EthCC 2: Thibaut Sardan

all right so I want to walk you through the history of what people used to do or usually used to do with their private key how they stole them how they use them and what like why we came up with this idea of the party signer so before we start who view owns a hardware wallet show me the hand oh that's a big portion I would say a good eighty-five percent so I'm gonna go quickly because also we are late on the schedule that's a nice story but I can it can be a nice quick story so you probably all know that when we send a message on the blockchain we want to transfer money basically when Alice sends money to Bob what Alice does is create a transaction that's like a message then she signs it with her private key and so that she can tell okay this is actually Alice had created this transaction and then it's sent to the blockchain so these two arrows or places were you gonna use a software to do this and this is where you can get tricked or you can people can try to to kind of take your private key eventually or yeah pretend you're gonna do something and they are actually doing some some other things so that's when you will use a software and these are the keys that the key elements that we want to make sure secure and of course the most important part of in this whole thing the thing that you have to hold securely is the private key so when you get the private key today or actually Argent for instance try to hide this but like originally what we used to have was okay am a monic or private key directly in plaintext that is given to you and where do you keep it it's well you should be should be on a piece of paper but at some point there are like text messages and the problem with these two is that they are not encrypted if someone takes they can steal your money so you better put it somewhere safe and what we came up with after that it's Jason key file that is encrypted itself and that you can use eventually also - together with the password - just give access to to be able to sign transactions right so what people used to do in in the beginning of crypto was using website so like my Thor wallet so what you do is you actually copy place your private key or you upload your Jason key file and then give the password and the problem is if my the wallet gets hacked or maybe not or maybe you just click on this link this day because you were in hurry and you wanted to send some crypto to your friend you know usually that you shouldn't click on ads and stuff but you will another computer whatever it can happen that you actually give the private key to some fake my wallet and the problem is not that my the wallet can be hacked anything can be hacked right DNS etc the problem is that you give you private key you should never give you private key ever right so people could use meta masks as well so meta mask is not in the browser it's like a bit like an application it's actually more on your computer than in the browser the thing is it's connected constantly to the Internet it's a plugin so it can be updated automatically and at some point madam asked can also quite easily well get hacked at some point if you remember a couple now it's a couple months ago Mira Muscat actually kicked out of I think it was the chrome store and during this couple of hours there was a fake minimus that popped up so this is the kind of thing that I mean minimize even though it's an application on your computer can get hack and and your private key can get stolen so what you also can do and that's for instance to move that microp to date or what we did with the wallet that's called parody feather it could be used on your like not directly connected to the internet but on your as an application on your PC right again you're gonna have to somehow give you private key not in plaintext because they don't allow it but you have to unlock your your Jason key file and if these guys for some reason get hacked or because you use it on your PC and that's probably the main problem you use it on the PC you use every day right you PC the whole environment could be watching you could have a key logger and you can just lose your private key so most of you have some hardware wallet these guys they are nice they keep your your private key safe and you still need to somehow craft the transaction and send it through the blockchain right so what you do is that you use an application such as feather or my crypto you craft the transaction you send it to the hardware wallet you sign it on the hardware wallet you should be able to check it before signing it right then you send it back to this application and this application sends the message that you just signed on the blockchain and then the blockchain is verifies it that it verifies that it's you that did this and if that's fine then it's kinda it's gonna be alright so what happens is if this application that you need could be could be treasure could be ledger could be whatever is trying to send you a message that is that it's been uttered you should be able to check this and actually not send it right and say okay stop if still they let you craft a normal transaction but when once you signed it they try to alter it you probably all know the that's actually not possible nobody can sign it without having the private key so if they alter the message the message or the transaction will be invalid and not added to the blockchain so now what we've actually down here is that we've decoupled what I explained earlier we decoupled the crafting of the message and the signing of the message and we've just put this in a specific hardware wallet so these guys are nice I prefer when they are open source open hardware at cetera but they cost a bit of money and actually I don't know if you saw these talks at CCC this year but they are also not totally invulnerable like we can actually add them and what we thought was would you be cool if there was an app that could turn your phone into a hardware wallet so that anybody can kind of without having to buy a hardware wallet that is surely very secure you could still have like a bit of money somewhat safe on your smartphone that is not used because all of us have some smart phones all the smart phones that we just put in a drawer and let them collect dust and yeah it would be nice to use them and how would we do this we would use QR codes to communicate with the computer so again this is what we want to use it forward to just not regularly but sometimes to use it quite easily and and with the phone that you already have so this is why we built pair designer who you have ever heard about 30 designer all right 20% I would say so I'll present it briefly and I'll show you demo how it works so pearl seiner is an app mobile app that runs on iOS and Android and what it does is that it's extremely simple it's you can create an account you can recover an account with a seat phrase and you can sign transaction with QR codes and that's about it oh yeah it does this all offline your mobile phone should never ever be online you should just I think I have this on the next slide yeah you should use a new smartphone so it doesn't look probably as nice as the latest Samsung as before it looks like you old HTC with the broken screen cool actually we don't care about the bottom screen that's fine as long as it has like a screen kind of that you can use and a camera so use an old smartphone that you never use for day-to-day things like you want to have it offline so you should factually reset it encrypt it if you can on iphone it's encrypted by default on Android you have to do it yourself then install a designer with an SD card if you can otherwise you might have to connect it once to the Internet and then you put it offline if you can even remove the the Wi-Fi antenna at Star and then you will use this as as a hardware water so how does it work and that's what I'm going to show you now so I talked to you about pearl-feather parity feather earlier this is this tiny piece of software that is actually a wallet running on top of a light client so this is the only centralized part here is the developer building this app which is open source by the way so nobody can actually alter this transaction once I will make it on the left part I have my phone here it's there and I have already created one per designer an account as you can see it's in offline mode and this guy is connected to to a node and it's synced so what I do is I'll just bind my account so I'll just say important account and for Patty signers so here it's my camera and on the phone I will just show the QR code of this of this account all right so here I just did something very simple I just talked to my feather on the right hey this is my account that I have on my phone so that I can always check the balance for instance right cool I have like 98 eat and what I want to do is send send something right so I want to send will have something in my no I don't so I'll just copy there I'll just copy a rich a rich account and I'm gonna send this from my account on my phone that is offline again and I'll send I don't know I'll just send the max I don't mind so here it says scan so basically it created the transaction and showing me the transaction the first message that is not signed yet and it asked me ok sign it with a signer so I click on scan I scan it here I can review and that's the beauty of having a smartphone right you can really show tons of information and really review things very carefully like ok I really want to send this amount of eath from this account which is none right the demo it's ec2 this other account who is not known by the hardware wallet and I can say sign transaction all right you're gonna see my pin it's Rob's turn so I don't really care and it's 1 2 3 4 5 6 so that's ok and then it shows me a sign transaction on the offline smartphone so here again I have to show the signed transaction to parry feather that shows me one last time I'm gonna send from this account that is offline how many 8th then send that's it so it's gonna take probably a minute or two so I'm just gonna keep going and as you can see it's it's actually fairly straightforward presentation right so behind-the-scene how it works is a real simple app written in react negative as I said it's open source the crypto library or all written in rust there are also open source it's made to be used offline totally it's actually something that we really hope will be followed that people just never never switch it online yeah if you want to learn about it it's it's on on github of course so let's be extremely clear I'm not saying this is gonna replace your hardware wallet by no means right we're just saying this is a way much much more secure than having your keys on your computer or on meta masks etc right if you have like some amount of money that as always with crypto today unfortunately you're ready do you lose right you should be able to use it anywhere and we want to have it like to store it as securely as possible so this is a reasonably secure app what I want to do next as you saw it's really simple it's it you can use it with robson with covin and and so mostly with the theorem today we want to have some substrate support in the future we want to support message signing this is actually already possible with the version that I showed you that's master from today and we want to have VAP 39 recovery phrase which we didn't have before all right yeah you can get it on Google Play Store can get it on Apple I see already questioning and of course on github you can download the apk alright questions yes please yes yes I can't remember exactly but I remember an issue that was raised by Li ghee for this and I think we just cannot for this specific use case because I think we have to pass the chain ID or something like this so like you can check it out later on but this is like we have to come out with the standard I was talking also with with Pedro from wallet connect from also with the the other guys from that built this kind of application we need I totally agree to come up with the standard so that we all can use the same kind of QR code I totally totally agree on that yes so again we're like we're not we're not trying to sell it or something it's like if you kind of want to use your old smartphone like you don't have to buy one etc we're not telling you do it use it like if you don't want to use it don't use it it's just there like we were like okay why not do this and we just did it I'm not sure I'm not sure what you mean with the whole process okay well alright I'm gonna take another question last last last question all right please quick quickly and really love I don't we do we do support mnemonic today but it's the old party Manik so basically you can like it's like a brain wallet you can just write any sentence and this will be worked out in my Manik this is definitely a showstopper I totally agree like the next next version we're gonna have Party 39 I'm happy to talk with the next guys for the next question thank you [Applause]