Interview, Fireside Chat
a16z Podcast | Crypto, Security, CS, Quantum Computing, and More with Our New Professor-in-Residence
- Dan Bonet, an applied cryptographer and professor of computer science at Stanford University for 18 years, joined Andreessen Horowitz (a16z) as its second Professor in Residence to bridge academia, industry, and startups.
- Computer science has become the largest major at Stanford, with enrollment exploding due to the increasing integration of software across all disciplines, leading to the launch of the "Computer Science Plus X" program allowing double majors in fields like Slavic studies.
- Public interest in computer security has surged following the Snowden revelations and high-profile data breaches, driven by the expansion of the Internet of Things and the centralization of vast amounts of personal data in the cloud.
- Bonet identifies "usability" as a critical missing link in security adoption, noting that even secure technologies fail if they lack intuitive user interfaces or require burdensome user interaction.
- Traditional second-factor authentication often relies on smartphones, which Bonet argues fails as a true "second factor" when the phone is the only device used for login or when left behind; he advocates for body-worn devices like smartwatches or glasses as more reliable second factors.
- Biometric authentication (e.g., fingerprints) faces significant hurdles because biometric data is non-revocable (unlike passwords) and easily harvested from physical traces like water glasses.
- Current estimates suggest only approximately 6% of Gmail users have adopted second-factor authentication, though Bonet views this as a "remarkable success" given the difficulty of changing entrenched user behaviors.
- While second-factor adoption is low in the consumer sector, Bonet cites Stanford's implementation of mandatory second-factor access for all campus users as a successful model where security mandates can be effectively enforced in controlled environments.
- Bonet is developing a novel authentication scheme where central repositories store only public information, ensuring that even if a server is breached, the stolen data cannot be used by attackers to log in as users.
- Bonet is teaching a new Stanford course on Bitcoin and blockchain, emphasizing the technology's potential to provide financial access in the developing world where traditional banking infrastructure is absent.
- To address trust issues in Bitcoin exchanges following failures like Mt. Gox, Bonet and his students have developed a "zero-knowledge proof" mechanism allowing exchanges to prove solvency daily without revealing private financial data.
- The security of Bitcoin and modern cryptography relies on mathematical problems like integer factorization, which are currently considered hard to solve, though Bonet acknowledges this trust is provisional and based on the lack of a known solution rather than a mathematical proof of hardness.
- Quantum computers represent a theoretical future threat to current cryptographic primitives, but the cryptographic community is actively developing "post-quantum" primitives that remain secure even against quantum attack vectors.
- Bonet predicts that while building functional quantum computers is an immense engineering challenge involving qubit isolation, an operating quantum computer is likely within his lifetime, though not imminent enough to cause panic.
- Researchers in Bonet's group proactively identify and publish vulnerabilities in existing systems, such as browser-embedded password managers, often leading to immediate patches from major technology companies.
- Large tech firms have increased security teams' power to delay product launches due to vulnerabilities, whereas startups often rush to market, creating a risk that security retrofitting later will degrade user experience.
- Bonet's "applied" cryptography work ranges from theoretical mathematical proofs to real-world systems used by billions, such as the encryption securing connections to Google.
- Bonet created a free, public MOOC on applied cryptography, which has attracted 600,000 global sign-ups, serving as a "21st-century textbook" that supplements his on-campus teaching and facilitates a Socratic learning style.
- The a16z Professor in Residence initiative aims to leverage Bonet's research to solve real-world startup problems, particularly in areas where deep technical expertise intersects with business applications.
- Security teams at large companies now have the authority to halt product shipments if critical vulnerabilities are found, a shift from past practices where market speed often trumped security considerations.
- Bonet asserts that perfect security is impossible in any system, noting that given enough resources, an attacker can always breach any defense, drawing parallels to the physical world's lack of perfect home security.
- The evolution of "Computer Science Plus X" reflects a trend where computer science is becoming a foundational language for almost every field, from literature to biology, necessitating cross-disciplinary training.
- Bonet warns that while cloud infrastructure handles basic backend security (e.g., DDoS protection), startups must still engage in "threat modeling" from day one to anticipate and design against specific application-level attacks.