Taylor Monahan ~ The Impossible Balance Between Usability & Security MyCrypto

[Music] next up talking about on the theme of getting the next million users we hear a lot about usability in crypto projects and what does that mean and kinda what are the trade-offs that come with it so next up is Taylor my no man for my crypto who's going to be talking about trade-offs and impossible balance between usability and scalability or security all right awesome so yeah as he said we're gonna talk about balancing security with usability and especially in this space it is it's so hard and it is so important that we get this right because as will go into cryptocurrency is just simply different and so I know we focus a lot on usability we focus a lot on user experience we focus a lot on design but as we do so we also have to keep in mind that it's our job as product creators to keep our users safe and secure and their asset security even if we're not taking custody of those assets so this is one of my favorite quotes Everest from Jameson lop um and he said the most secure solution is one where you create a private key you send your money to it and then you immediately throw it away so that literally no one can ever access that crypto or steal that crypto and it's brilliant because it really emphasizes you know this is a spectrum right and this is the very very end of that security spectrum this is as secure as you can get but it's also completely unusable like literally you can't access your money either and so you can also you know on the flip side of it talk about usability the most usable sort of solution would be one where literally everyone has your private key and anyone without even think about it can send your money around unfortunately that would probably result in your money being stolen so that's not secure whatsoever and so what we're trying to do when we're dealing with cryptocurrency and blockchain is we're trying to find the balance we're trying to ensure that people can be secure their money can be safe but they can actually use these products that we're building and they can interact with the blockchain so to back up a little bit today when we talk about people using our products what are they expecting what are they used to first off they're really really used to logging in with a username and a password every traditional service every traditional app has this sort of form it's instantly recognizable this is what people are used to and they're also really used to be able to easily access and recover their account so the forgot password forgot username forgot emails you can literally forget anything and through one mechanism or another recover that access another great one is people are really expecting someone some external party to fix it when it goes wrong whether that's a customer support agent whether that's the little chat box in the lower right hand corner whatever it is if something goes wrong people are expecting someone else to come in and save the day um and a really interesting one that we don't really think about a lot is this banks today have this amazing ability to not only sort of block transactions that are fraudulent or reverse them after you've like notified them of a fraudulent transaction but they're actually like preemptively detecting when your card is frauded so I don't know if you guys have had this experience maybe you lose your card maybe the numbers stolen whatever your bank will send you a text or an email and they'll be like hey we think this is a fraudulent card and when that happens we build up these expectations that if my card is stolen my account is accessed without permission no matter what happens there's always someone that's going to come in and save the day they're gonna detect this for me and there's nothing on my end that I have to do in this situation and obviously unfortunately when we're dealing with crypto currencies that simply isn't the case um and the last one is that people are not use of this concept of forever or this concept of permanence so when you write something to the blockchain not only can you not reverse it or undo it but it's there forever and we've seen this a lot with people which is like a microblogging Twitter sort of alternative on the blockchain is um people suddenly when they're confronted with the fact that their tweet or their peep is gonna be stored on the blockchain forever they suddenly become very hesitant they're like we were wait what does that actually mean okay I can't delete it I can't add it and that sort of induces fear and it also breaks down the confidence in users so but these are dealing with adapt information data or you're dealing on the financial side you know these are big sort of expectations that we are literally just like removing completely so why exactly is this decentralized web 3 world so different first all of our adapts and everything that we're building are putting users in full control right and this is empowering this is what we're trying to do we're trying to take the power away from the centralized banks the centralized governments we're trying to give it to the individuals unfortunately mmm in not all cases do these individuals want all of the power additionally we are usually dealing with real monetary value uh and without real monetary value there's no undo buttons there's no password reset you can't reverse transactions and again there's no central fixer who's gonna rush in and save the day if you make a mistake or your account gets compromised or someone steals your money or whatever it is and you know we loved loved loved talking about being your own bank and for most people in this room that is an empowering and exciting concept by what being your own bank with that phrase doesn't encapsulate is the fact that you are also now your own security force you're also now your own risk manager you are now in charge of every single department in that bank it's not just as fun as oh I'm gonna hold my own money and nobody can stop me it's also I have to secure that money I have to make responsible decisions I have to do all of these different things and it may not be you know being your own security first is definitely not as exciting as being your own bank makes it out to be so what should we keep in mind as we are all building this decentralized future and this applies to everyone this is not coders this is not marketers this is not product people this is literally everyone even if you are just a user of a product if you are just super super interested in this space you have the power to contribute your ideas and your thoughts you have the power to question the people building these products and you have the ability to shape the future as it's being built right now so first off people expect the same easy experience that they currently have okay that means that they're over up there Airbnb app their bank that's what they expect and if it's different which it is you're going to have to adjust those expectations or deal with the consequences another big big big one is that cryptocurrency is unique in the fact that stealing this sort of single string of characters stealing access to your account has really really really direct ROI for these attackers and so whether you are a central exchange that is holding everyone's money or whether you're an individual just holding your own money the attackers are out there and they will do literally anything to get their hands on that money so if you've been in the space for any amount of time you've seen the numerous hacks on exchanges you've seen the Twitter giveaway scams you've seen the phishing sites the phishing emails you know they will become increasingly creative and they will do just about anything in order to get access to this money and then the last thing that we really need to keep in mind is that as we talk about the user experience we need to keep in mind that that's not just pretty buttons and glorious graphics and cute illustrations that jump and pop and do all these amazing things when you open the page the user experience is what people experience us they're interacting with the blockchain and if people are losing their money whether that's by accident by fraud or by just direct act that is the worst user experience it doesn't matter how many glorious buttons you have uh their money's gone and they are not having a good experience with the blockchain you so let's ask the hard question how do we find the perfect balance between usability and security how can we not go too far on the usability and how can we not go too far on the security on and I am sorry to say but there is no one-size-fits-all solution we need a number of different products that are targeting a number of different target audiences that will satisfy the needs of everyone every single person has different expectations and they have different needs they also have different technical abilities they also have different desires in terms of not only what they're expecting but what they're demanding from you and this is why I'm not one of those people that's like every single solution needs to be completely 100% decentralized non-custodial solution we need the whole spectrum of stock we need the Fiat on-ramp we need the people and the funds that are gonna hold and manage people's money we need the wallets like mine like my crypto that is that non-custodial decentralized solution and together this is gonna form the ecosystem that allows the masses to get in because for most people like myself I didn't start a hundred percent decentralized I started like most people with coinbase and so as we do this and as we build these products buying the target audience that works for you and target them don't try to build for literally every single person and build the best solution for them and and work on educating them about your product and then as you're building just remember that people will always use your application and on expected ways they will do what you're least prepared for so as I said previously you want to you know know your target audience you want to build for your target audience but you also want to be aware that uh your target audience may not be the one that actually ends up using your product and even your target audience that is using your your product probably won't use it in the way that you're expecting so as we're billing you know these are hurt these are kind of overcoming challenges right we have to be better and strive to be better we have to know all the things that we're up against we have to realize and understand that this is these are hard problems to solve and then what can we do about it so the first one is as you were just starting out and you have an idea for a product or an idea for an application share your idea do not hide behind NDA's do not have this misconception that everyone in the world is gonna steal your idea share your idea talk to people validate it and when people ask questions or have feedback don't just uh push it away and be like oh they don't got it if they don't understand it or they don't get it everyone is going to have that same thing and this goes hand-in-hand with my next big point which is do not build in a silo okay these companies that are sitting around in their little teams building and sharing the idea with only within themselves you have no idea how your users are gonna use your product if you do not ship and you do not give people access to your products you will never know what needs to be fixed whether that's on the security side the usability side or some other side okay like I said everything that your users do will be unexpected and the only way to start to expect those things is by having people use your product and tell you this is how I'm using it this is what I'm doing uh-huh and for that reason I would recommend that everyone ships early okay if you ship so late that you have the most perfect polished product only to learn that this perfect polished product isn't serving anyone it doesn't adjust the needs of the market it doesn't address the needs of my users um you're gonna have to go back to the drawing board anyway so all you did was waste a lot of time so ship early and then talk to your freaking users every single day when I first started working in this space I lived in the support inbox which was a gmail address I lived on Twitter I lived on Facebook and I talked to people that were using my product every single day and by doing this I really understood what they were struggling with I understood and I felt their pain when they lost money I understood and I felt their pain when they were confused and intimidated by this space and I and I also lived and relished in their successes when I would talk to a new user who successfully got into this space and said I did it I did it I got it it's in my own wallet I have it now that gives me immense pride and joy like it's the best feeling in the world when your product and something that you have built right allows someone to successfully hold and manage their own cryptocurrency but if you're not living in that support inbox if you're not talking to your users you have no idea what's going on you are living in a very a very delusional little world that you've built for yourself and then as your users are using your product in unexpected ways and as you're learning about how people are understanding the concepts that you're throwing at them and as you're understanding where the usability flaws are the security flaws are you have to react fast right this doesn't mean you have to completely pivot but it means that when you notice a number of users not saving their private key properly instead of just being like oh well they're dumb or oh they don't get it you say how can I improve the product what changes can I make is a is it the messaging do you not have enough education is there something to the user flow is there something about the design what can we do to ensure that people take this right actions and one thing that we learned while building was that if we do not force users down like the proper path they won't go down that path on their own and so the original version of our UI um it basically would just like spit out the private key and address up the user and it was so useful or so great or so fast but people never saved their private keys so one thing that we did was okay we're noticing this issue we're gonna force them down a flow that makes sure they back up their key and then they can continue on and by doing this fast I have no idea how much money we saved but it feels good to know at least you know we could have done it right the first time but as soon as we learned about it we were able to change that flow very very quickly you and so lastly you know we love to spend money on design we love the UX researchers we love the designers we love the UI it's it's tangible right it's very easy to allocate a budget to design but we also need to allocate an equal amount of budget to security and the reason for that is this and I've heard this in real life a few times now if my user experience is so bad if my design is so bad that I don't have any users whatsoever then does it actually matter if it's insecure okay and my response to this is if your product is so well designed and literally has all the users but they end up losing their money because your app is insecure can you really say that your product is good that your user experience is good okay on both ends you have to have it you have to have the security you have to have the adherence to safety but you also have to have the design and that's why I say equal parts is good okay do the bug bounties do the security audits have experts on your team that are solely dedicated to understanding where people are being unsafe or what parts of your application are unsafe and then also do all the fun stuff like Gloria's pretty buttons um and and the key is is that this balance is hard this I was like a product person or a person running a company or a person building anything in this space this is the magic right if you manage to find that perfect balance for your product then you are a magician and just FYI if you're building a product in the space you're already a magician you may be a really bad one but you'll get there as long as you keep trying ok I have hopes for this space and then I just want to like remind people that experimentation and especially environments like this like hackathons or is really really valuable and I see a lot of people get hung up on both the UX side of things but also the security side of things and sometimes it can be intimidating like you feel like you can't even pursue an idea or play with an idea or see if an idea can come to fruition because you don't have any idea how to make it 100% secure or 100% usable and the reality is is that everyone has to start somewhere and so don't get too hung up on these huge picture long-term things just start and take iterative steps every single day you will never learn as much as you learn when you start building for actual people so I really just want to reiterate this talk to people build for people talk to more people react to how people use your product and most of all coming from someone who builds products for people see people from themselves because at the end of the day this entire decentralized future that we are building is about people okay it's not just about the security or the usability or any of the other BS it is about people we're building products for people with people we're trying to shape the world that everyone lives in and a good reminder that the people that are building these products the people that will end up changing the world the people that end up affecting other people they don't always set out to do so when I started my ether wallet it was not a company it was not a long-term plan it was not a polished product it was literally a tool that people could use for now and today at my crypto we have an amazing team of people who work from the infrastructure side the security side the design side the marketing side the operation side the technical side and everything in between to build the most remarkable product that can help people access the blockchain easier okay if I had known years ago that we would where I would be on stage right here talking to all of you surrounded by amazing people surrounded by my team members I probably would have locked in your face I would have never believed you because I was just building like a little open-source tool that people could use like right now so the amount that you can grow and the amount of traction that your product can gain in the amount of the effect that you can have on the people around you and the world around you it's up to you start somewhere solve a little problem and and go from there and let the world hate you and one thing that that I always remind people in this space because it does seem to be very technical still right a lot of people think that is only the technical people that can contribute the reality is is that this space means everyone we mean literally everyone helping improving our products we need everyone to help the ecosystem we need people that come from diverse backgrounds that have different experiences we need people who can build and they can also communicate and tell people why this is valuable we need everyone and so if you're sitting here and you're not already in this space or you have one foot in this space I want you to think about what unique skills you have what are the experiences that you have that you can contribute to this world because it's not just the coders that are gonna make this successful it's literally everyone if the decentralized future is going to affect the entire world then the people building these products need to also Rock reflect the entire world MPs if you want to work for my crypto there's an email it's called jobs at my crypto I check it every single day and we're always always hiring amazing people to be part of our team and that's it I just want to say thank you so much you guys are amazing and thank you Denver [Applause]