Everything Feels Wrong Until It Isn’t: How Web3 Breaks User Intuition - Saadya 'Nick' Chevan

Transcript

Thank you for coming today. I'm Nick. I'm from the Trezor expert team at Trezor here in Prague. We are one of the leading manufacturers of hardware wallets. And what I do at Trezor is that I mostly talk with our user base. Today I want to talk with you a little bit about personal experiences I've had with users, personal things from my life that I think um really get into very well the challenges that Web3 users experience when they are interacting with Web3 apps and hopefully inform you about key takeaways that you can build bring into your own products. Uh who I am? So, I

have been assisting at this point hundreds of Trezor users with the Trezor expert service. I do video calls explaining to people how to use Trezor, understanding what their pain points are with using Web3, with using our products, and helping them improve on their usage. That gives me familiarity with a lot of different approaches to crypto self-custody. It allows me to succeed where are our users succeeding, where are they failing, and uh it's allowed me to really see patterns, uh things that people

misunderstand overestimate underestimate, and uh better be able to inform the improvement of both our products and the industry as a whole. Um yeah, so we've got a bunch of stuff up here about what users struggle with. I think really it's just the uh top thing, TMI. Uh too much intensity in terms of figuring out, you know, what what exactly do I do once I have a crypto wallet, but maybe we can break a few more things down. Um in essence, you have these highly uh technical for many people. Uh for us, maybe here in the room, it's crypto's

not all that technical. It is uh based on a lot of older technologies. It is based on things like TCP/IP, RCPs at a basic level, but to the average layperson out there, to say your 80-year-old grandfather in the eastern side of the country, it is challenging. It is highly technical. The interfaces are minimal. And breaking it down, understanding it, that is challenging.

Um what I am trying to help people with are things like uh long-term recovery planning, so thinking in terms of the Trezor multi-share backup system, also sometimes multi-signature systems like Gnosis in the hall. And, you know, things like um really understanding what are the implications of making a transaction. A lot of people get scared because at the end of the day, this is money. This is things that they are valuing and need to handle. So, understanding how to review transaction details, understanding where the risks are with phishing.

Um separating out all the noise about crypto, especially about failing uh to use crypto properly from the real risks. People inherit a lot of fear from the various horror stories on YouTube, Reddit. And um really, again, helping getting people to the point where they can build resilient setups. That usually takes uh multiple meetings to uh get people to that level of confidence and yeah, making informed decisions ultimately knowing where you are. Um I'm a skier and I think it actually does have I'm a much actually mostly a back country skier. I'm not a downhill skier. I'm a back country skier.

I think it has some applicability to Web3. Just bear with me. So, with Web3, you have to make a lot of complex decisions and you have to make decisions before you understand everything. Um I don't exactly recommend going here unless you know what you're doing in terms of hiking. Uh it's not really snow anymore. But, this is in the Czech Republic. This is a place called the Giant Mountains. Uh believe it or not, I have skied down that hill. It's pretty hard to ski down. Um you have to kind of go usually off the path because it's uh really really steep. Okay?

And it's quite overwhelming to go down. You have to be making a lot of decisions about where am I going? How do I keep my balance? Blah blah blah. Um when in general in skiing or also in driving and in crypto, you want to be looking at uh really 10 seconds ahead of you. You want to look to the back of the room, not the front. Um and that's because you want to look at where you are going, not where you are right now. You want to understand everything. And for users, this tends to be overwhelming. They're committing to paths they may not be understand understand understanding fully, especially if they're new to crypto. So, I went down this hill.

As you can imagine, it is uh asking to get into a ski accident here. And this is what happened to me. I did get into a ski accident that day. Right there. Uh not there specifically, but uh on some lighter terrain. Why did I get into that accident on lighter terrain? Because I was going too fast and I had gotten comfortable after going down here. And this was something that I knew how to handle, and I mishandled it, and I ended up in bed for a week with a concussion.

And I do think that self-custody very much um works similarly to help being overwhelming, then you overcome the hill, you get confident, and that is where the actual trouble, the actual risks can exist. Things like uh getting more and more comfortable with smart contract transactions, and then ending up uh with a blind signing error. It's not about struggling in an environment you don't feel comfortable navigating. If you don't feel comfortable navigating it, you're never going to get up the mountain. It's about being on the mountain and um coming down rather hard.

And you know, for me as a Trezor expert, I have an hour with our users. So, I can teach someone the basics. I can get someone set up with their crypto wallet in an hour, but getting people to maintain the confidence, you know, I only have an hour to meet with someone in person, plus maybe some email correspondence, um which is a lot harder. Email is text. Text is a lot harder than seeing someone, even if it be over a video call. So, helping people to really maintain mental models, I just have to say, you know, check every character of your address.

Don't give up your recovery seed to uh people who ask for it randomly or to random websites. Most people will be fine. They'll manage that, but I can't be with everyone all the time. I can't control for that every day, and that is a challenge. So, ultimately, what we try to do is we try to distill security down into simple, durable advice that users will rely on for potentially years before we see them again, or maybe forever.

And we just hope that when the time comes for them to go down the hill, they know how to handle it. Um it is a kind of a scary challenge, but that's what we do. So, how do we empower people to be ready for this? Well, um we have definitely a recurring challenge with self-custody, which is uh long-term planning inheritance uh you know, Bitcoin, for example, that has been around for 18 plus years now. And there are entire generations of Bitcoiners, there are entire generations of Ethereans, too. Ethereum has been around for 11 years, who have cycled in and out not because they got fud, but

because they had to confront real life, and maybe got seriously ill, or unfortunately passed away. That is the reality we have to live with as humans. Um so, when we are onboarding people, we very often have to simplify. We can't talk in an hour about inheritance. And frankly, if we took the 3 hours it takes to talk about it, people would get overwhelmed. So, at the end of the day, we are just trying to reduce as many single points of failure and make the inheritance as simple as possible uh when people want to upgrade.

It's something we can accomplish with multiple conversations. It's also something we accomplish with what is called the SLIP-39 system, which is uh Trezor's uh multi-share system. You can see it displayed on the screen. Basically, you are able to use um multiple lists of words, multiple um backup phrases in order to access your crypto. You decide how many of those lists you want to have, for example, five. And in this case, in this example, any three of them can be used to uh see get regain access to your wallet.

Um And that is very convenient just to give people to people for free, whether they know that or not when they buy a Trezor, because we can then go and tell them, even years later, "Hey, you have this option. You want to do an inheritance plan? It's there, ready for you, and it simplifies their process so much, save them so much time, and makes it incredibly easy for us to really uh get them to that next step whenever they are ready. And we can just, in essence, wait for them." Um there's also this interesting little challenge that I like to talk about, kind of nerdy challenge, which is that uh by default on Trezor, you create what's called a single share backup.

It's like your classic 12 or 24 word seed, but it's 20 words. And it just has the upgrade capability to multi-share whenever you're ready. And in the third and fourth word of that seed, it's always the same. It's the word academic. And that is a nice little Easter egg that I can use to kind of get people into the multi-share backup conversation, get them into the inheritance conversation. If they notice it, if they don't, well, then, you know, maybe they will eventually. And uh it's just basically it's not um like any kind of uh security. The words the third and fourth word are never for security in our system.

Uh what they are is just to tell the Trezor, "Hey, this is a single share backup. Hey, this is a multi-share backup." So, that way we always know a single share backup has the third and fourth word academic. And that's for the Trezor. Um yeah. In general, we also, like when we're creating a single share backup with people, we encourage people make multiple copies. We have to always assume when we're talking with people, failures can happen. Um and you know, in essence, it's important that backups uh remain preserved and legible. We have products for that. Selling them out in the hall, Trezor Keep Metal, if you're interested.

You don't have to be. Um and it's you know, we have we also work with people on testing their backup. This is a step that unfortunately a lot of people miss. Maybe for better or for worse, some of you have missed it in this room. If you have, I strongly recommend you double-check your backup is correct. We have a system on Trezor. I think our competitors in general have systems like this as well. If you're using a hot wallet, you can just, you know, eyeball the words or try recovering them into another hot wallet. I just want you to keep your crypto safe regardless of whether you're using our product or not. Um and it's a great way just to really ensure that people understand the recovery system. Not everyone

understands the recovery system when they come out of setting up a crypto wallet. They're just Well, most of us, you know, they maybe they set it up to get rich, who knows. And this really helps people just start to have that aha moment of understanding okay this is long-term and it's not as maybe crazy as I heard it is on the internet. It's actually kind of stable, maybe. Um our goal is ultimately to create systems that remain understandable and recoverable under stress. And you know, we accomplish this gradually. We accomplish this um through kind of filtering down the information people need to know. A lot

of people tell me like when I talk with you, it's just putting together a lot of different bits and pieces that were in my head. And I can tell you why this is. It's because people are assembling ideas from all kinds of different sources they read on the internet into a mental model that was never actually meant to be, never designed to um work together. So, there is a lot of information about crypto out there. People, if they're just getting into crypto, they might not have the full backstory, they might not understand all these little design decisions that have been made, why we do what we do.

Um it's very difficult to tell the entire story because again it takes 3 to 4 hours. We don't have that time and people don't have the focus to listen in that amount of time. And um I have seen all kinds of bad ideas. Let me give you an example. I'm going to create my own seed words. Uh by the way, neither of these seed words work. And I have run into some people who have done that. In one case, someone memorized a seed they wanted to use, which is a little concerning because if that person then tries to come back 5 years later and they have that seed in mind, it's just not going to work. And then

whoever may maybe me or my successor in 5 years has to figure out, well, why doesn't it work and kind of gradually pry that story out because in the meantime, with all of this, I can't ask you your seed words. If I ask you your seed words, I have access to your crypto even though this doesn't give me access to your crypto, but I don't know that. Um not without getting out a word list and figuring that out. Um which takes time. So, it is not fun having a conversation like this. You kind of want to jump out of the computer and say, "Please, you are doing it wrong. Please, just trust me on this."

Um but you know, it is important that we have these conversations, that we help people to understand the right path. Another example, uh much more Ethereum related, is token approvals. I work with a lot of users who are actively afraid of token approvals. Um and it's because they've heard again all kinds of things on Reddit, on YouTube, uh that approvals can be dangerous. They can kind of violate the principles of a hardware wallet or cold storage, and they don't understand why is that the case.

Um and again, it's because unfortunately token approvals, great idea, have gotten a very bad reputation thanks to all the fishing incidents that have happened with them. Um and also token approvals have just all kinds of interactions. It's not just the approval step, it's the connect wallet step with WalletConnect or MetaMask or Rabby Wallet. It's a message, then it's doing another transaction, and you already feel like you're being double-charged. What's going on? If you are experiencing this for the first time, it just gets overwhelming.

And if you have nothing to do with it, you've also heard that there's some sort of way to steal crypto. Um I'm not here necessarily to give the perfect solution for how we demystify token approvals. I hope most people in this room understand why they exist, but unfortunately, it's something that has um created the situation where again users start out overly fearful, then they become overly trusting, and then they get into trouble. They go down the hill the wrong way.

And ultimately, I think, you know, you want to learn to separate best practices from all the noise. It's not just about giving rules, it's about how helping users form the right mental model, understand what their self-custody is, and decide make the right decisions for themselves. I in general um want to believe that people have the freedom to reason through things. I want users to understand why practices exist. I think they're more confident when they understand them.

There is a very simple saying for what this process is. It's don't trust verify. Um when you effectively teach people why things are the way they are, you are allowing them to kind of reduce cognitive overload. You're making it look less magical and more realistic, more scientific. Um my goal is ultimately just to help people make informed decisions, usually the same decisions, but sometimes we need to understand where someone is coming from and why they might want to do things differently as long as it's technically possible, as long as it's not I made up my own words and want to put them into your product, which is

not the way Trezor works, maybe some other wallet, but not our wallet. Um yeah. And you know, for me another helpful thing is just people asking questions. I understand our users better through the questions they ask, through the problems that and the challenges that they experience. Um I always encourage people to ask questions uh because it just helps us understand where they are on their journey. And one of actually the most uh interesting things to me about how people ask questions is things like um people come and consult with me about how to set up a wallet when they've already set up a Trezor wallet.

Sometimes people will wipe their wallet and then come to me and see how am I doing it. Why? Because they would not trust me to help them set up an actual wallet with crypto on the call. They will want to see how I do it to be sure that they have done it correctly. In essence, they want to see our mindset, which is very humbly. Um ultimately, you know, you want to get into individual users' mindsets. You want to get into their ideas, how they think, help them reason through things.

Um and, you know, also, uh things like backup storage, for example. What I will say about backup storage is, in general, if I tell um 10 people a month the same place to keep their backup, it runs into a risk that someone could burglarize every single one of my clients in a few years and find the backup their backup in the same place. And, you know, that is a scary challenge for me. Um yeah.

So, ultimately, I kind of leave it up to the user to make the right decision. And I think what I always tell people is understand your surroundings. For example, understand where you are. You're in the Municipal House in Prague, uh but maybe this is a really nice view that I got a few months ago of the Municipal House. Like, have you seen it at sunrise? How well do you know Prague? How well do you know where you are at a crypto conference to really um have, you know, good opsec, good personal security. At the end of the day, what we are doing, we are doing things in real places. We are shaping our self-custody decisions by how we live, in our houses, if we're digital nomads, if we're traveling, if we're

in crypto conferences, and so on. Um you know, we want to be as familiar with our environments as possible, but at the same time, we don't want to get complacent. So, ultimately, to summarize, you know, we don't want to um uh compromise on our security. We want to be assured about um operational uh recoverability, clarity over time and you know many of the risks people encounter they are from misunderstanding consequences permissions changing environments we want to understand how users are filtering their information how to respond to it where the main challenges

arise things like warnings about token approvals are risky token approvals are scary FUD these sorts of things and you know misunderstandings about how to set up a self custody wallet being another one that is one that I like to talk a lot about and finally ultimately we want to understand the context of where you live where you are going in life and help you basically as much as we can as much as you're willing to share because you know everyone has a right to privacy too you don't have to answer any of the questions I have to help you basically design the spaces you are in

so I mean I hope you've enjoyed kind of my talk about what I help people with what the challenges are that I see I hope you go out there make a positive impact and be kind to one another thank you >> Thank you very much anyone has a question for Nick about Trezor's in general