#defendweb3: The Wallet Wars

hello these are my notes so I'm going to read this way all right hello everybody my name is LJ I am the brand marketing manager and marketing Analyst at Tahoe wallet formerly known as tally ho and my name is Alex I'm the tech lead at Tahoe all right we're going to start with a quick survey because I love audience participation and not talking why did you get into web3 oh no I broke it all right who got into it because of a to get rich I'm gonna raise my hand because I love getting paid and it's totally fine I support you cool okay how many of you got into it for B if because you believe in web 3's core values you can raise your hand for both it's all valid cool cool cool all right so for all of those who said B how many of you think the wallet you use is aligned with your web3 values it's an awkward question right it's an awkward question all right I'm gonna lay some hard truth on you all of you who standby web3 values like Open Access transparency and self-sovereignty you're under the oppressive rule of your wallet they are using you they are using up your resources and they are locking you outside the palace walls it's time to revolt okay I could kick off this presentation by talking about the technical why of these wallet Wars but instead I'm going to talk about values because one of the reasons we're in this war in the first place is that we have all become so concerned with our Tech stack that we've lost sight of our value stack okay so what's a value stack our value stack is exactly what it sounds like they are the pillars upon which we are building our project our company Whatever You're Building that's your value stack same as your Tech stack but it's what you believe in so this is Tahoe's value stack we're web3 wallet we stand for Access for everyone radical transparency and most importantly full community ownership so earlier this year we began our own Revolt when we wrote down our value stack and what we call our defend web 3 pledge defend whether we pledge uh and we called for anyone who aligned with those values to sign the pledge with us and what's pretty cool is that over 300 000 people have signed so far so if you did already thank you and if you didn't look it up so we created this pledge to defend web3 for a pretty simple and straightforward reason we were Disturbed we were disturbed by what we were seeing in web 3 we were disturbed by the wallets that we saw in web3 and that's why we're here your wallet is the most ubiquitous and critical tool in your web3 toolbox can anybody name a single thing you can do in web 3 without connecting your wallet I don't I'm not even going to wait that long because you can't name anything so you want to swap you have to connect your wallet you want to bridge your East to an L2 you have to connect your wallet if you want to use literally any dap guess what you have to connect your wallet but even though the wallet we use is so crucial we often Overlook the fact that the most widely used wallet in the ecosystem has abandoned or actively worked against web3 values yeah this is why they put us after that last presentation so the decentralized web was supposed to bring down web 2 in this blaze of blockchain glory but here we are again we are back under the thumb of a few or just one really Insidious and secretive Monopoly that are they're no different than the monopolies of yesteryear if you don't remember the browser Wars of Web 2.0 you absolutely have to study up and learn how we are repeating history with our web3 wallets Microsoft's closed Source Internet Explorer managed to entirely eat up its major open source competitor Netscape simply by packaging itself with the windows OS and without permission integrating itself into your computer now if you're like me you're 12 you get this great computer you open up your browser and you're like what is this thing why does the UI suck do I even want to use the internet this is bumming me out all of a sudden everything was like optimized for Internet Explorer the good news is ultimately Netscape gave way to the Mozilla project a community of developers used that open source code to build Firefox and hooray the browser Monopoly was mostly toppled okay does any of this sound familiar how about I put it this way today the most ubiquitous web3 wallet has over 30 million monthly users is closed source and it's in bed with Wall Street that sucks the moral of the story here is that we shouldn't let sneaky volpine look that word up corporations make our choices for us we shouldn't follow the path of least resistance we shouldn't put our portal to web3 in the hands of the web free version of Internet Explorer now I'm going to hand it back to Alex thanks LJ so let's talk about some of the threats that we all face as wallet users really no matter what wallets we use um I think security is the obvious one here there's a constant battle between wallet providers and hackers to user private key secure sometimes the wallet providers are winning sometimes the hackers are winning sometimes the hackers are winning but it's a battle that's probably going to last until the end of time the most recent big wallet security issue is probably the halborn Demonic exploit which if you're unfamiliar with affected users of metamask phantom Brave and a whole bunch of other really popular wallets the tldr on that is that seed phrases were being imported into these wallets in a way that allowed them to later be exfiltrated so basically the nightmare scenario for anyone trying to protect their seed phrase now the good news is is this was detected in 2022 and fixed but it was around for years and potentially affected millions of users fraud is another big one that I'm sure we're all familiar with especially if you're into nfts this can range from fraudulent sites posing as legitimate sites trying to get you to click on things pop-ups posing as your wallet asking you to enter your password or reconfirm your seed phrase and even fraudulent tokens posing as legitimate tokens trying to get you to transact via them the important takeaway here is that while these problems do affect all wallets there are plenty of things we can do to improve upon them these range from focusing more on security having a better UI or ux in the wallet and just adopting a user first mindset in general now I want to talk about a different class of threats that we face as users of wallets and I would categorize these as web3 wallets acting like web 2 monopolies these threats are not common across all wallets and the fact that they exist is entirely at the discretion of the wallet provider of the wallet that you choose to use I think probably the most painful threat is uh price gouging so for example did you know that the largest wallet provider made close to 200 million dollars off of its users in 2022 a lot of this Revenue came from in wallet swaps and charging a fee on top of those in wallet swaps in fact some of the largest wallet providers charge almost one percent to swap inside the wallet when most of the time all that's happening is they're routing in order to unislop which is something that a user can just go do themselves and save a one percent fee this is also true for in-wallet staking or really anything defy that you can do inside of the wallet now obviously wallets do need to make Revenue to survive but charging these exorbitant fees is damaging to the community to the ecosystem and to us so platform risk is something that I think that we as a community probably don't talk about enough and the way we Define that in a wallet is a wallet relying on a centralized or non-swappable service to provide a fully working experience uh the classic example of that is wallets that rely on a single or a single set of RPC providers if those RPC providers go down you lose the ability to transact with a blockchain you might even lose the ability to look at your funds Apple Store Chrome Store Google Play Store these are also centralized platforms that we all rely on to download and use our wallets and if a while it gets delisted from one of these venues and they're not available anywhere else then we lose access to our funds now of course we should all be good citizens of web3 back up our seed phrases export them but we know that not everybody does that all right so let's talk about surveillance I think this is probably the most ubiquitous threat uh facing us today should a wallet choose to it's actually very trivial for them to tie your IP address to your on-chain address and then all of your Anonymous transactions are no longer Anonymous to anybody that wants to pay to get that information wallets could go even a step further and ask for access to your cookies and then they could find out just about everything about you that advertisers know which is just about everything about you so this even goes a step further because even if the wallet itself is trustworthy if the RPC providers that they're interacting with are not they could be malicious and also link your IP address and your on-chain address having you lose your anonymity RPC providers could censor you feed you incorrect or malicious data about what you're querying and do a whole bunch of things that honestly will make your web3 experience terrible some examples of this are not letting you submit a transaction to a given address or interactively given contract delaying submitting your transaction to the mempool to extract Mev from it or giving you fake coin balances to encourage you to interact with some malicious contracts that the malicious RPC provider has set up the good news is is it's not all a pit of despair and these are the problems that we as wallet devs are working on and we think are worth solving sweet okay reading my notes hopefully we have some Dune fans out there so you can follow the metaphor with me um I'm gonna repeat myself wallets are your portals to web3 they should be delightful rabbit holes that you fall down and have fun in not giant sand worms lurking beneath the surface of a desert Planet ready to devour you like Alex said we know that some threats are technical or related to human error and there are decent solutions to those like crowdsourcing responsible disclosure or even token lists but a lot more threats are just caused by webto influence wallet operators with pretty bad values who always choose to serve their own interests at your expense these threats are harder to fight because your wallet doesn't want you to fight them they don't want you to find a way for them to stop mining your data or gouging you with transaction fees and again I know this sounds pretty grim but let's go back to Tahoe's value stack for a second and see what we find yay community community is the Cornerstone of what we do everything we do is based around community and we believe as corny as it might sound that this is what can save us we're not the only ones who think so either right so a community-owned web3 wallet opens up some pretty creative and cool ways to avoid the giant sand worms being open source helps keep things secure a community treasury can make sure that funds go back to improving the wallet and most importantly it creates a shared interest between wallet operators and users so rather than sitting in this parasitic shy-helood fremin relationship both the community and operator are owners and United by a common interest and then suddenly the need for operators to rely on surveillance or gouging or other Insidious tactics is made obsolete awesome okay so what Alex and I and everyone at Tahoe is doing is actively solving or trying to solve some of the toughest questions around these issues more importantly we are nourishing our community because we love them so much and together we are cultivating a web 3 world free of fear because fear is the mind killer thank you if you want to hear more about what we're doing come chat with us now hit us up on Discord look at our eat Denver bounties we want to hear from you thank you do we have time for questions you guys were I think we have time for exactly one question and uh oh gotcha uh here we got a question right here can you share the Social Links Social Links we don't have Social Links on our slides do we I don't think we have Social Links on our slides wow what a failure oh my goodness uh you can find us on Twitter at Tahoe underscore XYZ on Discord as Tahoe what else do we have and our website is tahoe.xyz that's right that's what we have well we're getting everyone what question do you wish someone would ask you I don't know this is hard for me totally fair ah here we got one right here let's do this you mentioned the wallet was open sourced am I able to just Fork it can I go to can I go to GitHub and just access everything you better believe you can I smell a plant but yes that's amazing uh fantastic what's the GitHub actually uh I think it's github.com Tahoe wallet right now yeah and we are fully open source GPL V3 license and we encourage anyone and everyone to Fork us and make it better and if you can like below the current wallet out of the water make your own and make it for the community and definitely check out the bounties we want to see a lot of cool stuff from the community obviously we we love our community it's amazing and make pull requests Upstream let's do this fantastic thank you guys thank you [Applause] all right next up we're just setting up for a panel this is going to be Joshua and yev and Cameron and Ivonne they're going to be talking about web3 tech and the borderless future it's the poll between the tech and governmental control over boundaries so we're building the future here and the law and the governments have something to say about it really excited for what this is going to be so we're just going to take a minute to get set up for panel land we'll get started and we'll start in just one or two minutes