Decentralized Web Security - What's Next?

Live from Breakpoint 2021, Ali Yahya (a16z) moderates a discussion about wallets, custody and the User Control Layer with Brandon Millman (Phantom), Filip Dragoslavic (Solrise) and Maria Phillips (Slope Finance).

00:10 - Intro

02:32 - Custodial vs. Non-custodial models for keys holding

07:11 - Education is key

11:37 - Building on top of user-controlled layers

16:48 - Unbundling Wallets

20:04 - Mobile vs. Desktop

DISCLAIMER

The information on this podcast is provided for educational, informational, and entertainment purposes only, without any express or implied warranty of any kind, including warranties of accuracy, completeness, or fitness for any particular purpose.

The information contained in or provided from or through this podcast is not intended to be and does not constitute financial advice, investment advice, trading advice, or any other advice.

The information on this podcast is general in nature and is not specific to you, the user or anyone else. You should not make any decision, financial, investment, trading or otherwise, based on any of the information presented on this podcast without undertaking independent due diligence and consultation with a professional broker or financial advisor.

Ali (00:10):

All right, welcome everyone. So today we have a great panel to talk about the user control layer. So everything that has to do with UX, interfaces, wallets, how people use their private keys to interact with blockchains, and how all of that plays into web 3.0, and the things that are being built in DeFi, NFTs, et cetera. And we've got only 20 minutes, unfortunately, which is an egregiously short period of time to cover such a meaty topic, but excited for it. It's going to be a great conversation. I'm going to start by letting our panelists, maybe introduce themselves. Maybe one minute kind of introduction, and then we can dive in. Does that sound good?

Filip (00:50):

That sounds good. I'm Filip from Solflare. We actually built the first wallet on solana. That was actually before magnet, July last year. And Solflare was the first taking wallet, and right now we have over 20% of solana circling supplies stake through Solflare, and we are expanding onto all platforms. We have a web browser, we have a browser extension. We just launched mobile on Friday. And we are just looking to give all our users the opportunity to access Solflare from whichever platform they want to. And that's what we're all about.

Brandon (01:37):

Hey, everyone, I'm, I'm Brandon Millman. I'm the CEO and co-founder of Phantom. Just got started back in May, and it's just been such an awesome journey. I just wanted to say thanks to everyone in the audience and listening back at home for helping support us on this journey, and to hit 1 million users recently. Each and one of you are one in a million to me, so really appreciate it.

Maria (02:03):

Hi everyone. I'm Maria Phillips with Slope Finance, I'm head of communications. Slope Finance was the first mobile wallet on solana and we have over 150,000 downloads and an MAU of 95%. We are mobile first. Yeah, fantastic. Delighted to be here today.

Ali (02:23):

Amazing. Well, thank you guys. Well, let's start with, I think one of the basic questions about how user interfaces should interact with a blockchain. And that is the question of whether the keys should be held by the user, or if those keys should be held, or might be held by a company in the middle, like say a company like Coinbase or a company like that, where that would be kind of a custodial model versus having things being non-custodial and sitting at the edges. And I think we all kind of know what the ethos of this space is, but of course there are many trade offs. And so I'm curious to talk through how you guys think about those trade offs, and what are the kinds of things that we can do to empower the user as much as we possibly can.

Filip (03:04):

There's two different approaches like custodial and noncustodial. Noncustodial is in a true spirit of crypto where you actually control the keys. You control their finances and no one can actually take it away from you. I talked to someone from Algeria and he told me how important that is for them.

Ali (03:24):

Yeah.

Filip (03:25):

Since I don't live in a country like that, I didn't know that's so important for them because at one point in time, someone can actually get something from the bank account, they lose everything. But on the other hand, all people are actually used to, don't have that responsibility of just holding all their finances with them. So we have bank accounts, we trust banks with our money and it's going to be a long road to educate old people, to get from the custodial to the non-custodial thing. And I don't think that it's ever going to happen in a big way, but as all crypto people here are, we are like early adopters and we want to try new things, but the vast majority will always stay non-custodial. And there's always going to be those two approaches.

Ali (04:19):

Yeah. Makes sense. What do you think, Brandon?

Brandon (04:22):

Yeah, I'll start off by saying that at Phantom, our goal is to make the decentralized web safe and easy to use for everyone. And you know, what that means is expanding past like the very small number of users we have now to tens of millions and billions in the future. But you know, the thing is that giving private keys directly to users, is sort of akin to giving them keys to like a super car Ferrari, it's like super powerful, but not everyone needs all that power. And I'll say, actually, I think there's actually more than just this dichotomy of like non-custodial and custodial. It is actually a bit of a range of different techniques that are kind of somewhat in the middle. So I think there's things like social recovery, multi-party computation, premier secret sharing, tourists, those sort of things. And I think all of those techniques have not really been given the chance to really been taken to their like full extent. So yeah, we're really excited to kind of explore a lot of those options and sort of bring more custodial flavor, to non custodial tools.

Maria (05:32):

When we look at our user base, okay, number one, India, number two, US and number three, Malaysia. Everyone of our customers really are accessing via mobile, and that onboarding, and that access is a huge concern to us to make it as easy as possible. So we are looking at different innovations in this space. And especially because we're looking at being the gateway from web 2.0 to web 3.0, and being able to link activities in decentralized identity is what we're calling it. Being able to identify people in specific ways, according to their activities. And hopefully we're going to use that to lower the access and entry barrier for our customers to make it as easy as possible. And a better experience

Filip (06:16):

Just wanted to add that actually education is so important and just getting people to know how crypto actually works and why is it so good for them? That's actually one of the things that, what we actually launched our sulfur academy. So we have blogs and guides to capture the users and tell them, okay, this is how works. Because there's a lot of scams out there. I mean, we both know that because before we actually launched mobile, we have caught three fake wallets. We actually met one of the developers who made those fake wallets reached out to us. And told us, oh, I'm so happy that you're using our wallet at the wallet that I made. And he was actually commissioned by someone else to produce fake wallets for Solflare and Phantom. So that was mind blown to us. He felt so bad, but he didn't know that. And so education is key actually to preventing users, for getting scammed and actually get so burnt that they say, oh, okay, all crypto is a scam. So that's why...

Ali (07:22):

I think this point of education is really good because I think there are two philosophies in this space. One of them is crypto wants to be seen. This is a line from Cavan, who's a founder of foundation. And his view is over time, people should become aware of what crypto is. People should become aware of the way that private keys work. They should become aware of the fact that holding your own private key is very different than signing into a web 2.0 service. And that's one philosophy that these things will become front and center. And that education will be a big piece of this and that you actually, as an application developer, should not be trying to hide it away, right. That you should not be trying to fully abstract it such that the user actually does not know anymore that they're interacting with a blockchain.

Ali (08:05):

And then a different philosophy would be more like a product and a very pragmatic point of view, which is people have a very hard time understanding how all of this works. And so instead, what you should do is you should abstract it away. You should make it look as much like a web 2.0 thing as possible, so that you can get people on board. And then over time, maybe you shift towards a more kind of web 3.0 native user pattern. And those are two very different ways of building a product. And I'm curious how you guys think about that. I mean, your point about education, how do you think about education?

Filip (08:38):

Yeah, I think educating users is actually the key to it. I mean, they don't need to know like 90% of it.

Ali (08:45):

Yeah.

Filip (08:45):

It's totally fine if they do the very basics and if they interact with, for example, much more complicated protocols, they don't need to know what goes on in the background.

Ali (08:55):

Right.

Filip (08:55):

But they need to know when the app says, okay, you're now signing a transaction, what end means on the blockchain. And this is the only thing that they should know. And we should actually push as an industry, users to educate themselves just in those basics.

Brandon (09:15):

I feel like none of us here really know what the final conclusion of all of this web 3.0 tech is really going to look like. And I think we're just so early in the vast majority of people who are going to use these centralized technologies have not really used it yet.

Ali (09:30):

Yeah.

Brandon (09:30):

But I agree. User education is super important. Support is another thing that we've seen that's super important. Unfortunately, the status quo nowadays is to kind of throw everyone into this zoo of a discord and let whatever happen. And unfortunately, a lot of projects basically just turn a blind eye to what happens in there. All these scams happen, people get DMed and whatever. So yeah, I think we really all need to take a much more user focused approach, not just in the applications themselves, but in, around just all of the surrounding infrastructure, support, education, et cetera.

Ali (10:06):

Yeah.

Maria (10:07):

Financial literacy and traditional financial services isn't great either to be honest.

Ali (10:11):

Yeah.

Maria (10:12):

But I do see this whole e-commerce space that we're involved in and looking at, I think that is a way to bring people into the space to understand it better.

Ali (10:20):

Yeah.

Maria (10:21):

If they start using cryptocurrencies or if they start using this in their normal daily shopping or activities, this is a way for them to understand that it's safe. You know, I paid for something, I got it. Yay. This is good. That's a real great way for them to understand and onboard in a really low level way, but get there.

Ali (10:41):

Completely.

Filip (10:42):

I just wanted to touch on the topic that Brandon actually mentioned, with support. We both did in our discords, people get scammed and stuff like that. So we tried everything. So we take this try and see what works approach. So we tried with telegram, we tried with discord. Yep. But people always get scammed. So I think we're launching periods to our live chat support on the website, but it's always like this fine line of, okay, how do you actually provide the users the best experience, but that they also feel still completely anonymous. It all depends on that fine line, and we need to see what works best actually.

Ali (11:22):

Completely. Well I think this actually segues well into how a user control layer application like a wallet or other kind of applications at that layer enable developers to build on top of them. Right. And I think that there's another kind of spectrum of different schools of thought or different approaches in that world as well, where you can think of meta mask or the kind of wallet that is very un-opinionated about how developers build things on top, as being on one end of the spectrum where you can really just sign anything using meta mass, you can sign just a binary blob because it doesn't provide you with very much context as to what it is that you're doing. And it's really on the developer to inform you as to what you're signing actually is.

Ali (12:18):

And then on the other end of the spectrum, can be much more opinionated about how the wallet integrates with specific applications, such that the wallet itself, the team who builds the wallet itself might integrate directly with a protocol that does lending. One example on ethereum world would be compound, you integrate with compound directly. And then there's a whole spectrum in the middle where a wallet could provide the tools for developers to build applications for it that are standard. And that give a little bit more structure and context for what that integration should look like, but it's not done by the team itself. And it enables an ecosystem to kind of emerge, to improve what the user experience might look like by enabling them to do things in a way that's more structured. So I think we need certain standards that help us build these applications in a way that are intuitive. And I'm curious how you guys think about this factor, or if you agree with it and, and where you guys kind of land on it philosophically.

Brandon (13:19):

Sure. Yeah. I can lead. Again, I'll preface everything by saying that we're in this mass experimentation phase where a lot of things are still being figured out. That being said, I feel like some of the walls that you've alluded to that have done more plugin type architecture. So namely origin, I feel like have sort of been left in the past a little bit, just because they were not really able to keep up with the explosion of all of these permissionless daps.

Ali (13:50):

Yep.

Brandon (13:51):

And, therefore were not really able to sort of participate in the network effect that gets created between daps and the users of those wallets. And so our opinion right now is to keep it very permissionless. Keep the current model going, as it has a lot of momentum and all of that. But again, that being said, I feel like we still have yet to see the final conclusion of all this, so things are always changing

Filip (14:19):

There's different trade offs between both approaches because if you integrated directly into the wallet, so firstly, the UX is going to be way better. And you could actually provide safe haven for all those new users because the permissionless world is the wild west. So you have like five great applications, you have five applications that will actually scam your money, so you could actually protect them. But on the other hand, you actually are gate keeping with your wallet. So this is why the panel is called whole user control layer. So the wallet actually dictates to which application the user can actually connect. And this may not always be in the best interest of the user because maybe that wallet has, for example, a business model with the dap that they have. So this is one part of it, in a permissionless system, the other thing applies.

Filip (15:22):

So there's inherent risk. And if we're going that way, then we need to go back to the previous topic and that is education. So if we educate them, then it's completely fine to do as permissionless because they know what they're doing. But if there's a big influx of new users who are just coming into the space, wanting to experience something and they want to do it quickly without educating themselves, we're in a really tough spot with permissionless systems. But as Brandon pointed out, we're so early, we don't know which way is actually going to work best. So I think there will be wallets with different approaches and we'll see which one is going to be the most successful one, which the users will actually choose that perspective.

Ali (16:10):

Completely. Do you want to add something Maria?

Maria (16:12):

Yeah. We have integrated with over 80 daps, but we're very lucky, we have 35 engineers, and we've created a standardized way for them to come to us and work with us and partner. So that's been fantastic and it grows, our list is growing, we're meeting people here, so happy to connect.

Ali (16:29):

And Maria are those integrations integrations that the team has pushed forward, or are those collaborations with the teams, or I'm curious how they end up working.

Maria (16:40):

It's collaborative. Yeah. Yeah. We absolutely work with them and make sure that they integrate with us seamlessly.

Ali (16:46):

I think an interesting question that also duck tails with what we're talking about here, with respect to integrations, is whether it's possible to kind of unbundle what a wallet is. And I mean, there are kind of standards out there that are being pioneered to things like wallet connect and I'm curious how you guys think of what the actual kind of user controls layer looks like. What are the various different components? What are the roles of that piece of the stack and how you think about what you're doing plays with that?

Brandon (17:20):

The wallet is actually, in its current form, a very complicated multifaceted product. So there's so many different parts. So not only in the app and outside of it. So inside the app, there's things like key management, there's things that people expect, like being able to do everything that you expect from your tokens.

Ali (17:39):

Yeah.

Brandon (17:40):

And if view, NFTs, swap tokens, like interact with daps and all that. And so it is a very challenging thing to juggle all of those things at once, especially in such a fast moving environment. And I think we're already seeing those sort of things, getting unbundled with like NFT viewing specific daps and daps that are more geared towards very fine gain grain control of your token accounts and things like that. And so I could see a world where they get unbundled, but I could also see a world where someone's kind of able to solve all those things, and under one umbrella,

Filip (18:26):

That's an interesting question. So it's basically the WeChat and other things. So is it a super app that can do everything?

Ali (18:34):

Yeah.

Filip (18:34):

Or is it an app that does one specific thing and then lets you connect to others? I think a really interesting approach is actually to have that super app, but in a light version. So you, the let the users do very basic operations with NFTs, with SPL tokens, with whatever they want to, because the space is evolving so fast, user demand is shifting from one week to the other and if a wallet can end up fast enough, then they could provide them those basic functionalities. But if they want to do some really heavy, deep stuff, then it's almost certainly going to be unbundled because you can't have 50 different integrations, fully integrated into the app. This just becomes exploded at one point. Especially on mobile. Dap is doable.

Ali (19:35):

Yep.

Filip (19:35):

But mobile, when you're limited with space, it's going to be almost impossible.

Ali (19:42):

Completely.

Maria (19:43):

For us, it's the super app approach. We love to keep our customers internally within the app. And you know, we do everything from activities, news, ranking centrally in the app. That's what we're trying to do, and it keeps our open rate really high as well.

Ali (19:59):

Yeah. Well, in a related question, which you alluded to is the question of mobile versus desktop and how the patterns of usage of web 3.0 and crypto might evolve and what might become the dominant vector for using keys for interacting with web 3.0 apps. What are your thoughts? How do you guys think that this will evolve?

Brandon (20:20):

Yeah, it's interesting. Because I feel like web 3.0 on mobile in more recent memory has had a hard time sort of getting started.

Ali (20:30):

Yeah.

Brandon (20:30):

And I think it's actually a function of the user base that has been using blockchain apps for the past couple years, which it has been more of like this prosumer DeFi type of user that prefers using complex DeFi apps on desktop. But what we're seeing now, I think is a couple paradigm shifts that are really setting the stage up for mobile. So first is this kind of new cohort of users that is much more NFT focused, and therefore a lot more casual. And so I think those people actually expect a really polished mobile experience. So I think that's one paradigm shift that's happening. And the second one is why we're all here today, is scalable and cheap blockchains, which their nature actually lends themselves much, much better to a mobile environment. So I think those two things are actually setting us up for the sort of new age of like web 3.0 on mobile. Which I think was not as tenable as before.

Maria (21:37):

Well for us, it's definitely mobile. Okay. We do have a Chrome extension as well, but for our customers, they don't really have laptops. It's very much mobile and that's their experience and how they onboard and how they continue to access. So it's definitely mobile for Slope.

Filip (21:53):

I'll go back to the last point and I'd say, it's going to be mixed. So you're going to do complex operations on a desktop, most certainly because mobile won't have the ability to provide them, but I see actually mobile and mobile wallet as your signing device for everything. When you connect to your desktop application, you just sign it with mobile. So because it's much more secure on mobile. I can't imagine myself, I can't imagine a lot of people actually, I don't know, sitting on a couch with a laptop open and browsing NFTs, as opposed to just sitting on a couch and browsing NFTs from their mobile app.

Ali (22:38):

Yeah. Yeah.

Filip (22:39):

And buying, selling. I want to connect to radio and harvest my farm in the morning from mobile. I don't want to do it from a desktop, open the desktop, type in radio, something like that.

Ali (22:51):

Yeah, it does feel as like, as web 3.0 begins to intersect more with a consumer world, mobile becomes increasingly more important as a result.

Filip (23:01):

Completely. Especially with NFTs.

Ali (23:03):

Yeah.

Filip (23:05):

Because NFTs and games in particular, so all those web 3.0 games are going to provide a huge user base, actually that is younger, the opportunity to experience crypto. And then you need a mobile wallet because all those mobile games will need a wallet.

Ali (23:20):

Of course.

Filip (23:21):

Unless they integrate one themselves, but talking to a lot of them, they don't want that responsibility because it's actually hard to build a wallet and maintain a wallet for it to be safe and secure for all users.

Ali (23:33):

Completely agreed. All right. Well, I think this is a good point to wrap the conversation. Thank you very much for joining us. This was awesome. This was awesome.

Hosted by Simplecast, an AdsWizz company. See pcm.adswizz.com for information about our collection and use of personal data for advertising.