Self-Custody Unconference

Transcript

Welcome by Jérôme Bailly, Vice-President of the Board at Crypto Valley Association / BD at Adnovum

almost good okay I think now we can uh we can start I I need uh to have a confirmation from uh from Nikki that yeah good to go thank you very much everybody for uh uh attending this uh crypto Valley event on uh self custody so this is a hybrid event meaning that we have here at adnobu office in zurika an audience uh in person but we also have uh people following us uh everywhere with the with the zoom zoom stream so thank you everybody for for coming it's uh it's uh it's a it's a it's a pleasure to welcome everybody

here at uh at underboom and uh to spend this evening together uh with the the speakers that we have uh from the crypto Valley uh so this event is organized by the crypto Valley Association and by the cyber security of uh working group of the association and Marcus will introduce himself and this group and the speakers just after me and uh let me allow you to uh give you a few slides of um what is the crypto Valley Association because uh as today it's a free and open Event uh maybe we don't have uh only members already so I introduce myself uh I have two hats today I'm the first

cryptovel hats this president of the crypto travel Association and I'm also doing business development here at uh at the room and they feel free to contact me follow me follow me on on Twitter so what is the crypto World Association it's an associate professional association non-uh non-profit uh established in 2017 uh so five years ago um we have now more than one thousand member uh including more than 250 corporate member companies from startup to uh to large corporate here are some logos of the most well-known uh covet members we have in in the crypto

Association and this is the global map of uh uh almost 200 plus uh companies that are um members of the association so you see not only in Luke not only in Switzerland everywhere in in on the planet so we have working groups nine and working groups and you see one of them is the cyber security working group which allowed the the the event tonight uh but we'll also have chapter uh Regional chapter like local in Switzerland we have the Western chapter which is Western Switzerland meaning where I'm from maybe you can hear from my accent and we just launched two or three weeks ago International

chapter we started with South America chapter Middle East chapter and in in the coming weeks we will have uh the North American chapter which will be launched so it's a really Global uh Association already 35 roughly of Our member are abroad Switzerland we do hybrid events like today fully virtual events online we publish uh papers by the way I think the cyber security was a very productive you are the two or two two papers published by by the working group and of course the flagship event we do the crypto value conference once every

year in June uh last time we had 700 700 attendees and save the date for the next one uh in 2023 would be June 1st and 2nd you can join us to uh connect learn Network Advocate it's it's uh it's easy to do it online on cryptography we have membership for individual startups SME and corporate then here for the uh in-person audience uh you are in the brand new headquarter of Anna room um and I will I'm representing the banking and fintech uh division of uh of any room so we are um a company created in zurich's more

than 30 years ago we have 600 650 employees half of them are here in Switzerland in Bern and also in lausanne and the other are abroad as they're in Europe or in Asia Pacific we do digital solution cyber security application Cloud Consulting both for the traditional uh Finance but also for the the digital assets so you can see that we work for on the left of the screen in finance we work both with a retail bank Continental Bank and private Banks so these are only the

logos that we can display obviously we have a uh much more be careful with the with the camera um and yeah some some example of project you maybe some uh your best client in the room or online we we have done the and we are doing the digital banking solution of UBS both e-banking and uh and Mobile Banking I'm sure some of you use twins it's a it's a project that we uh we we did from scratch at uh at that and now we are very happy to see that this uh this project is very popular um in a digital asset we we worked with crypto Finance on their asset management

software um we also work with various other uh crypto Bank uh based in uh in Zurich and uh yeah last but not least of course and the womb is a prod member an active member of the crypto Valley Association so yeah there is for the for the intro now I will um I will end it to to you uh Marcus Marcus uh uh you at the great idea to organize this event with your working group and active member of your working room so I will uh let you introduce and uh and kick off the presentation thank

Event opening and topic introduction by Markus Perdrizat, Chair of the Cybersecurity Working Group at Crypto Valley Association / Head Custody at Bitcoin Suisse

you Marcus and thank you the working group thanks for the introduction sherom it's been just about three years that we had the first working group Live meeting about the Swiss blockchain security and I was there in a panel speaking about the security of custody Solutions and today we're again here in Zurich speaking about the security of cost resolution and it's really great to be back in a physical meeting being able to catch up with people in person and it's also great that in the two years of Corona we've learned how to have hybrid events so welcome audience

around the globe good evening good morning good afternoon as the crypto Valley working group in cyber security we're meeting on a monthly basis to speak about what happened and what's happening in the cyber security space in blockchains and DLT Solutions we are practitioners of cyber security in that space we are also practitioners of cyber security outside of blockchain who would like to learn about blockchain Secure Solutions and we're also welcoming people who are just getting started in Security in blockchain and outside so very open group we welcome everybody to join us in our monthly meetings when you remember

of the crypto Valley Association you should receive the invite to our working group meetings in your email please make sure to join if these topics are interested in to you even if you don't if you're not an expert today we welcome an open group a mixed group of people you're welcome to join us and listen and learn as much as contributing to the sharing of information as well as contributing to the papers and research that we publish it was just this year that we published two papers and over the history of the crypto Valley cyber security people in the world it's a total of five papers that we already released entirely out of the voluntary

work of members of the working groups my name is Marcus Paradiso and I'm the head of custody of Bitcoin Swiss you may ask what is the head of costly doing in a self-custody event well that's how I got started for one in 2013 when I bought my first Bitcoin what options did I have I downloaded Bitcoin it wasn't even called Bitcoin court at that time I created a wallet no deterministic seats at that time yet and in the meantime of course the space has come along I have joined Bitcoin services in the meantime but even now self-casted is very important to me personally and also very important to us at Bitcoin space

some would like to be in control of their own assets some would like to be their own bank and that's important that's what part of makes crypto and blockchain crypto blockchain that you're in control and you can choose the solution that's right for you today we're focusing on self-custody we will be giving away a self-custody device a bit box sponsored by shift crypto today and will likely be a quiz at the end to answer the question to figure out who should win the big bucks so please

pay attention and of course it's limited to the audience who we have in the room today what do we have today it's an unconference it's lightning speeches the dinos so how is this going to work today the four panelists sitting here in sequence are gonna step up to the stage and keep a lightning speech about five minutes at most seven minutes and if they go longer I will need to cut them off so I'll have the clock running and we'll be monitoring the time so they'll speak fast they'll go through a lot of content hopefully you'll learn something and then immediately we'll open up the

audience for questions so if you see anything that you'd like to follow up on that you'd like to dive deeper or that you like to ask the speaker who just went through the lightning speech that's your opportunity I'll open up it out for questions mostly in the room here another five to seven minutes so we'll be Bam Bam Bam will go through the speeches lightning speeches then I have two maybe three questions and then we go to the next lightning speech of the next person at the same time we're also collecting questions for the online audience and we'll have time at the end for a few questions from the online audience so without further Ado let's get started

Overview of wallets: mobile, paper and other by Maria Sommerhalder, Managing Consultant Emerging Technologies at AWK Group

Shadow merrister Mike let's see if this works does it work yeah okay great thanks a lot um let's just see um my first um the first talk today will be about the different types of wallets that we have it's going to be a short overview just in case that people don't um don't know what the different types of wallets are okay great so I will start with with paper wallets um this is the the most Lo-Fi version of wallets that that maybe all of you have seen before if you've been in crypto

more than a couple of years and it tends to look like this where it's either a self-generated wallet where you write down the public key private key and maybe even the address and it might or might not have QR codes to to use with secondary wallets um and in general like as I said before you can you can generate yourself in a mostly secure way for example with an air gapped PC and offline but ninety percent of people tend to just go to a website which generates a PDF file for them they download that to their normal PC with um with internet exposure and then send it over Wi-Fi to the printer which is obviously a cyber security

nightmare so that's the first kind of wallet that people tend to be exposed to now I I noticed in the last let's say 24 months that there's been a certain like convulsions between the term uh paper wallet as well as the the seed phrases so people tend to refer to their seat phrases so like the 12 uh 12 or 24 words that you receive when you when you set up a wallet um to to their people as well but there's a difference obviously because when when you're referring to these seed phrases those are backups those are not actually your paper wallet but anyway like they're both both paper based so I'm just like throwing them in there so what what you need to be be careful

of when when you're um handling these paper wallets or paper backups is that they're very very susceptible to fire and water damage as well as to fading like the the writing that you that you have on paper can fade uh there can be termites in the house that destroy them so it's really important to to laminate them with for example a feed proof or a waterproof kind of plastic lamination system um for additional security it might might make sense for those backup systems with the c phrases to to have an additional passphrase as added security then let's move on to the the second one um my second least favorite one would be

the PC wallet meaning that you download a piece of software a wallet to to your PC and you store your your keys on your hard drive you can encrypt them or you cannot encrypt them doesn't matter and um well this has a lot of different uh vulnerabilities because your system is only as secure as as your Hardware meaning that if if you use your all-purpose computer where you surf the web this will of course be less secure than if you're using a specialized air gap PC um the Saving Grace there is that you can actually use your Hardware wallet in conjunction with all of those PC wallets adding a additional layer of security meaning that you never expose your

private keys to to your PC um another more famous One recently has been the web-based uh wallets these are all the types of wallets that you use your browser in conjunction with so these might be your meta masks these might be your my ether wallets Etc um these are easy to use and in general you can say that you are in custody you're in control of your own private keys because they do let you generate your own seed phrases however there are certain vulnerabilities with with these wallets because you are interfacing with a website and you are trusting trusting them to generate your private keys so you have no idea about the type of entropy that is behind

um the systems that are used to generate the priorities and you also don't know if if there's been some kind of leak right um then also another thing um really important is that they're super vulnerable to phishing so a malicious actor might generate a a website that looks exactly like um like the provider and asks you to input for example your 12C phrases which you should never do mobile apps are similar to PC but what they have is a secure element which is essentially a an isolated uh part of your memory which only that specific app is is allowed to use meaning that you have a

certain secure Enclave where your your app can um process certain information or store cryptographic secrets what you also need to be be careful here when you're using mobile wallets is the fact that there can be keyloggers like for example all of these nice Emoji key um like keywords that you can download these tend to be quite quite dangerous because they they can log any any keystroke that you do for example if if you're entering your passphrase or your 12 seed words um then as a as an additional um word of precaution because people don't really talk about it is it's the fact that you should disable all of the backgrounds at background ads um sorry apps when when you're actually using these hot on these

mobile wallets in order to make sure that um there's just one dedicated app that is running it at this time when you're using your crypto then on to Hardware wallets I mean um dog will talk a bit more about it but these are dedicated devices which ensure that the private keys that you have will never leave the device so essentially there are like I have two over there maybe I can show them later but um so these are dedicated devices that are either used to construct transactions or store your private keys and actually sign your transaction with us those private keys they're really like an an additional step in security because they allow you to

um to like off-board all of the physical security and um under it security from each other because when you're setting up the this this wallet you're you're being asked to actually record a mnemonic phrase so that the 12 or 24c phrases that I was mentioning earlier um you can keep them on paper while um the seed is actually um you don't have to take care of the seed you can re restore it whenever you lose your Hardware device so you're not really um like ties to to any hardware the important thing here is that I mean Patrick will talk about it a bit more but we'll we'll have to be really careful about the backups that we make of of the 12 words or 24 words an important thing about this as well is

that the the security is very much harder about so you have certain additional knacks to to increase security like for example you have a an additional pin that you can Safeguard your your device with and you the pin will always shift Direction so no one can actually um tell the um which pin you're entering because the keypads will keep shifting and some of them as you can see on the pictures I don't know if you um on locations you can see it but some of them have a screen where you can where you can actually demonstrate certain things to the user and the user can directly interact with the device meaning that it's no longer um necessary for them to actually

involve a PC or keyboard something else that could be key locked um one thing however that I would like to talk about is supply chain risk so make sure that you're actually sourcing it from a reputable vendor we have two of them here yeah all good yeah all right thank you very much Maria please introduce yourself okay yeah my name is Maria Somerhalder and I'm a consultant for awk group I used to work together with Marcus for DVC where we were auditing crypto Solutions all right good thank you very much are there any questions to Maria about

wallets not right now oh yeah there is one any numbers of distribution how many users are using these kind of products first question is are there any numbers of users around the distribution between these wallet types you would have to ask the wallet providers maybe doc can answer people do you have an answer yeah so that's uh State secrets of course but um if you look at some research they say there's 200 million active users right now so that's the the

broad picture of course that's growing if you look at Hardware wallet manufacturers and cells I think only a ledger is really talking about it and treasure also where it's um in the few Millions uh reported sales so probably mid mid Millions for Hardware wallets and then um tens of millions to hundreds of Millions for um uh exchanges I would say and maybe the online web wallets yeah we crossed by 5 million for per lecture yeah any other questions please okay yeah I mean best practices you're

you're talking so um the gentleman is asking about best practices for wallets and I assume you're referring to what kind of wallet should you choose yeah so okay it really depends on what your level of knowledge of the technology is right because um there's always as you said a sweet spot between your own knowledge of of the technology as well as like your risk appetite I mean certain people might have higher risks than others so for example if you're a celebrity you might be more at risk of being robbed or you know some swapped but for us normal people it's um the highest risk is like losing the keys or like forgetting where

we stole it so uh sorry we kept it yeah um so I would I mean in 90 of cases I I would think that it's it's a sufficient if you have a hardware wallet and you keep two backups of your C phrases which are um the sort of random words according to pip 39 that you get when you set it up so you know use pen and paper laminated paper or you might even put it onto steel like I've in the first section the First Column there I'm talking about Metal as well because not only can you record your C phrases in in paper but you can also also etch it or like you know uh sometimes you have like these um these sets where you receive like scramble scrabble like letters and you can assemble the sea phrases so I

think that's for 90 of people will be sufficient so just make sure that um you have two backups in two different locations um you might actually put them into tablet proof envelopes or into fireproof safe something like that yeah I do not recommend paper wallets we could take one more question maybe can I if there's no question I would like to elaborate in paper wallet maybe because there's one um one risk about paper wallets that many people aren't aware of which is the fact that it's actually a single use wallet so um when you see that picture there of a of a paper wallet you can see that it's a public private key

but the fact is that if you use like utxo based um cryptocurrencies like Bitcoin you always need to change address right so if you if you send a certain amount of Bitcoin from one address to the next you're not just sending for example 0.05 Bitcoin you're sending the entire amount and you're receiving the change back meaning that whenever you interact you need a change address you need an address for the the rest of the amount to come back to but that's not the case with a hardware wallet so some people have had the problem that they have actually imported their um their private keys from a paper wallet into a software wallet just to test they sent a small amount to some other wallet and um then of course like the the software wallet has actually

generated a a change address for them as as is customary for for new wallets um but then they just forgot about that they were like oh yeah um all the crypto must be back in my paper wallet let's just delete delete the software wallet and put the paper wallet back into my safe and that's how they lose their crypto so just be really careful about that so Maria we heard I do have one bonus question for you we heard about utxo big 39 etching metal and all of these other nice terms why do people actually go to to learn how to get started with self-cost and if that sounds like too much well I don't know it's kind of basically like learning by doing I don't know

about you guys but I basically learned by exposing myself to the stuff and trying losing some crypto in the process of course but like that's just the nature of things like trying it out um reading all you can about it like there's a lot of interesting documentation maybe we can send around some links as well um and yeah there's a lot of uh really useful YouTube documentaries that you can watch about this stuff there's lots of good stuff online there's also lots of bad stuff online so be mindful when you go and ask Google there are Bitcoin music groups and crypto user groups in almost every city around the globe and that's also a good way of getting started it it is usually random strangers there but they're good

with humans mostly and and here to help if anybody has other accommodations start small definitely yeah so small all right thank you very much Maria we hand on over to Douglas is there a clicker okay so uh I'm Douglas I'm a CEO and co-founder of shift crypto where we make the bitbox hardware wallet one one type of Hardware wallet um that was originally inventor now I am stuck in doing business as a CEO

Deepdive on hardware wallets - Why & how? by Douglas Bakkum, Co-Founder and CEO of BitBox #hardwarewallet

um but happy to to be here talking to you today and so I'll start I'll try to run through this really quickly um I wanted to do deep dive five minutes I can't dive too deep um and if there's time we can go a little bit more so a few years ago a number of years ago I was invited to speak at a conference uh the keynote speaker was the head of the CIA um former head of the CIA and he said that there's two types of people in the world those that have been hacked and those that have not yet been hacked he was later corrected by every other speaker at the conference that there's two types of people in the world those that know they've been hacked those that don't know they've been hacked uh and the take-home message of this conference was that if you have anything valuable

on your computer or your mobile phone it can be easily stolen by a thief who's motivated enough this is an example of something that might be on your computer your mobile phone that's valuable this is uh one of those seats but Maria just talked about um random bits of data random numbers like this hold trillions and trillions in value well maybe a little less than a trillion now um but that's pretty good motivation for a thief I would say and uh the issue is that security doesn't really scale so imagine the seed this this random number is inside of this red balloon and you need

to keep it safe and so to keep it safe you have to protect all of the surface of this red balloon but an attacker to get it only needs to find one little area to poke it with a pin and pop it and if you look at computers mobile phones they're actually designed to make this balloon even bigger through downloading apps through the App Store your browser web access and so on and so on um and so the the solution to this would be then try to make this balloon as small as possible maybe use something other than rubber something a bit stronger and that's the whole point of Hardware wallets and so the concept is very simple

um they generate the keys on board the device their their single purpose miniature computers and they never let these Keys these secrets your coins touch um the computer or a mobile phone where hackers or malware could see them and so these are um uh offline Secrets ideally no operating system they have a miniature computer on it uh some of them a lot of them have additional secure chips for added security and ideally they're open source so you can or someone can verify them keep the manufacturers accountable purpose one as I mentioned before is to

generate and store the keys and this is done through random number generators on board the device Randomness also called entropy is extremely important if you if it's bad quality Randomness someone could guess the the seed and then if they can guess the seed they can take all your coins this has happened in the past with online wallets that use JavaScript in the browser where there are some back doors in there and people could predict what seeds were created and people lost a lot of money um they should be designed for physical protection that means if the device gets stolen um your keys should still be protected I think it's important to note that nothing is unhackable but the point for Hardware wallets the goal of

Manufacturers is to make it hard for a thief to extract the secrets by heart that means takes too much time or too much money to actually extract them and um as mentioned last slide backup and Recovery is very important so this should also be all completely offline through the device itself um the second purpose is it should be usable and so there's often a false or a dichotomy oh sorry there's often a saying that there's a trade-off between security and easy uh but to me I think that's a false dichotomy and the goal of Hardware wallet manufacturers is to make something that's both easy and secure has to be easy otherwise people aren't going to use it self-custody is really

important if there's time I'll talk about why I think that's important um and so easiness is something we really focus a lot on and so the question before how do you get started um you can buy a big box sorry sorry for that um and another key important factor is there should be a screen on board the device you can see one here in the picture and that's to again the the idea the threat model is you should just assume you're a computer or your mobile phone is uh hacked um and then all you need is a hardware wallet to be safe and part of that is by verifying visually that what you think you're going to do where you're going to send these Bitcoin to what address is

actually what you really are doing so you can trust the screen on the device and of course there should be no automatic signing so there should be some kind of button that you press to confirm um with that thank you um do I have more time yep okay seconds 90 seconds great uh and so this is a conference about self-custody and so I think it's important to say why why self-custody is important Marcus touched on a little bit before but just my opinion um if you look at Bitcoin and other cryptocurrencies a key factor is they're decentralized this is what allows all these great properties of like censorship resistance anyone in the world can participate

without needing the permission of a government or a bank or anyone they can just participate um however we talked about numbers before if most people are keeping their coins on exchanges that kind of defeats the purpose and so exchanges can act as Gatekeepers you have to trust them it's basically an IOU um there's billions and billions of value lost over your tax of exchanges governments can tell exchanges to block this account because it looks suspicious so you get censorship you have to get permission uh from third parties and governments again and you're just back into the Fiat world and so I think Bitcoin and other cryptocurrencies they

want to be held by you and I think uh Hardware wallets are often considered the the best way to do that the safest way that I will end and open up for questions thanks thank you very much Douglas very much on time let me stop the timer here any questions in the room a little bit bigger and more convenient the color screen I mean on the Nan knowledge foreign so the question is why is a screen

required and a follow-up question why aren't the devices bigger if the screen is so important yeah I think why why are the screen so small was the gist of the question yeah and so I think um yeah some of them are really small I I think when we made the device uh part of the design aspect for us was to make it also um discrete so our our device looks like a USB stick if you unplug it you don't see the screen um and so we thought that was important uh as another aspect of security so if you just have in your pocket you have in your desk people don't suspect there's you have your million or 10 million in Bitcoin on it for example

um that said uh you know the industry progresses uh and so I think there's an example of advice here with the bigger screen uh and this is something we're also considering and so um bigger screens touch screens uh things like that it's the two assets really a question of what the market is looking for that was a question from the gentleman in the blue shirt okay friend of mine years ago for ADHD company next uh like a credit card they didn't attack in the software but they just kind of hated it and measured it you know physical properties they've used it I'm not sure I don't know the

hardest but is that are those chips that he used kind of by Design so the question was um in the past he heard a story about um people attacking like credit card chips Bank bank cards um and not using algorithms but using like physical attack mechanisms he's wondering if if this is a consideration and so yes definitely Hardware wallet

companies are aware of that and uh most of them not all of them but most of them use What's called the secure element which is designed specifically uh to prevent physical tampering uh like that that said the bank cards also new secure elements and so oftentimes we'll put in redundancy so have a bunch of different layers of security so where if even one form of um security mechanism is broken there'll still be backups so we have we have a Blog on our website talking about our our threat model and our security model you can read more there and I guess Ledger and others would that also yeah I can add to that I mean I'm not going to have time today to go through but we have a dedicated team called Don John who

actually that does exploits on a daily basis to figure out all these cases uh the case that you're talking about I think is when the microcontroller which is the business inside the hardware wallet gets in some way uh put in a state that allows to extract files from it uh and usually do it you do with power power glitch that's how you trigger that but you know it's a very they're very sophisticated attack yeah I can actually show you later we we have videos on it that that goes through it so well we're looking at that we have one more question over there [Music]

okay transactions so with nfts digital identity people would like to take that along with them without having a full-on hardware device how could that be done yeah so um yeah it's a great question uh I think at least the bitbox and other Hardware wallets I think also are designed that you can carry it around you can use it if someone steals it you're still safe um that said of course if you have your Millions on it probably you don't want

to do that um I don't know just brainstorming but maybe maybe you need two Hardware there's also recent Trends to going through RFID smart cards where you store for example lightning funds on a smart card to Take Along I've not seen it for ethereum or NFC addresses yet but that's a form factor that everybody has with them or had until a few years ago where well it started to move into the phone actually okay one final question um yeah I think

uh someone before asked how many oh sorry should repeat the question so the question was uh in in our experience do we see more people doing self-custody or centralized custody is that right yeah um the the numbers I mentioned before uh seem to show that a lot more people are doing um Centric using exchanges um maybe in part that's due to not having uh big values and that if you don't have a big value having on your phone or having an exchange it's not that big of a deal you're not going to lose too much and so I I think yeah it's like that right now which is uh yeah a little disappointing from from our side but

what we see is that there's more and more awareness of the need for a self-custody and what we see is people are more so not saying there's a big difference from four years ago people are saying not saying I don't need it they say I need it but they're more so saying how do I get in uh I'm afraid of making a mistake and things like that and I think that's where our job again as companies is to try to solve that solve that pain all right if there are any more questions here we are going to stay around for longer after the formal part of the event there are going to be drinks and snacks to be had to mingle and ask questions and also exchange on thoughts and ideas within the audience

and the speakers here that's part of the reason that we do this as a brief interlude sorry Patrick so that we can have a physical get together as the cyber security working group instead of only just meeting remote in a zoom call on a monthly basis right so today it's the working group meeting extended by everybody who's here welcome to the today's working group meeting and on the other hand we are canceling tomorrow's video call because we're already meeting today so more time for more questions at the end and now Patrick please okay thank you

Securing against loss, theft and preparing for inheritance by Patrick Schramböck, Head Key Management at Six Digital Exchange

uh thank you for the opportunity to speak to you I'm Patrick schramberg yeah okay I'm Patrick schramberg and I'm working since 2017 in the crypto area mostly in the security for financial institutes but now I want to talk to the others at the other sites their self-custody of the crypto how to do it because self-custody is still a major part of the crypto area and people many people have its uh maintained their cryptos with them so I want to talk in five minutes about four

topics so it's a bit challenging I need to be a bit fast but luckily Maria talked a bit already about the different types of wallets so I just start with the entry mentioned a bit the loss so loss is the simple situation when you cannot access your wallet anymore may it be on the PC with metamask May would be on the soft on the iPhone with your mobile device which crashes maybe it'll be that's the hardware crashes which can also happen sorry but and the last and this can happen that's a simple way the most complicated ways so you have a fire in a house and it destroys

all your equipment so how what can you do and the best and continuous best solution for this at the moment is the speed 39 this mnemonic phrase this recovery seat as we call it and it has been mentioned here that's this 24 or 12 Words which give you access to the passphrase of which we give you access to the private key why is it important why did it why is it good because it's easily to write down you can remember it you cannot do many errors but you need to keep it offline so it should not get burnt when your house gets destroyed it should not get destroyed also so keep it offline somewhere else and make it not

accessible to somebody else this makes it a bit tricky so one point is you encrypt it again easiest way and have it stored somewhere but have it offline so it makes the risk less it doesn't reduce the risk but it's maybe the easiest way to stay to sort to solve the storage of it another way is what you need to consider is if you use Services staking and Inspire your participating power chains into nfts and so these are special setups you use Smart contracts so note down this information which volatility use which types the USB because after

half a year you might forget them so it's also good to have an overview but you have invested way up so that's that's for the loss a bit the basics which you can do you can expand it and it's always also to increase to reduce the security is always also a good opportunity to use Hardware wallets because they are more safe and more robust instead of a PCO instead of a iPhone so for loss that's the one thing then theft that's a bit more complicated so if this somebody steals the iPhone somebody accesses your PC and then it gets tricky because you don't know if what happens to your

keys are the keys compromised or not if they are not compromised this device is lost it's gone you recover the keys from your mnemonic phrase good the other thing is now the keys get compromised now it gets I have seen this in one situation when a person was doing a presentation and in the background you saw the hacker getting access to his PC and reading the file with the passphrase and constantly transferring the money off from his wallets during the session here you have a problem that the C for attacker has the passphrase and can X can everywhere in the world create a

transaction and send the money off to some to his personal wallet so this is the point where you need to have some sort of emergency set up if you want to prepare for this you have emergencies that are ready when you notice that the keys are compromised you can transfer the assets to this emergency ball setup which is a total different wallet totally different setup total different wallet just empty and just ready if you need to transmit I won't do it if you have 1 000 francs on it but if you have one two millions I think it's worth to think about it to have it transfer to have something ready to Transit and something gets compromised

so next more complicated level inheritance use only not hopefully you I don't wish it but you can die you get in an accident you get injured into your have severe damage so you cannot handle your keys anymore you forget it or so it's it's a tricky part so you need a way to secure the hand over the assets to your successor to the birth you want to have access to it now that's the first question how to securely hand over this private keys or

this information to the person you want one point is people talked about it go to a lawyer have it stored there and the lawyer hands it out only to a certain person as described in the writing usage evidence back okay I need to push evidence back also for possibility but that's one part second part is you need the information note on which password which Keys which wallets which all the details you need and then you need somebody who explains it to the person because the person has normally no idea does your kids does your wife know how to handle cryptos no way and last thing don't forget about the local regulations

regulations Clearly say in case of f there's a clear regulation you cannot hand it over around the corner like I would say there's some clear regulations be careful with this that's inheritance now kidnapping the last and critical one consider you or your wife or your family gets kidnapped and threatened with death with injury I call it the five dollar range attack because people always have this picture mind you get the wrench for five dollars and then you beat out the key out of the person it happened it really happened that people get kidnapped and forced to transfer the assets to the wallet of the attacker until

about the efficacies so what is happening here the attacker knows you the attacker can know stick how much coins you have you cannot just hand it sneak by so you need to have preparation have the assets dispersed on different wallets different setups don't make them visible and have secondly having the amount small amount ready which you can hand out in case of a kidnapping so if since it does not know about this your total amount you can have a chance but don't play the rough tough guy have a chance to hand it out and and to get off with a small amount I think that's in seven minutes and I may have more to tell but the time is

sorry up so thank you for your attention thank you very much Patrick I'm sure there must be questions it's multi-party and you know it offers a higher level of security I mentioned so the question is about NPC wallets and where do we see them go compared to traditional secure element based wallets who wants to take the question

Patrick please I can take it I'm recently working with empty I'm working on the topic NPC yes it's about it's an alternative but it's not a fully usable yet in the normal way because it if you the owner yourself the owner of the key it doesn't make sense to create two MPC key shares on the same person on the same device so it's usable for companies but it's not for the personal individual usable suggestions on uh storing a secure way the 24 work seats so how to store the 24 word seeds in a

secure way taking in account all of these four points two huh you have excited that okay I hope I repeat everything but one is this steel wallet but that's reasonable to everyone so you have a bank board where you can store it the other thing is I suggest to have some sort of secure encrypted part which is stored offline where you cannot access it offline and off-site offside offline and encrypted but Patrick um I have a question for you you said having a bunk Vault so then you are kind of recent realizing it to a bank because

um what what what what how can you open uh a bank vault is there any anywhere that somebody has a new open a bank vault um I know the bank itself or the regulator or the police uh what's the regulation on bank vault the physical bank vault ah from my knowledge the regulation on physical Bank what is this that the banks are handling the vote in your name and if the regulator games before the law okay how you say that the charge comes with a claim I don't say I don't know this special form which demands opening this world then there is a

chance then that they get can get access to it so there is a way to open it but not easy and uh almost the same question you talk about lawyers for inheritance so same question for lawyers uh how can you make sure that you are not recent realizing uh and uh exposing it to to some risk the risk of to reduce the risk of not exposing is the contrary question of where do you trust most you trust a person on the street you you don't trust that much a person in a bank you have more trust a person a lawyer you also have a certain trust so it's a question

on how much trust you give to it you should not give full trust to the person otherwise you fully rely on the person that's also their services in the internet which offer custody of backups or to backup services and also exchange with offer service custody of your coins but they only to a certain extent trustable they can go bankrupt they can open they can run away with the money that's a risk so Sharon is created asking trick questions because of course we're here about trustless self-custody and then we're bringing backups to trusted artists how do we fix this there's only one way but I wouldn't

advise to anyone to try that which is to create a sentence of the moronic Siege and memorize it then nobody will ever ever access to that that's the inherent and it's broken but um for example you you provide the 24 words you we can't choose the word ourselves the legend I know correct yeah so yeah but there is a way to create a sentence just it's not advisable to do that okay because if you hit your head you'll get hit by a bus or the way is maybe to combine different security mechanisms and the more you combine the less risk you have but the more complex it gets so it's using their reducing the usability heavily

that have to come together that's the familiar secret or NPC technology but if you want to do self-custody on your own it's not working even then splitting the secret in part between multiple different parties is part of an effective mechanism also having multi-seek on the blockchain level for those blockchains that supported is an effective way of doing this that secrets are split in the foot strengths in full storage even with cold um so there was a question about like how do you prevent like the

recentralization of like a decentralized system right because that's what we're trying to do we're trying to decentralize stuff so then it's ironic that we're taking it back to a lawyer but like for some things like um like inheritance like there is no other way right because you can't go to your like Dad or Mom and explain them exactly how crypto works and they understand exactly how we do so you do need certain instructions that well you need to be sure that these instructions we we should love that ones and your next of kin right and the way that you make sure that this happens is that you have for example a safe deposit world or you have a notary and um they know whom to contact just in case you die like that's that's one of the best Solutions on the

whole inheritance problems like you write a letter to your to your loved ones your family with instructions how to use these other words um you have like instructions of where the password is what the pin is and um how to use these menonic phrases that we're talking about one quick point if I can jump in it also depends on the attack surface for your specific case and what are you trying to protect from right are you trying to protect from I don't know the small guy that wants to rob you are you trying to protect from a state are you trying to protect like what is the level of threat that you're going against then based on that you can assess what you need to do so it's not like I'm actually about to talk about this so maybe I'm jumping the gun a bit but it

depends what is your level of risk right who is after you right or what you think is up to you you get you can get really paranoid very quickly so let's hold that thought for a moment until you see it okay in a few minutes let me take a final question from the audience but then we have another round at the end is there somebody in the room also I have some questions from online because I think it's good that we take a question from the live stream a few so we have a question from octet or ciao glue so if I do not spell it your name right so the question is are there insurance companies in Switzerland which offer refund or replacement in

case you lose the keys or get it stolen so interest ing good question by the way there very good question does anybody know I just know if anything I would expect so but I don't know I just have partial name but I I I'm pretty sure there is I don't know yeah he'll wish I used to have that when I was working for crypto storage which is part of the crypto Finance Company um like we were investigating like different companies that would offer that and like if we should did have some form of cyber security-esque um insurance that partly covered but it was only up to like 40 million or something which of course makes sense for us yeah food company yeah not for

individuals but for company I think this is custody insurance for crypto custody service providers or bigger ones and there's the normal household insurance which is not covering it there are some insurance companies offering for private persons uh houses recruit not crypto but cyber security cyber insurance but crypto insurance I have not seen for private persons that's at the moment my information all right let's wrap this up for a moment we'll get back to a more open a lot of questions at the end I would also have love to speak about social recovery while it's here but we're not going to do this we could speak about this at the end

Historical and most common wallet #hacks by Adriano Bertini, Senior Business Analyst - Strategy at Ledger Enterprise Solutions

Adriano thanks Marcus for the invite and hold uh I know you did a great job and I think you also briefly touched on some of the point that I wanted to talk about can I can I go all right I'll introduce myself Adriana bertini I am strategy Lee The Ledger and analyst so we work in multiple spaces from custody to uh staking to the d-app

offering to the next brother is going to come up so we are fully booked with many different products I'm very interested to talk to you about uh later later after the presentation uh so today I'm going to talk to you about the most common and historical hack okay according to uh Crystal blockchain about 14.6 billion uh has been lost due to hack since 2011. this is two percent of the total cryptocurrency Market as of so just think about that number right and I think the main fundamental problem and I think is actually an industry problem that a lot of people in the industry think of security as a fixed

parameters is my wallet my system secure or unsecure and it's fundamentally wrong because security is not fixed parameter is actually a variable and it's based on two main parameters how much resources the attacker is really to execute on you and the second what is the price what is the amount of value that you can extract from you so if you think in that way then answering the gentleman point before you can think about a strategy based on your level of risk right and that changes because the amount of driving costly changes as the price of that amount change in the market so you have to think in that way so let's talk about some of these hacks I'm

going to start and focus on human error because those are the most common because the hackers know that human error are more common than machine errors so they focus on that I'm going to start from axiscam probably many of you are familiar with that I'm going to talk about that because a lot of business in the industry still didn't understand that so if you have a single key that control the entirety of the assets or even if you have a multi-sick where you have multiple signature to uh to do as to execute on a transaction if you give it to one or two people you are exposed to these people so no matter how good is the artwork is here is the software if these people are gone disappear die your funds are gone so what we suggest is to look for governance software

and that's what we offer a lecture Enterprise sorry Marcus um and uh that's that's what you need if you have a business that wants to do self-custody so that's the first attack Vector then going to the next one medium to technical expertise required in this case so the first point we see was low level of expertise required to execute the second is medium I'm going to present two the first one where the user is blindsided what does it mean he thinks he's interacting with an application a software a wallet application instead is inter with the legitimate one instead is interacting with the malicious ones and the first one I want to bring to you is fake browser was very sorry fake browser extension which was very common in 2020

2021 we saw about 49 Google extensions of legitimate software wallet uh being malicious and the way they the the attacker execute this was very clever they basically use Google accounts probably with bots so they have multiple Google accounts and start to upvote those extensions in addition to that they buy Google ads so when you were searching for the extension it was the first result on Google and guess what when you see the first result you think is legitimate so people people will download the first thing he will ask you is the mnemonic seed which you should never share with anybody as you enter it the malware will execute an HTTP post request back to the backend server of

the malicious actor and your funds were gone so that's blind siding the second I want to bring to you is actually um where the user create an opening for the attacker and I want to focus in Cloud breach uh Cloud breaches type of so those according to separate blade are the most common crypto tests and you might also think about why is that right so you have cloud services and you have multiple devices and each device is connecting to the cloud service so if one of these devices compromised and there are ways to do that which I can explain you later how they work because I don't have much time I have markers here checking all the time but if you have in this device even one file that

is a malware that file could be uploaded into the cloud that bank and back synchronized to all the other devices so let's talk about some of this malware I mean Maria already touched upon one which is key loggers so everything that you type if you have a malicious malware like a key logger on your system uh what does it mean on your device it means that everything that you type is actually logged and sent back to the malicious attacker so it could be your Cloud password it could be your email password it could be your pin and if it's Cloud then email then they can get even more access and intrude further into your device the second I wanted to talk to you about is screen capture malware the way this malware works you take a screenshot with

a certain frequency of your screen of your monitor and when you set up a wallet for the first time almost every wallet solution give you the mnemonic seed on the screen so that screen will be captured we'll go to the back end of the malicious actor and your seed and your your your wallet funds are gone because you will have full access the third one is crypto shuffler which is kind of interesting a little bit more uh sophisticated so the way crypto shuffler works every time you copy an address like a Bitcoin address or an IT address you were able to recognize that this is an address and it will change flip that to the attacker address so you paste it into your risk recipient address on your wallet solution and when you click send you

send to the attacker so that's a that's a very clever way to steal your funds uh lastly there are uh High highly technical um Hack That generate our machine errors there could be software exploits which I mentioned briefly like side Channel attack or Hardware like power glitches on on the microcontroller we have a dedicated team a ledger called The Don John team that works day and night actually executing on the devices of our devices or competitor devices these exploits to understand how they work and making sure that we have a solution for those so I'm very happy to show you after doing the breakout how those work

we have a recorded So if you're interested happy to show you I want to summarize and close with three the first one never ever ever share your mnemonic seed with every nobody like anybody there is no reason to do that that's what we always advise also our client second always check the URL of the website of the software wallet application or application that you want to download because if the URL is not correct obviously something is not right and check the extension that you are that you are downloading lastly if you have a business that wants to do self-custody you need a governance software to manage who can create a

transaction who can approve the transaction you have to have governance otherwise you will fall for axiscam and we add Ledger Enterprise that can do that quite well and happy to talk to you about that that's it and now I'm only opening up for any questions you guys might have I couldn't do it any better oh thank you but they ask you for questions of course I mean maybe I'll scrap the questions sorry yeah I partially understand so there was a recent attack where if any of the others generator was used and do

you know it was also used to have interview to the tuner for this about 30 million or so 160 okay so what's the question how do they put it up yeah what's the importance there is it like important to choose a certain service that um the securing generate that or yeah so the problem that you are referring to is the randomness when you are when you're generating a new address um so it depends on the source of entropy that you utilize to generate uh to generate that uh I don't know the all the specific I didn't get the time to go

through the specific that's that hack but I would say that probably the source of entropy was either not right uh or uh there was uh some exploit that may generate uh addresses that were easily uh guessable I guess I don't know the specific of that of that attack in this case it was exactly source of Randomness 32 bits only okay limited and therefore easy for anybody else out there to guess which addresses were created to repeat the process that these tool data for its users to repeat that offline or online and then look at which of these addresses that they found

separately were already used by users of the tool and then use the private key that they found to steal the assets going back to it's been mentioned a couple times use a device that provides very high Randomness that you trust that it provides High Randomness such as a hardware wallet some people like to do with dice seriously that's how crazy can get any other questions I have a question from the online audience uh so in the past weeks we saw a warning from metamask to deactivate the iCloud backup function but that app in order to prevent the arc or steal

your data out could we solve this issue if you know this issue that's actually one of one of the things that we were discussing with markets I do not see honestly I mean it's going to be a bad answer I guess I do not see any easy way to prevent um issues if you are sharing any file that is part of your wallet solution to a cloud service because the attack surface is so wide that I mean maybe Douglas maybe you know a better uh better way but I I would highly discourage any wallet that use Cloud solution I mean we are paranoid at The Ledger for sure

so we don't like Cloud solution I know that there are some players in the market that advise to use that and use that and sell that uh we think that the attack surface as I say is too wide and it becomes quite difficult to make sure that every file is uh not corrupted or nomalicious and we cannot guess how the file can evolve once he's inside the device so I'm not sure if I'm answering the question but you want anything all right I see one more question at the end you were talking about businesses would you mind sharing a few more words yeah

so how to approach self-custody as a business yeah so I I think as I say and not many of our uh not that many of the people in the space uh that run business think about this but it should be the level of threat that you are facing the first the first point that you need to think about and second you need to think about how your business governance should work I think those are the two points that are important and the first one I think our solution generally works with the majority of our client I mean some client that specific need of having Hardware on site some other have specific need but you know generally that that covers it the

second I think is the governance that's the main point like who has access to what at any given point who can take specific action at any given point and the governance software we have has a very nice and easy to use and easy to update segregation of Duty module let's say so certain people can only create transactions certain other people can only approve transaction we have an administrator or more administrator that can do certain things so you are breaking down the chain of control on the on the on the self-castly solution and in that way you reduce the risk of of being exposed I think that's the key for business and that's why we've been focusing a lot on that that's actually the premise of Ledger Enterprise

does that answer your question yes yep thank you a super admin um not that I know no what what you want to elaborate on that maybe yeah I know why the super like what what do you specifically like what what no no we don't have that absolutely not yeah the the person in control of the assets is the the client because he owns the key okay any more questions here online yeah maybe you you see you seem

to be uh quite against multi-seek uh as understood do somebody knows Casa the service uh that is offered by uh Johnson love his CTO and he's a well-known in the Bitcoin space he will be a speaker Plan B Lugano next month so they they provide an interesting uh uh super emotic up to six uh plus so what you think about this service it's only for Bitcoin but it looks interesting so we are not here to promote anything with uh so maybe maybe I was too fast during my talk but I'm absolutely Pro multi-sig like the exact office so I'm well Ledger does multic I support multisig multisig

has been around for years and years uh I am not as uh strong on NPC actually but that's that's a different discussion and I'm familiar with Casa solution and I think the great things about Casa solution is the inheritance uh plan I think that's very interesting because it's not the and really I don't think we touch upon today but one of the biggest problem is if I get hit by a bus right how the other like family friends get access to the funds so I think Gaza is a pretty good Solution on that and we're looking even within Ledger for for solution to that problem yeah but the inheritance planning is only for U.S and Mexico yeah the limit but yeah I'm I'm a great

fan of that solution okay do we have more questions for Adriana specifically before we open up the round for questions for everybody if I take too much time anything online that you see for Adriana specifically um a lot of but some of them I don't understand too complicate it but uh you go on maybe I I ask a little bit all right maybe it's good we open it for any questions we'll continue for a few more minutes not in the room then what's popular online Sharon okay so maybe I will read the question of Francesco Moki this Monday so from

Q&A

one of the opening statements if we haven't been act we should expect to be then where do you see the optimal security level for crypto to really disrupt traditional Finance what do you expect custody will look like in five years from now Francisco from online thank you Francisco all right I'd like to ask Douglas to start answering you know so uh sorry could you repeat the question uh the question the question with Francesco is where do you see the optimal security level for grito to really disrupt the traditional finance and where do you see maybe uh custody in five years from now

um that's a hard question to answer because things change so fast in in the space we're still backing on um self-custody as a solution like with Hardware wallets and things like that um again just if you look at all the the security threats out there as a number of us have talked about now um it seems like the solution is really to decentralize custody so it avoid Central honeypots where you have a single person who can steal stuff and that really comes down to people being comfortable holding their own their own Keys um and so it you know maybe there's

something other than Hardware wallets but to me Hardware wallets is a solution I don't think it's going to go away maybe it'll become easier maybe it'll be some different form factor uh things like that but I think that's going in in that direction but maybe maybe someone else can also offer their opinion on where they see uh the space going in five years yeah maybe a little addendum like we were talking a lot of a lot of harder you can combine hard roles with different wallets like for example if you use like a a mobile wallet for for like your small amounts that you use day-to-day to like pay people back when they invited you for coffee or something like that so we can combine it all the

time to to give yourself more flexibility so you're you're thinking um more like a checking account on a saving account so for example checking would be your mobile and um a saving would be your your Hardware device also to add some my two thoughts to this uh I think we are on a natural honey we are now on the technology side we have it done we can do it cryptographically secure but we don't have solved the financial aspect yet so it's not fully accepted in all countries as a payment method it's not fully uh secured as from the regulatory perspective so all the EML stuff it's still a problem which

hinders us or which hinders us to accept it as a standard mechanism for payments and this is is one big problem and the the other one is that it needs more Acceptance in the in the world so we still have many people who don't often we are not familiar with the technology and don't want to get familiar with the technology not everybody wants to handle a hardware wallet or a Mobile iPhone so they want to go to the bank they want to go service provide and have it they are securely stored and and usable every time everywhere so that's the basic the basic functionality of the money is the fungibility the availability and then some other things in this must be solved

and available to make it really worldwide usable I I have a very good question from Mohit Pandi uh who asked what about mapping mnemonics or private keys to fingertips or bio Authentication I can take that can I take this just a minute please can we switch back to the first slide with the overview well maybe we don't need any and it's like so that we have enough we could share this is

all right so mnemonics uh connecting do you want us to take that I thought okay please go ahead yeah so what was the question again mnemonic yeah I repeat the the question of Mohit Pandi what about mapping mnemonics or private keys to fingertips or any Bo authentication yeah that's uh that's been around for quite a while the problem with any bio is that as a single signature it's like it's it's Unique signature if that gets hacked or compromised or somebody's able you know you have the iWatch you have like you cannot think of the multiple ways your bio can be compromised uh once it's it's game over so it's not very

I would say scalable or uh usable in the long run yeah that'll be my challenge I agree I'd just add a way to think of it as um Biometrics like fingerprints Iris scan uh stuff like that is in in our words more like a login rather than a password um and for exactly these reasons there's only one of them someone cuts your finger off it's gone there's been uh in the news I think some German politician was giving a talk and someone with a super powered camera at the back of the audience took their picture and recreated their Iris skin

and so you leave your fingerprints everywhere right so I highly recommend not doing that all right we have a question here what about the gene sequence what about chain sequence uh it's like your DNA I guess you leave that lots of places also everywhere so I I wouldn't recommend that either bio doesn't work next all right remember yeah I'll get to the question remember that we have a bit box raffle at the end we're gonna get there soon but we're

also speaking about hotel devices for most of the event but we didn't actually really show how the device I don't know I think Ariana you have a device and Maria you match that you have a device maybe you can hold these up and show them a little bit and where is the beatbox that we're speaking about all the time Chad do you have it [Laughter] oh nice so really small but by the way the Nano also is pretty small because I agree that should be discrete but it depends on the use case yeah so we have a couple

of treasures over there this is a bit box and that's uh Enterprise Ledger moment there are more than 10 Hardware wallets available on the market so well known uh you see here the well-known ones and there are different sizes and different functionalities or capabilities um yeah we were talking about the the screens and you can see uh the master screen over there the slightly tinier one here and the very tiny one here so you can see the evolution as well so can I quickly comment on why so we introduced clear signing so not only your transaction but also your smart contract the contract details are

approved on this device so if you want to look at the contract details you want to make sure you can you can see the contract details very clearly before you sign so that's why we we decide to keep the the screen bigger okay thank you very much back to the question that we had please I was just curious because if you just do a thing it's kind of many people don't use it if you use they use it in software keys and most people don't know what to do together

I keep missing four dividers optional really quickly I think we need to do a better job in ux and UI we cannot pretend that everybody understand you know cryptography and you know and CLI yeah I agree I think uh for me it's um yeah easy so again uh people shouldn't be afraid to to do self-castity shouldn't be afraid to do a um it should be easy to do and that's that's our goal as a company and I think the second part is education so just understanding uh the need because the crypto world is very very different than the Fiat world where uh Gone is gone so whoever has the keys

uh can take the coins whereas in the Fiat world you do have um delays between when you send a wire transfer you can reverse transactions credit cards you can reverse transactions after six months uh and so if someone steals something there are some ways to come back and insurance also I think is a is a big role um maybe in the future if there is insurance for uh personal crypto uh cryptocurrency Holdings there might be uh less fear more adoption also that's a good question thanks I think that's also a point of how much it costs because some devices cost 100 200 bucks and the other thing is their their usability people don't uh very

easy way they don't want to enter a pin on a different device they are so they are more used to the easy way of fingerprint Touch ID on the mobile device and so that's why it's still a bit The Challenge to convince the people to use it but it's definitely worth because these Hardware devices are much more secure than the other software could I see there's another question here in the room and we're going to start to wrap up with two final questions so the one in the room please our Linux systems more secure than Apple or Windows and I assume that's on a

computer laptop as opposed to a dedicated Hardware wallet desktop who would like to take this I can if you so I I'm I'm not sure if you're gonna like my answer but I don't think you should assume security so Linux has certain property that make us make it less difficult to attack but we know already that there are attack services on Linux as well compared to Microsoft Window I mean I would say marginally better probably better

but I'm afraid to tell you that because then you assume security uh if you want security at the operating system level then you have to go into different type of program that segregate your environment in different let's say boxes and in different boxes you do different things and we can talk to you in the break what those are but you know you do not assume that one OS is Bulletproof but yeah I would say Linux I think it's better comparatively okay and two we have another question from the online audience you are the church on which one um yeah the last one uh by gergel

lonzinger so I see a plenty of a question about inheritance it seems to be the the hot the topic so do you see any need in Shamir secret as a solution for inheritance good question so if xiaomi's secret is a method to use in inheritance it can be but it's it needs to be applied correctly because if you have a you need several people it would work if you have several people which then needs to bring their keys together to get access to their assets so it would work if you have just one person you want to

hand it over it's not working so it depends how you set it up but I think definitely it would be a effort to do it so maybe in a few words what is xiaomi secret sharing secret sharing is that you split a private key into multiple parts and Define that for instance if you split it in five parts that three people must bring their parts together to recreate the full key and this you can create quite flexible you can make two out of ten you make can three out of five that's xiaomi's secret it allows to recover The Key by this method and the additional benefit is that each of the parts can have the same strengths

cryptographic strengths as the original private keys so it cannot easily be guessed which is the case if you had five people five parts of a secret they each have three words and it's a much reduced security some people do that they break the seeds and say okay now I'm more secure you're actually I think doubling uh I mean halving the level of security and somebody run the map like you're much much less secure than if you keep it together the point about having everyone on board

with with this thing because if if people are supposed to be um involved in any scheme that you have no matter if it's Shamir if it's multisig or whatever you have to make sure that they're on board and they know that their responsibility because you can't just like expect them to pop up and understand how to use these things so it's like really training talking to them having a conversation maybe involving a third party as well or having a bigger Quorum than you actually need that's going back to the question that people need to be informed and know how to handle it if you handle it to your relatives and they don't know how to do it it's a bit tricky it won't work all right I hear the classes are being prepared so soon we're going to be ready I I do have a final question which is

we've heard a lot of things how complicated custody self-custody is how many things you need to consider about the inheritance loss and hackers and how easy it is to be hacked why do you still do self-custody and how do you explain to your family that you have put a potentially significant amount of assets into a cost resolution that is so easy to be hacked Douglas would like to meet the mic yeah so I think if you talk to Hardware wallet guys we like to talk about attacks and hacks and things like that

but in general if you compare Hardware wallets to other forms like the the security is so like a completely different level um and then I would also say you get the the question of okay I'm just going to trust this Exchange um and so you there's you know the exchange could have absolute perfect security but because of the human factor uh your funds are still at risk with exit scams and um key person uh issues but ignore that how do you log into your Exchange username password so username and password that may be restoring on your

mobile phone and so it comes down to the same thing you need to keep these things really secure you can't lose this uh coinbase for example has uh quite a bit of money that's been lost through Sim swaps where people figure out ways to hack someone's phone um and so you know what's the best solution yeah you know you have to figure out kind of kind of all these different aspects and again with cryptocurrency gone is gone so the security level it needs to be a step higher than what what you're normally used to and the mindset needs to to shift a little bit is the question also why they need to do it right Marcus is that let's go to the Y and wrap up with the y i

I think I think it will be very clear if you talk with your grandmother why so it's been through the war right so people that have been into a very difficult situation and they need to move money and you know everything will be compromised very easily being able to memorize a few words and being able to transport it across land I mean I think that's a pretty important use case and you've seen recently in Ukraine people fleeing with their mnemonic seed just thinking in their brain memorizing it I mean you wouldn't be able to do any other way there was no banks there was nothing so what happened if there is a situation where you know you need to

quickly carry out large sum of money uh digitally how do you do that just to add one sentence I think the basic idea of crypto was to help the option for each person to participate and to do transaction payments without Banks without the need of service or institutions and that was the basic idea and from this the whole idea emerged to create the value or which created the value and the response and the interest in this in depth in descriptor and that's why it's still this idea is still here we still people still think of having independent payment system where

they can decide to whom they paid the money without going to the bank that's why self-custody is the main driver of the crypto and and brought a lot of push forward because it's available to everybody you need to think about how many people in the world don't have a banking account and they would be now able to get access with this method to do transactions without need of a bank like self-custody crypto as we just um just mentioned like begin small and start dabbling in it and begin to understand like what a sea phrase is for

private public cases and suddenly you'll find that it's not that hard at all to do self-custody write the 24 words put it in a safe place I remember your opinion yeah that's the problem mine and try it yes thank you very much all right so we're wrapping up with a bit box again do we have a wrapped big box to give away that I can hold up for people to see all right let me hold them up all right there is

the Bitcoin only Edition and another one that has a few more coins and the question who we have here is actually going back to the history of the bitbox how long ago how many years ago was the big box created this month how many years ago the first mod to get it correctly gets to choose one of these big boxes please four five which one no seven yes how did you know

October 20 what was it 15. you have something to tell about the story of how the big box was conceived in October 2015. sure if there's time um yeah I guess the the bitbox business officially started in October 2015 with the founding of a company um I did work on it a bit before then so maybe the guy who voted eight could get a bit bucks too um but yeah it started in my spare time and the idea of Hardware wallets existed but none of them

um were actually physically made yet and at that time there's a lot of scams um at that time in Hardware so like in mining there'd be a lot of scams where you'd pull a bunch of money to order some mining equipment to mine Bitcoin to make money but then that disappears it's just a scam there's no no Hardware there to get delivered to you and they just steal your money so I didn't think that Hardware wallets were going to come you know it was an open question I I got into the the Space is really interested and so um I had some idea of the security it took me two months or not two months two weeks until I actually felt comfortable holding my own coins because I knew some of the security risks it's like this doesn't work and so I just decided in my

spare time to make a hardware wallet uh went to meetups someone mentioned how do you get in go to meetups are really great uh met uh Jonah schnelli um co-founded a company with him Jonas has uh actually one of the most uh well-known people in the Bitcoin space he was a core maintainer so one of the few people with the key rights to change the Bitcoin core code base and there's other people like Jonas a lot of people in Switzerland like that that go to meetups and so and people here also a lot of important people uh trying to advance the space um yeah and that's how how it all started and kind of snowballed from there all right thank you very much and

congratulations on your new beatbox you've learned a lot what not to do some things what to do this I'd like to welcome Sharon back on stage and then yeah it's almost over I really love this uh this event it was so interesting so many questions uh from uh the the public here from online and that's really what we want to do with the crypto Valley Association this kind of a hybrid event uh keep in mind everybody in this Association um is a volunteer uh the chairs the active members uh the board members so everything is allowed by uh by you our individual members corporate members via

our your membership so we are totally relying on the on the the financing of Our member and of and of course of the the company that support us so that's that's that's uh that's for tonight I know whom will invite you to share this uh operative uh uh together and uh so thank you for the online audience and uh sorry and uh thank you for everybody you can uh come and have uh adapter together thank you