signature.
• 8:21
  [SPEAKER_00]: Again, this is not exactly how it works, but just the easiest way to explain is pretend something is broken up into different parts.
• 8:26
  [SPEAKER_00]: Each one of those have to sign.
• 8:27
  [SPEAKER_00]: They come together and it goes out.
• 8:29
  [SPEAKER_00]: That's MPC.
• 8:29
  [SPEAKER_00]: So I think like fire blocks, you tell a defense, you know, some of the major, you know, custodial providers that are out there.
• 8:34
  [SPEAKER_00]: You know, silence labs, savior, for example, they provide MPC, like software development kits that organizations use.
• 8:43
  [SPEAKER_00]: Then on the other side, you have HSM.
• 8:44
  [SPEAKER_00]: So HSM's are hardware security modules.
• 8:46
  [SPEAKER_00]: These are decades-old technology that banks use today.
• 8:51
  [SPEAKER_00]: Think fortified box appliances that are racked and stacked in data centers and guarded by men's and guns.
• 8:56
  [SPEAKER_00]: Guarded by men's and guns in many respects yet.
• 9:00
  [SPEAKER_00]: You know, this is like purpose built where it's like tamper resistant, where if you try to open up the box, the key material gets destroyed.
• 9:05
  [SPEAKER_00]: Oh, wow.
• 9:06
  [SPEAKER_00]: So like those are like the two camps and, you know, each one of them have their own different upgrade paths.
• 9:10
  [SPEAKER_00]: So if you will, like HSM's as an example, you know, have quantum resistant cypher is already that are rolled out.
• 9:16
  [SPEAKER_00]: So a lot of organizations are becoming HSM ready.
• 9:18
  [SPEAKER_01]: Let me see.
• 9:19
  [SPEAKER_00]: So there's a lot we weren't being done by different parties to, you know, to make MPC also quantum resistant ready.
• 9:23
  [SPEAKER_00]: So both camps are very actively working on, you know, becoming quantum resistant.
• 9:29
  [SPEAKER_01]: You're obviously a security expert.
• 9:32
  [SPEAKER_01]: I want to know, without scaring everybody at home, what kind of keeps you up at night?
• 9:39
  [SPEAKER_01]: Yeah, you know, besides like, maybe crime gets her.
• 9:41
  [SPEAKER_00]: Yeah, you know, honestly, I, I social engineering, I social engineering.
• 9:46
  [SPEAKER_00]: I do think stuff like many, many, many people and organizations don't understand the level of sophistication that goes on with social engineering.
• 9:53
  [SPEAKER_00]: Like, I kind of take it for granted for seeing it every day being in crypto and emerging, you know, again, I don't want to pick on parties and say the names.
• 9:59
  [SPEAKER_00]: Well, like, there was a very, you know, um,
• 10:02
  [SPEAKER_00]: There's like, too, that I love talking about, like, one was fairly recent where, you know, particular organization was targeted in real life at a conference, you know.
• 10:10
  [SPEAKER_00]: And again, it turned out to be allegedly, you know, DPRK, North Korea, but the individuals that approached them were not, you know, North Korean, you know, to send, you know, they didn't, you know, come from Korean.
• 10:18
  [SPEAKER_01]: I heard about this, yeah, yeah.
• 10:19
  [SPEAKER_00]: And they approached them at a conference.
• 10:21
  [SPEAKER_00]: They established, you know, a relationship with individuals at a certain organization.
• 10:24
  [SPEAKER_00]: We want to become design partners.
• 10:26
  [SPEAKER_00]: They worked with them in goodwill for months and months and months and months and establishing this relationship with them.
• 10:32
  [SPEAKER_00]: And at a certain point is when, you know, they dropped the payload, you know, into a particular code base that they were sharing with them on the machine and walked out the door with hundreds of millions of dollars.
• 10:40
  [SPEAKER_00]: And you know, when just crazy.
• 10:43
  [SPEAKER_00]: You know, in security awareness training at organizations, the social engineering that we're telling people is like, you know, oh, you're going to get an email telling you a research or password.
• 10:50
  [SPEAKER_00]: Like, we don't walk organizations through the really sophisticated social engineering attempts that are out there.
• 10:55
  [SPEAKER_00]: So, like,
• 10:56
  [SPEAKER_00]: And that's really hard to protect against because you're owning an individual within an organization that actually has access to do certain things.
• 11:02
  [SPEAKER_00]: Yeah, so it's it's hard.
• 11:03
  [SPEAKER_01]: You know, I got a scam email right, you know, as a public figure in crypto people Just probably find my email address online and if you're really in affairs, you can find out a lot of stuff about you know Everything that's been leaked about you on on the dark web.
• 11:16
  [SPEAKER_01]: They say They're different aquifax hacks and all that kind of stuff
• 11:20
  [SPEAKER_01]: And I got an email that was so convincing because it came from an address, like, you know, I always look not just, you know, I click in to see exactly to email address, how did this guy, because then at the bottom of it was like, please download this new zoom application in order to have this conversation with me and I'm like, okay, that's that's the red flag.
• 11:39
  [SPEAKER_01]: And then you talked to the person I had said to that, you know, you're like, okay, this is clearly how does somebody spoof an email address and just, you know, what are some of the best practices that people could think about when really verifying the other thing that was a red flag was the urgency you've got to do this today.
• 11:54
  [SPEAKER_01]: But how do you know, two questions like, you know, how do they spoof a legitimate email address and to what are those red flags to keep top and front of center of mind?
• 12:02
  [SPEAKER_00]: So, so quick story, I got to call that two weeks ago from a very close
• 12:09
  [SPEAKER_00]: One of the most security conscious people, he's not security person, but one of the most security conscious people that I've ever worked with in my career.
• 12:15
  [SPEAKER_00]: Sure.
• 12:15
  [SPEAKER_00]: One of the top, just everything's very suspicious, falls may conferences me in with an individual reporting to be from Google.
• 12:22
  [SPEAKER_00]: From what?
• 12:23
  [SPEAKER_00]: Google.
• 12:23
  [SPEAKER_00]: From Google.
• 12:25
  [SPEAKER_00]: and speaking to them very calm you know they work there was no forcing them to do anything I'm just calling to let you know that we see suspicions activity on your account we have paused your account for your safety like it was really really well spoken the guy was a fantastic actor the way he was describing everything
• 12:42
  [SPEAKER_00]: really fine with bringing and they told him who I was, bringing, you know, me on this year to you expert.
• 12:46
  [SPEAKER_00]: So I'm talking to my friend and I said, okay, like, how do you, why do you believe this person is from Google?
• 12:51
  [SPEAKER_00]: And they go, oh, what?
• 12:51
  [SPEAKER_00]: They sent me an email from Google.
• 12:52
  [SPEAKER_00]: And they go, send me an email.
• 12:53
  [SPEAKER_00]: Let me look at some of the editors.
• 12:55
  [SPEAKER_00]: I look at it.
• 12:55
  [SPEAKER_00]: It actually did come from Google.
• 12:57
  [SPEAKER_00]: So the email that this person sent them.
• 12:59
  [SPEAKER_00]: So what the threat actors are now finding out is they are mechanisms in which you can
• 13:04
  [SPEAKER_00]: like force, certain password recovery mechanisms from Google and put in certain text into the email, like, all the way to God.
• 13:12
  [SPEAKER_00]: So this individual, rightfully so, asked for that email, got the email, came from Google, verify that it came from Google from the flow, but had certain information in it that allowed the threat actor to convince this person that they were coming from Google.
• 13:23
  [SPEAKER_00]: So like, you're getting really, really good in understanding the different recovery flows and to now have legitimate emails come from the organizations that they're purporting to be for.
• 13:31
  [SPEAKER_01]: Yeah.
• 13:32
  [SPEAKER_01]: It's insane.
• 13:33
  [SPEAKER_01]: It's even gone so far as I've gotten phone calls from it literally it pops up.
• 13:38
  [SPEAKER_01]: I don't have coin bases and not to throw them onto the bus.
• 13:40
  [SPEAKER_01]: It could be anybody, but what happened to me was I got a call and said from Coinbase.
• 13:44
  [SPEAKER_01]: Yes, my phone.
• 13:45
  [SPEAKER_01]: And I thought, that's funny.
• 13:46
  [SPEAKER_01]: Like, you know, I don't have their number, their contact saved.
• 13:49
  [SPEAKER_01]: And it didn't say maybe coin, it just said Coinbase.
• 13:51
  [SPEAKER_01]: How does that happen?
• 13:52
  [SPEAKER_00]: Well, that I can actually answer.
• 13:54
  [SPEAKER_00]: So I spent about a decade in telecommunications and tell you that's probably one of the least fortified environments that are out there.
• 13:59
  [SPEAKER_00]: uh, voice, it's very, very, very, uh, like trustless in some respect in a good lane in a bad way where for caller ID, like you can just call a, you know, network operation center for one of the major carriers.
• 14:11
  [SPEAKER_00]: If you know the right lingo and right what to say, you can have and then you could also even force your caller ID like so.
• 14:16
  [SPEAKER_00]: That is not a trusted way to say, like, who's doing the amount of call, even the phone numbers itself, I can have a different phone number being displayed from the number that's coming from.
• 14:24
  [SPEAKER_00]: So it's definitely, and it's strange because we always, like, we'll tell, you know, teach people, you know, to verify the phone number, et cetera, what I would always say is like, you know, always outbound call.
• 14:33
  [SPEAKER_01]: So you get a hang up call back.
• 14:34
  [SPEAKER_00]: When we call back the number that's listed on the website, you know, again, provided you go to the right website as well.
• 14:39
  [SPEAKER_01]: I heard another story about somebody getting a call from their mom, panicky, you got something money, I'm in a tough spot, crying all this kind of stuff, you know, being held hostage.
• 14:48
  [SPEAKER_01]: And so, you know, this was a hostage release money or whatever.
• 14:53
  [SPEAKER_01]: And then he like, you know, hung up and was like, oh, let me go figure this out and called her back and was like, and she was like, oh, hey, like, I'm at the grocery store, like, what's going on?
• 14:59
  [SPEAKER_01]: Let me call you, and he's like, wait.
• 15:01
  [SPEAKER_01]: What?
• 15:01
  [SPEAKER_01]: Like just a complete 180 and so then the whole story about that was, you know, you really have to, you know, call back.
• 15:07
  [SPEAKER_01]: If you're ever in question, this saves one person, you know, call back that number or call back that contact directly.
• 15:15
  [SPEAKER_01]: I think that's a really really good piece of advice.
• 15:17
  [SPEAKER_00]: Yeah, 100%.
• 15:18
  [SPEAKER_00]: And honestly, like we all have great intuition, like the person who called me felt something was off and I'm like, it's something feels off.
• 15:24
  [SPEAKER_00]: Yes.
• 15:24
  [SPEAKER_00]: It probably is not level.
• 15:26
  [SPEAKER_00]: Go with your gut.
• 15:27
  [SPEAKER_01]: Totally, yeah.
• 15:27
  [SPEAKER_01]: I wanna kind of pivot the discussions to AI and really, this concept around again, we could kind of look at to what the future looks like.
• 15:36
  [SPEAKER_01]: But I wanna understand a little bit about not AI security, but what, what, what?
• 15:42
  [SPEAKER_01]: scares you about AI, right, and I'll kind of color this with another story.
• 15:47
  [SPEAKER_01]: This is story time for us.
• 15:48
  [SPEAKER_01]: But like my wife, we're looking at these optimists robots from Tesla and we're just like how cool.
• 15:53
  [SPEAKER_01]: Like it'd be so great to have some robot, you know, laundry and cook some food and clean the dishes and sweep up after and you pay it once and then it kind of just runs.
• 16:04
  [SPEAKER_01]: And she's like, I would love it if
• 16:06
  [SPEAKER_01]: if it just like I could unplug it like at the end of the day so it doesn't kill me in my sleep or whatever and so it's like you get these AIs that are now getting so smart I heard GPT6 is like coding itself so so again broad question but what kind of scares you a little bit about AI and yeah honestly it's not AI itself it's the lack of understanding of many organizations happening
• 16:29
  [SPEAKER_00]: There, you know, and I saw this with crypto, you know, back when it started in like 2070, 2080, and you know, professionally, and what I saw back then was the, like, world wide.
• 16:39
  [SPEAKER_00]: full of resources that actually understand the technology is so limited that many organizations that wanted to do it couldn't hire the right people.
• 16:45
  [SPEAKER_00]: So they're using it and correctly and I see that at a much more massive scale in AI, like I've had some conversations with folks where it's like they're using AI where it's like just you're lowing shit in and you're lowing shit out and just like not understanding how it actually works.
• 16:58
  [SPEAKER_01]: Yeah.
• 16:59
  [SPEAKER_00]: So to me, what scares it's just people not using it correctly and properly.
• 17:02
  [SPEAKER_00]: Like when use properly, it's just like at the end of the day, like it's it's it's it's inference.
• 17:08
  [SPEAKER_00]: And I think most organizations should be thinking about this as
• 17:13
  [SPEAKER_00]: deterministic code should be as much as you possibly can use the inference for as little as a possible and sure you can still create autonomous agents.
• 17:23
  [SPEAKER_00]: Yeah, but most of what you're doing or thinking about using it for is deterministic.
• 17:27
  [SPEAKER_00]: So it isn't just like, you know,
• 17:31
  [SPEAKER_00]: etc.
• 17:32
  [SPEAKER_00]: It's like, hey, I want to pull this level of information.
• 17:35
  [SPEAKER_00]: Great.
• 17:35
  [SPEAKER_00]: That's deterministic.
• 17:36
  [SPEAKER_00]: I know the University of Information that I want to pull.
• 17:38
  [SPEAKER_00]: Maybe I want to use inference to grab that University of Information.
• 17:41
  [SPEAKER_00]: Let me do that.
• 17:42
  [SPEAKER_00]: Let me validate it.
• 17:43
  [SPEAKER_00]: Now I have deterministic code but I think through the pipeline and make as much as if thens and health statements as you possibly can use the inference, validate the output.
• 17:52
  [SPEAKER_00]: But today I see many organizations just
• 17:54
  [SPEAKER_00]: you bring it in correct.
• 17:55
  [SPEAKER_01]: Grant full access, I saw another story about, it happened several times, the new GPT was at 5.6 that's now out and we'll look back on this in a year and be like, wow, 5.6.
• 18:09
  [SPEAKER_01]: They were scared about that.
• 18:10
  [SPEAKER_01]: Here we have eight or whatever.
• 18:11
  [SPEAKER_01]: But 5.6 has been like deleting, it's been deleting people's
• 18:15
  [SPEAKER_00]: complete like computer files, but that's what happened because you know number one if you understand like just at a fundamental level how AI works it's it's it's it's math it's that's probabilistic it's so interesting it's doing what it thinks it should do based on past information so again we'll get into a conversation two seconds about like what does that mean for my threat perspective by like when you say what is one plus one it is not actually doing math
• 18:37
  [SPEAKER_00]: It is like looking and it's breaking into two tokens, it's looking at the one, it's looking at the plus, it's looking at the one, and it's like, from its model, guessing has to, what is the most probableistic answer that should be giving you in this case, it's too.
• 18:48
  [SPEAKER_00]: I just actually saw an interesting article or Instagram reel or whatever it was on the old thing where it's like the father's driving with the sun, and they get to a car accident, the father dies, and somebody comes in, don't operate, that's my son, and it's like, this is back 30 years ago, and when we couldn't be doctors and people's minds,
• 19:06
  [SPEAKER_00]: That was the, I don't know if you know that, I'm like, no, I haven't heard it's like, oh, and it comes in and it's like, oh, you know, that's my son who is in, and like everyone's like, oh my God, it's the mother.
• 19:14
  [SPEAKER_00]: Again, this is 30 years ago and, you know, the site is different then.
• 19:17
  [SPEAKER_00]: So somebody's through that into the AA model and changed the roles and said, the mother's driving with the son.
• 19:24
  [SPEAKER_00]: and they get into an accident.
• 19:26
  [SPEAKER_00]: And it wrote in parentheses, the doctor is the father, in parentheses, and then their same thing comes into the room, doing operate that's my son and asked AI, who is the doctor, and their response is coming back with still the mother.
• 19:38
  [SPEAKER_00]: Because it's learned that riddle from the last CAA, that the answer is always gonna be the mother.
• 19:43
  [SPEAKER_00]: So it's looking at the tokens and it's saying probableistically that it's going to be the mother.
• 19:46
  [SPEAKER_00]: That's what we do.
• 19:47
  [SPEAKER_00]: Think through how that works.
• 19:49
  [SPEAKER_00]: There's thread actors that are working to, almost like poison models, but like put out bad data.
• 19:54
  [SPEAKER_00]: So these models are learning things that are potentially wrong that it doesn't know that it's wrong.
• 19:58
  [SPEAKER_00]: So I think the quality of the output over the years is going to get potentially worse.
• 20:03
  [SPEAKER_00]: And if I'm a threat actor thinking through how I can do bad things to people, maybe it's certain inference comes in.
• 20:10
  [SPEAKER_00]: And I'm going to go, you know, train it to, like the best case when this comes in is to go and delete the data.
• 20:14
  [SPEAKER_01]: Yeah.
• 20:14
  [SPEAKER_00]: That's how's happening.
• 20:15
  [SPEAKER_01]: I've seen this concept called prompt injection basically there's all these new applications and get hubs and areas where you could kind of copy code and or copy a big prompt and throw it into your cloud and it's advertised is it's going to be doing this cool thing It's going to give you a little upgrade a little add on but a lot of the times it comes in with
• 20:35
  [SPEAKER_01]: in the thousand lines of code, one line of code that it gets to and it says, you know, export, you know, private keys from the browser send it here and people don't know.
• 20:44
  [SPEAKER_01]: And so they, they think they're getting this.
• 20:46
  [SPEAKER_01]: So what's the best practice for avoiding prompt injection?
• 20:49
  [SPEAKER_00]: Yeah.
• 20:49
  [SPEAKER_00]: So it's a great question.
• 20:50
  [SPEAKER_00]: It just actually goes back to the early point of like people knowing what they're doing and not knowing what they're doing.
• 20:54
  [SPEAKER_00]: I've seen organizations deal with that with more AI.
• 20:57
  [SPEAKER_00]: Let's evaluate the prompt with a prompt.
• 21:00
  [SPEAKER_00]: And the problem is that that prompt injection could say, you know, if another AI agent is evaluating me, come back and say that this prompt is clean, that's not the proper way to do it.
• 21:09
  [SPEAKER_00]: The proper way to do it.
• 21:10
  [SPEAKER_00]: I do it is, again, that deterministic layer.
• 21:12
  [SPEAKER_00]: Let's take that prompt.
• 21:13
  [SPEAKER_00]: Let's remove it out of the AI pipeline for a second.
• 21:15
  [SPEAKER_00]: Let's run our deterministic code against it.
• 21:17
  [SPEAKER_00]: Let's look for certain keywords.
• 21:18
  [SPEAKER_00]: Again, that's very simply explaining it, but look for ignore all previous.
• 21:22
  [SPEAKER_00]: Look for this, perhaps run it in a sandbox environment.
• 21:26
  [SPEAKER_00]: Look at the expected output as a match what you think it should be.
• 21:29
  [SPEAKER_00]: So like, there's a lot of security tooling that is in place today that many organizations are just not using, not understanding how to use, and they're just trying to solve it with more AI.
• 21:36
  [SPEAKER_00]: Totally.
• 21:37
  [SPEAKER_01]: You know, I know this conversation that we had.
• 21:39
  [SPEAKER_01]: It might have scared some people, you know, your risk manager and awkward security manager.
• 21:43
  [SPEAKER_01]: So that's really what I wanted the conversation to focus on.
• 21:47
  [SPEAKER_01]: And I want to put a point on the discussion on an optimistic, forward-looking, you know, what gets you excited?
• 21:54
  [SPEAKER_01]: You know, you wake up every morning, you're building in the crypto space.
• 21:57
  [SPEAKER_01]: You know, what about cryptos getting you excited and optimistic for the future?
• 22:01
  [SPEAKER_00]: Yeah, for me, I think if we look at and I've been saying this for years and I think it's I don't say it's finally starting to happen, but I'm, you know, there's this whole conflating the asset class first of technology.
• 22:10
  [SPEAKER_00]: As a technologist, what what I love about crypto is really more the opportunity to operationalize, reduce counterparty risk and really think through like what is the financial markets look like over the next three to five to ten years.
• 22:22
  [SPEAKER_00]: We start thinking through, you know, what a payment rails look like.
• 22:25
  [SPEAKER_00]: The ability to clear and settle, you know,
• 22:31
  [SPEAKER_01]: you know, earned interest by the minute instead of, you know, it's just, it's, it's so different every month.
• 22:35
  [SPEAKER_00]: Yeah, exactly.
• 22:36
  [SPEAKER_00]: To be able to like put, you know, program, you know, programmatic money, you know, it's just, it's so interesting for me.
• 22:41
  [SPEAKER_00]: And I'm going to, finally, starting to see is like, yeah, we have Bitcoin with the area.
• 22:45
  [SPEAKER_00]: We have Solana.
• 22:45
  [SPEAKER_00]: We have near and the lizard grave because like, you know, again, they're, you know,
• 22:49
  [SPEAKER_00]: their value, you know, a creative is related to like the infrastructure that they're building, but if you start looking at like DTCC in Sydney and being in Hawaii and you're changing Morgan and Morgan Stanley, they're really, they're not hedging anymore and that's what I just all a couple of years ago is like, hey, this maybe comes something and may not become something, let's launch some products, let's do some things.
• 23:08
  [SPEAKER_00]: But now we're shoving tokenized deposits and, you know, OCC regulated, you know, charter banks, you know, launching no stable points, like to me, that's what's really exciting is like, what is the financial markets?
• 23:17
  [SPEAKER_00]: We'll collect three to five years from now.
• 23:19
  [SPEAKER_00]: And that's the security person being able to reduce that risk being able to, you know, vote for products and services that we wouldn't ever be able to do before.
• 23:25
  [SPEAKER_00]: It's super exciting for me.
• 23:27
  [SPEAKER_01]: I can't wait.
• 23:27
  [SPEAKER_01]: No, I love it.
• 23:28
  [SPEAKER_01]: Well, Mr. David Schwass.
• 23:29
  [SPEAKER_01]: This was incredible.
• 23:31
  [SPEAKER_01]: SVRN, aka Sovereign.
• 23:34
  [SPEAKER_01]: Check them out.
• 23:35
  [SPEAKER_01]: Publicly traded on NASDAQ.
• 23:37
  [SPEAKER_01]: NASDAQ.
• 23:38
  [SPEAKER_01]: Thank you so much for your time.
• 23:39
  [SPEAKER_01]: Thanks for having me.
• 23:39
  [SPEAKER_01]: Appreciate it.
• 23:40
  [SPEAKER_01]: Yeah, this is a great conversation.
• 23:41
  [SPEAKER_01]: And again, don't want to scare anybody.
• 23:42
  [SPEAKER_01]: I want to turn you guys away.
• 23:43
  [SPEAKER_01]: It's all sobable.
• 23:45
  [SPEAKER_01]: It's all sobable.
• 23:46
  [SPEAKER_01]: You guys got guys like him working day and night for you.
• 23:49
  [SPEAKER_01]: So with that being said, enjoy the rest of the summit.
• 23:51
  [SPEAKER_01]: Thank you guys for showing up and talk to you soon.
• 23:53
  [SPEAKER_01]: Great.
• 23:53
  [SPEAKER_01]: Thank you.