foreign
[Music]
is redefining the level of control
people have in ways that was deeply
different and how this had been done
before not only that well 3 has started
with literal Financial value even though
this is an empowering proposition we see
how meaningful
has their money compromised every day
I'm Antonella I do block security at
metamask
my folks are there
before that I will let the user
experience team by the tour project for
half of the decade
deploying privacy and Hyson technology
is not a crime wallets can be a lot of
things
we can Define wallets as a container of
private keys and their system
affirmations to manage them every time a
dove asks the wallet to execute a
transaction the wallet is asking the
user to confirm the usage of this case
Dan Finley and Eric Marx made a
beautiful definition
wallets are built around the
responsibility of myriad in the the
interactions between untrusted
applications and users keys on the
computers getting appropriate consent
from the user if we map a thread model
of a non-cotiller wallet like metamask
we will discover that the two more
important assets that we have at stake
are a pair of keys and the permissions
to use this keys
this talk is not going to be about very
Keys it's not going to be about
artifacts to protect this privacy like
Oh see it's phrases passwords fast
prices or attacks or that
today I'm going to talk about
permissions
and I want to talk about permissions
because permissions is the elephant in
the room usability topic Dev foreign
users in this ecosystem there is a lack
of Interest or protocol level on how
protocol decisions affects everyday
people's lives and the responsibility of
giving users the chance to understand
what they are giving permissions to
falls on wallets when we talk about
permissions
we talk about an invoker requesting a
wallet access to certain user
information it can be different
depending on what the rehab is prompting
the user to do during a connect flow for
example the rehab is requesting access
to users public skills the address to be
able to push requests in this way and
this is the user-facing interface on how
the request looks on user's computer I'm
sure some people has been facing these
screens before
the wallet is making an epic effort to
expose and Trust information in a secure
environment in a legible manner so the
user can consent to execute or not this
transaction we do things like
treating childish and treat analysis
human review we have a lava mode for
preventing supply chain attacks you
should check out on kumari's talk from
yesterday we have fishing detect block
lists to Medical efficient attacks our
vanity program and more people who work
on security knows that this is called
elastic security or Security in that but
this is not enough to enable users to
consent in transaction and I will stop
and I imagine that some people is
questioning why we are talking about
consent in a usable security talk and
Friends
because they are not secure systems
without consent consent is the radical
idea that one person must voluntarily
agree to the proposal of the size to
another thinking about this why Building
Technology he still gives a feminist
perspective to active concern to apply
it to their social information system
that we work with every day these are
not my ideas
these are ideas that came in the
backbone from the feminist principles of
the internet for open human centered
design processes basically when we talk
about consensual technology we talk
about having control over our digital
bodies which of course include our data
and for sure our money so how a
transaction based on concern should be a
few people has been thinking about this
they're finding a framework on how to
approach a consensual way to having
interactions I really like the five
principles defined by false uh Alien
media you can check this and more in the
website it's called senseful touch.io
good consent is
freely given is revocable it's informed
it's enthusiastic and it's specific and
what we mean by all these things the
fact that the consent is freely given
puts the person in a position of doing
something with another that should be
made without pressure with force or
manipulation
anyone can change the mind on what they
do at any time trust is not forever this
is why transactions should be revocable
people should be able to understand what
the trade-offs are of this decision
people should be able to read what they
are going to consent to
people should be able to comprehend what
is going on consent should be
enthusiastic if someone is not excited
or really into it that is not consent
consent should be specific saying yes to
this now today here in Bogota in October
doesn't mean that I said yes to other
things so we started questioning our
interfaces and how they can become
interfaces that could enable people to
give real consent the use of a security
design question that we put over a table
with our teams with designers with
developers with project managers with
people working on metrics with people
working on communication if we build a
transaction flow grounded in concerned
how could it look like
um
you spoke
and we are listening we read social
media we read the forums we read
and we are working hard on improving our
confirmation screens
even when new transactions methods are
being defined right now in other rooms
on protocol level without considering
how to expose users to a consensual
interaction let's see the case of
approvals
to allow a smart contracts to
interoperate tokens and provide a better
user experience what interacts with that
in order to perform operations that
require interactions with a man
contracts like minting stacking swapping
users are first required to permit the
invokers more contract to transfer a
number of tokens on their rehab
sometimes the dive required improving
this infinite amount of these tokens
even if the user trust it up it could be
problematic this is our current tokens
allowance screen
we have the original mind requesting
this transaction we have the contract
explicit who is asking for this
interaction but the point here is
we don't have allowances in the first
screen of this flow and we have been
working on that and we iterated this
this new UI aims to empower users to the
final allowance that they want to give
to the lab we split the flow into we now
have gas fees in the second screen which
was something that people was looking
um too much on the first version and now
we have a specifically who actors are
interacting in this transaction we are
allow users to verify contracts
we are making explicit which assets are
being transferred we are adding friction
to warn users when
the site is requesting
um the entire collections on a MSC to be
transferred users can yeah I say that
before can verify contract details
and more things echo in on what Taylor
said this week we should be responsible
of what technology we build
we should be there which will technology
that we expect people
as developers as wallet developers we
have the responsibility of critical
thinking about how to expose users to
give consent
to a decision that directly affects the
digital values
and these allowed us to explore
opportunities to design the centralized
technology that respects people but
practicing open design methodologies
balancing security
and usability it's complex we do a lot
of complex things here
these requires
inadequate thread modeling the
possibility of including people in your
development process
[Music]
and trying to understand people's mental
models too much with the flows that we
propose as a facilitator of consensual
transactions we are trying to generate
more Open Spaces to discuss ESL Security
in the decentralized circle
if you are a product if you are a
designer if you resonate with this you
can find me I will be happy to talk
about this if you are a security
researcher if you are a hacker
if you want to punch our services we and
get money we have a hacker one program
in place hackerrone.com metamask if you
are a developer and you have ideas on
how to improve metamask you want to
extend it you want to connect your API
to metamaski expose in a metamask UI you
should check out meta multiply IO slash
snaps and edit stocks from yesterday I
personally believe that there is a long
way to go to rethink how the information
systems to which we delegate trust
interact with consent
this is an open call and I invite you to
think about that with me
thank you very much Antonella and we
have several hands up we are going to
start here but we have to there oh we
have a lot of questions Anthony hi uh
super presentation thank you a quick
question the UI that you presented is
there is a date when they're going to be
released
we are working on that uh later Quarter
Two quarter four uh yes yes
you can we work in an open environment
we have a GitHub repository so you can
check stuff
next question we have some one two and
three
hello hello
um thanks for your talk uh and you
presentation is told that as a security
researcher you have to do balance
between user experience and security
how do you draw the line of saying the
issue is supposed to know the thing uh
and I have to teach the the user that
did you think that happened now good
question
um I don't think we are here to teach
users I think we are here to inform
people to make informal decisions on the
balance between how much information we
show in our screen and how this
information resonates with people and
also the time that happens between the
people make a decision and read may vary
and change I think that is the most fun
part finding this balance
I think it's super important also to
work with users if you have a product if
you are building a pro a product
whatever you should have users in your
development process so you can expose
users to your product early and you can
get feedback and that it's so rich
because you have people using your pro
before your life or whatever so that'll
answer your question a little bit there
is one two and three and four we have
time okay so and I see the fifth here
please thanks great talk it's part of
the your definition of consent uh you
you discussed uh revocable and uh you
know where does metamask or the ux fall
with revocability and helping the user
know that they can revoke or what what
they've given consent to in the past
beautiful it's a protocol issue it's not
our problem now we should work together
on protocol level to make sure
that I mean to comprehend that we are
human and we can make mistakes and
I know that Rick vocability is like a
Hot Topic in this space
there are a lot of ideas on how to make
transactions revocable you can do things
like I don't know having a space of
nouns in the middle and you have a
certain time that you can revoke and
stuff they are smart people thinking
about that
um but yeah it's it's an open question
hi great and great work using is consent
how do you think two is possible to
handle a psychnic message concern
specifically when we sign some
structured information on metamask you
will see an adjacent that is really hard
to understand and there's been a lot of
hacks lately based on on our erc20
tokens able to permit user to sign
message in order to allow for
transactions so it's very hard for a
user to know if you're approving uh
genosis
multiple or giving permission to someone
to spend your tokens on your big house
have you thinking any kind of mitigation
for this problem on metamask
there are a lot of initiatives they want
to make transactions readable they are
you know I mean I remember five right
now but there's a lot of people working
on that I think it's the next step for
big adoption should we having
transactions in every double Manner and
I seek companies making their own
versions of this we should aim to have a
community level consensus on how we are
going to expose these two users I think
it's like it's more powerful if we were
all together then if a company says that
they are doing
clear singing or something like that so
yeah
I think it's a work in progress and I
hope you are willing also a solution for
transactions uh to be real
hi uh thank you so much for our
presentation today I feel like I learned
a lot so uh one question I just really
want to ask is uh about metamask product
design so I as far as I know initially
melamas didn't want to launch the swap
function and you know on they launched a
swap function I just wanna I just feel
like uh in the current space the
switching network is really you know a
significant problems that in you know
improving ux I just want to
ask more about what's the future plan on
Madame mask about this interoperability
issue and uh does metamask having plan
to solve this network switching problem
yeah amazing question
um I can open my computer and show you
our designs after the talk and we can
discuss it we are working on network
abstraction it's super interesting
because super early in the moment right
now and the options are infinite like I
don't think the version we are going to
ship first is going to be the best one
but I think it's something good that we
are going to iterate and we are going to
learn also how people is using different
networks
um we are thinking we can talk in our
about it
but yes please find me and we can
discuss like how the research knowledge
hi I actually have two questions if
allowed but one is a follow-up to the
question before last about signing
um and permissions and how those
interact and even where they are
readable if there's one particular thing
that's being asked for over and over and
over and over and over again the user
will get alert fatigue and just be
clicking and to avoid that I was seeking
to have a permission for that particular
thing that gets repeated many times and
uh was here for the hackathon last
weekend and wanted to use made a mask
snaps to make that easier and was told
oh no I actually made in my Snaps
doesn't support working with the
permission system to do that I was
wondering if there are plans to allow
snaps to work with the permission system
in the future uh to follow up on that
good question I think the most powerful
thing about snaps is like the list of
formations we have available right now
it's not static it's something that is
going to grow in the future so I'm not
uh here to say when but that may be
something that is in the pipeline and
the other question was you showed
earlier some designs where you were
making it clear that like oh you can set
a limit for how much of a token a
particular dab can be authorized for and
you have a line in there like oh you can
raise this limit later but you aren't
telling people that there's a cost to do
so it's like a financial cost of doing
so later and I think that that seems to
undermine this idea of consent a little
bit because you're not telling people
that there are going to be costs if they
want to limit things now and then add it
later do you have any thoughts about why
that decision was made to obscure that I
agree
um we we are not exposed in future
cost of the transaction and maybe
something that um could be part of some
documentation on user-facing
education material or something like
that
estimating how the thing is going to
cost in the future it's weird and
but
I don't know maybe something to explore
thank you for that question and the last
one hello yeah thanks for this uh great
presentation it's really insightful and
so I have a question around the
of the fact of give it consent you
mentioned that
um it's quite complex because it's
either you give too much permission and
you fall into like an area where it's
dangerous as a user or you you give too
much restriction and then you hurt the
usability of a user because the user
then cannot do that much
what's your opinion on that like how do
you find The Sweet Spot of a right
balance like this right area where it's
not too risky but in the other on the
other side is not too unusable the
equation
um it's it has different parts
first you should have an
interdisciplinary team working on stuff
because it's more powerful you have more
views when people when building
something for people then
there is something very strong having
enough meta mask right now and is the
fact that we are building approach for
the entire world
put us in a position to hire people from
all over the world so basically we have
people working everywhere
and this is powerful because you have
people sitting and tables making
decisions that have different biases
mental models
this is one part the other part is
talk with users I think talking with
users is
um it's so insightful you are going to
discover things that you even imagine in
the first second three rounds of user
testing so
the worst team users first and
try and iterate I think the finding the
balance is the most fun part of being
working on this
thank you very much we have time for one
last question in Spanish can be also if
not in Spanish
if not
muchas gracias santonella yes I'm