Securing Your Self Custody

Transcript

foreign [Music] hello hello good afternoon uh welcome to efcc it's super exciting to be here on Monday kicking off everything so I hope you're excited as I am my name is Micah hisogawa I'm the co-founder and CEO of a company called webassee and my talk typically when I do talks at events it's kind of safety security technical related which this partially is but more importantly I'm going to talk to about something that's probably pretty interesting and that is how other people self-custody their crypto so yeah let's get into it so very briefly on my background I'm Japanese which is the best country ever so you'll

see like influence in the slides I studied AI at Stanford machine learning I was a performer for Cirque du Soleil in a past life and that's actually when I first was introduced to crypto back in 2014 so kind of a weird introduction to the space and then most recently I was at Microsoft doing cyber security with the government and then in 2021 I founded my company and if we have time at the end I'll tell you briefly about what it's about but we won't do much about that that's my professional life and my personal life if I'm great at parties so I will see you this week so what are we going to go through today I didn't want to do anything too boring and so what I've actually done is I spent the last couple months in you interviewing 20 to 25 crypto ogs these

are guys that have been in the space since 2010 2011 some of the early early protocol devs of all the companies that you've probably probably heard of I won't tell you who they are but I will do some case studies and also tell you some commonalities I found across the space and then I'll also talk about a couple new things in self-custody I won't talk about account abstraction because I'm sure you'll hear about it from everyone else here but I'll talk about everything else that's going on and then webassee at the end so we'll go through those three points so I'm also not doxing any of these names for very obvious reasons but I will give them fake names so case number one this guy was an early protocol Dev at one of the top 10 L ones if I named it you would know it but in crypto since

2016 so not the earliest of the ones I've interviewed but still very interesting he's a self-proclaimed alt chain bro and he was involved before any traditional like Hardware support of the big companies that we know and love today so he's really been in the self-custody evolution and seen it change from the very beginning from when he built his own self custody to the companies that came out and how they've evolved over the years so he self-custodies his stuff by running his own scripts so he's paid out in tokens or he was historically paid out in tokens and then he would run a script to automatically split to his Cold Storage wallets um one commonality across every single interview I had was that people did not have accounts on custodians or they did

only for on-ramps and off-ramps and they did not hold assets on them so that's one thing across all 20 uh 24 interviews that was very interesting to me and then he also doesn't use Hardware wallets for anything other than the main tokens and one reason for that was that he didn't believe in the support for them until after they were battle tested so he'd typically wait one or two years from the release of the support for a particular token before feeling comfortable moving those tokens onto the hardware so he usually does his own Hardware support case number two this is the most interesting one so he is a current cyber security engineer one of the major leading security firms in the space these are one of the firms that do audits code reviews things like that he's been in crypto since 2015. so of

all the interviews I did 80 to 85 percent of everyone they're all guys they were all dudes that I was interviewing um they told me that they got into crypto because of you know nefarious purposes whether it be drugs or gambling or something like that the other 15 that I interviewed they lied about it so everyone got in through the dark web so this guy again he doesn't use centralized exchanges he holds only BTC and eth and so this he's kind of also a hacker so he gets paid out in bug money um and when he receives any kind of token of any kind he immediately swaps to Ethan BTC he wouldn't really tell me why but you could probably make assumptions about it um he so this he uses USBS and his own built Hardware devices of other kinds he doesn't use third-party Hardware devices

and he also mentioned you know building defense and depth so across all of the layers from web 2 to web3 all the access the most interesting part of this so he was inspired by I can't remember the TV show but there's a TV show where this guy puts secret phrases inside of music using steganography it's a cryptographic term for putting data into other files so he developed his own script to splice the seed phrase and put them into movies and so he puts these movies onto a USB stick he has many copies around the world and so he can watch his favorite movies but it's also his seat raise so it's a custom script to decode it as well on the other end it's extremely complicated but it's also very much my favorite case study that I had from these interviews

it's also quite complicated so a couple of things of that he noted he doesn't trust Hardware wallets made by Third parties particularly he mentioned a couple years ago I don't know if you remember there was this issue where the Kraken security team found that there was a like a supply chain attack against Ledger and this has been dealt with of course but there is that attack vector I also asked everybody what happens if you you know die like how do you recover these assets um he very bluntly said that these assets would be lost forever and it's a significant amount um so a lot of uh blockchain assets have been lost due to people passing away unexpectedly or expectedly but people just don't know how to access them so that was one funny thing some tips from a technological level he was pretty

clear that some scripts for decoding and coding does not run the same across chains so when you're doing your own thing if you plan to do something more hardcore test across chains before you try to actually Implement because when you go to actually decode things it might not work across let's say Solana ethereum and so on He also mentioned that a good piece of entropy is actually more than 30 characters so your passwords are all probably a little bit too short but it's also too long for you to memorize so it's kind of a chicken and egg problem when it comes to good security third case crypto founder this guy really really OG so crypto founder since 2011. he started by doing sketchy stuff on Silk Road has been doing things like Bitcoin all trading and so on 100 self-custody so same thing across

the board majority of these guys do not trust any centralized exchanges so they hold entirely unself-custody his staking payouts go to his multi-sig he transfers um from Sexes to off-ramp primarily he doesn't seem to care about identity which is one another interesting thing is that a lot of these guys did not care if they were Care I'd seed into their accounts and then he was also reminding me of if you've been on Reddit for a long time with crypto that bird math meme of a guy so I'll explain it it was about hardware self-custody and he had put his seed phrase on a USB device puts it in a box and puts it under his bird bath in the backyard and that was his defense right and so it's it just goes to give you a story about how complicated it could be and how how

unrealistic it can also be at the same time so the next part of my talk I want to go through two different eips that are related to self-custody in the space and kind of on the Innovative front that are not a kind of abstraction so the first one 3074 this is a new OP code to allow externally owned accounts to delegate control to a contract so both of these are kind of about expanding the power of eoas so you can delegate control of your eloa to a contract and it kind of acts like a smart contract wallet but it is not a smart contract wallet so it's an alternative if you know this meme acts like one quack Cyclone it's not it's a one of the new eips so this allows four things called sponsored transactions so you can pay a

trans pay for the gas of a transaction from somewhere else so if you're someone like me I don't keep eth in my account so that you can't a hacker can't send anything out of it um there's like a wallet drainer system on it so there's no eth you can actually still do transactions with that account by sponsoring the gas fees from a different account the next one 5806 so this is a delegate transaction uh you've probably heard of delegate cash um I actually don't know what they use but this is one of the eips that are within the system right now so it allows EOS to actually arbitrarily execute code through delegation so again this is a new approach it also has some replay risks there are some mitigations to that but it's very similar to how eip7 allows smart contracts to delegate calls to

other smart contracts so which allows for batch transactions which is something really great if you're have been using any web3 apps that requires you to you know approve approve approve this is something that is quite Innovative and great and it gives it more abilities to EOS which is what we want and then this is some of the mitigations you can do for replays which makes things safer but less powerful than three zero seven four now in the few minutes that I had left the company webassee so what we do is we do self-custody security we're not a wallet we're not a safe we're not a vault of any kind we are actually a layer on top so you can bring any self-custody wallet you have to us and use it and we do three main things we assess risk we monitor your wallets and we help you act in an emergency so we

have a risk platform you can pretty much assess what that is we take data from a bunch of different sources and tell you about the risk of your wallet transactions smart contracts you've interacted with and so on we have a wallet monitoring service so every one of you you're not on your computers right now I assume you might be but if let's say I get a text of something leaving my wallet I know it wasn't me because I'm talking to you right now and so that's something to be concerned about so it provides both peace of mind and also knowledge about what's happening in your wallet so it all inbound all outbound airdrops royalty payments you get notified through SMS and email and then two other things that we've built it's a backup wallet to recover this is a loss of access recovery method that's not social recovery it's not seed

phrase sharding it's all through self-custody ownership as well as a panic oh emergency evacuation button in case you have things moving out of your wallet finally funny enough this is a the very first product we built kind of touching back on the question I was asking everyone we have a crypto will so on chain inheritance how do you pass things on to your loved ones after you pass away which we all inevitably will um this is some pictures of the platform it's all totally live we launched one month ago out of beta um and yeah I'll pause there I think I have a few minutes for questions but other than that thank you very much uh self-custody safely thank you for the University what do I use I can't

tell you that no I use a variety of things so I have multiple Cold Storage I have a multi-sig and then I use hot wallets that are basically burners to interact cool thank you [Applause] foreign [Music]