BTC Sessions - Every Way To Outsmart Hackers, Big Tech And The Government | Max Hillebrand & Ben Perrin

Episode Date: October 20, 2026

Mentor Sessions EP 105 | Max Hillebrand & Ben Perrin on GrapheneOS, White Noise, Local AI, KYC-Free Bitcoin and Privacy Guerrilla WarfareIf you click next, next, next on mainstream tech, your privacy is fucked. But Max Hillebrand (White Noise, Marmot protocol, author of The Praxeology of Privacy) and Ben Perrin (BTC Sessions, Sovereign Sessions) argue the tools to route around surveillance have never been better. With an old laptop, an AI agent, Nostr and Zapstore, you can now build and ship a freedom tech app without knowing how to code.From there, they walk through a practical privacy stack: Pixel phones running GrapheneOS (8, 9 or 10, not the 11), Linux laptops, password managers, paying privately with gift cards and prepaid cards, Wasabi Wallet and peer-to-peer Bitcoin, Zapstore, Tor VPN, Amber and White Noise for encrypted messaging, local AI and trusted execution environments, self-hosting on an old laptop, quantum risk to encryption, and why privacy matters for honest price discovery.Timestamps:0:00 Cold Open0:41 Privacy Guerrilla Warfare: Can We Route Around the Grid?2:37 Build an Anonymous App Without Coding6:19 Why Your Data Is So Valuable7:38 Google Maps and Your Location Data9:40 GrapheneOS, Organic Maps and Linux10:53 Is the Privacy UX Gap Closing?15:23 Moving the Cultural Needle on Privacy20:12 Starting a Private Device Setup24:46 OS-Level ID Verification25:41 Best Pixels for GrapheneOS: 8, 9, 10, Not the 1127:05 Linux Laptops and Operating Systems28:54 Face Scan vs PIN30:27 Passwords and Password Managers32:19 Paying Privately With Gift Cards and Prepaid Cards35:07 Spending Bitcoin Through Friends37:13 Wasabi Wallet and On-Chain Privacy38:21 Getting Bitcoin Without KYC41:38 Zapstore, Tor VPN, Amber and White Noise48:00 How the Marmot Protocol Works55:52 How Disappearing Messages Work57:57 Private AI and Running Local Models1:01:29 Talking to Your AI Agents Through White Noise1:07:37 Private Cloud AI With Maple and PPQ1:08:43 Trusted Execution Environments: Cypherpunk Magic1:14:35 Self-Host Your Data on an Old Laptop1:17:14 Is Quantum a Threat to Encryption and Bitcoin?1:25:09 The Economic Case for Privacy1:29:00 Ben's Blond Streak Disguise1:29:55 Where to Find Max, Ben and White NoiseTools mentioned: GrapheneOS, Organic Maps, Debian, Qubes OS, Pop!_OS, Omarchy, Framework, Apple Lockdown Mode, KeePass, Silent.Link, Bitrefill, Coincards, Garmin Pay, Wasabi Wallet, Lightning, Hodl Hodl, Bisq, RoboSats, Zapstore, Tor VPN, Obscura VPN, Amber, White Noise, Marmot protocol, MLS, Nostr, Nostr VPN, FIPS, Routstr, Cashu, Fedimint, Bionic, Maple, PPQ.aiMax Hillebrand (Nostr only): https://towardsliberty.comWhite Noise: https://whitenoise.chatSovereign Sessions (tutorials): https://youtube.com/@SovereignSessions⚡Previous Episode:Jim Rickards & Simon Dixon: https://youtu.be/djc-F6TPfos🔔 Subscribe for weekly Bitcoin Podcasts🐦 Follow on X: https://x.com/BTCSessions🐦 Follow on X: https://x.com/theBTCmentor⚡Casa MultiSig & Inheritance: https://casa.io/sessions10% Off First Year Promo Code SESSIONS⚡ Sponsored by Trezor - Get Your Safe 7 Today: https://affil.trezor.io/aff_c?offer_id=352&aff_id=1088⚡ POWERED by Abundant Mines: Fully managed Bitcoin mining. Learn more at https://qrco.de/bgYKPB⚡ Sponsored by BITCOIN WELL: Best Place to BUY & SELL BITCOINhttps://qrco.de/bfiDC6💡BOOK Private Sessions with Nathan, Ben and the BTC Mentor Team: Master self-custody, hardware, multisig, Lightning, privacy, and more. 👉 Visit btcmentor.io#BitcoinPrivacy #GrapheneOS #Nostr #MaxHillebrand #BenPerrin #WhiteNoise #WasabiWallet #LocalAI #SelfHosting #FreedomTech #Cypherpunk #Bitcoin #BTCSessions #Privacy #Zapstore

Sorry to break it to you, but your privacy is fucked. The lines are going to be blurred, and then the lines will be gone. Well, do you want private and secure, or do you want to be beholden to Google and Apple? What is it that they're collecting on people? What are they doing with it? How is it actually a value to them? It doesn't even have to mean that Google is necessarily malicious. It could just be that your Google account gets hacked.

You take a photo and it uploads the cloud. What if you could do it to your home server? Mostly we're going to want to know about AI. These frontier models can be censored. They can be directed. to give you certain types of answers. Passivity in the face of evil is not a good choice, similar to how Bitcoin helps you on the financial side.

All right, good morning, gentlemen, thank you so much for joining me. I'm very excited to have this conversation to sit down with you, too, because I always learn so much when I have you both in the room. Now, privacy threats are absolutely getting insane. We got flock cameras, AI sleuthing, KYC data leaks. It's just awful, but there's been this idea that's kind of been rolling around my head, and I kind of want to get your thoughts on it. And that is kind of this privacy guerrilla warfare.

So yes, the state surveillance tools and control grid are tightening around us, but our ability to build and route around them has never been so great. So you don't necessarily need an army of developers to find vulnerabilities or build escape hatches. So this game of cat and mouse might actually be on kind of even footing. So Max, I want to start with you. When it comes to defending ourselves against privacy violations, am I right about that or am I just kind of kidding myself? I think you're totally spot on. If someone is a user of modern day technology and you just click next, next. next next and you don't really care and you just use the mainstream stuff.

Then I'm sorry to break it to you, but your privacy is fucked. There is so many bad implementations out there that just take way too much data more than they actually need, in part because you're not the customer, you're the product, as the same goes. And your data is the thing that is being sold and harvested. And all those free applications out there that you can get on the app stores with thousands of downloads are probably not designed to prioritize. your security, privacy, and sovereignty especially.

So this is where most people will have a, like sadly a rude awakening, where that lack of privacy and security will come home to roost. And, you know, we see that with ever more increases in attacks and kidnappings, etc. But then on the other hand, and why I'm still so insanely bullish more now than ever, is that we have made it so easy to build anonymous technologies. and the actual privacy stack that is available, even though nobody knows about it, is incredible. Just to quickly illustrate the point, right?

So all you need is you get yourself an old laptop. You flash Debian or some secure operating system on it. You install Routster, which is a way where you can buy anonymous AI compute with eCash, Kashiu tokens, so fully private. And then you just connect your white noise application to it, So you can talk to your AI agent without needing a phone number or anything, without having to expose the laptop to the public internet at all. And you just build the application that you want.

You publish the code on MGIT, which is Git over Nostr. All you need to sign up is a key. And then you publish the app on ZAP store, which again goes out to all the users without you having to KYC or do anything. And you can publish release announcements on Noster. So you have all your marketing and advertisements done without any KYC without any sign up, only Bitcoin involved, and you can earn SATs for that app that you built.

And voila, you didn't even need to know how to code. This is really something that anyone with a little bit of motivation can figure out and do. So the amount of potential freedom tech developers has just skyrocketed. Because in the past, you needed to know coding and syntax and advanced logic to build useful applications for freedom. And, you know, the common excuse is, oh, I can't code so I can't contribute, which was always a lie, because you could at least do the marketing or onboarding or user review.

There's a thousand other tasks in freedom tech that need to be done. But now especially where even the developers no longer write the code, you really don't need to have that skill to be useful. And the fact that we can do that all anonymously now and anyone can do it is insanely bullish. the main task left is to tell people about the tech and help them understand and use it. I think so. Sorry, I was just going to say there when you say that you don't even need to know how to code anymore and the coders aren't even code. You know, my first foray into this is not long ago. You know, I've always tinkered with the toys.

And, you know, I was like the driving instructor. I didn't build the engine. I just showed people how to use the vehicle. And now I'm finding myself, you know, obviously in testing all these things and trying all these things, I obviously encounter bugs and I see things. And I didn't even really know before how to use GitHub properly and all that. And now I've got it kind of tied in where I'm like, I'll all be testing something or making a tutorial on something. And then I'll just, you know, to my agent, hey, can you drop a note on GitHub that there's this bug that I found?

And it'll just go do it for me. And it's all kind of linked together. And not only that, but if I'm doing a tutorial on something and I know it's supposed to work a certain way, I can just say, hey, just fix this for the tutorial. I know it'll come in the next release, but just fix it for me now so I can show people how it's supposed to work properly. Like it's crazy the amount of stuff that I'm capable of doing now that I couldn't do just a few months ago. It's wild. Yeah, totally. And sure, like the software engineers that have a lot of

experience and architecture skill and really understand how computers work, they will build even more amazing applications that you possibly could. But to get to that MVP stage, to have something that is useful, you know, at least for you and your friends, that sure would break underload with millions of users where bucks will get discovered really quick. But if it's just a small app, it's really totally fine and good enough. No, I completely agree. And I think it kind of understates just the importance or value of what's going on there. You think about how much value has accrued to basically information holding companies, right?

Like your Facebook, meta, Google, all that stuff. Their service is all information, coding, developing products of that nature. And it was kind of this pedestal. Like if you were a developer, a software engineer, you could sit on high and quite a lot for your services. is and that's become just completely ubiquitous. Everyone can now do it. So there's tons I want to pack. You mentioned a whole bunch of things. I want to get into the tools. But even before getting into the tools, I want to get back to what information is kind of being lost with people in their day-to-day use. Again, I think the hard part here is not even necessarily now using it or building

it. It's communicating to people like why this is actually important. Even just this morning, I saw there was a, an attack on, it said crypto. I don't know the detail specifically yet. There's an attack on a crypto holder in Toronto, Canada. It was seven people went after him for a wrench attack, three of which were Canadian Armed Services as well, too. This stuff is really important. But even on just the lower level, Max, you kicked off the conversation, talking about everything that you agreed to in terms of data that you're just handing over to these companies that they don't necessarily even need to have. What is it that they're collecting on people that they might not even be aware of? Where is the risk coming into it? And what are they doing with it? How is it actually a value

to them. One the main example is just Google Maps, which seems fine. They find really fast routes. They see all of the traffic, etc. But if you think about it, you're sending to this random large company the exact location where you are right now and the exact location where you're going to

and the exact route that you're taking. This is extremely sensitive information. And if someone who wants to hurt you has this information, their life just got 100 times easier because knowing where you are is the main, you know, difficulty in any attack, first identifying you and orienting yourself to the victim. That's the crucial first steps. And if we can cut that observation, then a lot of problems simply disappear. And, you know, I don't know, 15, 20 years ago, you kind of needed to have a big powerful server to do map routing

calculations. But nowadays, you can absolutely do that on your phone. It's actually, actually a better experience usually on the phone. You can just download the entire globe of map data and a couple of gigabytes. If you just want your country or city, it's megabytes, or as much as a picture. And you have highest quality local data on exactly what is in your neighborhood. And you can do the route calculation in seconds. It doesn't take much longer than Google Maps unless you're doing a very, very long trip. But that's just one example. And it doesn't even have to mean that Google is necessarily malicious. It could just be that your Google account gets hacked because most likely the password to your Google account is the name of your dog and

the birthday of your wife. So that's something that will be, that is or that has been cracked for decades. And you're, you're very exposed here. So make sure that these critical accounts, if you use them, are really locked down, secure passwords, randomly generated, well backed up, second factor authentication. And that that is already part of something of the basic security. Great. Ben, curious everything to add, yeah. Yeah, I mean, I've been, I've been messing around a bunch with graphene lately. And one of the ones, just on the topic of maps, organic maps, I was quite enjoying it. Like, it's just, I think it's interesting when you dive down the road of of alternative operating systems, things like that,

and start tinkering with these non-cucked apps, I will say. You know, at first it feels like you're being kind of limited. You know, you have this initial reaction. Oh, I'm not going to be able to do the things that I was able to do before. But it's actually, once you get over that hurdle, it's actually kind of freeing because you're realizing like, oh, I'm no longer beholden to, the people that can say no.

And it puts things in a different light, I think. Yeah, the graphene OS especially and Linux more generally, it's finally your computer again. You don't need to connect to some company to create an account to use your computer. It's just your machine and it does exactly what you wanted to do. Yeah, 100%. We wanted to bounce off that a little bit, actually get a little bit more because that's one at least it was kind of the case for the longest time,

But I'm wondering in your experience, because you've been testing a lot of these things and using a lot of these tools more regularly, if the user experience is finally catching up with what you'd say like the Norma Tech layer was. Because previously, it was always the trade up between privacy and convenience, right? If you're going to use more privacy-focused tools, computing apps, all that stuff, you're getting a worse user experience. There's some sort of trade-off along the way. But I'm even thinking now, too, to things like Adobe and Microsoft Office, right? that even that can be fully open sourced and copied really easily. So if the closed source system has developed a good experience, we can take that into the privacy and freedom tech and offer the same level experience.

So, Ben, first and foremost, what are you seeing out there right now? Yeah, so I think that gap is being bridged right now. I would say if just from the experience of teaching people for years and tinkering and trying all of the different UIs and UXs out there, all of that. There is or there was

a pretty large chasm between a normie friendly user experience and a secure or private user experience. And I think in the dawn

of AI, that is being bridged first and foremost by somebody being able to dive into a foreign experience, perhaps like Linux for the first time. And, you know, the user experience has gotten a lot better. But when you encounter those sometimes barriers that would make a person just throw their hands up and say, I don't know how to do this. Now you can literally just ask. And it'll just, oh, yeah, just this.

here's how you do it, exactly how you do it in the moment. And that gives somebody superpowers to be able to better understand their system or to be able to just better navigate it and get it to do what you want it to do. But furthermore, I think a lot of developers prior, they knew the nuts and bolts of what they want to do. And they were so heads down in the weeds of all of the intricacies that they were used to, oh, there's these menus and we'll open up the terminal and, oh, we'll do this. But now, as you said, you can inform yourself or have your agents informed by the tools that exist that have the

simplest and best user experiences and then put that on top of an incredibly secure or private underlying foundation. I think that's incredibly exciting because the lines are going to be blurred and then the lines will be gone and then it will just be, well, do you want private and secure or do you want to be beholden to Google and Apple? And, you know, there won't be really much of a tradeoff almost, I think, in the very near future. Yeah. And even more so that it, you won't just have a similar experience. I think you'll have a better experience. As long as the incentives align and there is enough people on the freedom tech building side that just obsess about the application and making the product as great as it can be.

You don't need that many obsessed people to build amazing products nowadays anymore. And the thing with these large corporations, you know, like Adobe, etc., they are so slow, they are so full of bureaucracy and have similar economic calculation problems as other socialist systems where you don't have individual ownership. that they simply lack the capacity to adopt quickly to user demands. And on the other hand, a small team of one, two, or three freedom tech enthusiasts that set out to build an amazing product, with that smaller scale comes much less communication overhead, much more ability to pivot and build the right things and throw away things that don't work anymore. And if you then channel that in a good direction where the outcome can actually be great,

you have a perfectly fine chance of building something very quickly that is much better than what these large, slow organizations can do. Yeah, there's no barrier to entry anymore. I do want to come to a lot of the tech and things that people should be trying to, trying testing with devices, with the money, of course, communication, with AI, with all that stuff. But even before that, Max, I do want to kind of touch on this idea, like, why is it, do you think that we're in such a place? What's it going to take to get people to value their privacy in a new way to be aware of these sort of things? How do we move the cultural needle maybe? Because what I'm thinking about is that I worry that on one side, you're right, we have freedom tech. It's developing at a pace and a quality we've never seen before, which is phenomenal.

And on the other side, I feel like the ecosystem is getting tighter and tighter and tighter. Where I imagine at some point in time, like with cloud computing, with basically server run, like outside server, external cloud AI, you combine that with like software as a service. I feel like a lot of normies are making their way to the point where basically they're not running, it's not stored on their machine. not running on their machine. They're communicating with AI in a different machine. And they're just almost like a voice interaction with a computer that they never actually own or control. Yeah, for one, it's going to be pain. That's where a lot of learning comes when you realize errors. And that makes you curious about other potential solutions. So curiosity is another key part. And then awareness. Do you actually know that there are alternatives? And so we shouldn't

really accelerate the pain, I think. The government is already doing a perfectly fine job. Doing a great job of doing that. Yeah. What we should focus on is the awareness and the availability of these different options. So simply build more amazing tools that satisfy all of these use cases that the people have and build them in a privacy preserving, freedom preserving environment. That's why Noster is so exciting because everyone is building freedom tech applications in an afternoon now. And it's a platter of. of innovation there. So that's that's one aspect. And then the awareness is is also insanely important. We need to have good propaganda that spreads the availability and knowledge of these tools and how to

use them. I mean, that's why BTC session is not just successful, but insanely important, because it's one of those foundational pillars to really help people understand that these tools are available, and here exactly is how to use them. And so that has helped hundreds of thousands of people to understand and value this tech. And, you know, a lot of a lot of, a lot of it is then word to mouth and that's I guess the shout out to the audience of you have to be active in this fight. A passivity in the face of evil is not a good choice. So really do something about the things that you know to be false and fix them. And again, you don't need to write the code. You don't need to die on the front lines, but you probably really should tell your friends and

family about the available options and how to use them. You know, Ben can make as many cool videos as he wants, but a real proper sit down in an evening over dinner where you help friends to install these types of applications and explain them in meat space one-on-one is going to be just much more thorough and deep in the understanding that will be reached. It doesn't scale. That's why Ben can't do it, but that's why we need the rest of the audience to actually step up. Because once you came to understand this insanely valuable knowledge, I think it's a moral

obligation to pass it on to others. I really like that. It's, I think it speaks to the fact that every individual can have, I think they underestimate the impact of individuals everywhere, just focusing on their inner circle, right? And what that does, because there's a, there's a six degrees of Kevin Bacon that happens there, right? You know, you, you onboard some of your friends to things that are. are going to improve their privacy and, you know, help them be more self-sovereign and give them

sovereign money and all of these great things. And, you know, they get excited about it. They start playing and they'll be telling others about it as well. And there's there's something to that virality of a tight-knit connection of like-minded individuals. And, you know, we've witnessed it here in Calgary with the sat market and being able to kind of create a local Bitcoin circular economy. And I think we want to lean into more of more of that, more of the freedom tech angle at those events. But, you know, your local community is not to be ignored. And if we can get more foot soldiers out there doing the good work, the world will be a much better place. No, I completely agree. Like, we've all got a back chat, right? And I had so many things

start up in my back chat, that's a cool app. That's a cool new development. It's a new piece of software. You can always, at least, at the very least, you can share it with the friends you have those secret conversations with, and I know you have those secret conversations with. So if we want to take a look at the actual practical, if you're a say here for a second, and then I'll start with you. I want to actually kind of run through, make this really helpful for people. If we want to focus on our privacy and our security, let's give them things that they can actually build into their full setup. So even just starting on the device level, Ben, I'll start with you. On the device level, when we're thinking about privacy

considerations, security considerations. What are you looking at? What have you played with? What questions do maybe you even have for Macs? What's a blind spot? Yeah. I mean, so one of the shifts that I've been gradually making is from Android to Graphene and from Mac to Linux. Obviously, one of the biggest hurdles for me has been.

in terms of content creation and, you know, being able to create videos and all that, my whole setup here, you know, I'm on a Mac for the computer for the video creation part. The graphene shift has been easier than the Linux shift for me in and around that, in and around creating media. I don't always feel like that will be true in the future. And Max, I think something you said earlier speaks to that, and that's in and around pain may be necessary. And I see these ID verification on an OS level things coming. And I think that's one that I'm going to have to grapple with sooner rather than later. But in terms of things that I think people should maybe start looking at is if you want to make the leap to a graphene phone, it's really easy to get a cheap pixel, just, you know, get it off eBay or Amazon or whatever and then just flash graphene on it and test it out.

Just to kind of see how it functions, how to customize it yourself, take a look at some of the alternative apps. that you can use instead of some of the Google Play ones and just start there. And then maybe just say, okay, I'm going to use this for a week. Just see how it goes. And maybe even get like a, get an e-sim. I did a video on Silent Link where you can get your own e-sim and pay in Bitcoin and, you know, use all that from there and start tinkering with more private chat apps. I'm sure we're going to talk about one specifically momentary.

but I think that's probably the lowest barrier to entry in a migration to a more private operating system that I've experienced so far. So I'll see that there first. And maybe I'll let Max tag in there if you have thoughts. And Max, just to add there too, Ben mentioned the ID on the OS level. For anyone who's not familiar, you could expand upon that and your thoughts on private devices. Bitcoin well. You know them.

you love them, long-time supporter of the channel, and one of the easiest places to buy Bitcoin directly to your wallet in the U.S. and Canada, but that's not all they do. So for anyone looking to make a big purchase, there is Bitcoin Well Infinite. Because the hard part is in the buy, it's making sure you don't leave a giant mess for your family. Taxes, estate planning, even mining and lending. Bitcoin Well Infinite pairs you with your own dedicated advisor to help you every step of the way. And for the Americans, they're launching their own Bitcoin IRA and the waitlist is open. Verifiable and on-chain. So sign up today, visit Bitcoinwell.com slash BTCSessions, our code on the screen. One company I like pointing people to when they ask about Bitcoin mining

is abundant mines. They were founded by Bo and Christine Turner after losing over half a million dollars to broken promises in the mining industry, and they built their hosting model to remove the usual headaches. With abundant mines, you own your machines and keep 100% of the Bitcoin you mine. There's no revenue share, no hidden skims. Pricing is simple. One flat monthly fee covers power, parts, labor, and repairs. They also guarantee uptime. The machine goes down, their hash rate redirect system routes hash power from their fleet, so earnings don't just stop, and every machine is insured at full replacement value. Everything is hosted in the U.S., powered by hydro, and mining equipment may qualify for 100% Year 1 bonus depreciation.

Learn more at Abundantmines.com slash sessions. ID on the OS level, for anyone who's not familiar, you could expand upon that and your thoughts on private devices. Yeah, there's this ongoing effort for decades now to surveil the internet and to know exactly who is talking to whom and what they're saying and where they are. And that becomes much easier if the computer requires the user to scan a ID and do a full KYC process in order to actually use the computer. A very great point of surveillance and control and censorship, of course. Anyhow, this has been happening for a long time, and the free software community is very strongly working on simply ignoring that. So Graphene OS will never require your face scan. A Debian will most likely not.

And even if it does, there's 100 other Linux flavors that you could use. So the solution to that is the free market and getting out of these silos. So for hardware, as Ben said, any Google pixel, I would go with either the 8, 9 or 10. Those are the best in terms of security, not the 11, by the way. And any of them, if you want just a cheap one, get the pixel. I'm going to stop there for just a quick second. Why not the 11? Because Google is stupid and they wanted to cut some costs.

And so they removed, they downgraded the chip. And that made memory tagging security protections almost impossible. if graphene figured it out by now. But so some of the core security of Graphene OS is not available on the 11th generation pixel. They might have finished some work on the phone. Basically, yeah, yeah, shrink inflation in it. But the good thing is the old phones are still available, you know, like the 9, the 10, these are great. They also made some privacy or security jump from the 7th to the 8th generation.

That's why 8, 9, 10 is a sweet spot. And yeah, you can get a used pixel 8A for, I don't know. 100 to 100 bucks something like this that'll be fine you know um and the pro ones are are good if you want fancy cameras and stuff uh and then obviously the operating system here is grafino s don't use the stock google like it's so funny the mainstream market always thinks that the google pixels are so needed because they have the google ux you know this amazing operating system that is so AI integrated and whatnot but like probably the vast majority of people who are buying google pixels are instantly throwing away that

that part and installing the secure GraphinoS on it. So in anyhow, for laptops, I mean, honestly, any Linux runs on almost any hardware, not really on the new MacBooks, which is a shame. That would be cool because they are quite fancy hardware. But there are also then hardware providers that really optimize for freedoms. So the framework computer, for example, comes in like Purism, System 76, Taxido, there are tourists, there's a couple open source. enthusiasts that are also providing the hardware.

They're usually not as great as Apple devices on the hardware because Apple are just aliens with their hardware tech. But the new framework 13 Pro or something like this actually looks quite slick. So seemingly they're making good strides on improving the build quality. And then in terms of operating systems there, my personal choice is Cubes OS, but that's a very paranoid operating system where every application runs in its own

virtual machine and it's a bit clunky to use. So I wouldn't really recommend that. Pop OS is a good way of starting. I've heard good things about Omarchi as well. I've never really used it. But especially with the AI integration, it might be really easy for people to just talk to the AI and it will set up the machine in the exactly right way.

So yeah, those are some good options. If you do need to stay on Apple, then definitely turn on lockdown mode on all of your devices. just one setting, it's super simple. Most of the things will just keep working. Occasionally something might break, but most likely you won't even notice, but the security gets massively improved.

And of course, make sure that your Apple password is secure. I love it. I actually just want to quickly double-tap on something as well. I think, I can't remember if it was Ben or UMax that mentioned it. Should people be using the face scan in biometric security locks on their devices? I assume that information is being encrypted

and stored on the device, but is there actually concern about using your face scan to unlock or your fingerprint to unlock? Is there any way that the manufacturers, the operating system can be recording or keeping that data? Yeah, I'd say no solutions only trade-offs. The upside of a pin or password is that you have it in your head. And so you need to actively speak it out loud before it becomes known by someone else. The downside is you have to type it in. And so if someone is looking across your shoulder as you need to unlock your friend,

phone, they will see the pin and password. And so that is a problem that biometrics fixes because it doesn't directly reveal the password while using it, because I mean, technically you reveal it all the time, but with the type of sensors, it's hard to fake that. So ultimately, I think it's a good tradeoff. One cool option that graphene provides is the fingerprint plus pin combination. So you do need both factors to log in, which is cool. and then you can have a really strong password

that actually encrypts the disk. So every time you boot the phone, you would need to type in a long passphrase, you know, your six, seven, eight words. And then for everyday usage, you tap the thumb and type your four-digit pin. That is a really cool setup that gives you the best of both worlds.

I love it. Quickly one more, because you actually made me think of it as well too. Good everyday hygiene and practices. For someone making a new password max, which at the minimum threshold be, right? Is my four-password Lego going to be able to secure me or no? For a character, sorry.

If you made your own password, probably no. Humans are really, really bad at entropy, and we just shouldn't do it, I think. We should use tools to improve our entropy and hopefully tools that work, right, and do it proper. But ultimately, use a password manager. KeyPass is a good option. It's fully local and offline. and you generate a passphrase. And by the way, with a larger dictionary,

you can have six, seven words being a secure enough password. So you don't need even the 12 words that Bitcoin uses. And then you can memorize those. And you could cycle through the random number or random password generator until you have one that you can build a nice story to remember. But really, you can remember five words, seven words. That's doable. And so that should be the password to your password.

password manager. And then the other passwords you shouldn't even see or know about, in my opinion. Maybe occasionally you have to type them in on the second machine, and that's where passphrases, again, are useful. They're much easier to type than these long cryptic, multi-symbol passwords. So I'm a big fan of passwords in general. But their password manager really is the way to go. And then, of course, use the second factor authentication. And you get extra benefits if you have your password manager in one application and the second factor in another application, maybe even on another phone, and you don't put those two secrets together. Because then even if your password manager gets compromised, they still don't get access to your account. I still don't have the

2FA. Ben, is there anything you want to add there? And on top of that, you know, if we're looking at getting new phone, we're looking at getting a new computer, I'm probably going to need to pay for it. How can I maybe be a little bit more private with my finances? Yeah. So, I mean, In terms of the password stuff, I think Max pretty much covered it there. It's, it's, you know, you, you're going to need the manager to manage all of the additional passphrases. I think the, the 2FA is always a good idea. And just ensuring that, you know, for your master pass phrase, that, that one, you can

remember it. And two, maybe you've, you've written it and stored it securely somewhere. for safekeeping just in case something should happen to you. The other part of this would be in terms of you mentioned, how can I pay for something securely and privately and get devices, stuff like that. Obviously, we're all Bitcoiners here and that's helpful. You want to be able to use more private money when you, when you can and avoid credit cards.

So I've kind of done a few different things. Obviously, if you can pay for something directly in Bitcoin, that's fantastic. But I'd also say that you can look at doing things like getting gift cards with Bitcoin, you know, bit refill coin cards, all places like that. So you go get your Best Buy cards and then you go into the store and you pick up your device and you're all happy and good to go. The other thing that I've been playing around with is the free. Pridomiya card, which has been pretty slick.

Hopefully it sticks around for a good, good period of time. But you can create a reloadable visa card that actually doesn't even need your name or ID or anything. And reloadable is huge. And you can create as many cards as you want and fund them with Bitcoin up to $5,000 U.S. dollars a month, I believe. So for online purchases, that's great. If you are using, and this is where it gets a little fuzzy, but if you are using Tap to pay on an Android phone, it'll work.

But of course, then that gets tied in with the whole Google ecosystem. So you've got to navigate that as best you can. But yeah, I would say, pay directly in Bitcoin, use gift cards. Fordomea card is a great option. You can get prepaid single use visa cards. cards and master cards and stuff like that as well. So those are some of the ways that I've been looking at lately. Max,

if I want a little more privacy with Bitcoin. On the card side, it's a good option. And by the way, the Garmin watch, you know, these smart watches, you can get them and flash the pay to tap card onto the watch itself. And then I, you know, you can have a just little coin, remove the wristbands, even put it in the pocket. And you have this magic coin that spits out fiat money. That's one useful hack because GraphinoS and tap to pay doesn't really work well together.

There's some options with curve, but it's tricky and I don't have a bank account, so I don't know how to use that. But also I still wanted to mention one more cool way of buying stuff with Bitcoin is just find friends who want to stack sats and who have dirty fiat and then use them as a proxy merchant where they get the sats and they order whatever you want online and deliver it to their house. next time they see you, they bring it to you. That's my favorite approach because it keeps the Bitcoin in the local economy. My sands only go to my good friends. And then it also helps others to get KYC free Bitcoin. Because sure, you couldn't get the KYC free off ramp with one of these prepaid card providers or gift cards and so on.

And that's good. But they are most likely KYC businesses and will have to put those Bitcoin on the book somewhere. If both sides of the trade are peers, then it's just a cool boom to the benefit. And you know, once you have Bitcoin, I think you're on the easy side of the trade. It's way harder to find someone who's willing to sell you Bitcoin than to be able to buy it. Sorry, then to be able to sell it. So it's just much easier for you to sell the Bitcoin that you have and just find some friends who want to stack Sands that goes back to actually you should be the one orange peeling your friends so that you can offload your sets to them and they can get you

all the fiat stuff and they have a dollar cost average for every monthly you know electricity bill payment or whatever that has to be made. I love it. Before I come, I want to jump into that actually a little bit more because that question comes up a lot when I'm talking to people. But just quickly, Max, from like perhaps an on chain perspective or actually doing the Bitcoin transactions in different ways, which ways, how can we add privacy to our Bitcoin transactions? Of course, they are pseudonymous, not anonymous. Yeah, the easy answer to that is Wasabi wallet. It still works great.

It's the most private way of using the Bitcoin blockchain at the moment, huge volumes. And that's just an set it and forget it solution. It comes with Tor, anonymous blockchain synchronization and, of course, coin join. So for a real privacy experience, Wasabi is still the best. There's a lot of cool new research happening on what we can do with. shielded and zero knowledge pools. Multiple people are working on these second layer bridges. They will come sooner or later, so the privacy of Bitcoin continues to be improved.

And of course, lightning is another good option that works even for larger amounts. But, yeah, ultimately, Wasabi is the quick solution. And then hopefully in a couple of years, we have even better stuff. Ben, was there anything that we missed there? And then if I wanted to get my hands on some Bitcoin, we talk about peer-to-peer direct, Is there any other way, Ben, that I might be able to get Bitcoin without handing over my blood type and my full, like, you know, banking history and everything else? Yeah, I mean, so we, to Maxis point, we use wasabi wallet all the time just at, you know, the BTC sessions as a company. Like when we invoice people, it auto, it goes into a wasabi, it auto coin joins and then goes to cold storage.

for myself when I'm spending naturally everything on chain will have already been coin joined but then I'll usually bump it into some type of a spending wallet which typically has some additional privacy benefits like using lightning so you're kind of hitting it twice there as it goes out so that's always great peer to peer is fantastic and and yeah in terms of you said in in terms of using Bitcoin and spending it? In terms of if I needed, I didn't have a friend who could sell me Bitcoin and I didn't want to necessarily hand over all my personal information to get some, would that be possible? Oh yeah, yeah.

Yeah. So, I mean, obviously there's, the best bet is peer to peer. So, you know, if you can use cash and you have a friend or you know somebody who has Bitcoin, that's a great option. If you can sell your goods or services for Bitcoin, that's even better. Now you've got a continued source of new sats. That's amazing. You could feasibly be, you know, if you've got access to cheap power,

you could be getting your non-KYC sats that way by doing a little bit of mining. Of course, you've got to do the calculations on that yourself. But the other thing that I would say would be some of these peer-to-peer online non-KYC market So, you know, you've got hoddle, hoddle, you've got BISC, you've got Robosats, you've got a whole bunch of different places that you can go and basically matches you up with another individual who either wants to buy or sell Bitcoin. And in a lot of these instances, there may be a traditional fiat payment, but the differentiator here is that the person receiving the payment, the fiat payment would see the sender. But there's no like database keeping that information with the the, the, um, locale where you set up the trade. So like hoddle, hoddle or Bisk or Robosats.

It's not like they're logging the Fiat payments and linking them to Bitcoin transactions. Those things are kind of separated out and it affords you much more privacy than going to a full KYC exchange where not only they take all of your information, but also log it and link it to Bitcoin payments and all of that stuff. Yeah. And if you do need a centralized exchange for liquidity reasons, because it's hard to buy large amounts of Bitcoin, especially peer-to-peer.

You know, use one that's not run by idiots. Apple Bitcoin being a good example. Nope, 100%. So, Max, all right, I've got my device. I've got my phone. I've got my laptop and I've got some spending money as well too. But how can I possibly talk to Ben without Apple seeing everything that I'm sending him? Yeah, that's a good question.

First of all, you need to be able to install new application. And that's SAP Store, right? So that's the decentralized app store that runs over Noster. As a developer, it's the only app store that works. Every other app store rapes you whenever you want to ship an update to your users. With SAPStore, it just works because the only thing you need to publish is to sign a little text message that says that the new release is available. And that's it.

So fantastic to create application. And that's why it's also fantastic to discover applications. So you will find only free and open source software there. And it just works well. They're also, by the way, working on some amazing privacy upgrades. It will be by far the most anonymous app store where nobody knows which apps you have installed. That's one of the common downsides with the other app stores. It's that your phone always sends a list of all the applications that you have installed to a central server, to Google and Apple.

And be like, hey, Google, what's new? Do I get any updates? And now, even if you use something like Aurora, where you can get the anonymous profile, they still see that this random dude with these 132 applications has requested updates again, and that's a very, very identifying target. So the cool idea with ZabStore is just we download all of the metadata, all of the releases that ever happened, and then we just check locally which of these are actually good. It's the Bitcoin full-node version, where you download all the transactions and verify locally,

perfectly privately. Same idea with the upcoming Zabstore release, so I'm very bullish on that. But after you've then installed ZabStore, you can start getting apps. And first, you need to protect your IP address. So the second app that you should be downloading is the Tor VPN. It's a new modern implementation of Tor and provides a VPN service. You don't need to pay anything. It's a little bit slow, but it's pretty private and decentralized.

So that's the quickest way to simply protect your IP address without any further fuss. And then you could look into other VPN providers. You know, there's many. Mulvat is a good option, Obscura, IVPN. There's probably the three I would look at closer. And then you have your IP protected, and now we can start messaging. So for that, I would download white noise. So that is the decentralized chat app over Noster.

But if we want to actually stay in the, you know, hardcore description of all the steps, I would go one step back because first you need a Noster key. So for this, we'll install Amber. That's your hardware wallet for Noster. It's the one application that has your private keys, your NSEC, and that will then help other applications to log in. So first you install Amber, you create a new key, you make a backup on steel in your password manager, whatever.

And then you open White Noise again and you will tell the sign in with Amber. This way the White Noise application will never get access to your private keys. One really cool thing that you can do on Android that you can't really do on iOS, is to really make sure that your key is in only one application and that's always offline and fully locked down. And other applications just request signatures from it rather than seeing the actual private key. But then once you have white noise installed,

we will sign a couple packages or key packages, kind of events for you in the background, which will now create a new set of encryption keys. So all the messages in white noise are encrypted, but they're not encrypted to your private key. They're encrypted to new keys that we generate all the time for each message, basically. And that has the cool benefit that even if your Noster private key leaks, none of your messages are revealed to anyone. And the attacker would not even know in which groups you were or which people you were talking to.

They simply know nothing. And that was the big thing that we wanted to fix about Noster direct messaging, because all the previous Nostradirect messaging standards had that problem that if your NSEC ever, leaks that all of your chat messages are out in the open. And that's just scary. You know, because- The number of people that I talk to that haven't taken Bitcoin off the exchange is honestly quite frightening. And those that do, a lot of them by one device, get it set up and never look at it again. Their security ends up becoming a snapshot of whatever the hell they knew that day. Bitcoin is not a set-it-it-and-forgeted asset. Hoddling is an active process.

I've helped a lot of people build their way to multi-vender multi-six setups. And almost every time Trezer was one of those devices. Intuitive, secure, Bitcoin-only-form available in open source. And that last one is really important. They've always been open source since the very beginning, since 2014 when they built the very first hardware wallet. And those recovery words that you got stamped into metal, that standard was co-authored by Treasor's founders. This is a company that the industry has literally been building on for over a decade. But there's one thing that nobody could open up, the secure element, the place where you actually store your keys. The Treasor Safe 7 has two of them, and Tropic O1 is the first open source secure

element that security researchers can actually audit. So if you're taking self-custy for the first time or you're building something a little bit more robust, level up, get a Treasor Safe 7 today. Use promo code BTC sessions 10 for 10% off any model. Scan the QR code on the screen or click the link in the description down below. Unless for some reason you think they're about to stop printing and stop borrowing, you know exactly where Bitcoin is going. And whether your stack is already at the size where you know you should do something about it or it's headed there, it's time your security caught up. That's why you need CASA premium. Your Bitcoin secured across five keys, three on hardware from different vendors, one on your phone and one held by CASA. Use any three to sign, which means

if you lose one key, you don't lose your stack. It also means that CASA can't move it without you. The kit, devices and everything goes with it, ships right to your door and their advisory team walks you through the full setup. And for those of you who care about privacy as much as I do, there's no KYC on the vault. Use any email you like, use any address you like. No one has to know your personal details. I know what you're thinking, what if something happens to CASA? What about my family? Well, Sovere and recover means that you can always rebuild using open source tools like Sparrow. And as for your family, CASA inheritance means you're not leaving them a locked box with no key. You invite them with an email and their key lies dormant while you're

still alive and should that day ever come, you don't have to worry about them having to figure it out when you're not around to ask. You've already taken care of it. So head to cossa.io slash sessions promo code sessions to receive 10% off your first year. That's cossa.io slash sessions code sessions. Click the link in the description down below or scan the QR code on the screen. Max, can you back up? Because I want to make sure that I follow that correctly. So we have, I want to make sure that I understand what's going on here, maybe a little bit more in the background. So, because you're right, because the problem with Noster is that it's permanent on a whole bunch of servers. And so that information gets out, well, I'm kind of screwed at that point.

And so we're taking, we have our one kind of login key, but then we're generating additional, we're generating new keys for encrypting every other message that goes out. How is it even keeping track of these keys to then read the messages on the app that I'm using? I'm getting a little lost here in the conversion. Yeah, and you're lost in one of the most hardest problems that I've ever encountered. Like that exactly, how the hell do we keep track on which keys to decrypt the next message to it is exactly the core problem that we've been trying to fix for the last two and a half years.

And we just recently found out how to do that reliably and that scale because it's really insanely hard. So there are two solutions to this. The first solution is what's called the messaging layer security protocol. That's named alongside the transport layer security. security protocol, which encrypts your HTTPS traffic. Every time you visit a website, that is the encryption scheme used to protect that one connection between client and server.

And we wanted to have a similar standard, but for encrypted messaging, for groups, not just for two people, but for hundreds or millions of people, potentially. And so a bunch of smart brains worked for, no, like eight years or something, I think, since 2017, so 10 years by now, on coming up with this very complicated standard on how do we exactly define who is in a group and how do we add someone to the group, how do we remove someone from the group, and how do we rotate our key for every message such that only the group members know how to decrypt the next message. It's really complicated. I don't even fully get it, to be honest. It's like 170 pages specification. It's kind of like Bitcoin you never really

truly get it. Yeah. So it's it's it's it's really a big brain stuff and we didn't come up with that. That's from the IETF, the internet engineering task force. Basically a group of cryptographers and scientists that have standardized the internet for the last I don't know 30 years or something. So pretty reputable tons of money went into it. Tons of companies are building on it. Lots of academic peer review at some security proofs that it actually works. So I have rather high confidence in the spec. But there were two things that the specification did not define clearly.

It was kind of left up to the implementers or application developers. The first is the so-called authentication service. So that's exactly the problem of how do we say that this key belongs to Alice and this other key belongs to Bob? How do we do that? Their original idea was, that's just Google. that's a centralized server. He has Alice's username

and he just tells everyone, yeah, this is Alice's Pub key. And we trust the server for that. You know, that's how the internet works right now. We trust the servers for a whole bunch of stuff. It's not really the things that I'm interested in. So thankfully, Noster solved this problem beautifully. Simply everyone is the authentication service.

You can create your Noster private key. And that's the authority that then gives you to sign a key package, this subkey even with a different encryption standard, different elliptic curve, et cetera, but you can bless your subkey simply by signing it with your Noster key, regular Noster event, super boring, tiny text file,

and that's your key package. And now anyone can see that this Noster public key has claimed this MLS encryption key as his. And by itself, that's not really that interesting, but once we adjust it to the rest of the Noster Web of Trust, all of a sudden becomes very interesting. Because now I can verify the BTC session, exactly that key, who has been posting the videos for the last couple years, who is followed by all of these people that I know and that I've met in person and where I could actually check that this is their actual public key, all of the likes and so on, all of this web of trust of all the information that Ben did under his key is the same key that is now saying that this Marmit key package or MLS key package is what Ben is using to encrypt messages to. So a decentralized authentication service, basically.

That's the first step that we did. That was the easy part. That was the easy part. Okay. The other part we thought was going to be easy, but turned out to be way, way, way harder than we ever expected. And that is the delivery service. The second service that MLS just assumes,

well, Google does it. We have a central server. and if you want to send a message, you're encrypted, and you upload the encrypted message to the server. And the server will basically do double spending protection. You will do the time ordering of which message came in first and then give that to every client. It'd be like, this is the order in which you should process all of these messages.

And if we have this strong ordering guarantee that the server actually enforces the exact time record of all of these messages, then it's easy to stay in consensus about what is the next key that we use. Because the problem that you quickly run into in a decentralized world here is that we don't really have one server who knows, who has the capability of knowing which message came first. It's a decentralized network and just out of latency and other stuff. Some messages will be received later than others, similar to how Bitcoin does this. And now we need a way to still get a,

a common understanding of the group of what is the actual order of the messages. It's a little bit like a blockchain where a block is a commit, basically where you change something about the group, you add a member to the group, you remove him from the group, you change it to disappearing messages or change the group title. All of these actions are commit messages in the jargon. And we need to order these commit messages in order. And the most recent of these commits is where we base our actual process. private key on for the next message.

So in order to know what's the next key, I need to know what is the blockchain of all of those group changes in the past. And the really tricky part was, and probably don't need to go into too much details, that we need to have a way to still reach consensus among the group that this is the exact order of the blocks, even if the messages arrive out of order. And yeah, that was hard, but I think we managed it with basically a lot of brute force compute and just a very well-defined state machine that everyone has to run. And that is the Marmot Protocol, the core part of it.

We call it the Convergence Engine, which is this protocol, this strategy on how to exactly process these messages that are coming in that are encrypted and how to run through them to make sure that you will always find the decryption key to the right messages and decrypt them in order and then still remain in consensus with everyone else on. what the next key for this group is. Man, it's just unbelievable. It's funny when you lift up the hood. Because what we're doing is we're sending Ben attacks

being like, yo, did you see the stupid person did the stupid thing? But then what's actually the engineering and everything that had to go in for me be able to do that and not worry about the Canadian government cracking down on me is just ridiculous. I bet I have questions for you,

but one thing I just want to quickly tap on because when you went through it, Max, there, I realize that I have no idea how this is actually working in the background and you might not know the answer. And it could just be like a Fugazi where it just like it looks like it's doing what I want to. Disappearing messages. How is that actually enforced? How is disappearing

messages working? Because it'd be easy enough for the app just not to show me it on screen, but the message still exists. So what's happening there? Yeah, so disappearing messages in most modern chat clients basically mean that first an app connects to the server, gets all of the messages, and starts decrypting them out of the transport layer, so to say. And then you actually see the message and you see who it's from. And then this message you store in a local database. And so that you can open the app when you're offline and you still see all of your historic messages. Because the decrypted messages are not stored on the server. They're actually stored on your phone. Now, most or the good applications at least encrypt this database as well

so that other applications cannot just read the messages, but they're encrypted with the private key in the white noise application itself. And that's what we do. disappearing messages basically means that you're asking the other members of the group that when the certain timer hits like one month, where a message becomes one month old, deleted from your local database. So the private keys that were used to decrypt the message as it was coming in, you're actually supposed to delete them as soon as you're finished decrypting the message, basically. That's the idea of key rotation is we literally delete private keys and we never show them to the user and there is no 12 word recovery word.

We want these to be fully random keys that are not deterministic and once we're done with decryption we toss them away. But of course we want to keep the decrypted message around but still you might not want to keep that around so the disappearing message timer

is basically just asking the other person in the chat to delete that from their phone as well. Interesting. So we're throwing away the key for that message. That's why we can't recover it again. It's basically lost to the ether at that point in time. Well, Ben, I'm not sure if you have anything you want to add on the messages there.

Maybe you could talk about if there's a way that we could possibly communicate if the internet went down. That might be another good thing to kind of have on hand. But additionally, Ben, what I wanted to start the next thing that mostly we're going to want to know about is AI. Is there any way that we talked about how powerful these tools are, how we can basically build privacy apps. we can become basically small. Our own dev team can just be us talking to a coding agent. But how could I possibly do that without throwing all of my information and chat logs over to Anthropic or Open AI? Yeah.

I mean, this is becoming the norm. Like everybody's de facto Google is now anthropic or Open AI. And not just that, but every little query, everything is all linked together. All of it is just, it's, it's. scary because people when you have the ability to ask deeper, more intricate questions, I think people use this for a lot more than just what restaurants are near me. And they start, some people have very personal private conversations and drive into things that are, they don't want shared with others ever.

And yeah, so this is becoming a bit of a problem. Not only that, but these frontier models can be censored from even answering you at all. Or it's very, very feasible that they can be directed to give you certain types of answers. As we've seen out of things like Google in the past, you search a certain thing. And the government rubber stamp of approval is on your search results. So how do you get around that? Well, local AI is a thing that people can do. Now, there are hardware limitations to that.

It depends what you're trying to do. And those limitations are, are seem to be dropping quite a bit for, you know, especially if you're using this as a glorified Google, those limitations are dropping quite bit. You can run local models on pretty modest mid-range hardware at this point. But there are instances where you probably want a bit of a heavier lift, in which case you can use cloud AI in a more private way. I'll get into that in a sec. I've been messing around with local AI a little bit recently. And just in a very basic way, like I'm, I'm probably using it in the most kind of normie friendly way that you can. I downloaded bionic, uh, which has some agentic capabilities.

You can, you know, you can manipulate. You can give it like a folder and, and have it create and look at and manipulate files and stuff like that. But you can download local models and you can just run it on your own machine. So I've got a Mac sitting in front of me. It's running Bionic. And I can access that not just on this machine, but I can access it remotely from any computer in my home on my local network or I can use something like yes, tail scale, but better option might be something like NosterVPN. And so then you can have access to your local models from anywhere on the planet, which is pretty cool. Can you talk to him with white noise? That's a good question, Max.

Can I? Yes, you can. So there's basically, if you want to talk to a computer that is running on some regular Wi-Fi at home, you usually need to have another server that's in the middle that helps you make that connection. And that can be a VPN. And that could be a Tor relays. You can use Tor to connect to your home machines. That could be something like Phipps, the new decentralized mesh network, which is really, really cool.

But it could also just be regular Noster relays. And so if you use White Noise to talk to your agents, you just use a regular Noster relay to be that message passing server in the middle that helps you to get in. But yeah, you can absolutely do that. You don't need to open a port or anything. because technically no server on the outside is ever trying to contact, make the first contact to your local machine. Your local machine always makes the first contact out to the server and then keeps the connection open to get all the messages delivered super fast. I've been using White Noise for over a month at this point, long before the release, to talk to my agents exclusively. And it's been really, really fun because for one, it's one, it's one.

it's one user interface for all of your agents. You can run Codex, Hermes, OpenClaude, Pi, all of the other cool harnesses. You can very easily hook them up to the Marmot protocol, which is the chat messaging protocol that White Noise is built on, because the agents don't need a phone number, they don't need an email address, they don't need to have a Google account or whatnot.

They just need to throw a coin and get a key. and they have all the power to create a marmot identity and send you messages to white noise. So that aspect of it, just one interface for all of your agents is super convenient. And then specifically for me, it was just fun because I talked to my agents to build white noise inside white noise.

So you're building the app inside the app. And the workflow that we have now is I still cannot cope with it. Like, you know, I open white noise. I see some bug. You know, all this button should be further. down the screen or whatever, then I make a transcription, we have an integrated dictation in white noise. So if you install the offline speech to text application, get it on Zab Store, that provides

you kind of an offline engine for transcription. So you don't need to send your voice to open AI, et cetera, to talk to your agent. You can do that all locally, I had a local AI model to transcribe your voice. And that's nicely integrated in the UI of white noise. So I just hit the microphone button and start talking about what's the bug. I hit the send button. It transcribes and automatically sends it, even if I'm in the background. And the clanker starts the clankering and finds the bug and works on it and keeps working on it

until all the continuous integration tests are passing and so on. And then he builds the application. And inside the white noise chat, he just sends me the APK file and says, hey, the new build is ready. Here's what I've changed. I click that file, it updates a second application of white noise that I have installed, which is like the testing version of it. And now I have those tests deployed, those changes, and I see, okay, bug was fixed, cool. I tell him, yeah, this was fine or no, something else is missing.

And then, you know, it goes into the next rounds of review and eventually it gets merged and eventually it gets released and then everyone has it. But so just this thing of there's one app, I talk to this one app, and it keeps sending me new apps that I can use and test. And that's just been a wild fun of building Android apps that only I use that probably no one else cares about, but that are really fun for me and really useful for me. So that mode of just having one common interface

to talk to your agents, and it's being designed in a way that it's just optimized for messaging. It works nice, even if you're offline, it sends the messages as soon as you come back online. you get nice notifications, you can customize the notification sounds. And we build in little cool features like if you have a long message from your agent that comes in,

you just take two fingers and swipe down on top of the message bubble and it starts reading it to you with the offline Graphene OS text to speech engine that comes installed on graphines. Little things like that that make it super fun for me, we've just added it all to white noise. And it's the best agent interface I've had in a while. I love it, Ben.

Sorry, we got a little sidetrack there. Everyone wanted to check on that one. And I also want to throw in while you pick back up with starting with just even the local AI sort of framework. Are you having fun doing it? Because I feel like sometimes it's hard to even illustrate. Like, I keep telling people to start trying these things. And I don't think they quite get it.

Yeah. I mean, all of this stuff is mind bending once you get into it. And I'm saying this as a non-developer myself. Like I'm just thrust into this. I remember over the past year talking with, you know, some of my favorite anon people in the Bitcoin space like Gigi and Calais and a number of other developers. And they're all talking like as vibe coding first became a thing. And they're like, oh, yeah, you just go and you do it. And you just tell it to figure it out, bro.

And it just kind of happens. And so diving into getting to use the tools and seeing what you can be capable of, even just locally is it's just really neat when things start to just work and work outside of the typical framework that your average person would, would dive into. And just to kind of go further down the thread, we were talked about running. local AI on a local machine. But you can also, if you need a little bit more firepower, there are some interesting things in the world of AI where you can get access to some of the other open models that are out there. And you can pay with Bitcoin. So one thing that I've been playing around with is Maple. Maple is pretty cool. I've got app on the phone. You can use a web interface.

you can download a desktop app, which I've got early access to the agentic stuff that they've built in, which is pretty cool. And then outside of that, you've got stuff like PPQ, where, again, you can not only, again, privately use some of these open models, but they've specifically labeled models that are either uncensored or private. So they work in a, it's called a TEE. I can't read the max. Trusted execution environment.

There we go. There you go. Yeah, exactly. So the provider doesn't even know if I'm, am I correct in this? Max, the provider doesn't even know your query and what's being spit out towards you. Yeah. These trusted execution environments are cypherpunk magic. It's, it's unbelievable.

Because, you know, for all of the existence of computers, if you had to run computation someone else's computer, someone else's servers, you fully had to trust them. You have no idea what exact program they are running. And you can't really prevent them from looking at the program and the data that you're trying to compute. So that was just a paradigm since forever. And that's why self-hosting in the past was so important because if you don't self-host, someone else sees everything, every file, every like banking statement, every all the details. every picture are clearly visible to whoever runs the server, especially if he has physical access to the machine.

And so for the last 15 years, maybe, especially in the last five years, there has been an enormous progress for creating these hardware computers, like physical chips, that have encryption and advanced cryptography baked into the actual silicon. So at the time where Nvidia is producing these GPUs or also CPUs, they can put a private key into a special secure enclave on the chip, a little bit similar to what we're doing in hardware wallets. They all have these secure elements. So that even if you have physical access to the device,

you still cannot break in. And now if you want to use something like Maple, what actually happens is that on your phone, you have your chat query and you encrypt it through the private key. that's inside the silicon of the chip. And then that gets sent through the internet, nobody can read it, to the data center provider who cannot read it, to the person who holds the hardware in his hands.

And even he cannot read it because the decryption key is in that secure enclave. And then it gets decrypted inside the GPU, and we run it over all this matrix multiplication. That is large language models, after all. And then we get a result, whatever answer to your, chat message and that again gets encrypted in the GPU and leaves a ciphertext to the rest of the operating system to then be delivered to your phone and your phone is the only one that has the decryption key, which by the way lives also in a secure element. Your phone has a secure element

too. These are slightly different. You need much more powerful secure elements for these server site applications. But the fact that that's not possible not only in CPU but also in GPU with almost no speed difference is insane. It changes so much. Like if we would have had this technology 30 years ago, Bitcoin wouldn't have had a chance because we wouldn't need Bitcoin. We could have a Chaumian e-cash style mint, like Kashiu like Feddy Mint now, and the mint could prove to you that it has the exact amount of Bitcoin in underlying assets and that it hasn't inflated the amount of tokens on top and that it is not censoring or actively logging IP. These trust assumptions that were the bane of old centralized systems in the past have now been

removed because the server can prove to the client the exact piece of software that is running. And so, you know, if you have, I don't know, an Electrum server. The problem with Electrum servers was always that they have all of your addresses. They know exactly how much money you have and where you get it and where you spend it. But if you connect to an Electrum server in a trusted execution environment, that proves to you that he's not logging IP addresses or Bitcoin addresses, then, you know, that's good enough. So a lot of the cool applications that a powerful server in the cloud is very useful

now have become secure and private. And not just in a niche market, but at massive scale. Like the entire Apple cloud infrastructure is run on these trusted execution environments, for example. So really a massive unlock for cypherpunk tech. And we can use this for a whole bunch of stuff. Like anonymous AI inference is just one of the many use cases. And we will start seeing these developed. But yeah, we already see cash humans running in these, for example.

I don't have much to add there, man. I'm just, I'm diving in and enjoying the hell out of all of this. It's been it's been a whirlwind. It feels like the early days of Bitcoin for me where I had, no idea what the hell I was doing, but it was a lot of fun anyways. That's where I'm at right now. Yeah. But that's why I also love that you guys are doing the sovereign sessions, because

it's very important to talk about more than just Bitcoin, because Bitcoin alone cannot protect you. You need to have a full stack, a full kit of tools that you can apply for all the different use cases. And really bringing that sovereign technology into your life in all those places is going to lead to massive benefits similar to how Bitcoin helps you on the thing. financial side. Exactly.

Exactly. Not completely great. It's funny, the way that you were just describing that last part, the, the, um, the trusted enclave, um, I almost feel like there's no excuse not to have privacy built into modern day apps and computers moving forward. Like there's no reason that it shouldn't be just kind of standardized across the board. And hopefully that pulls us into the right direction. The other thing I did want to touch on, but first and foremost, gentlemen, was there any,

so we got our devices, we've got communication. We've got actually spending with Bitcoin. And now we've got AI side as well. Is there anything else that I would have missed in terms of the, of the someone who wants that privacy focus stack. Is there anything that we haven't covered along the way that's worth a mention? I would just kind of extend it a little bit. To a degree we've talked about self-hosting in regards to AI.

But I mean, self-hosting your data in general is a net positive. So, you know, your typical iPhone or Android, you take a photo and it uploads the cloud. You know, what if you could do it to your home server? So I think home server with your own data is great with your own media even. Even insofar as just not wanting to pay for 17,000 subscriptions, you know, that's that's one angle. But the other angle is, yeah, like you own your photos, your videos, whatever you may have, whatever files and important documents, it's instead of being on your Google Drive or ICloud, it's. on your own server. Yeah, exactly.

And if someone says server, don't think of these huge computers that are the size of cars or whatever. The server is just a computer that can be online all the time and responds to requests. It's basically what a server is. And honestly, the best server for self-hosting stuff

is an old laptop. Really, get an old, used laptop that still has a decent battery. Even the screen can be broken. You don't care. and plug it in, turn it so that you can close the lid without it turning off, and voila, you have a server with lots of storage with plenty enough compute power. Most servers don't need massive compute power, especially if you're just storing pictures and stuff.

So laptops are a fantastic solution. They come with integrated power backup. If you ever have a power outage, a laptop has a battery, you don't even notice. And as soon as power is back online, it starts charging, et cetera. The laptops are really cool servers. And the other surprising thing is just Graphene OS. A regular Android phone does for a fantastic server. Like Amber is a great example.

Like Amber is the only app that has a private key to my Noster accounts. And that Amber phone can just be plugged in to power and connected to Wi-Fi. And it will serve any signature request or decorption request that comes in from any of my other devices. So you can host stuff like Nostorelays, Blossom servers, et cetera, just on a regular phone and same benefit as the laptop. So you really don't need to get these huge server rags and extra power supplies, etc. For most things that you will want to do, a regular old laptop from five, ten years ago will do the job just fine.

I love it. A couple more things that I absolutely want to hit on here. And I'll start with you, Max. I'm curious, again, you're deep in the weeds here. And I see this come up all the time in terms of fears and concerns. And I have my opinions, but I'll hold them back for now. Do you have any concerns about encryption being compromised as a result of quantum or AI? Is the math solid?

Or is this something that we have to be actively working towards changing, enhancing, being ready for? Yeah, I think we Bitcoiners have experienced quite drastically that this stuff is hard. Cryptography is really hard. mathematical assumptions are really hard. Implementing those correctly and efficiently at scale is really, really hard. So a lot of the old software that we have written is most likely going to be insecure. So I worry a lot about old applications, especially in C or C plus, which Bitcoin is written in. That's an insanely dangerous language for humans to write in, not recommended.

So that is a serious problem. and a lot of implementations of cryptography will be compromised. Now, thankfully, with these new AI tools, we will also get better at writing secure cryptography code. And I do believe that the universe smiles on encryption and that the underlying assumptions of cryptography can hold. Now, the specifics of those assumptions might not. Like the elliptic curve cryptography is something that a quantum computer in theory can break.

We've seen a lot of advancements in the quantum realm in the last couple months and years. And with the latest trajectory of how AI is accelerating everything, I'm pretty sure that there is some cutting edge both attacks against cryptography as well as advancements in the quantum computing underlying. So I wouldn't be surprised, to be honest. I have no idea about timing. These things are terribly hard to predict. And I'm not enough of a physicist or I'm not a physicist at all. Enough of a physicist. Just got my master's, yeah.

No, it's, it's, it's, it's really hard to say. But ultimately, I do believe that we will have secure encryption and signature algorithms in the long run. I, I would be sad if we don't. Let's put it like that. So I'll just think that I'm enough of a physicist to understand that we will. But yeah, it might might be hard. might require a lot of upgrades. It's definitely a good idea to build your protocols and applications in a way that you can

upgrade this stuff. Bitcoin upgraded its signature algorithm from ECDSA to Schnorr. We did it. We can do it again. Bitcoin will be a whole pain in the ass to upgrade if a quantum computer ever comes out or for whatever reason the cryptography is broken. That's a huge mess. But other shitcoins have done that too.

In the last couple months, Zcash, et cetera, also changed their cryptography system substantially because of a bug that was probably found by AI. And same with the Marmot protocol or white noise and the messaging layer security protocol that's underneath it. Both of these are designed to be able to upgrade the cipher suite to a new post-quantum system. We can do that for Noster. There's already early proof of concepts for that.

We can do that for NLS. We can roll that out in white noise. Well, not anytime soon because it's hard to implement, but if emergencies would come, then we could do something about it. The scary thing here is the harvest now decrypt later attack, but to some extent, thanks Satoshi, because your message to your mom is compared to the hundreds of thousands of Bitcoin that are on unsecure keys, the priority of which key do I try to brute force? the key that leads to thousands of Bitcoin or your good morning message to your mother.

So I think regular people will be protected by Satoshi's shield for quite a long time before we actually have to worry about it. Because if I understand that correctly, quantum computing is not like the cold card entropy bug. With the entropy bug, you just had a random chance of being hit every second. And maybe you did get hit, maybe not. And the longer you wait, the higher the likelihood that eventually you will get hit. And, you know, that can be really short or can be a bit longer if you have pass raises, multisix and so on.

But with this post-quantum cryptography attack, I believe that the attacker needs to choose a public key that he wants to attack and get the private key out of. And so it's not really a blanket surveillance attack. it's more of a targeted sniper shot. And we will hear a lot about, you know, Bitcoin being stolen before someone will even attempt to decrypt your private keys for messaging. 100%. Ben, anything you want to add there? I mean, I'm even less of a physicist, so I may not have a ton of.

Might have to ask Jocamo or someone. Yeah, yeah. Yeah, I mean, I think. If the day comes when a quantum computer can threaten Bitcoin, it's not that Bitcoin can change and adapt. It's just that you don't want to be tossing around changes that aren't entirely necessary. You know, Bitcoin by design is very difficult to change. And everybody around it is very conservative around the changes that are implaception. implemented rightfully so. And so the other thing is the there are proposed solutions around

quantum resistance and all this kind of stuff. So, you know, as if that time comes and, you know, it won't be like one day of yesterday, everything was fine and today it's everything's irreparably broken. Even if it was, okay, you, you, you, you, you, You figure out the next steps, you make the fixes and you move forward. Would Bitcoin's price take a tumble? Would everybody be a little worse for where? Sure. Would it kill it?

No. Still be around. And you know all the other financial institutions have the exact same problems. And they're even harder to upgrade. Like the software that runs banks is ancient and the developers who speak the programming language are no longer alive. You know, they're getting paid outrageous. just salaries just to come out of retirement

to fix the bug in the code that only they understand. So yeah, Bitcoin is hard to change but the Fiat system is also insanely obsolete and we will have a brunt force attack against a lot of institutions, a lot

of systems, a lot of companies, states, bureaucracies. The attack will be scary and I'm not downplaying it, but Bitcoin has a much higher chance of getting out of this without substantial damage compared to other institutions. Completely agree.

I'm very optimistic. I don't think it's going to happen, but we'll see. I've just, I've colored me just like, no, I've just, I don't, I've heard these things for too long.

I'm not all that worried about it. I think we'll have enough runway and we can get in front of it. And to your point, it's software. We can upgrade and make changes as need be. And I think if there was like a risk to that sort of level, we could actually get consensus on something across the board.

So very optimistic about it moving into the future. The other thing that I did want to make sure you touched on today, I think it's important to at least leave people with or have as a bit of a reminder as well. Is Max, I want to ask you if there are any economic consequences to violations of privacy. We talked about from the security perspective, we talked about it kind of from like almost like a very defensive position. But is there a positive value add to privacy that maybe most people don't even think about or consider or hidden cost to not having privacy to flip it the other way? Yeah. Ultimately, if you don't have privacy, then you cannot make the choice on what to say to whom. and with whom to talk to and with whom to trade ultimately.

Trade requires privacy in order to function, just as any other action does. So ultimately, if privacy is violated, then people don't buy the things that they actually want because they're scared of the repercussions. You know, if you buy a Quran or a Bible in the wrong part of the world and people find out about it, you can be at serious trouble. if then on the other hand also that you do buy the things that you only buy in order to make the surveillance apparatus happy and that might include paying some fines or just other things that you know that if you don't do them you will be looked down upon by society because they will find out that you did not make your purchases exactly so if we would have a private money and a private way of transacting and the private way of communicating that then we would see much honest, much more honest and real price discovery on the market. And prices are insanely valuable.

And Ludwig van Mises was so fantastic in pointing out that socialism cannot work because there are no prices, which means that we cannot allocate our resources efficiently, which means that we're wasteful, and there are no prices because there is no exchange, and there is no exchange because there is no private property. And as you see, the word private is in the word private property. Because you can only express privacy in your property, right? You own your body. And so you have the right to use it as you see fit and to speak a word or to not speak it.

So without privacy, you cannot really act. You cannot really trade. Not in a purely theoretical level. And then also on a more practical level, you simply will not do the actions that you otherwise would. And so that's a market intervention the same way that the taxes or regulation or licensing or money printing is. And that's what is causing the boom and bust cycle of the economy where, you know, we have these periods in the economy where everything is like on a rocket ship and any investors is making money and we all think that we're so rich. That's only happening because merchants and entrepreneurs and customers are tricked into buying things that they don't really need. and spending money that they don't really have,

and not just money, but resources as well. And so in the boom period, we have this massive reallocation of capital away from those projects, which we would actually have to focus on towards those projects that are subsidized, where the surveillance apparatus approves, etc.

And so those industries gain a massive boom while your regular everyday mom and pop shop who does not have those benefits of surveillance that can have these massive databases on analyzing customers and finding exactly how to discount prices or increase them, etc. All of this extra power that they have because of these surveillance apparatus is not available to smaller entrepreneurs and merchants. And therefore, it's yet another way that they are stricken down by the system and made not

successful. So ultimately, with a more private world, we would have the goods and services that we would actually want at a much more reasonable price and with a much more, frugal and efficient allocation of the few resources that we have available. I love it. And then, of course, the most importantly, last question, Ben, I just want to make sure that I understand correctly. Where does the blonde streak fit into my privacy and security model?

Well, the thing is, when people recognize you as a single hair streak, when this disappears, I am a ghost. So I put on a hat and posted a photo and my own mother didn't recognize me. she thought somebody bought my hat. So it's very effective. It's all misdirection. Nobody even knows what my face looks like. And on the other hand, if Nathan ever gets the streak as well,

he will just be BTC sessions. Nobody will know the difference. You could come to conferences. Funny story, Max. We were at a conference. And if I put on a hat, I disappear. If Nathan takes off his hat, he disappears. So all we need to do is quick swap.

And we're good. us have gone. Exactly. We can just walk around and nobody can see us. I love it. All right, gentlemen, this has been absolutely fantastic, hugely informative. Max, I know you've got the book out. Where can people go to find you, your work, all that fun stuff? Yeah, I've exited all of the Fiat social media as well as all the other Fiat stuff. By the way, it's a good life hack. Just get rid of all the Fiat things. You'll probably feel better after.

Fiat food, Fiat social media, yeah. Exactly. If you had money especially. And so you can find me on Noster only. And my personal Noster client that has all of my Noster stuff is Towards Liberty.com. I've actually been working a bit on this recently. So it's pretty cool. It not only has all of my regular tweets and posts that I've made, but also a whole bunch of articles that I wrote. All the three versions of my book, the Paxiology of Privacy, are published there as well because those were just Noster posts as well.

I have the audiobook for Towards Liberty is up there as well as some translations. and the audiobook that I did for a lodging of Wayfaring Men, fantastic cypherpunk fiction book, by the way, you guys must read it. And Crypto Economics by Eric Bosco, the best book on Bitcoin by far. So I've narrated those audiobooks. And recently, finally, I've got back to this, a previous version of the website years ago,

had this, but a library of hundreds of books that I've come to appreciate a lot with nice summaries and a good search index. So you will find a whole bunch of books that I keep recommending. will probably be listed there. I'm still filling that out. But yeah, that's basically where you can find me, just towardsliberty.com.

And then for White Noise, it's whitenoise.com. That's the name of the application. You will find it on Zab Store. That's the best way. For Apple right now, it's still on test flight only because the Apple gods have denied us publication on the main app store

for about over a month. I cannot tell you how much we need something like Zab Store as well for iOS. it's incredible, like such a shit show. But anyway, you can get the apps on whitenoise.chat and install them, try them out. Send me your pub key and I'll add you to the White Noise community group. We're at like 160 members in that group now. So pretty surprised that it didn't break yet.

We didn't plan for such a scale yet, but it's working. And then if you're a developer of stuff and you actually want to integrate your secure messaging into your existing application or into a new application, like you don't like the color scheme of white noise. You can simply fork it and change it. But the cool thing is that we've made it insanely easy for developers to build a application that will be interoperable with white noise. And that's my biggest learning after Wasabi is it has to be a protocol first, then a bunch of different libraries, and only then the third priority is the actual user interface app that users end up seeing. So right now we have one protocol, that's the Marmit protocol. We have five implementations

in independent languages in both Rust, TypeScript, C-sharp, Kotlin, and Odin. And what's funny is that for each of these applications, we not only built the whole Marmot State Machine, but also the entire NLS logic and code is also implemented natively here. So a huge diversity of the library infrastructure. And then we have, I know, 10 plus different clients that by now speak the Marmot Protocol and are all in sync with each other. So go to the awesome marmot GitHub page, probably find it somewhere.

And there's a list of all the different marmot applications and exactly how to connect your agents to it and so on. Beautiful. And Ben, if I needed to find a tutorial on some of these things, where might I go look? I mean, I think here, but more specifically over we did create a second channel sovereign sessions and all of the tutorial stuff is all happening there now. So it's a skip hopping to jump away. If you found this episode with Max and Penna Value, please do hit that like button and check out the previous episode

with Jim Rickards and Simon Dixon.