Dapper Building a Better Interface

so to start in 2017 we release crypto kitties - anybody here own a crypto kitty raise your hand if you do cool awesome if you don't know crypto kitties is a game where you can collect and breed digital cats our goal is to make it fun and easy for people to access the blockchain and to learn about the blockchain before release crypto kitties we knew there would be some roadblocks to people getting started especially for people who haven't used crypto before this is kind of what we thought the steps would be if you're a brand new user you don't have any crypto you don't have a wallet we thought people would have to you know download a wallet get some if learn about the game start playing but as more people started to play crypto kitty is we kind of realized it was a little bit more like this there's actually you know not just five more like ten or fifteen steps or ten or 15 things they have to learn about before you can actually play the game you have to learn about gasps you have to learn about transactions you have to save your your your keys and back them up somewhere you get all these scary messages saying like you know oh if you're gonna if you lose these keys you're gonna lose all your cats you're gonna lose all your money scary for new people and there's just a lot of roadblocks to getting started and unsurprisingly this kind of dissuades people from playing the game so most people who were playing crypto kitties and who continue to play crypto kitties use browser based wallets and we refer to these as client-side wallets because the keys are stored entirely in the client in the user's device and they're really popular as I'm sure you know because they're really simple and they're easy to set up they don't require any back-end infrastructure there's no like cost associated with getting started you just generate a seized phrase it's free but there's some pretty significant downsides to these the key that controls your account is a single point of failure and in the same way the backups for your account or single points of failure lose your device or it gets compromised everything associated with that key is gone on top of all that new users need to acquire eath before they can get started because they have to pay the gas for their transactions there's no flexibility around that and we looked at ways to increase the security of client-side wallets and these are just a couple of the ways you could keep split backups you could have you know cold wallets where you keep most of your assets and hot wallets where you do data a stuff but these things are just too complex for normal people to use and on the other side of the spectrum there's server-side wallets you know the coin basis of the world a lot of people use these two they have familiar user interfaces so you got that on your side if you create your password you're fine you don't have to worry about storing your keys you don't to learn a whole bunch of things you just sign up with an email and password and you're good to go but as we all know these have some pretty significant problems too they're really big at the really big targets for attack you know some of these servers store keys worth tens or hundreds of millions of dollars it's just a matter of time before somebody's gonna break in and they you know they have they will continue to do that and ultimately and possibly more importantly if you don't hold the key is it's not really your and there are some ways to combat this as well you can encrypt with the client-side key the the key that's held on the server but then you can't forget there you you know you can't reset your password again we think these compromised ease-of-use a bit too much and they aren't really feasible for most people to use and the main problem with all these things is key storage there's often just one key that holds you know that's the the key to the kingdom if you have the key you have access to everything if you don't you have nothing and key storage is really hard it's a problem that we've known about for a long time it's not new to crypto it's not going away so we think the best solution is not to come up with some new new way to approach key storage but it's to design systems where the individual keys aren't as important you can lose a key you can you can have a key be compromised and not lose access to your assets not lose access to your wallet and so shortly after crypto kitty's was released we set out to come up with a solution that accomplished all these things and in doing so still maintained a really good user experience and throughout the design process we kind of kept in mind these three me and design axioms there should be no single point of failure there should be no one key that you can lose where you lose access to your whole account you should be able to have a key be compromised you should be able to have a backup be compromised and you should still be able to get back into your account but even with that being the case the end user should still always be in control so even though they can lose a key they still have all the keys they need to have access and control over everything in their wallet and on top of that it has to be easy to use and has to be fun so otherwise nobody's gonna want to use it and that's why we built dapper so dapper combines some of the best ideas in the space with a flexible smart contract and smart contracts gonna be open sourced as well we've used the smart contract in our product but we hope other people will will use it in theirs as well and we use that to create a wallet that's easy to use for everybody but also easy to keep yourself secure and this is kind of a very very high level architecture of dapper and there's kind of two parts to this there's the smart contract which is designed to be really simple really flexible and composable with other systems that's the part that we've open-sourced already and the second is the dapper product that's the extension in the backend in the future more platforms and we built that on top of the smart contract it's designed to work with a particular configuration of the smart contract but the smart contract wasn't exactly designed for the product and the product doesn't exhaust all the possibilities of the smart contract which is why we're open sourcing it so other people can kind of go down different avenues with it and this is what dapper looks like if you had a chance to check it out already it's a familiar user experience and UI it looks like products people are familiar with but behind the scenes there's a lot of cool technology with a smart contract making it easy to use and easy to keep secure for the rest of the talk I'm gonna mostly focus on the smart contract itself so this is at a high level what the architecture looks like as you can see it's pretty simple we spend something like six months rewriting it to get it pared down as much as we possibly could so it's easy to understand and easy to reason about there's two components to it the first is the recovery component recovery allows you to have a offline or online recovery key that can be used to revoke all access to anybody else who has access to your wallet and set a new key that is the only key that's that has access to your wallet forward so it revokes access to everything now and gives one device access in the future and the authorization system is just a way to allow keys or allow other smart contracts to interact with the wallet and access the wallets assets and so on so digging in a bit deeper into the authorization system it's a two of two signature scheme so you can either have we call these guys child keys because they're kind of like sub keys of the contract you can have a child key with a cosigner key where you need both signatures to perform some action or you can have a cosigner contract or you can have no cosigner at all we think most people are gonna want to use these two options but you can still get some benefits from the contract without having a cosigner and the recovery is even simpler there's one key again it can also be a smart contract and it just revokes access to all the authorized keys that are on there already and sets one new authorized key to be the authorized key going forward so now I want to talk about some of the different configurations of the smart contract that you can use to implement kind of different security models the first one you might have thought of this already and it's kind of the most obvious case you can do Multi multi device strong to FA you just have one of your keys on a primary device one on a secondary device and you require both devices consent before you can perform some action on top of that you can actually have this point to another contract and that contract can further implement arbitrary and of M threshold signature schemes too and by setting the cosigner key to point to an on chain validator contract you can implement arbitrary validation that's enforced trustless Li on chain by that contract so some examples of this are you could you could require that certain of these child keys can only access certain gaps you could have a daily spend limit you could have a period like a challenge period before large withdrawals all that kind of stuff and the same idea can be applied to off chain validation so in the same way that you can have a contract validated to your transactions you can have an offline service hold one of these cosigner keys and validate your transactions off chain before signing them this is a bit of a trade-off in terms of sovereignty but it results in way more flexibility in what kind of validation you can do and you obviously save a whole bunch of gas because you don't have to run any everything through another smart contract and this is actually the way that we have leveraged the authorization system for dapper we provide fraud prevention and automatic gas management so if somebody submits a transaction that withdraws all your money from your account maybe will request additional authentication before letting that go or have a wait period or if somebody you know sends to a known scam address we can let them know about that and we can also intelligently select the best gas price based on network conditions somebody sends a transaction and then all of a sudden the gas price spikes we can adjust accordingly in real time without any action on the user on the part of the user and if you're really paying attention you might have noticed that there's a bit of a problem with that last scheme I just showed you since the cosigner is self is held by a third party and you need both the co-signers and the child keys permission in order to take some action the cosigner can just stop signing stuff right and then you can't and then you don't have access to your wallet anymore and we have a we have a solution for this for this problem we actually have several this is just one there's different ways you can do this that have different trade-offs between whether the user or the service has more control ultimately this is my personal favorite because it gives more control to the user but using the recovery system that I talked about a bit earlier you can have the recovery key point to an escape hatch contract and the escape hatch can detect when there's malicious behavior and you can detect that simply by seeing seeing if there has been a long period of time where nothing has happened on the wallet because if your cosigner stop signing transactions for you you're not gonna be able to do anything and your your wallets gonna have no transactions on it so as a user you can send a challenge to this escape escape hatch contract you can say hey I think the cosigner is being malicious no down the block number and note down the wall its current nonce and then you wait some period send another transaction to it if the nonce is not changed then that's an indication that there's a malicious behavior part of the cosigner and the escape hatch contract can initiate the recovery revoke access for the cosigner and get you back into your wallet and this is another recovery scheme this is the one that we currently use for Davern so the recovery key the recovery key can be created on the user device when the wallet is created you can sign a recovery transaction which will set set that new authorized device key you to be of this backup key and since this has so much power it can perform recoveries so it's it's quite a high risk key we immediately destroy it we hold the recovery transaction so that we can go through the whole process of performing their recovery for the user and the user holds the backup key in the form of a rescue kit PDF which is similar to one password if you've used that so similarly to the authorization system you need both of these pieces to actually get access to the wallet and they're held in two separate places if one of them is ever compromised you can go through this whole process you can go through this whole process again reset the recovery key recreate the recovery transaction recreate the backup key and you're back to a to a good security posture and the last thing I want to talk about is this notion of flexible sovereignty so I kind of made up this definition but the idea is the ability to do have a single wallet or a single address that can accommodate different levels of sovereignty all the way from centralized where somebody else holds your keys to fully self sovereign will where you hold all your keys and have that be the case without ever needing to compromise security so the reason this wouldn't work for a traditional wallet is if you start out if you if you get on boarded into a into an application and a wallet is created for you and some centralized service is holding the keys then they have the keys at this point right and they may give them to you in the future but you have no guarantee that they got rid of them if you use a smart contract you can revoke access to those keys and create a new set of keys for yourself and and then you can be completely certain that even though previously your account may have been may have been centralized and held by some third party you can know that going forward you're still okay and they can never get access to your account again and that's all I got so thank you a lot for your time I'm gonna be around for questions afterwards you can also come grab me where we've got a booth around the corner and before I finish I'm just gonna mention we have some bounties for integrating dapper and also for integrating crypto kitties three-three bounties one of them is or sorry two of them are $1,500 and one of them is $1,000 and you can come grab me afterwards for more details or help thanks a lot [Applause]