Recovery is the key to sovereignty - Olaf van Wijk

Transcript

Hi. So, thank you for joining and welcome at this presentation. I'm Olaf van Wik already introduced eh found of Neelium which is a protocol for solving some of the problems we are going to talk about today. Ehm the title is recovery is the key to self-sovereignty and privacy. And the idea of the presentation is to give a bit of a framework about what key recovery is, what the problems are and why it is so important for mass adoption. And now why this is important for mass adoption and I'm not the only one who's saying this. There's a lot of big names in the cryptospace who see key recovery as one of the core problems for mass

adopting crypto. Nou when we talk about mass adoption I want to bring up one small research by oh nou this this one. Sorry. So when we talk about crypto eh and key recovery, it is very important to understand that crypto introduced security that was very very strong but for the vast majority of people it feels very very unsafe to use. And the reason is is that everything with cryptography requires keys or secrets in some form. And the base principle is very simple. If you lose your keys, you

lose your access. And by solving the idea of security and moving to more safety, there is the problem of that convenience leads to custody which defeats the entire purpose on why we are here in the first place. So now this is a bit of a I'm gna see if actually could see it. This is a research of someone on Twitter. I know we operate in crypto and that is that we see it here there's the gray bars are a distribution of personality types and the orange bar is a distribution of personality types of

people in the space and what we see here is a large variation in the distribution in the world of people and how they are represented in crypto. And that's basically displays just how much in a bubble we live and when we build solutions for things like key recovery and when we talk about it I talk to many people and like yeah but se traces are fine. fine people in our bubble but they not fine for the vast majority and if you add that up almost 80% of the population and when we talk about in further in the presentation about usability it is about addressing that group and even as you

can see here like there are different groups doesn't matter you don't all have to be technical because we all know some taxi driver who uses crypto experimented with and was fine with it Right. So it's not technicals versus nontechnicals, but there is a group of people who is susceptible to education and people who just want familiar experiences. And key recovery is one of those problems to solve to offer a familiar experience. So when we talk about the concept of key recovery, it's very important to understand where the keys come from. And it's very simple. You either generate them yourself or someone else generates them. There is

practically there is some variations on this. But in relation to recovery, it's basically if you generate them yourself, you have to deal with the recovery and getting them back at some point, but you are absolutely cryptographically sovereign and why we started everything with crypto in the first place. And the other version is externally generated. It's either master key. There is a lot of innovation here. But the gist of it is that it's mediated access towards eh control. And from that point on we see a lot of decentralization happening which is good right so and then we have the other important factor when it comes to

key recovery which is going to be very relevant and we see that soon is how we use them. Eh how we use them is very different these are very different one of them is authorization. It's basically if true then do something and this is basically how the entire web tool works right. Ehm you instruct some other party do something on your behalf in their systems. Ehm to a large degree this is also how account obstraction and uh more technical version of the blockchain work because blockchain has is a world computer especially ethereum that executes on your behalf. So you authorize basically the system to move on state. Ehm but also things like

multisek and pases are of this part. And then we have the private use. And this is the more difficult one. That's encryption. It's where the cryptographic operation actually requires the secrets to operate and a lot of the privacy tooling we see now that a lot of people on big names talk about. We need more privacy. We need more crops. We need sensorship resistance. All of this requires secrets to operate and in to a large degree this is the same as externally owned counts. So when you talk about recovery you need to get your actual secrets.

Now there's a graph. There's a lot of information in this graph and we go to zoom into those parts a bit further. We have the vertical axis here which is decentralization. Higher is more decentralization and the usability more to the right is more to a web to like experience. And again remember the first growth we showed this is for people who are not on boarded on crypto yet and would otherwise be not willing to. Now we see a lot of this is not an exclusive graph but the point of the graph is here like we start from the left we see clearly that there's like the orange balls are selfgenerated keys. So this is where you start from

and on the right bottom we see where you start off the position when eh keys are generated externally and they move onto the ehm decentralization trajectory. is clear trend visible here more can go into that later. Clear trend visible here. We see like more decentralized like more self is less usable and the more we move to the usability side we basically lose some degree of custody all the way to a lot of custody uh loss. And where we want to end up is actually in that top right corner. We have to break this

trend if we want to solve key recovery. Now let's zoom into bit on one of these quadrants. And here we see some solutions that come from the perspective where the keys are generated by the user themselves. Even things like pass keys like you generate these uh these keys on your phone. Now we see things like BIP BIP 39 things like Shamir signature and social recovery. There has been some degree of innovation here, but these a lot of these things were already possible for very very long time. There's been very little actual innovation happening in this degree with maybe the exception of

things like paskies which are recent innovation and that immediately wants to address another dimension in this graph. A large bubble means a large thirdparty dependency because if you use pasky just dependent on either Google or eh Apple to solve this for you. But I want to the goal is here's been pretty little innovation on the act of recovery not in usage on the act of recovery and then we have the other part where we start off where some third party or not some third party where a third party generates a key and then bolts on to the degree of decentralization and here we see a lot of large bubbles because there's a very high degree of counterparty risk because if they stop

operating you're basically done. But this is where the last 10 years 5 to 10 years a lot of innovation on usability has happened in cryptospace. We see a lot of things like preving up the use cases for a lot of people otherwise not want to generate their own seat phases, split them up, do social recovery, do all of that. So there's proof that by just producing a better experience increases the likelot of onboarding more people.

But we also do see from this graph that actually leads to more to less decentralization and higher counterparty risk which is ideally not what we want. Ehm nou what is actually the problem that we need to solve? So what are the actual difficulties eh that we need to solve or do we that we deal with once we want to solve keyography? basically break from the trend that we saw in the graph. So the first one is I like to mention that it's like context locking and that's basically that the recovery procedure that you try to do is lock to

a circle context and to give another example on why context locking is important and when it was solved once is when we look at things the generating keys something like bip 39 seed phrases were widely adopted simply because they were context gener wallets malls etum bitcoin solana whatever is that you want and all rely on something that is context agnostic to work eh and this context locking is very important to ideally have slow lowest dependency on the second one

ischest ar is one of this is where of problems come from and that is the idea that you need to think about the worst case scenario before you even start and have to call friends before anything is lost before in the case of social recovery ehm and thinking about this is what causes a lot of the x friction and what that's what we call the oxistration burden is this the idea that you have to think about the worst case scenarios before you even start doing And the third one that one the most difficult one and the concept of the unverifiable trust and that's when before we had cloud sort of the concept if you never tried to do reset the

backup you don't have a backup and this is the idea that at the moment you are at your most vulnerable and actually lost access how certain are you that you're actually going to get it back and not be extorted censured or whatever in some degree so how certain are you that you're going to get it back and that's very because if you're not certain get back in chance the recovery might not exist at all. So why does this matter for option? I think it's sort of a self-explanatory answers like asking the question is giving the answer a bit but let's go it's basically growth attrition the idea that of unsafety eh stopping mass adoption it's just the idea there's all these stories there's no good solution

ehm and that's basically comes down to the threat of permanent loss and this threat of permanent loss is not only for individuals this is also very much true for companies and institutions which immediately leads to things like the custodial trap where Black Rock will say just let us do it and now we're back to the original point. Why did we start this in the first place is not to give some central parties control over everything. And lastly, which I think is very important is that if we don't solve key recovery, there's a very real utility ceiling. En the utility ceiling is that if we rely on people managing keys ehm there will always be degree of idea

about power users and that's just the small subset of the population and use cases that we can actually provide. So if we and that also relates to things like privacy. There's a lot of movement towards growing more privacy applications but they introduce more secrets. So if we solve it into one context like say Ethereum with the counter section we talk about that a bit later. all other new applications have to reinvent by the need to reinventing this ja creates utility ceiling for broader adoption now again special shout to native counterstction which i think is very good in the context of specifically

ethereum but it is an authorization mechanism because everything is public it is the code is public everything is public you can recover sign control you cannot recover key. So it's not something that works for externally owned account and is only valid on chain, but it does much more of course in the authorization space like payment limits. So it's definitely not something I want to discount especially in the context of Ethereum native applications and if you don't go out of that context it's a very good solution. Now how do we go towards a solution?

And I'm gonna paraphrase here a little bit of Milton Freedman. I do not believe that the solution to our problem is to simply trust the right people but to build to important things to establish technology which will make it profitable for the wrong people to do the right thing. Well, this line of thinking I would argue underpins all of the entire blockchain in cryptospace because this is what we've been doing and what blockchain solved and Bitcoin from the start with proof of work. It is simply make it more profitable to do the right thing than to do the wrong thing. And that is in the end what all of these systems provide. Well, proof of work in our situation is not really a relevant topic.

But proof of stake is very interesting in the sense because what proof of stake actually is is attributable misbehavior. It is you promise to do something in a certain way not violate rules and if you violate the rules you can be cau and your money can be taken. And this is a very important principle because this is to be fair the security model entire Ethereum runs on provable misbehavior. So if we want to go to that ideal position in this graph, we want to marry these two concepts.

ones all innovation happened. Right now there's large potential ability to colle. If you can solve that collusion by provable misbehavior or proof of stake, you can move the very high up. And that's what you can that's how you get to a solution. Roughly speaking, bring your own keys. You define the rules and you can and the idea is here that you can slash the counterpties in the case that they violate your rules. And the ide is that

here that's a bit different. This is application level proof of stake not a consensus level of stake is that if you can produce something slash conditional key recovery change the balance of power. in the relationship with custodians. So what do we actually get when we solve this? Right? Because that's in the end the very important problem even if we solve it. Now what? Well, in the same way bit 39 solved key generation and allowed a vast explosion of interruptable wallets to exist.

Eh if we could generalize recovery the same type of ehm explosion could happen but a focus on operational security because now all of the developers a lot of the tooling needs to think about how do we even recover access to the service to the wallet to the application everyone needs to do this himself if we can take away that burden there can be higher focus on operational security we get to more privacy applications into the hands of normal people. So for privacy we probably know this but the more people that use the privacy tool

the more private we are when we all use the tool. So making it easy to use and easy to recover from would allow for larger anonymity sets, larger privacy tooling and more people being private. And I think we all agreed that we need more privacy. And in the same way the harmonization across the chain and application recovery. So by harmonizing this just mention this with the BU 39 recovery. And the last thing is what I find most interesting because if we can solve recovery in a context agnostic way that is not tied to one blockchain. Now to used to be a lot of privacy tooling like PGP even we have

now proton like things like proto mail that do use a seat phrase. There's a lot of cryptographic applications that do not use a blockchain at all that are very very useful but do require some degree of identification continuation. We have seen things like solid pots where there's decentralized storage there's no encryption there. Why? Because if you lose the key, you lose the access. But if you can recover these keys, there's a lot of tools that can be used and built just by the verdict of being able to recover your keys and with that opening the space to a lot of eh non-power users. And yeah, so here's a bit of a list but nonexclusive and I

think the ones for us in Helium the one we specifically set out to solve was forget my password. thank you for listening. Eh, that was the presentation right on time. Good for questions. If you want to know more about what the helium is doing specifically in this space, feel free to contact us. Ehm I promise you we have a nice solution. Thank you. Thank you very much OL. Do we have a question?

So thank you very much for the talk. You said you have a nice solution. Ehm how context independent your solution is. So isn't it just trading of Apple to your solution? Nou on context agnostics fully contact agnostic so the goal was passwords and secrets but it can secure any data under arbitrary conditions but then to make for that sentence to make sense I need to explain a bit more about the solution but it is fully contact agnostic and the dependency is really not on a big tag but on participant network.

Thank you. Anyone else?