Web3 Security for Everyone - A new Prospect from the user's angle with Eskil Xu

uh make it a little bit quicker. So it's still a little bit weird on that. Uh but this is from Go plus security and the the topic today I want to bring with you is about the uh web three security for everyone which is like for user security. So I mean first I I want to uh ask a little bit question about uh when you talk when you're thinking about security I mean what is the new man because actually I find out that people could probably thinking about different things when we talk about security because a lot of topic about different chain about security about anticensorship and a lot of security topic is basically around the like auditing the smart contract but uh I think has been some corner has been long time ignored which is the user security Because I personally and probably you and your friend do see someone have been scammed every day was due to some uh fishing rack pool um I mean a lot of traditional web two attack and also like a fake nap attack from your appro and signature um but this haven't been kind of like a show a lot in the media it's not like a you know news from the poly network optimism Rooney you probably have seen this a big headline in the media but for users is not always there. I mean even this happened every day.

I mean even under our estimated this is the most part of ascent have been stoned or scammed there. So um for user I think I I just want to quickly take you to the uh risky journey which is for web 3. I mean why this is a I mean not so present um because we have been talking with different like even from central exchange OTC and you they are seeing a lot of user when they first transfer the money into I mean from fiat to some USDC or serum actually the next action they do is transfer that to some fraud website which is nothing relevant with with web 3 and uh you probably also heard a lot of story someone losing his private key or his computer or mobile phone has been hijacked and even once like finally you get bored your assent into the real I mean public chain but you still have a lot of risky when you're signing on something because the problem is 99%age of people when you're signing something you have no idea what you are signing for because it's not been I mean illustrated there and furthermore it's also I mean increasing the risk like your interaction with some malicious address I mean some probably under the blacklist to AML and some address itself is actually uh scammer or seifer and so in the end you probably pick up something you finally like but they due to this uh I mean one ability in their code they probably getting attacked it or some getting social attacked for example Rooney and Harmony they were kind of being fished during their email which is a very traditional web two trick but this also happened directly on the web three world with a a lot of more money there. So I mean if we say here's a problem then here should be some solution for that and if we see like a web three security is a real problem but what is the development stage for the industry to doing something something on that. So here I show you a very uh quick picture about like according to our knowledge what do we have right now on earth about the people who are providing all this risky security thing and uh I think the most kind of been um easy to think about is actually auditing because we go plus have started to user security data from 2020 and in the last two years the most frequent question we got is always oh you guys doing auditing no we don't do auditing this is somebody job but even for auditing there still don't have a limited don't have enough I mean amount of capacity to dealing with all the project who want to do auditing but there's also a gap there and beside it even auditing itself is not enough because in the end auditing is more like a one-time shot it's like consultancy is some checking on your currently code but the problem is every project they update with their code it's not like a static I would just use that forever until I actually they probably update their version on the next day.

So they probably also need a lot of traditional security measures like penetration or like a lot of traditional uh security waste like on their internet on their end on their uh threaten report and on their on on their on their security database and another thing as I mentioned a lot for the users. So user facing more problem I mean they are more high frequent and they are less professional and even right now as the development of web3 we see the user actually they have less and less knowledge about that but at the same time you don't really have so many solutions very limited choice at the same time I mean on another side for C5 central exchange or public chain unfortunately they also have the report to they were being attacked or they has a code leak there so it's like a whole measure of the things So a lot of things were lacking there but what could be I mean like the key question to I mean keep keep up with this uh keep up with the situation to improving on that. So we have a very simple logic about it for the whole security thing especially regarding user the basic logic is about attackers and the defender. So why there is a lot of attacker in web street world trying to attack on this users doing all the fishing rack pool fake NFTt I mean first thing in my mind is like because so easy and second is like they do have a lot of money there they can hack on and this is something a little bit different from web two because web two you probably also hear a lot of the problem a lot of attacker lot of cracker but actually very few people you really lose your money from your bank account directly because you still have some bank back end like protecting everything. But in web 3 it's a different story.

You lose your wallet, you're getting fish, you're getting attacked by some fishing website, you're done. You sign that you're done. And on another side, as I mentioned, there's not enough solution. So what we think what we really needed, I mean before we thinking about how could we solve this problem, we need to know what is happening. We need to know the data.

We need to how many people are doing the bad thing and how this user losing their ass and in what way they lose it. I think this is a fundamental thing we're trying to solve. We're trying to provideing the data and that should be a dynamic automatic and real-time information. It's not like auditing. I have no problem with auditing but the problem is they only do that for one shot but the thing is not I mean it's not real time.

It's not really tracking what's going on. So in the end day I mean it's I cannot see like there will be some they say we kind of eliminate all the attackers but there could be some they say the cost for the attacker is really high. It's high I mean like they just don't have a reason to do that because they don't they cannot make money or they probably feel in the way or they have the risk to be captured. I think that should be the balance in the end we have the better security information we we have the security situation. I mean in a in a better way.

So I mean what kind of the web3 secure data service do we need? I mean I had to actually mentioned a little bit on that um because just thinking about how the user losing their assent losing their money first you probably losing a private key that is not in this case uh because that's was mostly holded by different users and more on the web too like equipment and but but there also a lot of people actually they're losing money just because they buy some fake assent it's like fake NFT it's like some Ragu it's some honeypaw honeypaw token or there were a malicious function hiding in the metadata under the NFT you're buying and then another very high frequenc as I mentioned it's about signing and also approval and then it's about malicious address so we have been developed this secure data I mean regarding on all each of this problem like a token detection AP security API NFT detection API so we're going to detect it on the smart contract on the liquidity on the basic information on on all the fundamentals we label them together. We have the we have the database have all the labels have all the tokens for example uh regarding on the token we have 2.5 million regarding on the NFT we have 10 million NFT which have been labeled with risky or not and so who going to use all this data is actually I mean we are not trying to do that like in the front end but actually it was the most frequent interacted apps or software like user are using like data website like a wallet like some D app or even some browser because that's a place the user are using that every day you're checking your ass and you do all the interaction that's is like the the master road you go through when you're doing something and here's a corner you could see a lot of the logos like who is using our data again I'm not going to read their name uh but it's something like CMC coco I mean trust wallet and and even broader like opera Sorry. And uh and but beside the data, I mean, what else we could do?

Uh sorry about it. Okay. What else we could do? I mean, because the data somehow is still like the halfway to protect you. You see the data, you understand something, but it's still a gap like what you're going to do with it.

I mean if someone really say hacking your thing you just hiding don't do any interaction or what so we do see there's a need like they should need it like some you know like some web tool some anting virus software that could be someone who was making some monitoring software or like the firewall when you're really doing something different we really when you're really doing something dangerous they could jump out to say hey this is something malicious you shouldn't can do that or even some solution they are kind of connecting with RPC with me process. So when you're really doing something malicious they will do the they will do the transaction cementitation and they really sure that is something you shouldn't do they could cut off the deal they could protect you in the proactive way I mean like that but this is actually in different scenario and this is actually we always have the different way we can do that. So for ourself we also organize this security ecosystem. So this is like website you can find a different type of the security service solutions you could subscribe and you could use them to protect yourself in the following and uh here's a little bit road map about what we are going I just go through this quickly because in Denver a very important thing we are announcing here is we are announcing a security ecosystem which is welcome all the security service provider or data provider all the hackers who are really interested in this is going to apply Hi there and yeah this is our bounty I don't know if here there is any uh hiker participating in the hackathon but if you're interested or if you have a friends who interested doing something on that you could tell them like a go plus security have the bounty regarding on protecting users um mean interface I mean on different uh data new new type of data funding ways and new algorithm or like a finding a better way to improving the act interaction with letting the user to be aware of all the security thing. Um, who knows this picture.

Yeah, this probably a little bit old but not that old. It's maybe 20 20 30 years ago. I don't know. But this is a in the Star War. Okay, this is like the the Doom of the Jedi.

So why I'm showing here? Because I mean for us we started do the security data since since 2020. But right now we are actually already the largest user security data provider. But there actually also another question behind it is how could you make sure in the end we are not become another censorship about it. What is could be a better way to make the whole security data labeling to be a decentralized and sustainable infrastructure in the long run.

So um here's two more things I would just want to mention because we are beside on the business part we are doing on the technical part we are doing we also right now is creating a decentralized data framework to allow more security companies or hackers to join with the security data shying because the problem is we don't want to say in the end it's like a back to the web two security and uh security world you have someone who is a monopoly on all the data and it's easily to take advantage on others to say I have the authority to decide it who is safe or not and actually you don't really have the power to argue with me or at the same time I have this whole secure database with all the labeling but haha unfortunately you don't have it and by all this advantage in the end it will be very hard for some newcomers to entering this field to say oh I also want to do something new can you let me in well you can but you don't have data you don't have the thing you don't have any you know precontig condition in infrastructure there so I think this is something is also we remember but in our mind so the good plus security u our data API is being built as open permissionless and free version in the very beginning and we keep on doing that and the second thing is um since I mentioned something called security uh data sharing but this is something different I mean or more sophisticated if we compare with something like uh you know pricing like Oracle like you probably all know Chenlink but the sophisticated thing for security labeling data algorithm whatsoever it is more sophisticated than just a price or say it's just a number because this is actually someone was doing all this algorithm by maybe static checking dynamic checking sandbox some machine learning algorithm to check if they had a function heading in their smart contract or Mega data or their liquidity tool or trading watch whatsoever. So the conclusion there first is not like as simple just say oh this is a number this is actually maybe a bunch of labeling there. So since that was kind of sophisticated. So it's like something I mean you can do that I can do that but we can do that in a different way but how could I judge who make it in a better way. So this is actually more sophistic just about I showing some result and you just compare with me.

to see who is more accurate. This is actually um it's like a multi-party collaborative data decision model. But the thing is it's not like a sophisticated as a uh how do you say like the parameter discussion uh like right now it's a lot of dowsing you still need to have a lot of manual work. I mean I have no problem with it but it's rather sophisticated and it's taking a lot of time but for a real time security detection I want to get it right now because I want to protect myself because this hiker this cracker probably just trying to attack me on the next second. So what I could do is this is actually uh it's like a f a fual learning model like you can use it which means we can put different algorithm different model to train there but it's not say we can say or we can make a charges who is better or not I don't do that I just lie to the different algorithm training there but I would g to I to comp it's a lot also like the comparison in the real world to see who have the better probability who have the better performance regarding on the security detection but in a long way we're trying to find the better algorithm out of it and that could have the the the bigger voice in there um in this uh final decision say oh I have the better model but you are not that good but you need to train but this is not this will never been a ending game because there will always be someone jumping into with a new algorithm with a new data and in the end we just trying to hope it's becoming a denying make a comparison war with it but it's like in the back end and all the point of doing this is because we want to make sure in the user side they can really getting a better data to detecting on the security issue however this is also challenge after that and this is not easy task to do um I don't know how much of you like really interested in this data process or have the experience on that but I just putting it simply into four points uh it's not easy because first on currently public chain blockchain I mean whatever is layer 1 layer two module blockchain uh storage there's no mature infrastructure I just can use it right now okay there are someone doing something like that but this is more like like the test net or like the beta version we had tried some of them but it's not uh the same efficiency the same robust the same data concurrency could support it on And secondly regarding on security thing I have explained a little bit blah blah blah blah about what is it and another very tricky thing is for security data provider they don't want to show everything.

Yeah you see what my point because I had mentioned the security is like a war between the attacker and defender. So the defenders we trying to put the algorithm to do the other labelings or the similar thing to say hey you are a scammer but I don't want you know how did I do that you got it so the final day I just want to show my data but all my algorithm is like in the privacy model I won't let you know because once I open that everybody will know how did I detect it because the cracker the attacker they will also know how do how do I did it so they were trying to go around with us and that's actually our daily job every day so we don't want to publish all our weak part on there and the third part is a process of the data decision which is a like the IMD I just mentioned but actually I'm not 100% sure that will be the perfect model in end but I just think this is a most likely model we can use it but this is also kind of in the early stage on the modeling side on the algorithm per setting side and and and this is um and underneath is actually is this is also using a lot of ZKP but we didn't really highlight ZKP because this is not like a super big phenomenon regarding to say where are ZK security whatsoever because ZK is just a tool it's just a tooling okay it's just a tooling to use it and it's not a general purpose to use it you still need to train on a different model it's like any of the AI model you need to train there so this is probably still need to long way to have a perfect one there and in the end and in the end because this is not the data you can just use directly so we probably need a secondary buffer mechanism It's like before you get the result we are doing some judgment on that but this is pool we have different undecided data who's showing there but people can kind of competing each other but we have to have this mechanism and this mechanism is buffering the data we are not sure yet but once we sure about it or we have better version about it we will updated the API data you are using now but actually behind it this is a lot of pending data behind it and how do you do that this is also I And theoretically in practice we still facing a lot of challenge but we are working on that. So that's basically the four challenges we are working now and all in the end is is going to be make this decentralized security infrastructure in a long and sustainable way. But one more point I think I want to make here actually this uh this challenging here for us is it's not only for security. It's probably for a lot of similar things.

It could be social, it could be gaming. If we want we want to onboard more say web two I mean traditional application into web three world it's not only about the scalability for the public chain that's one side actually it's also about the sophisticated about the data deal about the database about how to handling all the um I mean the sophisticated mechanism behind it so that could be a question for many of them and that I think will be a very important question to really have a continuous growing web three but not only stay at this stage. Thank you. That's pretty much what I have today. And since we are in Denver, this is our local which is Mel High production and we have the booth and stair and is very close to the exist exist.

It's called go plus and there's a lot of candy and different incand there. Welcome to visit us. Thank you.