ZKPodcast: Talking UX with Taylor Monahan of MyCrypto

Transcript

[Music] welcome to zero knowledge a podcast where we explore the latest in blockchain technology and the decentralized web the show is hosted by me Anna and me Fredrik [Music] in this episode we sit down with Taylor from my crypto to talk a little bit about their backstory security education UX and also we dig in a little bit into their tech stack before we start we want to say thank you to our sponsor trail of

bits the cyber security firm trail of bits has released slither a static source code analyzer for solidity it's open source runs locally and instantly detects more than a dozen types of bugs and security issues in your code you can actually find out more about this on their blog at blog trail of bits comm so thank you again tre Lovitz for supporting zero knowledge and now here's our interview with Taylor today we're sitting with Taylor from my crypto hi Taylor hi so glad to be here and we're gonna be talking a little bit about UX the journey that you've been on what you've learned and yeah I hope from this we can

I don't know pull out some really cool tidbits of info that people can use when they're building products yeah absolutely why don't we start out by talking a little bit about you and the project like how did my crypto I guess back then might their wallet get started and where were you coming from before then so my ether wallet we actually launched in I think was August of 2015 so aetherium launched and then like shortly thereafter I think we pushed the first version of my ether-wall alive and it was really a it was just fundamentally a response to a theory I'm launching and there being no like user interface for ethereum you could use the command line which at the time you could use like Gotha or the C++ client and

that was pretty much it and a lot of people had these presale files I had been emailed to them and they were really excited about interacting with aetherium but there was just no unless you were comfortable with command line there was just no way to interact and so we made a really simple interface that allowed you to kind of generate a new wallet and it was like built to be basically offline you know everyone back then was super technical and so you could generate a new wallet and then send your funds from like your existing wallet to your new wallet and that was pretty much it was really really simple we didn't have any big grandiose plans for it we didn't ever say like okay we're gonna make this huge company or it's gonna turn into

this big thing it was really I would say like this you know an open-source tool that we kind of threw out there on reddit and came to the community and that was it why what got you excited about it where were you before this so I like personal history with like Bitcoin aetherium is super funny because I actually got interested in Bitcoin in the first like Bitcoin bull run basically on the way up and then obviously everything came crashing down with Mount Cox and you know just the price just literally just crashing to the floor but I never was super into Bitcoin I was never I just never connected with the community

obviously in that bearish market was kind of a really angry time for a lot of people and so I actually became really just interested in aetherium because I was not attracted to Bitcoin and like I just didn't ever connect with it on that deeper level and so when the etherium white paper started being passed around and like I remember these they would do like the early etherion founders would do these like interviews like on skype or like hangouts or like youtuber like whatever it was at the time and like you just have these like total just hardcore geeks in these like dirty living rooms sitting around talking about the future and the possibilities and proof of stake

and smart contracts and all these like magical things and so I just was really for whatever reason attracted to that and also the etherium community was so much more welcoming than Bitcoin like it was it was just like a really I think the early early days of ethereum were really magical so that's how I kind of got into aetherium and then obviously when aetherium launched and there was no like I was not going to use command line I never like there's no way I'm gonna send all my money via this like scary hacker tool or whatever like there's no freaking way so you know my kind of gut was like well if I'm having this problem that other people are having this problem like let's make buttons and let's make little fields that we'll

check and make sure that address is valid and just really basic things really simple things so I think people obviously know sir my ether wallet in my crypto today it's ID I'd say one of the most used you know apps or whatever you want to call it around this ecosystem but how did you get there like from this initial simple open source tool to like this this big thing that has millions I assume users yeah it's super interesting so it grew really organically and again we never really we never really thought of it like a company like it was always kind of a side project in the early days and then in 2017 when you know the market picked up in the ICO started happening we were just kind of the

obvious solution for most people to use and I SEOs were recommending us and everyone was like yeah I just used my ether-wall at my either wallet my teeth or wallet and we had to grow fast and like seriously step up our game because when you have a side project that suddenly has you know hundreds of thousands of users sending so much money through it every single day you don't have you can't be like oh y'all just work on this in my spare time and so we you know we we continue to like just build features that people needed whether that was things around the DAO and then like the split to e.t.c and then obviously like 4i cos was a big you know we were constantly trying to just

little things like the gas price versus gas limit and placing warnings so that people that were were these new people are entering the space and they didn't care about anything except like getting rich off these icy o's and so basically kind of like tweaking our interface or tweaking our error messages or tweaking warnings to to try to get people to understand the dangers and the risks that they were involved with and that was basically 2017 and you know support tickets were through the roof and you know at some point it was like okay we need a higher we need a hire people like now or we need to hire people like three months ago but let's go and so you know during that time it was just it was hectic it was chaotic there was fires everywhere

our infrastructure would go offline people would have issues all the time it was it was just absolutely did it also don't like inspire you because like the thing I want to understand it's like what is my crypto now because it's different right like it's I feel like it's a it's got a lot going on and I I'm curious like what got you there so I think that how I sort of feel about it in like my heart or my soul is like my craft oh is like us grown up so instead of being this side project that's messy and not organized and you know kind of fly by the seat of our pants my crypto is is yeah like leveled up or grown up a

little bit we have organization we have people on our team people have like specific roles and know their responsibilities and we work together really well and it's not like internally it's not chaos and externally we're also just much more we're focused on having processes in place and whether it's you know our internal security policies or you know how we do police's or how we decide what features are being built or whatever it's like we have processes in place it's not just it's not just like oh I think we should do this go go go and like oh let's push this feature live at 3:00 a.m. and hope for the best like we don't do that anymore and that's I think that's sort of the the biggest

evolution that we've seen and then obviously now that it's you know now that the market has calmed down a lot and like they the community is not as rapid as it was we got to we got to build much more thoughtfully and we got to make decisions you know where we actually weigh the pros and cons of features or the user experience or you know how the code is actually written and pushed live and those types of things so it's been it's been a remarkable evolution I would actually want to dig in a little bit into your sack and infrastructure that you have before then maybe can you just explain what is like your ideal user who are you targeting like and who do you imagine

that my crypto is for so we have struggled with this and sort of day one we have both ends of the spectrum so we have these super technical people these early etherion people we have people that use our product for like true cold storage I call them like the people that sit in a field like with their tinfoil hats on and their air gap machines and stuff like that and then we also have every new user that sort of enters the space the people that are greedy and want to get rich off these icy OS and don't really fully understand the technology and don't really want to fully understand the technology maybe also some people who are just getting into the space for the first time and are not looking for ICO stuff but don't know what they're doing right yes right

and so that's what we're seeing more today and that's what I actually love new users honoring the space today because they are just like a little bit more thoughtful or a little bit more interested in the underlying tech or the the promises of the blockchain I love those people so in terms of like our ideal user I love working with new people I love introducing new people to the space I love helping sort of guide them and hold their hand obviously you know serving the more technical people are making sure that we do have those advanced features it's important to us as well but I think that I was we're growing our product over the next couple years we are gonna really sort of double down on on serving new users and people entering the space and hopefully right now I would say that we don't really

target people outside the crypto world like are the people that we're targeting like our market so to speak as people that already have crypto or like really really want crypto there's some reason that they've kind of gotten to where they are already where in the future I would love to be able to reach out to people that don't really know what crypto is and be like hey this is the blockchain world this is what we're doing and hey if you go to my crypto like it's gonna hold your hand it's gonna take you through this journey it's gonna get you it's gonna help you understand what you know the promise of the blockchain the promise of cryptocurrency is and also here's how you can safely hold it here's how you can if we signed it here's the cool like tops or whatever you can you can

interact with that's where I aim to be but it's gonna be a journey to get there obviously I think that's a great sort of initial story and I think you have a fantastic opportunity as well to like over the coming years build out that sort of on-ramp so that you start with a super nice friendly initial experience but then you know you have an opportunity to build other tools like here's a downloadable thing that runs a full note or run to like client and here's that other you kind of can go off into different paths off of that initial experience yeah no absolutely and I do want to like bring up that point is um we are dedicated to like a dark horse like keeping things as decentralized as

as possible and that's one of the things that I have to explain to people sometimes is that yes coinbase is an honor app is fantastic by it it moves a little bit away about a little bit further away from the ideal blockchain ecosystem right like yes it's yes it's easy for people to use because I how's that username and the password and it has blocks on your withdrawals and stuff like that but we're not trying to be coinbase like we're trying to be an on-ramp that also is decentralized and you're not we're not gonna hold your money and in those types of things and so you know when we look at the other sort of things being built in the space whether that's just massive improvement on the clients like clients you know those types of things we're definitely

interested in in building or integrating those into our products so that we can have both like we want that the best of both world like we want to have our cake and eat it you want an easy on-ramp for a lot of people to get into it and yet keep it super decentralized and sort of put that into the spirit from the start right and I think that we can do that I think it's gonna take a little bit more work than just saying hey well hold your money and we'll give you a user name and password but at the same time I think it's worth it I was wondering if we could talk a little bit about the tech stack I think it makes sense to talk about it now like what is what are the different levels of my crypto today that's an excellent question huge

question it's not really it's a so my crypto we have sort of the core code base which is all reactant type scripts and it's a very fresh codebase we built it with maintainability in mind we built it with we're trying to be even better but like open source getting open source contributors being part of like a larger community so you don't necessarily need to be on our team to be able to contribute and improve our product and then we have so we have the website which is like my crypto comm and then we have the desktop application which is for it's an electron app it's for mac and Windows and Linux and that is probably we're gonna focus most of our energy on is really improving the

desktop app because what we found with the website is that it's so dangerous for the individual user like it's private keys and the web don't belong together and I learned this the hard way because I thought in the early days I thought oh the reason you don't put your private key on a website is because the people who run the website will eventually steal all your money and since I was running this website and I knew I wasn't gonna steal your money I was like oh it's safe no like that was completely wrong the reason you don't put private keys on the web is because there are so many attack vectors so as we've seen you can add malicious chrome extensions you can have like the Internet at its core attacked you can have the DNS system attack that it's

very very easy for a site that looks exactly like our site but with a little bit of extra code to basically steal people's money with the desktop app there's obviously like still some risks but if you successfully install the desktop application then you're good right like you just have to do it once and then you can return again and again again and the codes not gonna change we're gonna trust it like that's great and there's also some fun things that we can do with desktop applications obviously there's like information that can persist better than the web so we can save things like your accounts or your settings or your preferences and they'll stick around for for longer than a web site and then obviously the big discussion internally right now is is

mobile and mobile is such a big part of everyone's life so can we do that successfully what does that look like do we do reacting or do we go full native those types of questions so this is like the the JavaScript the app parts but when you like create a transaction in my crypto it has to go somewhere so where it's like the backend the part of the stack right so we run our own nodes I think we are split pretty 50/50 between Gotha and parity right now we use AWS for all of our infrastructure it's pretty robust one of the reasons that we do run our own nodes is because as much as I love either scanning in Ferrara I can't like bear to like rely on them you know along with the rest of it you guys are some

relying on them we do actually provide like as an individual user you can actually switch between the different node providers which is cool that again like helps with decentralisation so if for some reason our infrastructure were to go offline or I were to disappear the company were to shut down you could still use the app because you could switch to inferior either scan or your own custom node I was just gonna ask that as well yeah I think can you do that from the website or only the desktop app is like switch to your own local node yeah you can do it from both and then one of the cool features that were actually discussing and I'm hoping to get into like an upcoming sprint is the parity light client we can actually embed in the desktop app and what that would look like is essentially until

it's synced we would have you connect to you know our node or our infrastructure and then once it was full the light client was fully synced we could basically have you use your own light client within within the desktop application and again that's like we're just leveling up on the decentralisation and that's ideally where we'd love to be I think that's a great place to be yeah and one of my personal big concerns is exactly what you're saying that we keep making these sort of convenience trade-offs and essentially end up in a place where we might as well given if you're a Postgres database and call it a day yeah I've definitely had that thought before and where we're quite close with

the inferior team and I love them to death and I think that they are also on board with trying to decentralize like they don't necessarily want to be this just you know the almighty ruler of everything infrastructure and so I'm hoping that we can all work together and build you know better ecosystem and and build a more decentralized way of handling all these things could they decentralize themselves I think I think they're there I mean I can't speak for inferior but I think that they are working on some things or trying to not only decentralize like their own infrastructure but you know things like light clients or you know different end points or things like that because it's just yeah I think they are working on

some interesting things I mean I don't know how much they're into this particular thing I think they're they actually have some some part of their crew working on this so in a world like in an ideal world everyone runs their own like clients but in that world someone needs to serve those like clients rights and right now in Ferrara has this massive infrastructure that they offer for free or like off the back of consensus paychecks I assume but that's obviously not sustainable so how did they build a sustainable business well they could build a sustainable business by offering micro payments by serving like like to serving like my clients so my clients would pay to in Fuhrer to like use their nodes so they

can be sort of a backbone provider but then you know if they do the things the right way then anyone can participate in this network with their own full node and also earn money so I think that is sort of the ideal world in my opinion yeah and I mean that's the thing is that you know going back to what I said earlier about how welcoming and like great the etherium community is it's like you can have you know in furor you can have this you know there be there there aetherium is running on a bureau like it really is right but in fear is not like okay let's let's keep it this centralized right they're not sitting there being like we want to be in this position they're there saying hey what can we build what can we do what can we you know how can we build the future

that's more decentralize and I think that's really remarkable because it's very easy for them to be like okay we're good like we're running this like you know we've got the world in the palm of our hands like let's keep it like that and instead they're more focused on continuing to build continuing to grow there through me go and then also hey like you know let's get to our decentralized routes and and figure out how light clients can be usable for everyone and all of that stuff I always find that trade-offs so interesting in the space where it's like these projects have become more and more successful but then start to take on the centralized feel and unlike anywhere else where the more successful you are the hungry you are for more success right in this pace all those sudden it's

like you're successful you're sort of becoming the focus and so often you hear these projects kind of be like yeah but I don't want to be the focus I want the focus to be spread out it's so it's it's kind of counterintuitive yes but it's clearly like it derives from the philosophy that I think a lot of the people have had from the start right and that's why I think one of the most interesting questions that I'm asked from people that are sort of in the more traditional world is like so what's your moat like if all your code is open source and you're you know your game to teach anyone how to use any product in the space and where it where's the mode and I have to say like the moat I guess quote-unquote moat is like one I don't really want to have a moat like I

don't really think in terms of okay like let's keep other people out and like let's horde this data let's hoard this IP or like whatever like I don't want that instead I think the sort of the moat in in the sense of retaining users is like the trust and the reality is is that you know being trusted and being reliable and being part of the larger community if you think about it like that the reality is you don't have to like trick users into sticking with you or trick people into working with you and like hoarding their data so that it's really hard for them to leave it's like you know you can actually gain trust by having your code open source that's actually gonna level you up in terms of you know you're bigger moat or whatever and it is flipping everything

on its head but that's what this world is kind of doing so like let's just keep on doing it I think one of the big topics we want to cover in this conversation is UX and I want to start diving into the actual user experience the things that you've learned along the way and maybe we can start with you sort of mentioned this you you touched upon it but like early horror stories what shaped your kind of view of the of the space and your the view of the product that's such a good question so the early days were definitely all about like responding like we were not being proactive we were a hundred percent reactive and most of our reactions and the features that we bill

or the improvements that we made we're in direct response to people screwing up really really really badly and losing all their money so I would say that most features on the website most of the warnings you see most of the the knowledgebase articles that we have are a direct response to some where someone somewhere doing something like just terribly terribly wrong and one of the things that caught us really really off-guard was just how badly people can screw things up and the things that we take for granted whether that's like I understand that we're not holding your funds or that you can't recover your password the things that I just took for granted people entering the space don't they they carry with them all the things

that they've learned from how the world currently operates and they just assume they don't even ask the question they just assume that this world is gonna operate in the same way do you think password recovery it was like one of the first big ones yeah definitely one of the yeah not I would classify it as like not properly saving your so whether that's your private key or your password or even just like that wallet that you just generated and you just never saved it or you never backed it up or you took a picture of it on your phone and then your phone broke and you're like oops it was you know those types of things and we got a lot of people requesting us to help them like regain access to their account and the

reality is is that we just can't like we don't have any of that information therefore we can't recover whether it's your password or your private key like we don't we can't help you that's such a like a flip in people's mentality right we're like at parity we've had the same issues even like with our UI which is like reasonably complex to download and get going and like work with we've had people like email us hey can you like reset my password oh no we're not a service provider like your you've downloaded a piece of open-source software and in like if you're running a website it must be you know hundred times more difficult to convince someone that no actually we don't store this in a database in the backend like other

websites do exactly and that's what our infamous infamous onboarding modal which is like this it's shorter now but it used to be ten slides that was basically yelling at the user that's the dot onboarding modal was literally a response to to try to get it through people's skulls that like this is how the world works now and so one of the things that we did because I learned that so one of the things that that onboarding modal attempts to do is instead of just telling people and like basically hitting them over the head and be like back up your keys back up your keys back up your keys we try to help people understand why they need to back up their keys and why we can't recover them and the way that we did this was

the language was like we're not a bank we're not you know we're not this centralized entity you're going to be the manager of your own funds and you're gonna be in control and we found that people if they were able to grasp that they were they were in control and that they were you know basically their own bank that they had an easier time understanding oh of course I that need to properly back on my stuff and of course they can't reset it so that was one of the things that we learned was if they understand sort of the underlying architecture of the blockchain that they tend to be more understanding of why they need to back things up and then why we can't recover them and then obviously

the other big challenges with that we're trying to adjust in the onboarding mode or like the scams and the phishing websites and that this is like a dangerous world and there are people trying to trick you all the time and don't do that that one's a harder one though right because like if you are fished you are just on another site that will not warn you that that is happening to you right right and we had tons of warnings we had warnings all over the site we had like this big red bar at the top that's not like always check the URL always check the like pointing straight to it like you look check it read it you know and it blew my mind because in the you know in the early days they would switch like

one letter or they would have like a letter with like a little accent over it or something but we would still have people report getting fish from URLs that were completely different and it's just like then we you know one of the reasons that we're pushing people towards the desktop app now is that I realize like people aren't going to check the URL they're just not you know and even relatively smart people they can make a mistake once right they can have that slip there they're mine once and and it only takes once to lose your money and that really sucks and then the scams I think are one of the hardest things to protect against and why we're seeing so many of like the giveaway scams on Twitter and those types of things because they take advantage of human nature they take advantage of like this urgency or the

scariness and then obviously capitalizing on the greed that I think yeah you know of if you do this and you do it right now you can get free money like who doesn't love everybody yeah how were people mostly fished early on like over the last two years isn't usually reddit is it where's that where most where are you finding most of those things happening so it evolves it changes early on I think the first like real trend in fishing was the slack TM so if you remember every ICO had their own slack and slack was not really set up to protect against like malicious actors in your own slack so people were just like mass DM everyone in the sock

and some of these slacks had like you know fifteen thousand thirty thousand a hundred thousand people in them so these bots would come in and just GM everyone and and they again would capitalize on like the FOMO right and they would say like hey make sure you get into the ICO early twenty percent get discount and then they would link out to like a fake my ether wallet or we were even seeing like fake ICO sites I would have an address switched so instead of like status it would be like status with two S's or something you know something bizarre and then it's evolved into more recently it's these twitter giveaway scams which I'm sure you've seen we're fake if italic will tell you about there's a ten thousand each giveaway and

you know Coco Coco send us all your money or put your private key on this website and and this is why you have all the names like first name quote not giving away either last night if anyone doesn't know that because I mean I'm sure someone entering the space might be sick why is that and there are hoards of boss and I mean they I love watching them to be honest because they do they change and they evolve and they find something that works and they just like go so hard at it and all you can do is is try to educate people upfront because once they're in the space and once they're on

Twitter once they're in the slack and the scammers are attacking like if they don't know to be on the lookout for those things already then you've already lost them and they've already lost their money I remember so during the Polka Dot sale once this once the website went live I think two hours later a copy a copy cat called polka dot came out and they just ripped the website but not the styling so ugly version yeah we had felt it was this is what blew my mind boggled my mind was the fissures and the scammers they're not good at coding or like hopping like they don't have the attention to detail they would like the

code that they inject or add to a phishing website is so janky sometimes it won't work like sometimes it would be like stealing private keys except like we would look into it and like they're not stealing how everything is because like there you have an error in their code by but like you said like the styling just wouldn't be there or whatever and yeah and this is still blood tonight and yet people would still fall for it yeah and that's what like we you know I would just bang my head against the wall some nights because I was like how it sort of brings back that that aspect of like what are the types of users who were really deal with I was telling this story too earlier like I I started off in tech company many years ago and like we were selling software to financial advisors

were not the most technically inclined people and basically there were people who like had only used in intranet sites they like their whole working lives so they'd never logged into a site that and they've never seen a login form because it was all intranet so the first time they were using our products like what is this thing why do I have to enter my email and what's the password and like what what are these things and like they've never registered for a website so it's like it's a completely different world that these people live in like it's not weird that they get fooled by a sites because they just trust that you had this site says that it's a sale I'm sure it is and I think that the first time you enter into the space I mean I experienced this it was you do sort of

you are stumbling a little bit in the dark for a while you don't know who's legit there's all these shiny people shouting stuff at you and you're kind of like where where's the core and because a lot of the history is just being written right now and I think they like the more authentic players like I think if you if you do spend time on it they do emerge but when you first arrive you just don't know and I can kind of sympathize with those folks that just arrived and they've not seen this kind of scan like you said this cameras are not that sophisticated either yeah do you know of any like and this is a

question to both of you guys but do you know of anyone who is sophisticated who's fallen for one of these so I have I won't use his name because I don't know if he like wants me to call him out like this but one of the guys that's now like one of the most active people sort of fighting the Fisher's the reason that he's sort of like has this passion for protecting people now is that he originally got fish and he was he works on a company that is in this space he's very smart he's very passionate he's very empathetic and the reality was is that he just had a like a momentary brain fart you know and missed yeah it's just

right or something and that's why that's one of the reasons that we're moving you know away from the web and into desktop is because I realize it's not just quote-unquote like new people are stupid people or whatever you want to call them like it's not it's people that have a momentary lapse in judgment or people that you know don't don't realize that this is a scam or you know it just it's so it's too easy so it's you know it's a shame and and it's one of the big reasons that so the reason that we're like basically going full-bore and desktop and pushing everyone to our desktop app is that I realized we were banging people over the head like with this wrench or just like don't put your private Keys on websites don't put your private keys on websites always check

the URL always check the SSL cert don't have malicious Chrome extensions but you're allowing people to put their private key on your web so we're shouting at that but then we're training them to go to our website and paste their private key and like yeah no people are gonna have trouble with that and even though again like kind of turning things on its head we were basically like yeah we're gonna remove private keys the easiest way to access your wallet the most the way that most people interact with our website we're gonna force you guys to download us a blob so if you go to our website right now you can't put the private key on now it was like a hard decision for me to make because it goes against everything I've ever thought about in terms of user experience because we should be removing barriers

century we should be making it as easy as possible for people the problem with having things that are as easy as possible is that it's also really really easy for them to get finished order to get scammed or to have that momentary lapse and and enter their private key on a fake site and yeah there's a you know we're raising the bar a little bit by forcing people that download the desktop app but you know I wish we'd done it earlier to be honest cuz I can't imagine how much money would have been saved if we had I almost wonder like think about UX philosophy generally it tends to be make it so easy that like a kid can use it or make it so easy that it like just think general UX for mobile or web it's like make it so obvious and I wonder if that hasn't

just made a generation of lazy ass okay I have this theory cuz now like why is it that people aren't reading and paying attention it's because it's been made for toddlers because the Internet as we now know it like web 2.0 the Facebook's and the googles and apples they have mastered the art of like you can't actually screw anything up so there's always an undo button there's always a customer support wrap you know willing to help you there's always like there's no such thing as permanent loss and because of that yeah people just assume that Ava's gonna be that big undo button or hair you can call someone and

when there's not it's like really really mind-boggling but I also think there's something so I think it might be like gmail is to quote-unquote blame Gmail spam filters so good right like you don't ever see spam if you're in my generation like you don't you've never been bombarded by like the Nigerian print scams or the people offering you free money my grandmother she knows that's a scam like she knows that if someone's offering you free money or if you get a link to your banking lately she knows not to click the younger generation we never had to like learn how to build our own filters in our minds because Gmail was just like oh we'll just delete it for you and we'll just hide it for you and we'll

just automatically warn for you and so then when we are promised free money or like you know ten thousand either giveaway we haven't installed that filter in our brain like my grandmother has whoa so you actually think it's the younger generation that's more susceptible in some aspects yeah like I don't think that my grandmother could get into crypto successfully right now but I also think that if she did get into crypto she would laugh at the scammers in their faces and be like you're not giving me free money you idiot like why would anyone fall for that if it sounds too good to be true it probably is right right as an aside one of my favorite and pieces of entertainment is when people scam scammers so there's like YouTube channels with all this

stuff like it's it's amazing I love it but there's a famous sort of I can't do justice here so I'll just do it shorts or Google solidity honeypot the concept is basically you put out a smart contract that has some ether in it and then you go to like a helpful support site or something you give someone their prior your private key and then they look at the contract and like figure out oh you can transfer this like you say oh I've problems like transmitting this money I can't get it back can someone help me here's my private key please help me send this to send it to this address they figure out that there's no gas in the contract so they need to send some ether to this contract like have enough gas in there to be able to send this money to

themselves so they transfer some ether in to try to steal it but then basically just transfers that money straight to the person who put it up I'm surprisingly okay with this money and you get you get your money like so the evolution has gone from website to the desktop app is that actually safer because aren't there like and I'm gonna give an example like I know a few maybe a month ago or two months ago madam asked had this problem where they were

down for like just a few hours on the on the App Store and some copycat came up and looked the same and actually was also a phishing app this tower of phishing Chrome extension so is it safer so the the biggest difference between like a website or the desktop app or even a website or Chrome extension is that on the website every time you visit it you have to get the URL correct so ideally you'd be using a bookmark that you created yourself but if you click a link and that links the phishing link you're screwed if you mistype it you're screwed if the DNS has been hacked or

the registrar's account has been hacked you're screwed every single time you visit it you have to successfully visit the correct website the website has to be the same so the person creating the website can't have pushed malicious code they can't have had their personal register account like their GoDaddy or whatever hacked and then also like we saw recently with my if I wallet there's this thing called the BGP hawk and it basically pushes a fake version of the site not because anything my ether wallet did not because the register account got hacked but because the way the internet at its core in the DNS system at its core is set up they were able to be simply push a website that was fake through like the tunnels of the

internet so with a desktop app or a Chrome extension if you install it once correctly if you you know if you click the original link to download it correctly once every time you return to it you no longer have that risk you're not relying on the DNS system like once you've installed it you're not relying on the DNS to serve the same site every single time or the same application every time so that reduces that attack vector there are downsides so you know if you're in the App Store there can be fake apps and people can be mistaken that way with Chrome extensions they do auto update you can like as a user you can go and turn that functionality often manually update them but most people don't so if someone were to you know get the

credentials of like the madam a scheme they could hypothetically push like a malicious version with the desktop app like we don't have the auto update functionality so you know when if there's a if there's like a new version it just lets you know there's a new version you should go download it but it doesn't it doesn't like push new code automatically and that's again to reduce that attack vector so that we have to like secure very specific things but we don't have to secure like we don't there's there's no way for us to like push malicious code or or not malicious code for that matter to everyone at once and that's I think powerful I mean you then you also have like the you can do app signing and you have a few extra like security measurements

that you can take in a desktop app there's also like for all its you know evil or whatever people want to call it like the Mac App Store and the iOS like App Store they are very good at not having scam apps on it yes exactly they're not perfect but they're way better than the inter right and that's what like in the Chrome extension you know store specifically with madam asked you know it's much easier to detect that phishing Chrome extension because it has way less downloads it has like probably no ratings etc where if you look at the real madam asked it has like over a million installs and it has you know a ton of reviews and a ton of ratings and it's those little the little details

that you get in the op stores that you don't get with a website are really really powerful so we're talking about a lot of the different ways that people have been fished or been scammed but and maybe this is like a bit of a I don't know what the word is it's like it's kind of sick for me to ask this but I'm really curious what what is was the worst scam you've heard of like the most brutal so it actually is like nothing to do with our site or anything but the worst sort of case of lost funds was it was it was probably a couple years ago and this guy was running sort of a custom lining sort of setup where it sounded like he sort of had a pool but

it was all of his own devices so he had like a few different computers or devices that were all mining and we're connected in one way or another and in order to successfully do that he had to do some custom setup and one of the custom things that he did actually left his account basically insecure to the outside web and there's these BOTS that basically go around and paying all the the different nodes and different things that are online and say hey are you unlocked or hey do you have any funds in that wallet that's unlocked on your account or whatever and this guy had a lot of ether in his account on this online computer that had an open end point but what sucks the worst is that

the attacker wasn't actually able to like just outright to steal the funds right serious like paying his endpoint like over and over and over again you could see it was there you could see it had funds but he couldn't get them until the guy who like the owner of these nodes until he went to send a transaction in the way that it works is that it basically opens up for like something like a second or two seconds and so and this is what makes this so painful is that he went and did the best practice when you're sending a lot of my funds around which is you send a test transaction you make sure to arrive successfully so he uh he went and he sent a test transaction for like I don't know one ether or something and that one ether got sent but then the attacker was able

to send the RUS like all of his funds to the attackers address and so he was sitting there going like oh I just sent one ether as a test it got there successfully and he goes and he looks in his account and like the thousands of other ethers are just gone and that was like just so it was so painful for me to like hear his story and watch it and like try to have him decide for what happened because he was obviously very intelligent he had this whole setup he knew command line he had this network of computers and I think the thing that's like the worst was if he had been an arrogant little and sent all of his funds without doing a test transaction so if he'd gone against best practices and be like yo let me just send all this he actually probably

wouldn't have lost his money because it would have gotten cite and then the attacker wouldn't have anything to steal and I think that sucks is that when you see people trying to be careful follow best practices they know what they're doing they know how to you know these things and yet they still have like some little slip-up or some little thing that's insecure I think that's probably like the thing that hurts the worst for me to watch what about you guys specifically do you I mean maybe there's a lot but I think the one that hurt the most in general was the just the phishing sites uh that at the time it was my youth or wallet just than my Heath or wallet clones and there were so many of them and it was just every single day like clockwork they would

just spin up new URLs and we would have we have lawyers trying to take them down we had like people that do this for a living trying to take them down I'd send like her I'd personally sound like copyright and DMCA and like this is a malicious site things to all the registrar's and all the hosts and no matter how many times like we would have one go down there would be another five pop up and one go down another five haha it was just it was just insane and one of the things we actually built during this time is one of our like kind of side projects still to this day it's called ether scam d-beam it's about we're gonna change the branding and stuff to beat crypto scam DB because it's grown a lot but it essentially is a way for people to report malicious urls

and it's not just like my ether wallet or my crypto it's any malicious URL in the space it reports say and then we have this whole system that like takes a screenshot of it analyzes the code it connects it to other phishing sites obviously we can do takedowns very easily we can do you know all the different ways to take down a website and so we can not only track the different fissures and the different scammers but we can also then take action and it'll continuously kind of paint out and be like oh it's still online it's still online we should follow up and try to get this one taken down and then obviously when it goes offline it gets label this offline so that's probably one of my favorite tools that we've built because it it's just a remarkable tool and then it also gives

people who have been scammed a way to what yeah put their information let the world know let people that care no this is a site that's online right now that is stealing money these are the ether addresses or the Bitcoin addresses associated with this URL and hopefully you know ideally at some point in the future one of these guys will slip up and you know the bad guys only have to slip up once and if we just keep watching and keep talking you know at some point their identities will be known and something bad will happen to them and they'll be caught and not only will they be caught for the one website but they'll be caught for the their entire collection of website because we're tracking that and we're linking

them together has anyone been caught not that I know of off the top of my head I think I mean there's obviously like the amount Cox allegedly the amount Cox guy or the money launderer I don't exactly know what that how that flushed out in the end but again that was like you know a few very persistent people were tracking that money for years and years and years and eventually it led to an identity and I don't think like like I said the bad guys only had to slip up once and they're in Harold will come crashing down and so we just need good people you know just just with their eyes open watching and watching and watching and waiting for them to slip up this touch is obviously quite a lot on user education and you know you're talking

about proving or like showing what is a scam and and tracking that but what other education aspects like have you guys done what do you think should be done in this space so ideally ideally like at the core the user experience should be probably more similar to what people are used to so whether that's the username or the password or the fact that you can recover this information or those types of things I think that's gonna be one of the most important things that that develops the problem right now is that I don't necessarily see the problem as the private key itself like a lot of people say like Oh like you can't expect people to manage

their own private keys I don't necessarily agree with that but what I see the problem is is that when you give these people this really core piece of information that can't necessarily be protected with like two-factor and you can't have the password reset or you can't have you can't recover it that's the problem so I think that moving forward one of the biggest improvements to the the core user experience of crypto is going to be some sort of system some sort of whether it's a smart contract or a series of smart contracts or just a way of organizing private keys that you have a more traditional sort of authentication mechanism where you can

have not necessarily the exact same experience of like two-factor but a way of using multiple devices to prove a transaction before it gets sent Alex Van Dusen obviously has has shared this concept where you still use private keys but the private keys actually don't have any funds in them so it doesn't actually matter and I think that's one of my favorite sort of visions for the future right now there's also you know smart contract mechanisms where you have you know a series of keys and you need to use maybe one key to send a small transaction but two keys to send a larger transaction and any of the keys could make if you were to lose access to

one of the keys any of the other keys could basically shut down the account and then you need all these keys plus this additional information to recover access the account and I think things like that are gonna be how the the future kind of pans out because that's in my opinion you can do it in a decentralized fashion where people are in control but they also have the ability to recover their keys or their access their funds they have the ability to like revoke access to their funds so they shut down the account and then they have the ability to do essentially two-factor where you would approve the transaction on one device say your computer but before it gets that you'd also have to prove it on your phone and

the I think the one reason that we haven't seen these sorts of mechanisms really come to fruition yeah is simply because like smart contracts in general are so early we're still learning a lot about their solidity and and how things best tie together and the best security practices and you know obviously with the Dow and some of the other smart contract hacks it's it's a terrifying place to be when you're saying okay instead of having this private cube we're gonna rely on a smart contract because if that smart contract does have a flaw then you also lose all your money so it would affect multiple potentially multiple right people not one account but I'm still very hopeful for the future I think it's the very early days

and I think that we will see these mechanisms come to fruition and a safe and a secure way in a way that we can trust them it's just gonna you know it's it's we have to build you have to start building at the foundation and then we'll level up over and over again so I think this paints a little bit of a picture of what where you see sort of the the overall space going but how does that tie into like what you're working on now what's like what's the future of my crypto so obviously once we get to the point where we trust I guess like smart contracts or solidity or whatever you want to call it enough or we have this mechanism that's just we're really really confident and I think that I'll probably put a lot of energy and resources into developing

an amazing user experience for that you know in order to get from where we are today to that point there's a lot of different things that need to happen so when we talk about the user experience it's not just the user experience of managing private keys are managing the the access to funds it's also the user experience of sending a transaction of things like gas prices and gas limits and the data field and you know whether they want to send a token or you know the new like the new non fungible tokens or you know there's all these different things happening and how do you interact with smart contracts and you know is the

Deaf experience ideal right now will it be ideal those are sort of the questions that were asking and so the way that I sort of look at our product and how I make decisions of where our product goes is okay we can't just live in this ideal future world right we can't just look at what what's gonna be or what the sort of ecosystem is gonna look like in five years and be like okay let's aim for that and build that we have to take this very iterative approach that constantly improves every single aspect of our product so that in five years we'll be right there with you know all the the improvements and we'll also be the improvement so in the short term you know we're really focused on right now sort of like how your account is

displayed to you and and we're gonna kind of flip the whole app on its head so right now the first thing you do is you land on the site and you're like oh let me unlock my account so I can send a transaction and that works but it's also quite backwards like if you want to send a transaction you should probably like you know I already have your account and then you can you know make the decision about what you want to send or if you want to shift or swap between two tokens or whatever it is and then obviously continuing to educate users and finding the correct balance between you know educating them about what this stuff is and then abstracting things away so do we need to tell pew

what the gas price and the gas limit is in the difference between the two or do we just need to remove that completely from their view and and that's gonna be I mean that's been one of the hardest things we've dealt with and I think it will continue to be something that we iterate on and find the correct balance between because there is value in people understanding the gas but there's also valuing people not having to even know that gas exists so we'll get there I'm excited and and I think this the things that I talk about like in terms of gas and stuff like this applies to every single concept and word in this ecosystem because everything is new and everything like we love to make up words

and concepts and so I I'm constantly asking myself like do we need does these or need to know what gases or should they not see it or does the you know when they are interacting with a smart contract what does that look like and feel like and do they need to understand that they're interacting that's a smart contract even and those types of questions so I wanted to say thank you so much for sitting down with us absolutely thank you so much for having me thank you very much and for talking about this UX journey that you have been on I think we can all learn a lot from this and I'm excited to see what you guys do next absolutely thank you so much again so to our listeners thanks for listening thanks for listening you

[Music]