Web3Auth 🛠 Utilize MPC in User-Centric Non-Custodial Keys for Secure and Seamless Onboarding

foreign [Applause] [Music] so today's session will be about how we simplify blockchain and web3 access for everyone and how do you enable these smooth seamless experiences for your users using web3 auth okay so uh for people who don't know about web3 what we do is like we simplify a web 3 for everyone uh and it's where password assault meets uh MPC enabled non-custered L key management for our wallets and apps so that's like a mouthful but the idea there is like uh we allow you to do key management but we allow you to do in a non-custodial way and we enable familiar web to login experiences for web3 users so it's like uh you can use your social logins like Google login Facebook login and so on and get access to a blockchain wallet and we do it in a fully non-custodial way okay so uh let me just go through about what a typical web3 user experience is like and what are the typical problems with uh associated with that so um for so if you look at a typical web to login flow how does it look like okay user enters an app they log in Via SSO and then they simply use the app okay so this is what happens with the you know millions of applications out there in the wire and this is the typical flow which everyone is familiar with like you know more mainstream audiences like my dad and everyone okay so but if you look at web3 login flow it's a bit different right so it's dramatically a bit more complex so whereas user needs to enter an app and install needs to install like a mobile app Wallet or an extension I need to set up the seed phrase and we need to educate the users about securing those seat phrases uh need to connect the confirmation with wallet and app okay and we need to talk about the extensions and all uh and also after that the user will start using the app so this leads to multiple problems obviously uh the first of which is bad ux okay so let's say if you're developing a small game right you want the users to focus actually on your game rather than uh you know installing and setting up a Chrome extension so uh what we uh and uh a couple of other problems are like you know there are some uh unfamiliar flow so these are all like unfamiliar flows for mainstream users okay and uh there's no easy recoverability okay so if the user basically forgets uh the seed phrase or you know doesn't secure it for whatever reason so uh a lot of keys are lost okay so nearly 3.6 million Bitcoins are lost from misplaced private keys and a seed phrases are like the single point of failure in this case okay and for many applications which are built on web3 there is a very high drop-off rate okay so nearly 70 000 daily dapps users are lost from the web 3 ecosystem due to the long onboarding time so typical setup uh takes around like 10 minutes right so this is time better and in the day of in the day and age of like Tick Tock where people's attention span is like very low uh getting them to spend 10 minutes just to use your blockchain game is like super hard okay so uh so how do some of the Enterprises solve this uh Key Management problem okay so they use this concept called as multi-party computation so these are some of the Enterprise companies like fireblocks bitco Anchorage and uh paxos uh who use uh MPC Solutions or some custodial Solutions in order to uh manage the keys okay but what we do at web 3 office we are trying to democratize this Enterprise grade security for everyone okay so we bring these personal multi-factor keys for uh any application and any wallet okay so let's say if you want to build a wallet and you can use our authentication Service to uh build this you know the multi-factor authentication for your users so uh let me just talk about the way web3 Smooths the user's journey into web3 okay so what we offer is the familiar white label login flow so users can uh use the social logins which are very familiar with the web 2 apps uh it helps reduce the onboarding time it improves the conversion rate up to 74 and we also provide like the passwordless and other social logins as well so we have a very good ux team which has done a lot of research on this space and we have actually seen several applications move from uh traditional Chrome extension flows to using web 3 auth and they have seen dramatic improvements in terms of user retention uh this is especially true in terms of uh the native apps and uh the other mobile applications as well like you know the mobile web browsers where the extension flows are much more complex to use next uh we can connect to any blockchain with any wallet so we provide interoperability across the chains platforms Frameworks wallets and logins so we are blockchain agnostic we are platform agnostic as well so whatever platform you're building on whatever chain you want to Target uh you can use our SDK to basically get keys for that platform next uh what we offer is the non-custodial MPC enabled Enterprise grade security so it allows applications to legally operate without if I see AML because the key management is non-custodial so you are not subject to the same uh kyc AML regulations which other companies are subject to and it future proves the company's liability to Safe Keep user funds because of the non-custodial nature the user is actually responsible for his own funds and we have some really amazing ux flows which make sure that the user never loses their account and usually has actually uh very good access the secure access to all his different types of shares okay so uh you can experience this yourself as you can see now on the screen I yeah the video is playing so I just log in either Google and then boom you're actually in okay that's literally uh all you have to do so the rest of the magic is done in the browser uh I'll just go through on how this magic is done later on but uh the as you can see there is no difference between a traditional web to login flow and the web3 login flow using web3 auth okay so users feel very comfortable they feel at home and then that's it okay and they're able to connect to their wallet uh using this okay so some of the top Integrations look like you know a lot of casters caviar and chess.com so all of these companies have integrated us um we'll share this PPT later on you can actually go to the sites of all of these companies and then you know experience the login flow for yourself um these are web is actually trusted by uh the best and over 3000 applications so we are currently integrated into all of these applications as you can see uh so there are several wallets and exchanges there are several Games Social applications Enterprises marketplaces nfts finance and everything okay so uh the three companies in every space basically uh integrators and they try to offer uh the seamless experience to their users okay so at this point I would like to uh just pause the presentation and then go through our documentation yeah so uh so we have a really good documentation in terms of uh how to uh integrate our SDK so our team has actually spent months curating this and we have received like rave reviews regarding uh the ease of use for our documentation so uh if you guys uh go through and integrate our application using our documentation we would love the feedback which you guys can offer okay so we have a booth in the upstairs and uh our team will always be there so please feel free to reach out to us we also have uh Discord and telegram channels as well feel free to reach out to us and then you can comment about anything okay so if you uh feel some concept is harder to understand we'll be glad to improve our documentation regarding that yes so uh coming back let me just go through what uh the effects start on how it looks like so you can basically start by integrating a basic web 3 Model into your application and then you can customize it according to your needs uh we also have a really good uh integration Builder like this so you can choose your language framework and then you can choose the blockchain you're targeting uh you can also talk about whether you want to use custom authentication or you want to White Label our model okay I'll just show a demo of how this looks like as well but custom authentication basically is one of the key features which web3os offers so let's say your application already has a login mechanism okay so you have a email password login or whatever in your application you can bring that and you can bring those users over to web3 so which basically means that we create non-custodial wallets for your existing users as well so that is something which is possible with custom authentication and the typical web3 react quick start guide which because many people use react so yeah that's the default here and the blockchain is ethereum uh so you can just use and npx create react app and then npm start um so webpack5 basically said like you know uh we are not gonna support the you know node modules so we need to add this uh fix the webpack issues uh then you can install web 3 or ethers uh and then you install a couple of dependencies of web3 auth uh after that you import our dependencies and then at this point uh we would like that you know you guys register for a new client ID on our developer dashboard so our developer dashboard looks like this uh it's it internally uses the web login mechanism as you can see so we believe in our products that much yeah uh so the typical login flow looks like this I just clicked on login with Google and then oh I have Biometrics enabled so I just clicked Biometrics so that's also something we offer by the way uh and it goes through the typical login flows where the shares are reconstructed from uh the social login nodes and also I have one backup share on my device so all of that is being reconstructed at this point and then any minute now it will be done I mean the network is a bit slow here so it's taking a bit of time but normally it's much faster yeah uh and I just select an account I think I'll just get into my admin portal so whenever you're ready oh there you go okay so I'll just turn off my admin portal so uh this is how the typical dashboard looks like um and you go to the Plug and Play section and uh you can just create a new project okay so this can be any project you can select the environment which you want uh prefer typically prefer the sign mainnet for uh building over here because assignment is present in the US and then it's closer to this geographical region and uh yeah you can also select the chains you're uh building on top of and you can also select whether you want this web's key to be shown in the Taurus wallet so Taurus is the previous name of the company uh we have a couple of wallet Services as well so if you are building an app using web3 auth uh the key can be shown in the Taurus wallet so that it can be used within different marketplaces basically like openc or something like that okay now once you create a project you can actually whitelist the URLs here like you know it's a typical oauth flow right uh you create a project get a client ID you wait list your URLs basically and uh so on and so forth so um we also show you the typical usage of how it looks like on the dashboard itself and then you can also read the docs and go to the integration guide so let me just go back to the integration Builder so once you get your client ID you can create the web instance like this so here uh I'm targeting the ethereum mainnet so that's the chain ID and the RPC Target um and you can initialize uh the model so at this point it actually shows you the model uh you can log in the you can lock the user in using web3. connect and after the user is done the dot connect resolves and gives you back a provider uh you can also get the user info using web3.getuserinfo uh you can interact with any evm compatible blockchain because I selected ethereum at the top so the way it works is like you know the web3 dot connect returns your provider so you can use that to initiate uh web3 or ethers and you can do all the methods which you are familiar with using web3 right so you can just get your accounts absolutely dot get accounts and so on and so forth okay sign transactions and transactions and everything okay yeah you can also log the user out when he's done so using uh avoid web.

logout and that will basically require the user to log in again when they come back to the app okay so um how does a typical integration uh look like okay so I'll just go through that first so this is a demo app which we built uh for some you know uh it basically demonstrates all the different types of mechanisms which are possible um yeah there you go so I'll just select mainnet for now and I click on submit and then yeah that's fine so I'll just click on connect so it shows me the model so at this point uh when when you see the model it basically means that webster.connect was called and I just click on login with Google I go to the same flow which I showed you on the developer dashboard I select an account my shares from the Taurus Network the auth network are being brought into the front end it's combined with the device share which I have on the device and then that forms my private key and you get an app scope key for your application from that private key and um any second now that will be done yeah there you go okay so your application this is the demo application so this gets back the apps go private key and you can do everything with it okay so I can get the user info those that's my user info uh I can get sign some transactions okay so this is a typical transaction signature how it looks like I can sign messages uh so we support all the eip1193 uh yeah EIP one seven VIP 72191193 as well uh so you can also get accounts get chain ID get balance do you have balance on this no okay yeah and we support all the other ethereum provider um stuff as well okay this is how the typical integration looks like now uh you can also uh refer to our examples uh Slash examples GitHub repo so we have examples for all kinds of uh different combinations which you're looking for so we have some important links here as you can see and if you have want a react evm example or next view angular common JS so depending on the SDK you choose we have an example for it okay and if you really want an example for a different platform please reach out to our team we'll definitely be adding that example here as well so we can Target different blockchains different types of authentications and the mobile sdks as well even the gaming SDK so we have gaming sdks for Unity and unreal as well so we have documentations guides and everything for that so once you have the integration Builder we also have the SDK API reference so as you can see uh so we have the AP reference for both uh for all the platforms as you can see there and uh yeah uh you can integrate our SDK using the integration Builder the asdk API reference and we also have some guides so if you have some custom authentication like Firebase or zero or any other type of authentication provider authentication mechanism we have some really nice guides for that so yeah you can easily use all of that to provide the seamless experience for your users in the apps okay so now uh coming back to the presentation so we have uh something new which you're going to announce today okay so this is our Early Access Alpha MPC SDK so uh in the previous flows as you can see uh we reconstruct the private key on the front end okay so with the alpha MPC SDK uh we never reconstruct the private key okay so it's all done via threshold signatures okay so this is basically like uh fire blocks but for uh you know consumers okay so uh you can just scan this QR code to access our Alpha MPC SDK and uh I'll just talk more about it this is a very new SDK which we are launching just today uh this is a typical demo of how it looks like Okay so as you saw that you know this is a typical same web 3. login I'll just uh still log in with my Google account um it just takes a sec yeah so the difference here is that the private Keys Never reconstructed anymore I'll show you how that works and also the way we sign transactions is quite different because the transaction is sent to all of the different MPC nodes and all of the nodes basically partial sign and as I said I also have a share on my device so I partial sign with that share on the device as well and once all the partial signatures are combined it forms your actual sign transaction which you can then submit to the blockchain okay so uh the MPC has two phases like pre-computation and signing so the pre-compute phase already happens when you uh just simply load the page as you can see uh and it's very fast by the way as you can see even with this internet so I can just sign a typical message like hello Bogota and as you can see that signing was done okay it's less than a sec for MPC signing and this I would say is like the best in the industry okay and yeah you can also verify that the signature is valid by going to the scan and then verifying this okay so this website is live you guys can play around with it and then if you face any issues you can feel free to reach out to us yeah so there is some small comparison I would like to do uh comparing uh the web 3 auth MPC versus uh the typical competitors so I'll just use a cluster in South America for whatever reason and see gg20 is the current standard which the rest of the Enterprises are using uh and you'll basically see the the speed uh speed comparison between uh the two scenarios okay maybe I can open the developer console yeah so this is all the things which are happening okay so the green is the dkls which is wept it was done the pre-compute was done in 10 seconds the signing time is like one second whereas uh the gg20 is still not done okay so I can basically change North America run one more maybe than the gg20 will be done let's see okay so this basically shows that our solution is like miles faster than the competition okay and uh yeah this is all the console logs which are happening okay this is all the things which are happening in the background yeah as you can see the competitors uh solution takes around 27 seconds uh for the pre-compute and the signing takes 2.7 seconds so we are like much much faster okay yeah and hmm this is our uh the documentation for our Alpha SDK so if you guys want to use the MPC which I was showcasing here and uh here the threshold signatures we have a new SDK for that so the only difference between the new SDK and the old SDK is the way you initialize it okay so the older ones basically use at the rate web 3 or slash web3 auth and this uses at the red web MPC slash web3 auth and the way you use it is exactly the same as the a typical weapery auth integration except the open login adapter the way you write it so you just use iframe URL as MPC beta.openlogin.

com this is our Alpha site where we have the TSS signing and you use the TSS settings like this and then you can just copy paste all of this logic and it'll just work okay so as you can see the typical login logout flows the quick starts all of them are exactly the same and you can use it with any blockchain and the flow is also exactly the same okay so there is no difference or extra complexity which you need to do uh in order to integrate the MPC uh flows okay so we also uh have a very nice code for the demo so I was showing you uh this demo right so so this is a different demo uh which basically shows you how to integrate the MPC SDK and uh yeah this is a simple uh repo which showcases that integration and I can just show you the run through the code very quickly so it's a typical react app as we talked about I just install at the rate web 3. MPC slash base and the web slash MPC slash web these are the new sdks for the MPC as I was talking about uh and uh the rest of it is like the typical react app you just need to do the config overrides the same with any web3 application nowadays and when you go to app.tsx which is where everything is uh you can initialize web3 auth you can initialize open login adapter pass this TSS settings to enable the MPC for you and you I need the model I need the model basically initialize the model in the back end configures are different adapters which we have and so on and so forth and then when the user wants to log in the user basically can click a button and then we call webcl.connect so once the user is connected we get back a provider and then that's it you can use that provider to do uh all the transactions okay um so I'll just do uh npm install here or no it's yarn actually so I'll just do yarn and uh yeah I don't think the internet speed is that great but no worries so uh you can do the typical things which I was talking about like before like you know getting the user info logging the user out getting the chain ID getting the accounts balance signing and sending transactions and everything okay so uh the flow remains exactly the same it's just you need to use a different package okay that is all and our team will be always here so you can reach out to us if you face any issues by integrating the new MPC or the uh old uh web3 or typical SDK okay let me just get back to the PPT now so uh thinking about what to build okay so you might guys might be having different ideas already and you guys might be uh already forming a team regarding you know if you have an idea you want to build that right but if we also have some suggestions for some of the ideas which you can build uh on top of web so uh we offer uh around 20 000 total in the Bounty tracks uh the best overall app gets 7 000 the security track has two uh items the best in track gets four thousand and the run-up gets thousand and we have other tracks like identity and data and then use case and ux as well so we think ux is a very serious problem to solve in the case of blockchain and then we prioritize that by actually giving a very good Bounty for the your use case and ux as well so here are some of the ideas regarding what to build so uh the top idea basically is like the building the security policies on the MPC engine so I was just talking about the MPC engine right so where we have the threshold signatures and all so in that case uh adapt can basically choose to have a policy engine in the sense that let's say all the users of its dap should not spend more than 0.1 each a day okay or even user can configure this user skin configure like I do not want to spend more than 0.

1 each a day or any kind of limits okay so uh you know you can also have some sort of scam detection or you know transaction uniqueness or something like that so uh all kinds of security policies can be built on top of the MPC engine so we have some really good code for this in the demo which I was showing you earlier so we would love to see more security policies built on the top of this MPC engine and uh yeah the best price usually goes to the best security policy to be honest yeah and we also have uh combining the MPC with smart contract or multi-c capabilities so if you're building on top of other multisig or some smart contract wallets um you can use the MPC solution to integrate this as the default key for those smart contract wallets or the multi-6 uh cases so how do you introduce the time-based security on MPC or uh what are the some of the IAM systems that people would appreciate like you know you can integrate nodes to save plus MPC or something of that sort next uh there are some ideas around uh encryption and decryption as well so could we build a messaging layer between the wallets and apps based on the user public private key Pairs and what are some of the ux friendly permission systems for users when uh talking about their uh data so these are some of the ideas which you are thinking about in terms of the encryption decryption side and some of the ideas regarding uh the webtoon web3 identities are like you know how do how can we help apps identify what users would be into ahead of time so like web has this concept of uh derived addresses okay where you can know what the address of user will be before they actually log into your application okay so in that case as well uh you can use website to actually identify the identity and we can also manage the backend systems for web 2 and web 3 for Server resources and can we share the recapture or kyc for multiple users using this next because we link webtoon web3 and NTS right so it makes real sense to uh have some of that next uh for payment so how can we make crypto payments more friendly uh what stack or markets would appreciate crypto payment adoption and uh the most important on the silky smooth ux so ux that we just can't trust this like you know uh if you are building some application with a very slick ux that basically qualifies for a really good price and uh what are some of the gases abstractions you can do on top of the uh E2 okay so these are some of the ideas which we have and uh yeah that brings that brings us to the end of the ideas so this is our MPC SDK so you can scan this QR code and then you can uh keep in touch with us on the Twitter at redwap3. discord.dg web3 this is our Telegram and you can also mail us anytime so uh please feel free to reach out to us and uh we'll be available on all these platforms uh throughout the hackathon uh our team will also have a couple of mentors at our booth uh so please feel free to reach out on either the telegram or by coming over to our booth so we'll be happy to help you in any sort of uh way we can also brainstorm some a couple of ideas which you would want to uh discuss as well okay so uh yeah that's the end of presentation okay thus uh does anyone have any questions hello so the question was that uh if you sign using web throughout into different applications using the same social login would you get the same wallet address or different one so the answer for that is you can configure it okay so let's say if you own both the dapps if you use the same client ID you get the same address if you use a different client ID you get a different address so the way it works is even though the Social account creates only one private key if you use it in an app you get a app scope key derived from that root private key okay so the key switch apps receive are basically appscope keys yeah their scope to your app yeah no other questions you can always export the private key yep so users can export the root private Key by visiting app.openlogin.com or the DAP apps go private key is also available for the lab and the apps can create the UI to export it or users can also download all their app scoped keys on app.

opolanga.com as well okay so we have configured the entire ux around this to be very seamless both for the users and the dapps as well so the dapps can basically automate all of this programmatically in order to you know help users understand and Export their accounts as well yeah wow um not really so as I said the private key uh consists of multiple parts okay the private key consists of multiple parts so the social login basically uh share is split into multiple sub shares in the across the Earth Network and you also have a second share on your device you can also have one more share on your backup phrase and so on you require two out of these n shares to actually create your private key which basically means that uh it's non-custodial kind of or a self-custodial I would say for the end user because let's say even if the Earth Network gets hacked for whatever reason right uh the attacker cannot get access to the user's private key unless they have their device or you know the backup uh whatever yeah so in that way it's self-custodial login or non-custodial login the way you see it yeah that's that's kind of our USP in terms of comparing to our competitors yeah yes so uh while the user sets up the MFA we also offer uh different types of set setups okay so like user can start with uh two out of two two out of three two out of four and so on uh you can add multiple devices you can add a password you can add a security questions backup phrase you can also do n number of things so we have generated our own user flows after multiple uh years of you know ux research so to make sure that users never actually lose their account even if they lose a device or even if they lose forget their password or uh lost their backup phrase as well okay and we also have this solution called as web 3.self host which basically means that you can build all of the ux flows which you are which you are showcasing so in that scenario our team can work with you in order to provide the best ux flow for your application as well okay that's available as a separate feature yeah yes pricing um yeah uh the pricing you can go to web3.io pricing to be honest we are cheaper than Cognito or OCTA yeah is the pricing is basically uh based on Mau monthly active users so depending on how your application gets uh the monthly uh how many monthly active users your application has the price scales okay uh it's free up to the first thousand monthly active users and we have different uh tiers based on the number of Mau you have uh the typical would be like I'm not sharing screen but uh for a thousand logins it's like 70 something I guess yeah uh so it it's like point six cents per user 0.6 cents per user for a million logins uh per month okay Mau per month yeah it's like rock bottom so you can actually check the slider oh my God my mouse is not working okay so yeah so that's the slider we have and if you cross more than one million you can uh upgrade to Enterprise and then you can have a custom rate for your application yeah yes so uh one good example I would showcase is basically like uh cash dot IO [Music] yeah there you go so cache.

io is a typical example of a multi-chain application so they are present on both tezos chain and ethereum mainnet so how it works is you can simply log into your Google account I keep using Google for no reason you can use other social logins as well okay you can also use the passwordless by the way yeah uh and so on and so on so forth uh basically the app gets an apps called private key and then they derive the tesos key from the same private key okay so that way the keys are compatible with both sccp and dd25519 chains so you can typically literally use it with any blockchain okay so all blockchains basically use sccp or ed2509 keys right yeah so as you can see I have a account on Tera I have an account on ethereum as well okay using the same login mechanism uh yeah my time is up almost so if any hand has any extra questions uh we'll be right outside okay last question maybe yeah um not really so it depends on the dab to actually configure it because the lab gets the appscore private key right okay so they can sign transactions on your behalf okay so the lab can show the models uh depending on their use case but let's say if you're building some kind of application which do not does not want the private key we offer another integration called as Taurus wallet so Taurus wallet is also our product and in this case the DAP never gets the private key it lives in an iframe it's basically a web-based wallet and it's the one which is integrated into openc and other marketplaces yeah okay so that's it guys we're out of time so uh our team will be right outside you can reach out to us and we also have a booth on third floor please uh feel free to drop by and then if you have any questions please ask us thank you very much