Beyond Account Abstraction - Better Experiences and Safety using Cryptography with James Bourque

all right everybody thank you very much for coming my name is James bork I am co-founder at intu we have a booth just around the corner I do a lot of the research and development uh for our project and I am here today to talk to you guys about account abstraction which after the news this morning we all know is a very hot topic um but we specifically want to look at what's beyond account abstraction um so we are going to make this a nice kind of high level story first and foremost I think we can all agree that private keys are scary right everyone has nightmares about losing that private key with those assets and things just go sideways but the important thing to note here is that private keys are also the Cornerstone of everything that makes web3 great right that self-sovereignty that agency that ability to generate accounts without trusting somebody else right you can do the math on your own and we cannot lose that part of our community that is what sets web 3 apart from web 2. so just kind of high level broadly speaking their accounts in web 3 work in two ways right these are addresses this is where to find either applications or end users we have Smart contract addresses which are like your dapps and these are typically intended for other machines they also do not have a private key for everybody else for us external users we have EOS externally owned accounts and these have private Keys we use these private keys to send messages and transactions to confirm that we are owners of that public address and therefore as an external user be able to participate in web3 Networks now the big problem with eoas is that eoas do not meet human expectations right it's a single point of failure you lose that one private key and you lose access to your eoa if we want to get those next billion users that everybody's talking about we have to do better than a single private key single point of failure this is also a one account fits all um and then at least that into we firmly believe that saying oh it's human error you've lost your assets human error is not an acceptable excuse anymore for our customers our users our developers losing access to their data right to their assets so now we get to account abstraction right and so account abstraction is an attempt to provide a more human experience for end users um with more usability and more functionality by decoupling the private key from the assets that you use right so the signers aka the private keys are now separate from the assets that you're holding the assets are being held on a smart contract account typically so not necessarily so account abstraction is just this decoupling right it's this ability to provide a more human experience for end users when we talk about account abstraction today we almost always talk about it in terms of smart contract account abstraction this is not a New Concept right gnosis safe has been a variation of account extraction for a long time these are just new words for the same thing um and I think we can all agree we need to stop making up words for things that we already have but that's a whole different story um smart contract account abstraction allows us to introduce a whole new world of programmability into the way that end users interact with web3 but it's not without its limitations right smart contracts have to be deployed on a single Network that smart contract address does not automatically get translated to other networks right we've had front running issues where you have a safe on one network and it's you're sending assets across chain and someone has front run that at that address there's also limitations as to how smart contract addresses can interact with other protocols um compatibility is an issue there's also setup risk right the developer who is writing that code in that smart contract address the one who actually deployed it if something is configured incorrectly you are compromising the entire account there's also always upgrade risk right if someone has the ability to change the nature of your account as an individual you are trusting that person to not change the conditions under which your smart contract account behaves so the last one and the one that kind of came up mostly today with eip24337 was a trusting arbitrary verification of users up until now we have always assumed that one private key one public address one user no one is foolish enough to give away their private key right so now with account abstraction we're introducing this whole new world of being able to verify external users using things that are not private Keys things that they might not have either a complete control over uh or really care or secure that efficiently so let's look Beyond account of distraction in the past couple of years in particular we have made a lot of progress in cryptography that enables us to still generate eoas right public addresses sepic 256 K1 addresses but without single private keys this is secure multi-party computation this is verified secret sharing this is threshold signatures and with this we have the opportunity to introduce an eoa a static public address for humans like us but no single private key to lose right we now have the ability to use key shares and threshold signatures to still use an externally owned account but not have to worry about losing one private key right we now have to lose the majority of them because this is cryptographic because the end result is an eoa we maintain the broad compatibility that we enjoy today you can use the same account on ethereum mainnet as on polygon Avalanche Phantom any evm compatible chain that uses dcdsa uh there's also a lot of flexibility in how you use it and all the dapps that currently exist today are already expecting transactions and messages from externally owned accounts so it looks exactly the same eip4337 which we all know was announced and approved today is an excellent first start in standardizing account abstraction we now have a common language for developers to use in creating smart contract account abstraction the way that 4337 works at a very high level you're replacing EOS with users and you're replacing transactions with user operations these go into a higher level mempool this is above the consensus layer and these bundlers go ahead and process these smart contract abstracted accounts into transactions and then you interact with the rest of web3 this is awesome this is great this is the beginning of a standard way of having nft games that don't require micro transactions you can do proxy payments subsidizing payments for your end customers you can do privacy preservation all the things that we're trying to do we can achieve with a counter distraction and 4337 gets us one step closer to doing that in a normalized way however back to the issues with smart contracts you require trust in the smart contracts and the developers and organizations that built them as the previous speaker was talking about you have to it's an audit is not just enough right there are things that we can't anticipate there have been flash loans that have been used in ways that was never intended but has completely changed the way that we think about web3 security arbitrary verifications of users has a wide variety of unforeseen impacts right if a developer decides that they want to verify their end users using Twitter or a cell phone number we're now open [Music] to authorities that are saying you are who you say you are because I have your email address and it lives on a server somewhere and I pay for it every single month right uh additionally you're losing the cross chain compatibility again front running on Smart contract addressing and you're also losing all of the effort that we've put into off-chain security everyone knows there's nothing safer than an off-chain key that's why we have Ledger that's why we have treasure that's why we have Enterprise building on Hardware security modules to secure keys in a way that's at scale efficient and safe it's air gapped we lose all of that with 4337 so what I am here to propose to you guys and to hopefully engage in more conversations about I'm not saying we have all the answers yet but it's it's an important conversation for us to have is to look at account infrastructure first and to look at this Advanced cryptography first right using key shares instead of private keys and using threshold signatures we are enabling our end users to recover accounts right we can use key re-sharing to dynamically change participant ownership of accounts and with that we can better approach a more human experience right something that we're we're more closely chasing while still relying on the hard-coded consensus layer that we've all come to trust right that is why evm is so widely adopted is because private key public address we trust it we know it's going to be verified cryptographically by the network and we know we have the distribution in order to trust in that when we take that infrastructure and then we start building the account attraction on top of it we're divorcing the account side of it right the key management the identity of the end user while still providing specialized experiences for our applications so again proxy payments I can subsidize the cost of your browsing I can pay for your gas fees and I don't have to worry about your private keys I don't need to worry about how you've identified yourself on the network I can go ahead and just focus on what I'm good at right kyc compliance Deeds transfers all sorts of great things right without jeopardizing the why of web 3. so in conclusion I think what we all want is a web three that more closely meets human expectations we want to be able to reset our passwords we want to be human and not be penalized for it and I think most importantly this is what the mainstream was this is what we need in order to convince web2 users that web 3 is safe and you can still learn without losing everything along the way and that's it um so thank you very much for listening we are just around the corner uh we focus a lot on secure multi-party computation verified secret sharing threshold signatures um this is a great way to keep in touch we are remotely based but if you're ever in Paris or San Francisco or Lisbon come say hi I appreciate your time and I hope you guys have an incredible rest of your week Denver thank you