Privacy, Veilid, And You

Privacy, Veilid, And You

Speakers: Christien 'DilDog' Rioux (Member, Cult Of The Dead Cow)

Conference: Security Fest

YouTube: https://www.youtube.com/watch?v=Znl7TBFAz9E

Overview

In this compelling talk at Security Fest, Christien 'DilDog' Rioux, a legendary figure in the hacking community and a prominent member of the Cult Of The Dead Cow (CDC), unveiled Veilid – an ambitious open-source peer-to-peer (P2P) app development framework. Veilid represents a significant departure from the centralized internet model, offering developers a robust toolkit to build privacy-preserving, mobile-first applications that operate without reliance on traditional cloud infrastructure or intermediaries. The project aims to democratize online communication and data sharing, empowering users with genuine control over their digital interactions and challenging the prevailing "internet data capitalism."

Rioux articulates Veilid not merely as an application or platform, but as a fundamental shift in how applications are conceived and deployed. It's a response to the pervasive surveillance, data collection, and single points of failure inherent in today's centralized digital ecosystems. By leveraging advanced cryptographic techniques, a unique distributed hash table (DHT) design, and a novel onion routing mechanism, Veilid seeks to provide a resilient, high-performance, and genuinely private foundation for the next generation of online services. The project's ethos, deeply rooted in the CDC's long history of hacktivism, emphasizes accessibility, ensuring that advanced privacy protections are not confined to technical experts but are seamlessly integrated into everyday user experiences.

The significance of Veilid lies in its potential to fundamentally alter the economic and architectural landscape of app development. By eliminating the necessity of cloud hosting, it frees developers from the "cloud bill," thereby removing perverse incentives that often lead to data monetization through advertising or selling user information. This framework fosters a "right to be forgotten" philosophy, where data not actively cared for by the network gracefully disappears, contrasting sharply with the immutable, permanent ledgers often associated with Web 3.0. For defenders, Veilid offers a blueprint for applications that are inherently more resistant to large-scale data breaches, censorship, and surveillance, shifting the security perimeter from centralized servers to the individual user's device.

Background

▶ Watch: Speaker introduction and early hacking career highlights (0:00)

Christien 'DilDog' Rioux's journey to Veilid is deeply intertwined with the history of offensive security and the pursuit of digital freedom. His early career saw him pioneering Windows exploitation in the mid-1990s, a then-uncharted territory compared to the more established Unix hacking scene. His participation in Defcon 4 (circa 1996) led to his integration into the Cult Of The Dead Cow (CDC) and The L0pht, where he became instrumental in releasing iconic tools like L0phtCrack 2.5 and the infamous Back Orifice 2000. These releases, particularly Back Orifice 2000, served as a stark "wakeup call" for Microsoft and the broader industry, demonstrating the critical need for robust security in widely adopted software. This period solidified Rioux's reputation for using impactful disclosures to drive security improvements, famously describing his brief stint at Microsoft as an opportunity to understand the internal effect of "pulling their pants down on stage at Defcon."

Following this, Rioux co-founded Atstake, one of the earliest pure-play security services providers that openly hired hackers – a controversial stance at the time. His later work involved developing advanced vulnerability research tools, culminating in Veracode (2006), one of the first retargetable decompilation systems for arbitrary binaries. After a period at Apple and the release of the Stunt Banana VIP spoofer, Rioux identified a critical gap in existing peer-to-peer (P2P) and onion routing technologies. While projects like IPFS and Tor offered decentralization and anonymity, they were largely not designed for the dynamic, "high-churn" environments of modern mobile networks, which frequently switch between cellular and Wi-Fi, experience connectivity drops, and involve devices that are not always online.

The genesis of Veilid in 2020 was a direct response to this challenge and a broader philosophical concern: the increasing centralization of the internet. Rioux and his collaborators observed how online communication had evolved from direct interaction to a model where "Apple, a cloud, some servers, social media overlords, or even the government" act as intermediaries, storing, reading, and potentially selling user data. This centralization creates irresistible targets for hackers and enables widespread surveillance. Veilid was conceptualized as "Web 1.5," a deliberate counterpoint to some of the perceived pitfalls of "Web 3.0" and blockchain technologies, particularly the idea of a permanent, distributed ledger of all transactions. Instead, Veilid prioritizes a right to be forgotten, where data not actively maintained or requested by users eventually fades from the network, offering a more nuanced approach to privacy than immutable records.

The project builds on the CDC's four-decade legacy of hacktivism and tools for digital freedom, aiming to marry the principles of onion routing and strong cryptography with a developer-friendly toolkit. The core problem Veilid addresses is making truly private, secure, and decentralized applications not just possible, but accessible and performant for the everyday user, particularly within the constraints and opportunities of modern mobile hardware.

Key Findings

▶ Watch: Veilid: A P2P app development framework (5:00)

Veilid emerges as a foundational shift in distributed application development, characterized by several key findings and design philosophies:

1. Framework, Not Platform or App: The most crucial distinction is that Veilid is explicitly an open-source peer-to-peer app development framework, not a hosted service or a single application. This means it provides the underlying tools and algorithms for developers to build their own decentralized applications, rather than offering a ready-made platform that could itself become a point of centralization. The project is licensed under the Mozilla Public License 2.0, one of the more permissive open-source licenses, encouraging both open-source and commercial development.

1. Mobile-First, High-Churn Resilience: Veilid's architecture is specifically engineered for mobile-first network applications operating in high-churn environments. This addresses the inherent instability of mobile connectivity, such as frequent IP address changes (cellular to Wi-Fi), network drops, and devices going offline. Unlike many traditional P2P networks that assume stable, always-on nodes, Veilid is built to gracefully handle transient connections and dynamic network topologies.

1. Privacy by Design with "Right to Be Forgotten": A core tenet is the elimination of central intermediaries (servers, cloud providers, social media overlords) to ensure privacy for all. This "no middleman" approach means data flows directly or through encrypted, untraceable routes between users. Crucially, Veilid incorporates a right to be forgotten principle: data that is no longer actively used or requested by the network will eventually disappear, contrasting with the permanent ledgers often found in blockchain-based systems. This philosophy underpins its approach to data storage and network relevance.

1. Rust-Native with Broad Language Bindings: The entire framework is written in Rust, a language known for its performance, memory safety, and concurrency. It provides first-class bindings for popular development environments, including Flutter/Dart, Python, and browser JavaScript (compiling to WebAssembly). This broad compatibility allows Veilid applications to run seamlessly across a wide array of platforms: Windows, macOS, Linux desktops, iOS, Android, and even directly within web browsers.

1. Cost Model Transformation: By enabling true peer-to-peer operation, Veilid effectively removes the need for centralized cloud hosting, eliminating the "cloud bill" for developers. This is a profound shift that can dismantle the "perverse incentive" model where developers must monetize user data through advertising or sales to cover infrastructure costs. Veilid aims to foster a new ecosystem where app development can be driven by user value rather than financial necessity tied to data exploitation.

1. Robust, Evolvable Cryptography: Veilid is designed with security in mind from the ground up, featuring strong, end-to-end encryption for all communications and at-rest encryption for all locally stored data. It employs hardware-assisted storage and device keychains on mobile, ensuring that even if a device is compromised or its backups (e.g., iCloud) are accessed, the application data remains encrypted because device-specific keys are never included in backups. The framework supports simultaneous cryptosystems (e.g., current ED25519-based VLD0 and future MLAM-based VLD1 for post-quantum security), allowing cryptographic primitives to evolve without requiring app developers to rewrite their code.

1. Community-First, Unique Vulnerability Response: Veilid is driven by a community-first approach, supported by the non-profit Veil Foundation. It features a highly unusual and transparent vulnerability response platform that actively encourages ethical hacking. Discovered exploits are not just credited but are enshrined forever in an exploits folder within the project's repository, alongside the code, to incentivize developers to upgrade and maintain network security.

Technical Deep Dive

▶ Watch: Veilid mascot Ell explains project's purpose (7:00)

Veilid's technical architecture is a sophisticated blend of established P2P concepts and novel innovations, all meticulously crafted in Rust for performance and safety. At its core, it provides a peer-to-peer app development framework that abstracts away the complexities of decentralized networking, allowing developers to focus on application logic.

The framework offers several key subsystems:

• Direct Node Communication: Facilitates secure, encrypted communication channels directly between individual Veilid nodes.
• Store-and-Forward Mechanisms: Enables data to be temporarily stored and forwarded across the network, crucial for high-churn mobile environments where direct connections may not always be instantaneous.
• Distributed Hash Table (DHT): A cornerstone of Veilid's data management, designed to be more advanced than typical key-value DHTs.

Veilid's design for high-churn networks is a distinguishing feature. It recognizes that mobile devices constantly change network states (e.g., switching from cellular to Wi-Fi, entering tunnels, going offline), leading to frequent node disconnections and reconnections. The framework is built to be resilient against this volatility, ensuring applications remain functional and data remains accessible despite network fluctuations.

Inspiration for Veilid's P2P mechanisms draws from projects like IPFS (InterPlanetary File System) for its distributed block storage and DHT concepts, and Tor (The Onion Router) for its principles of onion routing and anonymity. However, Veilid re-engineers these concepts specifically for mobile and application-centric use cases, addressing the performance and usability challenges that classic Tor often presents for general-purpose apps. A key philosophical difference from Web 3.0 and blockchain is its "Web 1.5" approach, which actively avoids a permanent, immutable ledger of transactions, instead favoring a right to be forgotten where data relevance dictates its persistence on the network.

Cryptography

Veilid's cryptographic suite is robust and forward-looking, embodying a principle of "nothing is forever" by planning for cryptographic deprecation. It supports simultaneous cryptosystems, allowing applications to seamlessly transition to new algorithms without requiring code changes. Currently, the VLD0 suite utilizes:

• ED25519 for authentication.
• X25519 for key exchange.
• XCHA 20 poly305 for symmetric encryption.
• Lake 3 as a fast message digest.
• Argon 2 for slow, password-based hashing.

As a member of the Post-Quantum Computing Alliance, Veilid is actively auditioning MLAM and other post-quantum algorithms for inclusion in its next-generation VLD1 suite, ensuring future-proof security against quantum computing threats.

All data within Veilid is end-to-end encrypted, timestamped, and signed. Furthermore, all storage is encrypted at rest. On mobile devices, Veilid leverages platform-specific features like the keychain and hardware-assisted storage to protect local application data. Critically, encryption keys are kept off-device during backups (e.g., iCloud), meaning that even if a user's iCloud account is compromised and Veilid app data is downloaded, it cannot be decrypted without the device-specific key. This comprehensive approach to encryption makes spoofing a Veilid node extremely difficult and renders data secure even if the device itself is physically lost or compromised.

Distributed Hash Table (DHT)

Veilid's distributed hash table (DHT) is a significant innovation. Unlike simpler DHTs that map a key to an arbitrary blob of data, Veilid's DHT associates a key with a set of related values and utilizes a schema to define operations on these values. This advanced structure allows developers to build complex operational data structures directly on top of the DHT, such as linked lists or nested hash tables. This capability is essential for applications like chat, where storing millions of messages or contact lists efficiently across a distributed network is paramount.

A key focus of the Veilid DHT is locality. Distributing data across the entire internet can be slow. Veilid's DHT understands locality, allowing related data to be stored in "places that are close to data that is relevant or cared about." This design ensures performance, as retrieving a chat log, for example, doesn't require querying thousands of geographically dispersed machines. The DHT is not based on blockchain or cryptocurrencies, reinforcing its privacy-centric design. It also implements a caching system where popular data that is frequently used becomes more available and snappy to retrieve, while unused data eventually disappears, embodying the "right to be forgotten" principle.

Private Routing

Veilid implements an onion routing-style system called Veilid Private Routes, which differs from Tor in its control mechanisms. In Veilid, both the source and the destination of a communication circuit (or "compiled route") have some level of control over selecting the nodes that form the route. This dual-control mechanism mitigates the risk of a single malicious actor (either sender or receiver) choosing compromised nodes to compromise anonymity. Safety routes provide sender privacy, while private routes ensure receiver privacy. When combined, they form a continuous, cryptographically secured route. The project is actively working on Private Routing 2.0 to further enhance traffic correlation resistance, even against nation-state adversaries.

Storage and Network Services

Veilid provides several storage and network services through its framework:

• Table Store: A local, encrypted key-value store, utilizing IndexDB in browsers and SQLite natively on devices. This is fully encrypted on disk.
• Record Store: Mirrors the table store but operates as the distributed DHT across the network, allowing for locality-based data distribution.
• Block Store (WIP): A content-addressable system for chunked data, akin to BitTorrent, designed to automate efficient transfer and streaming of larger files.
• NAT Traversal: Uniquely, Veilid's NAT traversal mechanism is entirely in-network, avoiding reliance on centralized STUN servers (like stun.google.com) often used by WebRTC-based P2P systems, further reducing points of external dependency and potential surveillance.
• Schema and RPC System: Features an evolution-based schema system and an upgradable RPC (Remote Procedure Call) system. This ensures that as the network improves and new services are introduced, older applications can still participate, promoting long-term compatibility and network resilience.

Demo / Proof of Concept

▶ Watch: Veilid's core mission: privacy for all (8:00)

Christien Rioux showcased several applications built on the Veilid framework, demonstrating its versatility and the practical implications of its decentralized, privacy-focused design. These examples highlight how Veilid enables familiar app experiences without the need for centralized servers:

1. Intersect: This application, developed by Evelyn Hobert, functions as a distributed pastebin. Users can input small-form content, such as markdown, and upon hitting "save," they receive a unique link. Anyone with this link can view the content. Crucially, Intersect runs a full Veilid node directly in the browser as a WebAssembly blob, served from a static site (e.g., an S3 bucket). The content itself is stored in an encrypted form within Veilid's distributed hash table (DHT), meaning there's no pastebin.com or centralized server holding the data. Rioux noted that while the site uses HTTP (e.g., http://intersect.blog), the actual security is handled by Veilid in the browser, and full HTTPS support is awaiting WebTransport release for Safari, to avoid reliance on centralized TLS certificates.

1. Stigmerge: A console-mode application, Stigmerge offers functionality akin to BitTorrent. Users can select a file to "seed," which then generates a link. This link can be shared, allowing others to download the file directly from the seeder over Veilid's private routing mechanism. Rioux humorously recalled that the first file shared over Veilid was the movie "Chud" (Cannibalistic Humanoid Underground Dwellers), followed by "The Matrix." This demonstrates Veilid's capability for efficient, private file transfer without centralized trackers.

1. Vdrop: Developed by Brandon Vandergriff, Vdrop extends the concept of Intersect to arbitrary files, including streaming media like movies and sound. Users can upload files into Veilid, which chunks them up and distributes them across the network. These files can then be played back or downloaded via a link. Vdrop exemplifies Veilid's ability to handle larger data sets. However, Rioux emphasized that this is not "free unlimited storage"; files, like other data on Veilid, will eventually "fall off the network" if they are not actively downloaded or cared about, reinforcing the right to be forgotten principle.

1. Game Engine Integration: Rioux mentioned an instance where a game engine was plugged into Veilid as a backend. This illustrates the framework's potential to replace centralized services like Steam or Xbox Live for multiplayer game lobbies and direct player-to-player communication. Such an integration would allow games to operate without requiring players to pay for or rely on expensive, centralized server infrastructure.

1. Veilid Chat: As a prime example of "eating our own dog food," the core Veilid team is building Veilid Chat, a private messenger designed to be similar to Signal but operating exclusively on the Veilid network. Written in Flutter, it leverages Veilid's first-class bindings for Dart. Users create a Veilid identity, which can then be used across multiple Veilid apps. Contacts are shared via QR codes or copy-pasted blobs over any medium. The app currently supports text and emojis, with plans for media support. Rioux highlighted efforts to incorporate accessibility features, such as proper font scaling and low-vision support, underscoring the commitment to making privacy accessible to everyone, not just "Linux nerds." The app is available for testing on Apple's TestFlight and the Google Play Store.

These demonstrations collectively illustrate Veilid's practical viability for building a diverse range of decentralized applications, from simple content sharing to complex real-time communication and gaming, all while upholding its core tenets of privacy, security, and user autonomy.

Defensive Implications

▶ Watch: Debunking myths about online communication (8:40)

Veilid introduces a paradigm shift with profound defensive implications, fundamentally altering the threat model for applications and user data. By eliminating centralized intermediaries, it directly addresses many of the vulnerabilities inherent in the current internet architecture.

1. Mitigation of Centralized Data Breaches: The most immediate defensive benefit is the removal of the "honeypot" effect. Without central servers storing user data, there is no single, massive target for attackers to breach. Instead of a single repository containing millions of user records, data is distributed, encrypted, and often ephemeral. This drastically reduces the impact and likelihood of large-scale data breaches that plague centralized services.

1. Enhanced Data-at-Rest Security: Veilid's commitment to at-rest encryption for all local data, coupled with hardware-assisted storage and device keychains, provides a robust defense against device compromise. Crucially, the exclusion of encryption keys from cloud backups (e.g., iCloud) ensures that even if an attacker gains access to a user's cloud storage, the application data remains undecryptable. This is a significant improvement over many popular messaging apps, where local databases might be decrypted once on the device, making them vulnerable to direct device extraction.

1. Resistance to Censorship and Surveillance: The decentralized nature and onion routing capabilities of Veilid make it inherently more resistant to censorship and state-level surveillance. There are no central servers to block, no single entity to compel data disclosure, and traffic correlation is made exceedingly difficult by the private routing mechanisms. This empowers users in environments where free communication is under threat.

1. Altered Developer Incentives, Better Security Outcomes: By removing the "cloud bill" and the necessity of monetizing user data, Veilid aims to change developer incentives. Developers are no longer pressured to collect, analyze, or sell user information to sustain their applications. This fundamental shift can lead to applications that are designed with user privacy and security as primary goals, rather than afterthoughts or compliance requirements.

1. Proactive Vulnerability Management: Veilid's unique vulnerability response platform, which enshrines exploits within the project's repository, serves as a powerful defensive tool. By openly acknowledging and documenting vulnerabilities, it creates transparency and strongly incentivizes developers and users to update their Veilid framework, ensuring the network remains secure. This goes beyond traditional full disclosure, embedding the lessons learned directly into the project's history.

1. Resilience to Network Failure: The design for high-churn networks and the in-network NAT traversal (avoiding centralized STUN servers) make Veilid applications more resilient to various forms of network disruption. The network can adapt to nodes coming and going, maintaining connectivity and data availability even in unstable environments.

1. "Right to Be Forgotten" as a Data Minimization Strategy: The philosophy that unused data gracefully disappears from the network acts as a built-in data minimization strategy. This reduces the long-term risk associated with historical data retention, as less data persists over time, there is less data to potentially be compromised in the future.

While Veilid cannot prevent all risks (e.g., a user adding a malicious contact to a group chat, which is an application-level concern), the framework provides robust primitives and encourages best practices. The example of privacy-preserving methods for group chat invitations (e.g., homomorphic encryption to gauge how many participants know a new member) illustrates how Veilid can empower developers to build more proactive, privacy-aware application logic on top of its secure foundation. Overall, Veilid offers a potent defensive posture against many of the systemic security and privacy challenges facing the modern internet.

Key Takeaways

• Decentralized Privacy Framework: Veilid is an open-source, Rust-based peer-to-peer app development framework by Christien 'DilDog' Rioux and the Cult Of The Dead Cow, designed to build privacy-preserving, mobile-first applications without centralized servers or cloud infrastructure.
• Robust Encryption and Data Handling: It features end-to-end and at-rest encryption (leveraging device keychains and hardware-assisted storage, with keys excluded from cloud backups), simultaneous cryptosystem support for future-proofing against quantum threats, and a "right to be forgotten" philosophy where unused data eventually disappears from the network.
• Advanced Distributed Hash Table (DHT): Veilid's DHT goes beyond simple key-value stores, supporting schema-based related values and operational data structures with locality awareness, ensuring high performance for complex applications like chat logs across a high-churn mobile network.
• Novel Private Routing and Network Resilience: It implements a unique onion routing system where both sender and receiver contribute to node selection, enhancing anonymity, and features fully in-network NAT traversal, eliminating reliance on centralized services and improving resilience to network disruptions.
• Shifting Developer Incentives: By removing the "cloud bill," Veilid aims to liberate developers from perverse monetization incentives, encouraging the creation of applications focused on user value and privacy rather than data exploitation.
• Community-Driven and Security-Transparent: The project is community-first, supported by a non-profit, and promotes security through a unique vulnerability disclosure model that enshrines exploits within its repository, fostering transparency and continuous improvement.

About the Speaker(s)

Christien 'DilDog' Rioux is a highly influential figure in the cybersecurity world, renowned for his pioneering work in vulnerability research and hacktivism. A long-standing member of the Cult Of The Dead Cow (CDC) and The L0pht, Rioux rose to prominence in the mid-1990s by focusing on Windows exploitation, a then-nascent area. He is famously known for developing L0phtCrack 2.5 and the groundbreaking Back Orifice 2000, a remote administration tool that served as a critical wake-up call for Microsoft regarding security vulnerabilities.

His career includes co-founding Atstake, one of the first security consulting firms to openly hire hackers, and later developing Veracode in 2006, a pioneering retargetable decompilation system for arbitrary binaries. Rioux also spent time working at Apple and released the Stunt Banana VIP spoofer toolkit. His experience spans from low-level system programming and 3D rendering to advanced exploit development, which he notes require a similar analytical mindset. With Veilid, launched in 2020, Rioux continues his legacy of advocating for digital privacy and challenging the status quo of centralized internet infrastructure.