[Music]
all right hi everyone how's everyone
doing today hi I'm Taylor Monahan I'm
the founder and CEO Mike crypto
previously ours with my ether wallet we
did a little brand fork we are a
distributed team of about 20 people
we're all over the globe front row right
here this is my team so find us
afterwards ask us questions and if you
want to work for us we're always hiring
so definitely definitely talk to us so
today I'm going to talk about the
unintended consequences of product
design and some of you may be sitting
here going what the heck does that even
mean and basically it means in the early
days we screwed a lot of things up we
made a lot of design decisions that
we're just not necessarily the best
decisions that we could ever make and
they had some unintended consequences
that you know led to things like lost
funds confuse users and generally just
bad things happening in the ecosystem
now I want to be clear I'm not giving
this talk to be negative or to call out
certain products especially my own but I
want to make sure that everyone in this
ecosystem is able to learn and grow from
other people's mistakes so that we don't
repeat history over and over again I
want this entire ecosystem be safe and
easy to use and better so let's start
with the most basic interaction that you
do on my crypto which is creating a new
account if we have to go back in time to
2015 and in 2015 a theorem had just
launched there was no real way to
interact with with etherion blockchain
and we created a really really simple
interface and when I say it was simple
it was really really simple it had a
single button a single little field and
it just said hey generate a wallet it
wasn't called my crypto it wasn't even
called my ether wallet it was just
called ether wallet and how'd it get hub
pages URL and basically what we asked
users to do was type in a simple
password and press a button and then it
would spit out all of your information
just like that and by the way
loved this interaction from a UX
standpoint it was as frictionless as it
could possibly be one click and you had
all the information that you needed
Helmut how could we make it simpler the
problem was is that even though we
really really wanted to make the process
really really easy and quick it resulted
in people simply not saving their
private keys so if we go back and look
carefully that field right there under
success your wallet has been generated
is your address and that's the piece of
information that people need in order to
send funds into their account and so
what people ended up doing was instead
of saving the private key saving the key
sir files leaving the qr-code any of
that stuff they would just copy the
address send funds to it and then some
point down the road they'd be like oops
I don't have any way of accessing my
wallet and we saw a ton of loss from
this so how did we sort of solve this
problem what steps did we take to
mitigate that loss this is the new
interface on my crypto and basically
what we do now is that we have you enter
a password we have a whole bunch of
algorithms that make sure it's a strong
password which is also a huge positive
and then you click cranial wallet and
then it forces you to actually download
the keystore file so in order to
continue on you have to download this
file and even then we still don't give
you your address we give you the ability
to unlock your wallet via the file that
you just created and what this does is
that it ensures that the user has not
only created the wallet has backed up
the wallet but that they can also
successfully unlock the wallet now and
then obviously again in the future and
this cut down on the amount of loss and
incorrect backing up of keys that we
were seeing so so so frequently and it
had a positive really positive impact on
our number of support tickets so what
can we learn from this sometimes
friction is a good thing you need to
force people to save the necessary
information you need to force people
down this path and sometimes that path
does have some extra stops and it does
require some more clicks but if the
ultimate end goal is to get people into
this ecosystem safely and six
fully and for them to backup their keys
maybe you do have to literally force
them to do that or at least guide them
down the safe secure road and not let
them take this alternative path so my
next example is one that is really
really really terrifying I've seen it
with a few jobs already it's happening
more and more frequently and it's this
practice of saving private keys or other
secret information to local storage so
this is ether Delta which was one of the
sort of original taxes and in 2017
almost everyone was using this if they
were using into centralized exchange and
ether Delta has a create account
functionality and just like we used to
it just sort of spits out your private
key you doesn't ask you to back it up or
force you to back it up or any of the
above it just gives it to you but it's
kind of ok because they just save it to
local storage and for those of you that
don't know local storage it's kind of
like a cookie it's a way of saving stuff
to the browser so if you leave the
website or close your browser and then
return to the website it can read this
data again and so it can basically re
access your account or reallocate your
account without yuri entering your
private key so looking closer there's a
private key that they spit out of you
and there it is saved in local storage
right there and this is incredibly
dangerous local storage is not a secure
place to sort keys ever don't ever put
keys there don't put secrets there don't
put anything there but it's especially
dangerous when we're talking about
cryptocurrency websites because they are
such a huge target for attackers and
hackers and I know I said earlier that I
wasn't gonna sort of call out specific
products or you know shame people but
I'm kind of just gonna be frank with
this I'm shaming either Delta ok
because in December of 2017 they got
hacked their DNS was attacked ok they
rerouted the DNS from the real valid
ether Delta site to a fake one it looked
identical to get their Delta people
didn't know the difference people were
going in unlocking their accounts people
are sending money to a fake contract all
these things but the worst thing was
that anyone that read the news that day
and got scared and said Oh shoo I've
used ether delta before and simply
visited ether Delta then had their
private keys and their funds solon and
the reason for that was because the
private keys were saved to local swords
the user had to take no action beyond
simply visiting that website okay this
is an immensely harmful thing to the
ecosystem to users and to everyone
safety and security again cryptocurrency
websites are a huge target and we have
to be secure and we have to be safe and
that's your own personal security your
company's security your website security
and most of all your users security so
we know the intentions of ether Delta
and other similar jobs right they're
trying to make this process easier
they're trying to make it so that people
don't necessarily have to backup their
private keys they're trying to make it
so that if a user leaves the website and
then comes back they don't have to go
through this other process it's all
about reducing friction and that's what
we want to do when we talk about user
experience by unintentionally they
painted a huge target on their back like
let's be real for a second saving
private keys to local storage this
you're an immensely popular website
people see that you have users people
can see the amount of money flowing
through your website you've literally
just painted a huge target on your back
you've waived it the hackers and the
attackers and said hey I'm right here
come and got me and then when they did
come and the attackers did successfully
find an entry point it resulted in way
way way more loss and for me this is
simply unacceptable so if you're a dick
job developer and you're trying to make
the experience more frictionless I
applaud you but don't save secrets to
local storage okay it's not
philosophical it's not complicated it's
it's not it's just that just don't do it
don't do it unencrypted don't do encrypt
it don't save secrets the local storage
all right so moving on some of you might
be sort of arguing with me a little bit
and being like but
Serg is good I can save stuff there
right yes sometimes don't save secrets
there but local search can be really
really helpful because you can save
things like user preferences or settings
you can remember what language a person
uses or what currency they like or
whether they like the dark mode of the
light mode and you can also do things
that try to simplify the user experience
one example of this is the this is the
original the the OGE and a staff
experience so if we travel back to last
year when you wanted to bid on it
ENS name you basically had to go you had
to bid on the anis name and then you had
to wait a couple of days and other
people would bid on the name and then
you would reveal that name and because
it's all decentralized and it's all on
the blockchain you had to save three
pieces of information you had to save
the bit amount you had to save the mask
bit amount and then you had to save the
secret string which is just like a
jumbled string of characters that acts
as a salt for all the other information
so that it's not public on the
blockchain so this da sorry this stop
really wanted to make make the
experience as good as possible so
instead of telling the user hey you guys
have to backup all this information and
please don't use it and make sure you
save it and all of this they decided hey
let's just save that information a local
storage and they had the best of
intentions with this they wanted to make
the experience more frictionless they
wanted to make it easier they didn't
want to have to explain to the user what
this bid was and this mask bid was in
the secret isn't why they have to save
it all that stuff the problem was is
that especially in the cryptocurrency
space we use incognito mode we use
different browsers we use different
devices we use tor we use all these
things that protect our privacy and one
of the things that these things do is is
it prevents things in local storage or a
cookies from persisting right so if
you're in the incognito mode you close
that browser it's gone so shortly after
the first sort of bids were were
replaced and then we're ready to be
revealed the support tickets and and on
social media and everywhere were through
the roof and people were like I can't
figure out where my bids went I can't
figure out what this
Greta's I don't know what this is etc
etc and unfortunately there was no way
to even recover this information because
it had been saved in local storage the
user never saw it they never backed it
up and you basically just had to say
sorry your eath has locked up in that
auction
luckily the developers of the stop where
we're really really on it and so the
second they realized this they changed
the interface that basically once you
place a bid it forces you to sort of
download this bid and educates you and
it says hey so you need all the secret
information we know it's complex but
save a backup just in case anything ever
happens to your browser you can get it
back so we know the intentions of this
stop and I'm sure many deaths that are
currently out there and to come we want
to abstract things away we want to hide
these complicated and complex
interactions from the user and we want
to have the user perform less actions
because at the end of the day these are
does just want to bid on a name or
reveal a name they don't want to
understand the inner workings they don't
want to know how the sausage is made
unfortunately in this case it resulted
in confused users who couldn't reveal
the auctions and and there was simply no
way to recover the information and
that's a real shame I don't I don't want
to to my own horn too much but this was
sort of how we handled the same
interaction so I had learned my lesson
from the whole private key spitting out
the address not having people back up
I'd already learned that so when the E&S
came along and I was making design
choices with this we basically told the
user to screenshot it we told them to
back it up we gave them an easy way to
copy and paste the string and we told
them this every single step of the way
we told them this as they were replacing
the bid we told them this before they
sent the transaction on the confirmation
modal and then we even told them after
they said we're like hey by the way if
you're too lazy to back it up before
please really seriously do it now
and you see the little red bar there
like this is the middle sap the next
step it was like really starting to yell
at the user because if the user had him
backed up by that point we really needed
to do something to grab their attention
so what
can we take away from this example we
know that we don't want to save secrets
localstorage
it's sometimes acceptable to save non
secrets to local storage by make sure
that you don't rely on that information
because user environments can and do
change so I like to play this game where
it's called best case worst case and
when you're looking at the design or
you're looking at your product you want
to say what's the best possible outcome
and so in this case the best possible
outcome is the user can place the bid
reveal the big get their name
everything's hunky-dory they don't have
to take any other actions they don't
have to understand how it works flawless
the worst case is that their action
cannot be revealed and their eath is
locked up which essentially makes the
eath lost and for me that's not an
acceptable amount of loss that's not an
acceptable experience so then you have
to ask yourself what steps can we take
to mitigate that loss how can we change
this design change this interaction
change this experience to make it better
and if you think about the same sort of
game the best case worst case with
things like user settings right so a
user says hey I really like to use your
your app in dark mode and they change it
best case when they return to your site
again it's in there cool theme they're
happy they don't have to take an action
and the worst case is okay they have to
click the drop-down and select their
little dark mode again and that's like a
sort of perfect perfect thing for a
local storage because it's not the end
of the world if you lose that
information it has no value to hackers
you know all those good things all right
and then so I want to we've been you
know pretty heavy on the crypto sites
and I want to remind people that these
aren't product design UX choices that we
make are not limited to cryptocurrency
this is everyone everywhere and even the
big boys make these mistakes and make
choices that do have unintended
consequences so we're gonna take a look
at Google's recovery emails and phone
numbers and how they've set it up and
what this sort of results in so when you
first start up a new Google account and
this is like Google I mean like
everything Google Gmail YouTube
I don't think Google+ is the thing
anymore but you know it used to be they
ask you to enter some information so you
got to your name you got to do your user
name or your email address and then you
got to do a password that's all are
pretty standard the next step is that
they you ask you to verify your phone
number and you can't skip this step you
have to give them your phone number and
it has to be a valid phone number
because they're gonna text you a little
code and you're gonna have to enter the
code on the next stage and then once
I've verified my phone number
it asked me for another email not just
like an old email address and then some
other personal information that you
could enter you can go and fake him row
I give them fake info you know and then
once you've sort of successfully set up
the account you've given them your phone
number which has to be your real phone
number and a recovering email and if you
go deep into your Google settings you're
gonna see it's like halfway down the
page nested under security this place
that says recovery email and recovery
phone and then that's this is this is
the danger zone right you may think
about having a recovery email and a
recovery phone number is a good thing
because it allows you to recover your
account if I forget my password and I
click little forgot password it's right
there it's like hey we'll help you out
we'll get you a verification code you
want to use your email address no you
want to use your phone number okay cool
the problem with this is that attackers
and hackers can also recover your
accounts and what ends up happening is
that your your let's see so right now
you have an email called Dan loves
crypto so much at gmail.com and this is
probably super secure right like you've
got ufa on that like it's the best
the problem is is that it uses your your
email from a couple years ago your
libertarian dreamer email and that one
is also recovered from that that email
you use when you're applying to colleges
your your very professional first-name
lastname which is also can be recovered
with your you know your old gamertag
from high school that you don't admit
that you still have and so even though
you've secured your dad loves crypto so
much email and you have two FA on it
ah really your queen bees in your Gemini
and every exchange account that you have
linked to your current email is only as
safe as your literally your old camera
time from like 2006 and this is where
the problem happens is that hackers will
either get into one of your old email
addresses and then work up the chain or
they'll just port your phone number and
if you're in crypto you may think that
you're a small-time and you're like oh
I'm I'm just attending Def Con I'm just
a person who watches the livestream
every single one of you that's in this
room if you are knowledgeable enough to
be here or be watching the livestream
you are a target there are thousands of
attackers that do nothing but try to
social engineer the phone companies
every single day they try to port your
phone number they try to do a sim slot
and they try to get in to all of your
exchange accounts all your old Gmail
accounts they try to see what
information they can get they try to get
your PayPal and they will take your
money and the best sort of money that
they can take is your cryptocurrency
because it's anonymous and and it can be
you can go swap it in a Manero and now
nobody can talk it and then they can go
do whatever they want with it they can
go buy new domains with it they can cash
it out into their bank account and
nobody knows right so this is these are
the things that are happening and while
it's a good thing now user accounts can
be recovered and this is especially
important when if you're adopt developer
and you're working in this ecosystem
like you want to figure out how to
recover things be very very aware that
these accounts can also be recovered by
hackers and so what you know what
choices can we make to mitigate that
because it's not necessarily realistic
that every single gmail user uses like
au Baqi right like I'm not quite sure
that we want to tell everyone in this
world that they have to have this
Hardware device however Google has a lot
of information on us like they literally
they read all your emails they read all
your web browsing history they know
everything you do on your phone they
know if you're like a high
target person they know if you're in
cryptocurrency they know if you're a
celebrity they know if you're a
politician one thing Google could use or
do with all of that data is they could
figure out hey we got these average
users and we've got these high target
users and they could force those high
target users to not use insecure backup
right they could say hey you your target
for hackers let's make sure that you get
that hardware wallet or you use Google
Authenticator you some other mechanism
for 2fa and and that's something to keep
in mind if you're building in this
ecosystem is that every single one of
your users especially right now or high
target right they are at risk for being
attacked or hat and you need to
prioritize the security and the safety
of your users not just your usability
and then just PSA you guys all have
Google accounts please go secure them
and don't get hot okay so we're almost
done I talked earlier about one of the
biggest mistakes I've ever made which
was this sort of account mechanism where
we were just spit out your address and
people wouldn't back it up and you know
it was it was a mess and it was it was
painful for me to watch that loss and
everything but this is like one of my
biggest mistakes ever and it had a huge
effect on not just me and my company and
my users but everyone in the ecosystem
because people started following sue we
allowed from the get-go people to enter
their private keys or their keys or
files or their mnemonic phrases other
see phrases on our website we actually
encouraged it that was the flow you
created a new wallet it could be your
private key you unlocked your wallet we
their private key you sent your money
around that was it
the problem with that is so let's go
back in time when I first got in crypto
everyone said don't ever put your
private key on website and I was naive
and I assumed that meant because the
creators of the website would steal my
funds at some point when I created my
own website I was like hey I'm not gonna
steal people's money therefore it's okay
if we have people put their private keys
on our website and
was that was just wrong right because
the attack vectors are not just a
website owner stealing funds the attack
vectors are the user isn't on the
correct site they're on a phishing site
they're on a scam site they get in the
habit of entering private keys on web
sites all over the web or DNS could be
hot too BGP could be hot the internet
could be hacked
I could be hacked you could be act like
there's all these different things and
we did a lot to try to educate people we
basically we added so much friction to
the experience and we really yelled at
people and we told them don't use this
method
don't put your private key on our
website check these boxes acknowledge
that you're being unsafe this isn't
recommended we created this atrocious 10
freaking page modal that you had to
click through and it forced you to click
through and the buttons hopped around
and we were just adding friction left
and right and the reality was is like
you can yell and shout and stomp your
feet all you want but the user is always
going to take the easiest path and if we
allow people no matter how much friction
we add to use their private keys on a
website they will use their private keys
on a website and it will eventually at
some point result in loss so we've
removed private keys from websites if
you go to our current site right now
when you try to unlock right now and you
try to do this we explain to you yo this
is not secure we're not letting you do
this anymore
download our desktop app right we push
people down this alternate path and and
we don't have analytics but if we did
have analytics this would be painful
you can started be watching people drop
off right here like it's just insanely
large right the numbers would be like
you know 100 people arrived and like
only 25% continue on and that's painful
from a UX perspective that's painful
from a product design perspective you
want to get those numbers up but the
reality is is that if we allowed people
to continue doing this unsafe thing
people are going to lose
money period and so even if I'm losing
some users because they're unwilling to
click the button that dollars the
desktop app I'm ok with it because at
least I'm losing losing users I'm not
having those users lose money I always
want to lower the barriers to entry I
want to make this as simple and
frictionless as possible by
unintentionally by allowing our site and
even recommending private key usage on
our website I inadvertently created like
heaps of phishing websites heaps of scam
websites registrar's getting hacked BGP
which is like the innermost depths of
the internet it's like how the internet
works like hackers are attacking that to
get my ether wallet now all these things
because we put private keys on the
website we put mnemonics on the website
we put key server files on the website
we seize on the website and all these
other websites do it as well so it's not
just our site it's all the sites it's
all these scam sites all the phishing
websites and people will just sort of
copy and paste willy-nilly wherever it
is and so this is again not
philosophical not complicated if you are
building adapt if you're building a user
experience if you're building a product
in the space I urge you do not allow
people to put private keys or mnemonics
or key store files or other seeds on
your website create an app do a Chrome
extension use madam asked use trust
wallet like some other mechanism the
hardware wallets they're great like I
eat any of those but the reality is is
that if it's on a website you have to
trust that the website is the same the
website the code is the same as it was
yesterday as it is today you have to
trust that the register wasn't hacked
you have to trust that the internet
wasn't hacked you have to trust that the
users on the right website you have to
trust that nobody's scamming you there's
all these different things and the
easiest thing to do is just eliminate
that and focus on actually building your
product rather than everything that we
did for so long which was like oops
design pretty onboarding modal's to try
to force you to be safe like just let's
just be safe by default right
all right so I've got three minutes left
we're gonna move fast I'm sorry
why have we learned what are the
glorious huge takeaways from everything
that we've talked about today first do
not underestimate the people using your
product okay your users are talented
they are smart they are intelligent you
can educate them you can teach them they
can get into crypto because of you and
your product but they are also really
really really good at screwing things up
don't underestimate them on either end
of a spectrum and be prepared for
everything next people will always
always take the easiest path if you
allow them to not backup their private
keys or to just skip some other of their
other piece that they need of this
puzzle called cryptocurrency they'll
take it and they'll skip right over it
and it will eventually have a negative
effect on your product and your
reputation and their experience and all
of that education it helps a lot I have
been like really like constantly
applauded for my work in sort of the
education sphere and I'm telling you
like it go it does it helps a lot if you
really nail copy on education if you're
really nail like little helpful tool
tips and stuff it does immense things
for your user base but it really only
goes so far like we saw people always
take the easiest path and so you know
the education if you find that your
educational sort of materials start
being angry and start yelling at the
user it's time to take a step back and
say hey how can we just build something
that is secure and is safe by default
because it's obviously telling these or
yelling at the user or making onboarding
modal's isn't working anymore and learn
from others mistakes so work together
talk to each other listen to this talk
read articles about bad things that
happen in this ecosystem study them and
do your best to not repeat history which
goes hand-in-hand with be really really
mindful of the attack vectors
out there again this space this whole
block toon cryptocurrency world is it's
really different okay it's like
everyone's used to undo buttons
everyone's used to you know being able
to be a little bit lacks the reality is
is that the ROI that attackers got for
stealing a private key is so high that
they will do almost anything to get into
your website or your app or your
back-end infrastructure or your hot
wallets or whatever it is and always
consider the sort of the best case worst
case that game that we played earlier
where we say what's the worst possible
thing that a user could do or the worst
possible thing that could happen and
what's the best possible thing it's not
gonna happen
and how do we sort of you know find the
right balance and I just want to remind
everyone that building the decentralized
future is really really hard and this is
why it's so important that we all work
together and we all learn from each
other and we all build each other up and
that we all individually strive to be
better and we push those around us to be
better we want to make sure that whether
you're developer in this space whether
you've been in this space for a year or
two years or five years or two months it
doesn't matter
everyone has their role to play and if
you're seeing another developer in the
space that sort of may be making a lazy
choice or not thinking about something
even if you're just a normal person
who's reading Twitter you have the
ability to ask questions and to point
things out and to questions people's
choices and I still to this day read so
many of our support tickets and so many
of our Twitter jion's that our Facebook
messages and all of the above
and I always always always cherish the
ones where people are questioning my
choices and are pushing me to be better
because sometimes honestly I just didn't
think about something and being aware of
that is half the bottle because then I
can fix it
and then lastly building together makes
building this a centralized future a
whole lot easier okay we can't the space
is too small to have real competition
yet okay we have to all work together
build build this as this whole ecosystem
up
and we we need to think about it as US
us being everyone in this room everyone
watching a livestream
everyone on crypto Twitter verse the
world and the world is the world out
there that doesn't even know what
cryptocurrency is and has no chance of
using it we cannot be fighting with each
other we cannot be instigating Twitter
drama
we cannot be dealing with these little
tiny pieces of we need to be
looking at the big picture and the world
out there and conquering it so I've met
with a lot of people at Def Con and I've
been noticing this little trend of
people that are like one foot in this
ecosystem they're like I kind of want to
go full-time but I'm not going full-time
and I don't really know what to do
every person has the ability to make
this ecosystem better okay it doesn't
matter if you don't know how to code
because we need the people that can
write copy that can design that can make
the experience better we need the people
that are the mothers and the daughters
and the grandmothers and we need the
fathers and their sons and we need
people from all over the world that have
all different backgrounds that come from
different experiences that come from
different upbringings that have gone to
different colleges because in order for
us to build a global ecosystem that
anyone in this entire world can use the
people building the ecosystem need to
reflect that world it cannot just be one
demographic of people it can't just be
the technical people it has to be
everyone so if you have one step you
have one foot in I need you to step all
the way in I need you to think about
your unique skills your unique
experiences and I need you to figure out
what you can do to make the ecosystem
better and then I need you to email me
at jobs invite crypto calm because we
are literally always hiring and thank
you so much I'm Taylor Monahan from my
crypto I love you
you