The future of crypto wallets and mass adoption

Transcript

ready all right hi everyone welcome wake up i know it's hard it's nearly the end of the day but i'm going to make it short and i try to leave enough room for for questions uh i think it's a hot topic and uh i think you're going to be interested in uh in this talk uh my name is oriel i'm the ceo of xango uh zango is a crypto wallet it's a new generation of crypto wallet and uh we're going to explain how uh today there is a big problem in transactional security in web3 and how we are improving uh the situation um so let's get started with the problem the problem is simple

uh today people are losing their nfts and their crypto by simply using their crypto wallets and signing transactions if you don't know about it uh open your eyes read the news it's happening nearly every week just this week this has happened twice premium hack and um a social media account taken over um just a few reminders i'm sure this crowd is already aware i forgot to put my timer on um web free signing very simple you want to interact with an application built on the blockchain you need to authenticate to it you need to sign a message and that will give some sort of instruction and then do

whatever you do this is how you web free works everywhere on any type of app whether this is a decentralized exchange a marketplace or whatever so what's the problem uh the problem is that signing a transaction is becoming increasingly risky and dangerous and the reason for that is because crypto used to be exclusively or mostly about trading not interacting with apps not the case anymore we are now in a transactional economy versus a trading economy um and crypto is more and more happening on the go on smaller screens and uh wallets have not adapted to that reality a website i've seen build that's been built for computers versus mobile

screens and even on computers it's very very hard to realize the attack vectors that could you can be exposed to um and so so crypto wallets today are not fit to uh to that to that reality um so what does that mean that means that there is all sorts of dangers that are happening today uh in web 3 and i'm not going to go through every one of them there are just way too many but phishing camps scams dap impersonations celebrity social account takeovers doubt dap contract acts dap interfaces uh take over that what happened this week to premiums for example rock pools malicious air drops synth seed account takeover

abusive permissions etc etc those are live examples of things that have happened in the past i'm going through very very quickly because i really want to go through uh the solutions and what we believe all wallets should uh i should implement platform works protocol takeover i didn't have the time to update it with the the example of that week but it's really really very very numerous and the thing is that while it's even the most secure one at least today don't have a naturally fit built-in protection or at least user experience for that hardware wallets even that are extremely safe to to protect the private key don't provide a great signing ux ui expression experience and even less protection

so the problem is that is not so much on the wallet side or on the dap side versus on the euro side the experience for the user is is is actually inexistent and users do not understand the dangers that they are exposed to and they do not understand what they do not understand so that's really a problem and so what can we do about that and so to take a comparison today what it feels more like driving a car without a brakes and an airbag any wallet that you're using today makes should make you feel something like that unless you're not aware you are driving a car without protection um and so uh you know even outdoor wallet

have not yet adapted to that i'm sure this will come up but that's something that uh the illusion that the private key is protected is not enough to have a transactional experience that is safe and secure this is an example of oops something has happened on the slide sorry about that but the point is uh the screenshots on the right those are examples of what transactional signing experience looks like on popular wallets if someone can understand what's there congratulations you're very smart and very educated and if not you are a normal human being so that insanity has to stop we want people to really first understand what they are signing up for and the question really is can a wallet

be at the same time usable understandable and safe to transact not just to keep your your funds and be protected by a private key protection in the wallet but really safe to transact so um what would the safe signing user experience look like if it was existing it exists already but if it was existing first the account should be protected all right the private key should never be exposed in any way at any moment and ideally should not even exist right so that it cannot be provided by the user to adapt or adapt impersonator it should be built for anti-phishing

meaning it should be readable understandable and verified very important verified and it should also protect you like a firewall does meaning blocking malicious attack oops something's not working now it's working so what can we do about it so we've we've thought long and hard about what we could do at xango and we've spent a lot of time building a wallet that is by design not exposing private keys to anything because we're using multi-party computation meaning a cryptography where a private key is never ever generated although you can still control your transactions and sign on trend transactions but today actually we announced it at ftyc but today we're

announcing officially the launch of uh clearsign clearsign it's a firewall for free wallets so what is what is it it's a new and simple way to safely sign for uh uh web free transactions and interact with apps this is typical paths that you will see on on an app this is colablon but you could see that pass on on other apps you go to an app they ask you to authentify uh to authenticate through uh you know metamask or wallet connect or whatever wallet you're using and then you're going to interact with it so clearsign does three things all right it makes first and try to remember what you saw before in the screenshots of the uh the popular wallets that are exposing

transactions first it makes the transaction extremely clear and readable it's designed to be understood by someone who does not understand code as you can see here it's fairly well presented laid out that's not the most important thing the transaction signature the sagging structure is actually verified versus the original transaction signature uh signature of the dap so that you know that you are actually interacting with the dap even if the interface has been taken over so there is a check mark that is right there and you can also um double click and get the full message if you want to actually read it and you for an expert so it makes it clear it makes

it verified and readable but more importantly it will also prevent malicious attacks if the if clear sign identifi identifies that that transaction message and structure is not the original one it will not even let you sign the transaction it will block it and i know there are people that might scream that we prevent transaction from happening but we have made that design choice that if something is a known danger we do not let it happen so those are for non-scams and there is the case of high-risk transactions right so the case of you interacting with a transaction where you're going to have a set approval for all meaning you're going to have the total permission given to the dap and you're not even aware of you of you doing that or what it means

so we are introducing uh in the coming weeks this experience where you will have a double or trigger warning in red that makes it extremely clear that you are about to die right so you will have a message that said you're about to die are you sure you're sure you want to die then die right and if someone wants to die that's his choice but at least they know uh and of course on top of that you have the mpc protection of the pri of the private key never existing meaning that you know typical case you link to adapt it they ask you for you know your private key some people might want to do it on xango it's not possible because we're not using mpc we're using a password-less authentication based on liveness biometrics and if you want to see how it

works i invite you to to try xango so to summarize clearsign is a safer transactional ux user experience it's easy to understand it's clear it's verified it creates ls alerts for high-risk transactions it protects again unexpected and unwanted actions uh in case of uh dapps or interface takeover and eliminate the risk of seed and passwords um take over because they never exist the beautiful thing about clear sign it doesn't change require any change both from the user and the dev developer you don't have to implement anything at all everything happens intelligently intelligently in the wallet and you just have to use a

crypto wallet the same way you uh you usually do uh what do i have next oops oh no here all right some disclosure and disclaimers what it is not what clear no clear sign is not and by the way this is a security principle or a guiding principle we have at zango is when you announce the benefits you also have to announce the limits of a system right so there's nothing is perfect in security uh and you know and i'm sure many many wallets will beat something equivalent but we think it's important to understand what clear sign in our case is not first it's not an insurance against your crypto meaning that there is no protection if you indeed want to die and lose your crypto that thing can

happen and so there's no insurance there it's not a hundred percent guarantee that no risk can ever happen 100 security never exists in any system no matter what the solution claims and it's not a replacement for awareness and for education you should always be extremely careful what you're doing of course you know the miller similarly if you're driving a car with an airbag and a seat belt you uh don't you want to respect the speed limit because otherwise you are going to die for sure uh or likely to die it's not a protection either for perfect social engineering right so uh rogue otc deals peer to peer happening on social media channels it's very very easy to get lured into

those things and if someone wants you to send you you know crypto to him there's no you know way back button a clairson is not a protection for that the protection is you so you should always be aware of what you are doing um so the vision here oh i'm i'm nearly done all right the vision here is just to introduce a new layer of protection which combines user experience clarity of messaging and protection of dapps built in a user experience that already exists without having developers build new stuff and just users doing what they want to do so clearsign is already rolled on today online go on ios and android it's supported with colabland

and token proof and more depth that will be announced in the coming days and in the coming uh weeks very very shortly it will be uh there will be a generic no i can't uh [Laughter] we don't make watches we just make wallets uh uh thank you siri uh so uh in the coming weeks there will be a support for generic transactional experience whether uh an app is supported uh or not uh i think that's it this is uh oops the table has been broken again by the magic of powerpoint this is a summary of uh how uh xango compares to other typical wallets um in terms of security um you know by the way i'm sure that many

wallets are already thinking about building something like that but i think we're a step ahead here and i think i'm done i'm probably going to take some questions if you have most important slide stays in hi thank you very much for the talk um so as adapt developers does that mean if i want to integrate xango uh does it integrate simply with wallet connect and then the user can just choose on what it connects i don't have to specifically add you have to do you have to do nothing okay all right so uh the the the thing that we need to do though is if we want to develop a specific uh you know messaging for the user on yourdap there

is a little work that we need to do on our side but it's very minor and it can be done in like minutes um and so we're going to add without asking developers we're going to support all the most popular apps one by one and if you know apps is smaller and wants to interact with us they just need to ask and at some point we'll open source it and people will be able to do it by themselves hi my name is andrei thank you for the presentation um could you please tell does clearsign use any backend and is it open source or not so uh a clear sign is not open source we open sourcing all the cryptography that we are using so it's already there in github uh clearsign is a new product so our our principle is not to open source right away things we

first build them until they are crisp and then in a later stage we are we're open sourcing them so at this stage it's not open source last question thank you for the presentation um about the multi-party computing that you're using for the wallets um can you specify how does it work or there is sure i mean you could require an hour to explain that but very very simply instead of generating a pair public private key yeah right typical wallet do that um what we do is we are generating independent secret shares between the phone and our server right where the the controlling share is on the phone by the

user right and so together there would be a threshold signature which at some point uh replaces or performs as a private key and then performs a transaction on the on the blockchain okay so you have a the you have kind of a back end to absolutely okay thank you thank you thank you very much you