BBW24 – Day 2 – Retail Security in Crypto

all right so we're going to talk about a lot of fun things today um being your own bank how have you guys heard that before first of all and then how does that sound to you does it sound fun does it sound like something you want to do probably not right okay exactly um I think our industry is full of a lot of terms and phrases that people throw around being your own bank not your keys not your crypto and we'll talk a little bit more about this but what I'm going to get into is the reality of these things is not as simple as the phrase comes out like you tell someone to be their own bank but what the heck does that mean like what do I have to do in order to do that um little bit about me I I love crypto I've worked in this space for a really long time so anything I say that is maybe somewhat not favorable just take it with a grain of salt I've just been doing this probably far too long the key points are that usability um and security are going to be critical to on board you know the next billion million users that we have it'll also be critical to keeping the users that we have and being able to offer them more advanced products um yeah same thing around like face value um the basically if you're if someone's telling you to be your own bank um what they want is for you to hold your funds and not necessarily give it to somebody else the the question that I would encourage everyone to think about is is that really like the best case are you really equipped to do that and to think through that and when we talk about security and keeping your asset safe and keeping yourself safe those are the main questions that you need to ask um I'm fully capable of being my own bank I'm also very different probably from all of you some of you might be fully capable of being your own bank some of you are absolutely not and you probably shouldn't and you should probably use a third party custodian and that is okay um I think I I've built custody before um several times I've built disaster recovery for custody another several times I find it very hard and I find it very complex I imagine the mass of you know the general pop probably has no idea what's going on and that's okay um anyway hopefully what we discussed today is helpful for you you can think through some things and you can come up with your own personal security model for yourself that would be the goal um um and you can continue to do fun things in crypto and grow and learn but in a in the safest way possible and that's pretty much what I try to do at my job and anywhere else whatever you want to do I think it's great and I'm here to help you do that as safely as you can uh all right so I am currently the Chief Information Security Officer for Robin Hood crypto what does that mean I oversee the security program for Robin Hood's crypto business there's a lot to do there um I have a as I said I have a lot of experience building and custody um I specialize in product security architecture and design um so I'm very big on user experience how can we get the users whether they're an internal user an employee or somebody like you to do the right thing no matter what and make that as easy as possible for them so I think design user experience relating to your users very very important um I advise various startups and VC firms on these topics at different stages uh depending on where they're at uh I also am pretty active in the web 3 Community I'm a member of suiz Art Club where we advocate for equal opportunity in the space for a number of different artists I also have a patent um for artists to be able to digitally sign their own artwork and I made my little baby called tantamount Labs uh for that it's a tool um artists can go in and generate a public private key pair and then um be able to digitally sign their artwork on chain through a watermark uh that makes it so that it doesn't alter the artwork but you have that Integrity on chain um you can find me on Twitter in my own little corners of the universe but um yeah that's just a little bit about me also these views don't reflect Robin Hood they are mine and mine only all right cool um so let's talk about like actual custody um unlike trafi custody in crypto you the user are responsible for keeping all of your assets safe um when you look at the it the big picture when Banks fail there's a chance that all the users can lose their money um the upside to crypto is that if there is a banking crisis uh users would still have control of their money and that's I think what is so attractive about it um the other flip side to that that I don't think we talk enough about is that yes there may be a a banking crisis going on we might be able to maintain access to our money but what about all the other times where so many things can go wrong and because you and you alone are responsible you could also lose your money there's a million other ways you can lose money that doesn't necessarily happen in trapi you lose some money in trapi you can call and be like that wasn't me um this was your fault there's probably somebody to blame again being your own bank it's your fault most likely you aren't going to have somebody to help you there's probably not going to be support to talk you through what you did wrong and how you did it um so it's really you and you alone um and I think a lot of this gets conflicted because we want users to have self- custody and I think self- custody is great but we're not really as an industry I don't think we're equipping them to be able to do that long term um I think the the tech is too hard to understand I think the barrier to entry is really high I think the products that we have are not easy to use they're not intuitive um and it it brings higher risks to to investors so let's break down what retail custody looks like um so you have self- custody user has sold possession of their keys there's no third party involvement these could be online or offline wallets some examples of these would include um Robin Hood wallet coinbase wallet metamask uh there's various others you can also have physical devices that are stored offline um but basically you're responsible for your wallet creation your key storage any distribution that you may or may not do um and when you think about that let's say you have a bank account right you can designate a beneficiary and some third party we'll talk about third party in a second but some third party custodians will let you do that when you and you alone are responsible for this um how are you going to give your spouse or your kid or somebody else access to your funds is if you have wallets is that something that you've thought about regularly oh if this if something happens to me how would my family or somebody else that I want get this money um I actually advised on a cas where unfortunately someone passed away had a ton of money in crypto his partner had no idea how to even access it like you don't want to call me in that situ like you don't want to get to that point you don't ever want to have to call me if you have to call me it's a very bad day I don't want that for anyone in this room um she was unable to figure it out didn't really know what was going on um in the meantime like in that time period ended up getting scammed because she was being being targeted because her spouse had passed away and there was an assumption an adversary out there had a reason to believe that he had a large amount of crypto she ended up giving over a lot of information that allowed them to take full control of the self- custody wallets just a scenario for you to think through um you know as you custody assets yourself uh you should have a plan and other people typically the things that you don't think about because they're already done for you now become very prevalent with this um third party custody you can use somebody again like a coinbase a Robin Hood a kraken another exchange we will hold your crypto for you we manage the keys we are responsible for backing it up we give you options for beneficiaries if you would like to we offer a lot of the same things that a bank is going to offer you with your bank account um with that you don't have control over your assets if we become if any of these parties become a liquid or not able to fulfill your withdrawal request your money would be gone it's a very similar model uh to a bank you're also responsible for like your login and your credentials so similar web to security threats are going to apply here whether you're fished scammed things like that so you're you're kind of already looking out for things that you normally look out for like hey I got a weird email I'm not going to click it etc etc um onchain is also uh it's a more advanced option I think if you're you know doing a lot of trading uh your assets are going to be stored in a smart contract you can use something like a Nosa safe and then um there's other contracts you can put funds into uh usually the keys to that are going to be secured by a multisig scheme I won't get too into it but sometimes one person has all those multisig um and it's just going to be a higher risk for compromise um personal opinion here I think given the custody models that we have I don't think we would be able to onboard um the next billion users I don't think we're able to balance usability with security I think these wallets are hard to manage they're hard to maintain information if you ask a regular person you know would you ever write your password down on a piece of paper and store it somewhere safely they're going to tell you no um that's what we're essentially asking people to do with a seed phrase go ahead and write this really important nemonic down don't lose it and keep it at your house it's ridiculous it's crazy it doesn't make any sense fully aware of that um unless you know how to manage the that seed phrase there's a lot of things you could you could also do and if you have questions I'm happy to answer you can put things in a safety deposit box you can break it up there there's a number of ways to store this safely if you want to do that um but asking the mass population to go and do that and expecting um the industry to grow and to be able to onboard users I think is is frankly ridiculous so um that purist model which I I use the purist model I am a purist when it comes to security and when it comes to crypto I fully realize though that that does not work for the vast majority of people and it doesn't really work outside of even a small subset of people um I think effective security is going to balance protection and usability and then I think if we're unable to scale crypto and we're unable to make better custody products we are going to end up with the vast majority of funds centralized in one place at you know three or four custodians which is not necessarily what we want either and kind of defeats the purpose of decentralized money so we'll talk quickly about a couple security models I'm not going to spend too much time on these but um what we have today is mostly multisig MPC HSM uh these basically all provide a level of encryption for key shares and distributing the key shares for signing so you're basically taking your key splitting it up through some type of like Shamir starting or another mechanism you're giving it to a number of different people they're able to sign you usually have a quorum we don't need to spend too much time on this but uh a lot of Institutions are going to use this for an individual user that's impossible like where am I going to put these Keys how am I going to sign it how many devices do I need it's just a lot to ask um long story short I think pass Keys have introduced like a couple new ways we can explore how to make wallets or custody funds better um it allows us to use potentially a UB key where you can put your seed phrase there or your your private key there um UB keys are traditionally used for multiactor authentication um but it would help reduce the complexity of the first option which is going to be multisig NPCs or hsms um and I think the important thing to note is these the new wallets and the new custody products that we make have to essentially challenge the old way that we've been thinking about things and the old way essentially a device need to be completely air gapped um and then also uh you need to have like a specific dedicated device for these uh smart wallets I think are very interesting I spent hours in a debate about why pass keys and smart wallets may not work and could work and not work I think a lot of these are early but if you can use a device bound Pass key as your wallet um or as part of your wallet I think that potentially could be a good option it would make it a lot easier for people to use um and then also too the threat model for most people like you have to think of the threat model for like a high-profile executive or somebody who's very public facing or super wellknown is very different than what it's going to be for all of you in here so I think that's another point I want to get across is you know your security should be as good as what your profile is and it should be something that you can do you don't want to make stuff that's too secure that you can't even get back into it and yes I've done that more than once so that's not really like where you want to be and I think you have to assess yourself and what that should look like to know what you should be using but I'm excited for the new options that are coming out because obviously what we have today doesn't work I think it's just about getting to something else that has a really good balance um couple tips from me on just like wallet security when like you set up your wallet you're good to go you are your own bank you're doing all the right things um wanted to call out a couple things you need to stay focused on which is transaction verification always know what you're signing um it should you should be signing things in clear sign if you are not should start um there's plenty of thirdparty simulators that you can paste your transaction into and get the right information to verify it you should be doing that all the time um diversification don't keep all your funds in the same place have intermediary wallets that you can transact in between um your hot wallets are likely going to be connected to Smart contracts you don't want to have your entire net worth in that wallet you want to have whatever you need to do what you do as what we say like working for institutions is like just keep what you need to run the business you can always transfer more in and out as you need um you should also do that at home uh access and approvals is a big thing always verify the applications that you are using and check that the transactions you're executing are interacting with the right contract that you would expect it to be also check and revoke your approvals frequently um you don't want to have infinite approvals really at all and if you can you only want to approve for certain amounts super super important I think you know in the defi space and there's a lot of hacks that can happen and and occur you might not even know about it it could be while you're sleeping if you have infinite approvals out could easily have your wallet drained um so just something to some things to think about there let's see where am I at okay so what does all this mean for retail users um essentially it's kind of a lot of the things I already mentioned uh but you want to make tradeoffs uh know what your tolerance is and what your risk appetite is um and just make the decisions that are best for you uh if you need help I know plenty of people who' be happy to help you and just remember too like custody is hard security is even harder um when you think of I want to be my own bank think about all the things that could go wrong like you want to have an adversary mindset um so that you're able to kind of know what you're getting yourself into and know what you're managing I think a lot of people go into this they have no idea of all the things that could go wrong my job all day is to think about what are all the things that could go wrong and then you think of all the retail users who are cting maybe millions of dollars at home not thinking about all the things that go wrong and that's like very anxiety inducing for me I I get very worried um but anyway that's the takeaway there um I have a few more things for you uh and I can't stress this enough actually this is probably the most important part of this presentation um but you can't be your own bank if you yourself are not safe so managing the wallet and managing the keys and having that technical expertise and learning about it and all of that is one thing there's so many other things that are much more important than that and we'll talk about these um yeah keeping yourself safe is is really the big thing so this Topic near and dear to me I've seen it I've experienced it I've it's been it's everywhere physical security is the most important thing when you are in crypto there's a running list on GitHub of all the physical attacks that have occurred in the space it's not there's no way it's complete because most of these cases don't even get reported um but of everything that's reported it's a running list shout out to the internet for for making that um but recently a CEO was robbed at gunpoint um personal and Company funds were were uh compromised essentially uh the thing with this is um one if you are an executive at a company you should never have access to Mo funds you also should never be able to unilaterally send a transaction um that also depending on who you are might be a good model for yourself as well uh but generally physical safety and physical threats more and more like they've increased more and more since crypto has become more like retail focused and mainstream but this goes back to even like the super early days when it was when it was just Bitcoin um so getting into it um generally assets can be liabilities uh there's a number of different mechanisms that ad adversaries will go ahead and use swatting kidnapping inperson trades home or work invasions I have seen burglaries I've seen all of these in some way shape or form really in a work setting and in like a personal setting um can even reference a few weeks ago that fact that anyone still does inperson trades is beyond me but a few weeks ago someone wanted to do an in-person trade I think this was in Singapore um they got ambushed at the mall it was a whole thing uh they scheduled their meet up through telegram never had conducted business with this group before um all to reduce trading fees does that sound I would have rather paid whatever the trading fee was I'm sure all of you would too I don't think getting stuck or punched in the face because they want to do it in person trade is a you know I don't know who would choose that um but anyway getting to the important stuff that I need to tell you before I go over time and I'll try to leave a couple minutes for questions um we'll talk about really quickly physical security device management account management and international travel I think in general for all of these um paranoia's policy always think like something can it might go wrong head on a swivel like think about uh you just got to think through all the like all of these scenarios like I'm going to hold crypto at my home okay who knows that I do this who knows where I live um do I post about this on my social media platform maybe have I made myself a Target should I be concerned do I need better security um kind of steps like that and everybody's different right like I I love social media I love like being on Instagram with my friends I love to post I'm sure all of you do too um but there you can do in a safe way uh so when it comes to physical security be mindful of what you do in public places obviously don't advertise things that should not be advertised I.E I have crypto I worked for a company at one point one of our highest Network users love to post that he had crypto at the company all the time screenshot on Twitter I was like can you stop doing this please I would like you to stop doing this he's like but I'm like there is no but like you're ruining my day um generally you don't want to make your locations publicly known granted in the day and age of social media we do this all the time um but generally too I think the things that are most important situational awareness um you want to be in like a relaxed state but also paying attention I think walking down the street on your phone not looking not paying attention I don't recommend for a number of reasons but also just generally as well um I would not keep your crypto apps or your financial apps on your phone that you walk around in the real world with especially if you have something to lose if you don't do anything in crypto you have five dollars and you don't care cool um if this is something you care about and you have a significant amount of Holdings like you don't need that you're not going to go to the bar and trade I'm just gu I'm just guessing you probably wouldn't I wouldn't so I don't know um routine I think this is the hard one for me I have a routine I like my routine um it's good to switch it up every now and then though you never know who's like paying attention key thing assess your own threat model so you have your own personal security posture that's really what I do is probably not for all of you what someone else does may or may not be for you depends on who they are depends on who you are so really like sit down and take the time to like ask yourself those questions um I want to talk about decoy and duress wallets because I hear a lot of people say like oh just have a deco decoy wallet or have a dress wallet um the main point with this is you don't know if it is going to work someone who attacks you for your money or what they think you have is not a reasonable person a duress wallet may or may not save you how do you know what they will be satisfied with you don't um so I think I wanted to iterate that because I hear it so much of like this is such a good thing to do maybe maybe not you also from a liability perspective could be seen as escalating a dangerous situation because you're telling them you have something or giving them access to something um that's a whole can of worms we don't need to open up because I only have a few minutes left uh but I just want to iterate that that is not necessarily like that is not going to protect you in a in a scenario um device management I think the best thing I could say here is like TFA MFA everything that you have um always keep your stuff up to date encrypt your devices you should be in pretty good shape oops I went too fast account management same thing tofa um app based or UB key is best use password managers um enable fishing and spam protection G Suite has this I think you have to pay but it's pretty good so probably worth paying use Google Voice numbers also if you're sending stuff to your house especially like a hardware wallet or a lger um use a PO Box use a Dropbox things like that um you should do that really for any e-commerce stuff not even necessarily crypto and then uh international travel uh obviously certain countries are friendlier than others uh depending on where you're going I would leave things you can part with at home use a VPN avoid public Wi-Fi avoid plugging your phone into weird things um and yeah that's I think that's it do you guys have any questions for me thank you so much hey Caitlyn I got a question for you um yes so the question is could you do a super quick compare contrast of a wallet versus smart contract just for a whole like as a individual's hot wallet uh yeah so the the smart contract is going to be something like a nosis safe or something like where you're actually interacting with different protocols the funds will be stored there because the private keys are actually stored in the contract um usually those keys may or may not be protected by a multi Sig that could be two or three people or could be one person um your own wallet is going to be some sort of software Andor Hardware that you download from something probably a browser or you purchase um as a actual piece piece of Hardware uh and that's going to have a private key that Maps back to that wallet and that's what you use to interact with uh different onchain protocols or other wallets uh your regular wallet can interact with a smart contract um um yeah does that answer the question pretty much is good all right cool uh so are you familiar with any wallets that exist now for maybe uh erc20 is that's like a privacy wallet features with like stealth addresses um or maybe something that's using ZK rollups uh there was one that I was using but that got shut down Samurai so do we have anything like that available now yeah I heard Samurai got shut down I don't think I'm aware of like anything else lately yeah because my biggest concern is when you send transactions people can see everything that you have in your wallet once they have your address yeah so is there anything out there that uh um I mean I think I'm not really aware of anything also I think that's going to be hard to do uh especially for different depending on who provides the wallet if you're talking about like a completely isolate I just don't know how they would do that without uh being able to meet certain regulatory requirements so like a coinbase or a Robin Hood or somebody else probably wouldn't be able to put something out like that um yeah no okay hi I'm Calvin thank you for the security overview and props to you for not just saying go buy crypto on Robin Hood uh my question is about the next generation of wallets such as coin bases that replaces seed phrases with biometric logins what would be a good way for if something happened to you to have somebody that you want to have access to the wallet with the new type of password you know seed phrases are annoying but then again if if somebody knew where to get the seed phrase from you they could you know get access to the wallet whereas Biometrics it's not the same yeah absolutely that's a great question um the smart wallets are or what they're actually like calling a smart wallets are they're still going to give you the option to back up your seed phrase um so I think you'd have to bake that into whatever your plan is actually for recovery and if you wanted it to go to somebody else uh there is I have not had time to look into how like Social account recovery may work with smart wallets potentially and if you could delegate another user um or you could set up a there's also you might be able to do something like pre-signed exit transactions in a way where if an event happens or you haven't logged into the wallet in X number of months or days it could automatically send your funds to someone else or to a safer place or like a ledger um I think you'd have to do you'd have to do something like that uh because obviously they would not have your Biometrics and I think if you're dead you can't use a fingerprint still so yeah am I out of time all right cool thank you guys