Wallet UX evolved: where we go from here.

Transcript

[Music] messy hello hi um so thank you for coming here I expect you've all had very long weeks here in Paris and this is the the wind down period but I'm very excited to talk to you about wall ux today um where we are and where we go from here so first I guess in this talk I'm going to talk about three things this is the first time I give this talk so you'll you'll have to bear with me with some slides back and forth and and potentially my not knowing exactly how long it runs but uh but I'll talk about three main things why this topic really

matters and I think while ux is is really at the core of what web3 becomes as a project on the internet um asking ourselves what is a wallet really and what are we trying to do with wallets which I think we have to understand in order to understand how we get our users to sign things and perform transactions in our apps in a way that feels native to these apps and then finally talking about you know what the Cutting Edge looks like today in terms of building wallets and interacting with users in a self-sovereign way so with that I'll introduce myself first then and why I'm here and I guess why I feel like I can talk about this topic I am Henry Stern I used to work at protocol labs for a number of years on things like ipfs and filecoin and I left

to start a company called privy and preview is a single library to onboard all of your users to web3 we add authentication flows basically for users whether they are crypto ogs and have 15 wallets spread across metamask rainbow and other providers or whether they don't know what a wallet is they don't care they just want to get to your app and they need to be able to perform transactions in order to do so and the the product as I alluded to is really built around these two sort of core pillars the first is third-party connectors enabling you to support wallets across environments across browsers across devices trying to save you from you know the uh Circle of Death that is I click metamask on my mobile phone I got taken inside the app I

connect my wallet to my app get taken back to the app then I get taken to the app store and then I'm stuck forever that's the sort of thing that we try to help you not have happen and the second piece obviously is embedded wallets for a user who doesn't know what a wallet is can they come in with an email a phone number a social login and be ready to go and can we provide you with a single abstraction in the ip1193 provider that looks the same regardless of whether the user is coming in with metamask or coming in with their phone number um now I yeah so this is a little more Shilling which I'll skip through uh but the question is why why do both why do we take on both the users who really know the space and don't need any help

handling wallets and so here on the left you've got a one of our customers Shibuya which is a very web3 native product that has users coming in with wallets most often and on the right you've got another one of our customers Courtyard which is a product that caters to card collectors physical card collectors who don't know about web3 and don't necessarily care so why are we trying to serve both of these customer segments even though they cater to different users and I think this is part of the reason why this whole question of wallets matters so much in the space um you know the the probably biggest meme in web3 that I keep hearing year over year is uh we're gonna onboard the next billion users and you know the current Paradigm I guess to put it bluntly of what a wallet looks like will not be how we onboard

the next billion users um it takes a little bit too much work to understand okay now I've downloaded this third party extension I've you know saved the mnemonic somewhere okay but now I have this one account but I actually clicked on this other account and I need to switch networks it's just a lot of complexity for a user to get through if what they're trying to do is a simple task on the app and I think on the flip side simply you know handing over the ability for uh generating user signatures over to apps doesn't achieve what we're trying to do either um if we're trying to build something that is really a user-owned internet we have to have this topic of this of self-sovereignty be brought up we have to have users be in charge of what they

put out and what how how you gather consent from them and yet the experience needs to feel a whole lot better than it does today and so we think that magic happens at the intersection where Native apps are built from mainstream users and that's why we build in the way that we do um I alluded to this a second ago but basically signatures are really core to use their own internet without improving wallet ux thoughtfully there are really two outcomes for this space the first is crypto remains a financial infrastructure first and foremost and we never move Beyond it um I think the cat's out of the bag on on you know D5 generally but I think consumer crypto has a long way to go and and solving this issue is critical to

actually unblocking consumer crypto um the you know Bizarro outcome where we do this but we do it wrong is crypto ceases to be user-centric for every app a wallet and that wallet exists only within that app and it ends up being a user account the same as we've had for you know the last 40 years on the internet 20 years on the internet um so with that having set the stage for why I think this is one of the most important topics in crypto today let's dig into what a wallet is I think we need to understand the thing we're trying to deconstruct in order to build something better um so there's this uh maybe in honor of the open Heineken movie that's coming out later this week There's this story uh from Richard Feynman in which he goes to a biology class he's a physicist and

he asks can you give me a map of the cat and one of the biologists in the room says a map of the cat certainly you mean and I'm actually looking through my notes to remember what it is that she says um she says certainly you mean a Zoological chart and and the fact that I had to look it up I think talks to the importance of naming which is a map of the cat is a very descriptive way of thinking about a Zoological chart and yet to the expert it's not a map of the cat it's a Zoological chart and I think I bring the story up because the name really matters what is a wallet and I think there's a really good piece out there by Gabby Goldberg on stop calling it a wallet because it has too many meanings and by conflating all these

meanings behind a single name makes it really really hard to convey to developers and to users what it is they're trying to do with the wallet at any given time um so all of these are wallets obviously they have different form factors they have different security guarantees they have different threat models that they operate under uh so we need to unpack this a little bit so let's start off with the technicals um so we'll skin the cat you know head to tail um there's this tweet that I really liked which was you know the core reason why wallets are the number one issue in crypto adoption today is because they're used for two things custody of funds best in Cold Storage transacting in apps best in browser we need separate products wallets and passports

um this Point's already to two things which is you know Cold Storage browser we're talking about different thread environments we're talking about different security guarantees and then obviously actions custody in funds versus transacting uh this is these are already a few ways to start splitting what a wallet does um so you know we can already start distinguishing between basically these two core functions the account and the signer the account secures assets is responsible for kind of securing this is my identity according to this wallet and the signer is able to perform actions on that account to change balances to you know indicate intent and so on and so forth and historically obviously these two functions were managed by the same piece of software and eoa wallet

so how do you evaluate a wallet if you're trying to purchase a wallet you know you should talk to us but there are many people offering these Services um at large I think there are really five factors that matter most first customizability um and that is can this wallet fit into my app does it feel natural for it to be here or does it feel like basically I've just you know graphed it on a completely separate piece of software that has nothing to do with what I do second custody who must my user trust in order to use my product in order to use my app recovery are my users protected from their own mistakes integratability will this work within my existing user model drive to completely shred my back end basically to integrate

this wallet and security are my users protected from attacks or malicious actions outside of the scope of user Trust and you know I'm gonna spoil it by saying unfortunately there is no one-size-fits all uh all of these involve trade-offs and so a couple examples you know recovery versus security the straw man of how you can build a simple recovery system for a wallet is let us you know store your private keys for you and we'll give them back when you need them obviously that works it makes recovery very very simple uh but from a security and Trust perspective it's a completely broken system in which you're entirely handing your digital identity the entirety of your funds to a third party likewise you can think about customizability versus custody

um a hyper customizable wallet let's say I build a Dap that has a single function I want to allow people to order pizza on chain for a dollar fifty my custom wallet basically has a single function which is purchase for 150 to this address it is a while that does one thing that does it extraordinarily well it's going to be the best wallet for my app and yet obviously if my user says well I just loaded 100 bucks into this and now I want to go buy tacos elsewhere they can't do anything with those funds other than keep buying pizza so the question of how do you Empower users whilst giving them a very straightforward experience that allows them to do what your app is trying to unlock is a really big one and at its core basically I think there's a tension that won't be resolved no matter how

much better cryptography we throw at it which is user experience versus user freedom and I think that is the sort of core tension around this ux in wallets we can do a lot with a kind of abstraction we can do a lot with various advances But ultimately ux comes down to how are you orienting your user through their app um so yeah that's the first core Insight I think wallets have to be fluid wallets cannot stay monolithic they cannot stay static in this case I guess the user is this this police officer who's about to get killed clearly by uh by a Terminator but the wallet must embody the the liquid term and it was form and change so that it fits your app really really neatly um and here obviously it's worth talking

about account abstraction so as I mentioned before in traditional uh ethereum systems uh because of the way EOS were designed signer and accounts are conjoined account abstraction splits the signer the person who can take action on an account from the account itself and so here is I've been spending a lot of time with a one-year-old of late here is uh an image of how wallets are broken down uh you know your traditional eoa is that big block with all of the shapes fitting into it but if you actually split it out the wooden block you can think of as a smart contract account it sits on chain it holds content data assets and then the signers are the different shapes that you try

and fit into it to perform actions with the block by separating the two you can unlock much better user experiences historically you know the the smiley here is your app uh you had to fit an eoa into your app and you can kind of see the relative size you've basically got this massive Cube sitting on top of that thing you spent a lot of time crafting and you might ask yourself why the hell am I spending you know time doing this pixel alignment when at the end half of my half of the time my users are going to spend an app is going to be spent in a third-party piece of software that I have zero control over and the advantage obviously with account abstraction systems in 4337 being one of them is that you can actually split out the signer from the rest of the account

functionality so that the signer is deeply integrated into your app as a single tool that's right for you and yet you don't need to require the user to sort of have a you know much deeper account that only exists within your purview so you can connect that signer in your app to an account that exists outside of your app on the entirety of the internet I'll plug here a little bit by saying uh that you know obviously this has informed a lot of how we build so that you know our embedded wallets can act either as EOS or signers um so are we done like is this the end of the talk uh we have a promising technical path but you know unfortunately we're not done because the tension comes from uh bridging that ux gap between what is theoretically

possible given the systems that we've built and architected and what actually gets built by people working on these systems um so let's go through a user journey and this is the second piece great so now you have these tools whether you're using 4337 or whether you're using elas you have different ways of generating signatures on behalf of the user how do you think about your user Journey as pertains to the interactions that they have to do on chain um and here maybe you know a bit of ux 101 good ux really is about guiding the user it's about helping the user understand how did I get here what should I be doing now and where am I going next and as I mentioned before it's really hard to guide a user when you don't control half of the software on their screen

so going through the user Journey users really interact with wallets in four core ways the first is you know wild creation slash wallet recovery It's usually the same mechanism that undergirds both the second is funding the wallet and I'm very hopeful that if we give this talk again in like two years that category gets stricken because basically uh funding and on-ramps are solved by AAA or by other Technologies but today it's an inevitable part of where users falter when they try and use your app um the third is a transaction submission or signature generation and the fourth is wallet export or interopt widely which is to say okay you've got a user now you know they've

loaded up their wallet with funds they can pay for gas or you're sponsoring gas on their behalf they're able to sign a transaction and take a non-chain action through your app um what now can they take their wallet with them elsewhere can they trade that nft that they bought from you on openc um so with that having skinned sort of the wallet sort of two ways technically and from the user standpoint let's dive into how that actually informs World decisions that are made today and here I'll talk about some of our work um so we're going to take a slightly deeper dive now into embedded wallet Creations there's a number of ways to do this there are a lot of different products doing it different ways and again it's all about trade-offs and where what guarantees you want to make

to your user and what experiences you want to build for them uh but I'll start with a quick primer on embedded wallets and here I'll talk about multi-party computation and specifically from your secret sharing as you know flavor of multi-party computation that you can use to get better trade-offs out of that ux custody tension that exists so we'll see how all this works but you have your user at the bottom here and you have your app the the smiley face um when your user first logs in basically you are able to create a wallet in uh completely separate iframe running in an isolated environment that's the monkey so here you've got you know your little key that appears that's the wall being created in the isolated iframe

um great so now the user basically has this isolated iframe you can run messages through this iframe you can get signatures back you can submit those on chain you have a wallet that you don't actually have access to because it's running in this isolated domain but the user has access to and that fits really flush with the rest of your application okay but now your user logs out and You've Lost That wallet so we need to do a little bit better we need to make sure that the wallet persists from session to session and so here we use show me your secret sharing a form of NPC to basically split the private Keys behind the wallet into multiple shares there's an auth share that's stored by privy so if your user sign in with email we will verify that this same email is coming in and we'll

return the offshare if it has and there's a device share stir stored either you know in a secure Enclave on your phone or in browser Secure Storage and from here we're basically able when the user logs out to destroy the key running in the iframe and then when the user logs back in to reconstitute A and D inside of the iframe to recreate a key and get the user going again so your user is able to you know log in log out and they have access to a wallet that sits flush with your app that no one but the user has access to you never see the keys preview never sees the keys good now what if your user wants to provision a second device and this is the base of account recovery I've lost my device my device been stolen I you know have both

a computer and a phone I need to use my wallet across both so obviously this is where the third key share matters so we are running a two of three system R is the recovery share and using that recovery share basically when the user logs in to the third system they can basically combine the auth share in the recovery share to create you know a new set of device shares all together reconstitute the same key and now they're provisioned across two devices cool how does that actually look well in this in this model and here I'm actually going to go through a few options which which is part of the point in this model you know you can have and it's hard to see here where you've basically got a

passcode entry uh at the top so when your user logs in we prompt your user to generate a passcode and the recovery share is basically encrypted using some version of key expansion and that passcode by that user's entropy so basically preview will store the recovery share encrypted with a user secret so that we can never access the recovery share we never have enough to put the keys back together but when the user tries and log in if they can provide the appropriate passcode we can return the recovery share to them as we do here to help them uh create uh the the same wallet on a new device now the ux unfortunate part of this is that whenever a user signs into a new device they have to re-enter a password

it's a bit of friction so you might ask okay but I want my wallets to be recoverable with zero dependence on a third party I don't even want privy holding any encrypted materials so what do you do for me now and so you might have a second model which we do uh and here the recovery share is actually stored directly by the user so you can prompt the user and say listen as you create your wallet um or as you create your account depending on how you want to phrase it you need to give us access to your iCloud your Google Drive your Dropbox and basically store a key share there and that way even if AWS the whole internet goes down privy goes down the user is able to basically combine their

Dropbox account with their device and recover their wallet so they're good to go they're not dependent on anyone else now the obvious tricky bit is that when they sign into a new device not only do they need to enter in a passcode but they actually need to auth with a third-party system so it's that much more fiction what if you say but I don't want any friction for my users I want them to be able to move across devices completely seamlessly well there's another model in which privy can provide the entropy through which the recovery share is encrypted that entropy can be secured using a Hardware security module and so on and so forth the point I'm trying to make here is that there's a lot of ways to skin a cat and You're basically trading off across the way ux for recoverability you can get better ux and slightly worse

recoverability or you can get uh slightly worse ux and slightly better recoverability and the point is wallets are not one size fits all at the end of the day this is why we've built third-party wallet connectors is because for some people what they really want is a ledger that sits in their pocket or a piece of paper that they can use to transact and I think this is really the the lesson here is consider who your user is consider what assets they're storing as part of your app and then pick what ux you need for the model that you're building uh as you do this obviously consider all of these parts in the user Journey while creation funding transaction and Export and the export point I think is the next piece that has the lowest hanging fruit

in the space right now we have written a bit about it so I'm plugging here our blog but there's a lot of really interesting work to be done on how do you get wallets to interoperate across websites when they don't sit in the user's browser directly when they sit with the app itself so with that I'm going to conclude um technological shifts are going to unlock a lot of Novel ux for us I think account abstraction is a huge part of this story that is being told um but it only works provided we build it I think there's a lot of you know hand wavy finger snapping saying account abstraction will exist and ux will be solved and that isn't true unless we build the systems that actually make use of this technology with account abstraction you still need a signer your user still needs to be able to generate

signatures and so you don't lose you know account abstraction itself doesn't solve having to store mnemonic this is part of why you know the whole account abstraction versus NPC debate is is not all that interesting you should use both um wallets have to be fluid to account for your user experience and your threat model and the way in which you choose to use a wallet depends on what you build and I'm very excited to see more and more options so that we can move away from the monolithic consumer wallet for what it's worth I think there's a huge place for Consumer while it's in the space I think there's no way to have better guarantees of complete autonomy and self-custody than a consumer wallet an app that belongs to me and me only but it's only one of the flavors that I can get and depending on the user

experience I'm trying to unlock it might not be the right flavor um and then uh once more uh think through your user story think through the touch points uh at which your user has to interact with on-chain systems and decide how you want to build your app accordingly and as always think about onboarding think about orientation and think about the defaults that you build for and somehow there's an animation here thank you very much [Applause] [Music]