Solving usability problems with delegated key management

hello I'm Sean from Ford Matic so this workshop is fair a bit more about formatting and also you know give some tips and inspirations for winning the price cap the hackathon price we're giving three winning teams the first place will get a grand prize of $2,500 and 250 Canadian dollars for the runner-ups project we will be evaluated by user experience practicality and originality my past work because it's quite relevant so before founding automatic I actually work at docker for two years and I work really closely with the founder the CTO at the time to help you know manifest is like incredible ideas into things that are very accessible to developers and if you use docker before this little menu bar item right that's my project and it's got a docker desktop and basically it is the point of entry for docker and it is used by over two million monthly active developers and which is around 10% of all developers worldwide I was also the creators of kite Matic the desktop GUI for docker which is acquired in 2015 we wouldn't be able to accomplish this without a great combination of strong tech and developer experience so before dr. desktop darker wasn't optimized for the desktop right for common operating systems like Mac and Windows there's really high installation failure rate which resulted in all of drop-offs it was buggy is complicated it had very sporadic behaviour because it integrated with a third-party tool called VirtualBox and what we did eventually is we removed this dependency and made docker feel like he's running natively on the desktop is it's invisible and staying out of the way of developer right this was done by you know working with the best kernel hackers in the world and leveraged operating systems internal hypervisor I expose them to the users you know the dependency problem for docker is strikingly similar to what we're experiencing today in the DAP ecosystem we stops having to rely on third parties such as browser extensions or mobile wallets in order to serve their users with a really low you know twenty two percent conversion rate in the most optimistic case for users who are new to space instead of a virtualization issue they use their experience problem in that ecosystem it's actually a key management issue so after auditing the de facto browser extension user experience we've categorized the different steps into four categories the familiar right web to user experience with the lowest which has the lowest rate of user drop-off and also the unfamiliar web 3 user experience which may expose too much foreign concept in the user which result in drop off contact switches where users scratched between completely different user experiences result in the most chance for drop-offs and lastly informative steps where user can drop off from feeling annoyed or feeling exposed to too much information at once essentially what furred Matic did for that with our SDK is to remove all the steps from the user experience where users have a chance for drop-off and basically the idea is you know don't make users feel like they're working on stay nice without these warnings had to be careful with everything you know we have to make sure that users feel secure and supported therefore create a UI that is you know familiar authentication experience to mainstream audiences like email phone two-factor multi-factor login also user won't be spooked by unfamiliar experiences we also offer extensive white labeling service so you can make format a look at feel like your application without diluting your brand and user experience and help build trust between your app will also be shipping soon in a week the ability for users make transactions on taps with a credit card no kerosene needed for smaller amounts in the future we'll be adding things like Apple Google pay and bank transfers underneath our UI is our delegated key management architecture we actually just rolled this out on Monday and we've been working on this since we launched in February basically account recoverability is super critical to us because mainstream users will lose their device their recovery kits or forget their password for encryption the feeling of hopelessness from being locked out of their account is really really bad for mainstream adoption and to keep our architecture noncustodial we made sure we'd never see the private key at any part of the flow so private keys are generated locally on developers client within this cure iframe sandbox and then directly encrypted and decrypted with the cloud hardware security modules hosted on Amazon services and we actually discovered this by accident like searching on the Internet where this user was complaining that he got locked out of the Amazon's kms key management system so we instantly thought hey why don't we remove our own access to it so that we can no longer access our own use our own kms for encryption and decryption effectively locking ourselves out and to hold ourselves accountable we've gone through extensive soft - audits to make sure that we have the correct security controls which is a standard pioneered by you know industry leaders like coinbase and Gemini with a solution for key management authentication authorization fee at on-ramp taps will be leveling the playing field with centralized incumbents and you know we'll be ready to crush it in the market heats up again now for some ideas and tips for the bounty I feel like one of the biggest and most effective improvements taps can make is adopting a concept UX principle cut progressive disclosure the apps should be led easing users into more complex tasks by reducing the clutter and confusion and cognitive workload usually by avoiding giving users too much decision which causes decision paralysis and also showing too much information at once good example here you know our games if you play games like Starcraft before they cleverly avoid overwhelming users with the tech tree which gradually unlocks new units as you progress into each game cool equation called the hex law that illustrates the impact to reaction time based on the number of options provided by users it takes a lot for users to understand new concepts by leveraging existing concepts or memes that users are already familiar with it will help a lot with reducing cognitive workload and here are some pretty good examples so toca says that's a good job inherently complex under the hood but they've combined all of this complexity into simple and familiar actions of buying and selling tokens with one user interface that users are familiar words like wealth Ron and Robin Hood and you know D fights on the verge of Cambrian explosion your protocol is like set and you MA enables developers to build synthetic assets right back baskets of tokens that are Auto balanced or having tokens that are tied to the value of real-world assets right now with also the proliferation of decentralized exchanges it makes it it makes it much more accessible to publish these new assets to publish this new assets worldwide through these decentralized exchanges also great products are extensible ever evolving to the user need and also without too much introducing too much complexity we have formatic have been really fascinated by smart contract wallets because their elegant extensibility and also the extra security for users who need it basically format it never really intended to be a wallet it's just a good way to start and get people using it we've always wanted to build a robust and secure and compliant base level key management infrastructure for developers to use we'd be really excited to see format is key being used in as master recovery key for a smart contract wallet let's say on gnosis with the option for users at other keys further improve the security of their fund for custody and decentralizing trust this would be really great for enterprise users and also users which much higher security preference yeah and while you're at it would be really cool to somehow work three box identity into this identity that follows you around websphere technology also enables new types of organizations and business models I see those are just a glimpse of what's possible right in innovation in this space we've always been a fan of dowse ways to properly align incentives of network of people there are also many new innovative ways for organizations to fundraise like the continuous organization using things like bonding curves that are used by like unit SWAT protocols yeah and lastly I'd like to personally thank and congratulate all of you you know our collective effort and awareness in improving user experience having having significantly increased that monthly usage by about over 58 in the last 10 months and you know this data is from state of the adapt but they've given us like custom data to help us communicate this and yeah I'd like to give a short demo on how to integrate automatic into your application for Mary comm hit get started and now you'll be introduced to our dashboard basically log in with github and you'll be given two API keys one for tests that you can pick between rinkeby covin Roxton and also the production API cue so I just get started to our documentation so we have a helloworld tutorial here on code pen so the first step is include the 4matic SDK script we also have NPM packages but this is an easier way to demo and then now set up my 4matic instance and set up my website provider to be the 4matic provider and lastly you can use web 3j as functions as you're used to if your app works with madam ass it would work with automatic right away cool now I'll load up my API key so I'm gonna use my test API key well now the app has to restart it and now I can log in to automatic so I hit continue here you can either use your phone number or email to sign up so in this case I will use my email and then I'll log in with my passport yeah now I'm logged in and I'm instructed to send out a theorem transaction so for every developer who signed up on the Ring compute network we actually send them one free rinkeby yeast so you can get started right away from transaction I hope this works anyway so we continuously polish it that you see if it's completed so I can have telehealth users and understand the process and after it's completed you can view this transaction on ether skin or bath to that also I forgot to show that you will be able to select your face so you can actually select either faster or cheaper fees or developer can suggest their own gas for this specific transaction also some cool explainer on what gas is yeah there's a cool diagram here supposedly yeah great and so if you look at our documentation we do support you know regularity of transaction as well as general smart contract transactions you can do personal science sign type data batch requests GRC 20 transfers that we also work with fifties as well yeah great yeah any any questions what is the relationship between a user name and password with the API key that you generated are you venerating the user names across all these API keys or like how is it like multi tenant is it for a particular for a user that's that's a good question so the service as this now is one email and password for all the apps but each app have their own API keys which they can use they can let users access with their formatting account but we are introducing a service where it's multi-tenant that you can have different set of users or different set of apps who really want to you know have their only users and user experience and the connection between the eat wallet and the username is one-to-one is that right yes so in the second case where you have the multi tab there's gonna be multiple wallets created for API key yeah and that will be possible with the headless yes that's also a good question so we have a domain verification for that's to kind of verify their domain so they can know so they can actually use the production key so without verification it's only available for localhost yeah it's validated in our back-end so you can actually do that on our dashboard so they support like the meta tag way file upload or DNS record when what downloading go for Monica's seeking with and we can be like more beneficial than just like crazy about water table to do same thing it's for developers who would like one a lock down the version the yen asked question oh through the cloud you support us would it be helpful to have an API call they can resolve names including Argentines API culture art just a bi so that made that be useful yeah it's yeah so so it's a nice model where so the authentication its segregated from the key mechanism right so basically the keys generated on the client right in in the browser and the key gets sent directly to Amazon kms yeah through Amazon kognito which facilitates this this credential exchange right so phonetic doesn't like like lurk Matic also yeah so basically everything relies on Amazon's kognito and formatic try to stay out of way as much as possible and we do currently run a like an r3 layer that talks to Amazon and giving the tokens to the users but I can mention before we actually are left out of the Amazon instance ourselves so we cannot decrypt with yeah so it's like their own more developer-friendly teammates are in service even your long-term right press my user name and password yeah you can you can initiate a recovery flow which downloads encrypted key from the from 4matic right so we store the encrypted version of the key in case you're losing so now we can give it back to you and you'll be able to recover for example store your email address yeah so it's also the kognito credential that does the decryption so it so whenever two user authenticates Amazon kognito will send a either a encryption scope potential or a deeper sense called Prudential which you can use to directly talk to it Amazon kms for encryption or decryption yeah and then we'll also have like more detailed diagram illustrating these in a convenient day or two can you walk through there you do not need a username and password and the state essentially you create a burn a wallet on the browser hmm and then ultimately then I want to save my state I create for thematic account because that is the best user experience is no username login and a lot of popular but two apps lets you do that flow right optimized needs example you can play with the app without logging in and then once you want to save your customizations that's when you create an account yeah how would that look with automatic hmm I think that's that's perfectly plausible and I actually suggested to burn or wallet okay yeah so if they integrate and then go be able to come in with more permanent but you know I think still we're exploring that option and there's definitely more catered towards like crypto projects with quick wallets but you know that's definitely a good suggestion for like now getting started quickly and start exploring the the space but the challenges you know it's up to the adapt to inform their users to kind of genuine when I know technical constraints or useful not excuse anything when I see a brand new product and product hunt I'm always skeptical of sharing my user name and password because I know at some point not spamming so I always go to throwaway email dot-com create a throwaway email and then I sign up with a username password and if I like the system then I go into pre create an account and I'm not I'm shameless I do that but that's because you know I I don't want to tie it divide it to the end like try it out for myself right but maybe that's because I'm just a little more cynical maybe that's where I do that too it's definitely not the majority but I think there's a good chunk of us that you know would really love it yeah so we're going to be so we're working with a moon thing or we were gonna launch it today but you know it's delayed by a week so basically it will be able to send us a fashion just with the users credit card and then which we will try to abstract as much a way of the blocks away as possible so it's kind of a really slick web to experience imagine that it was like LED labeling so when users are interacting with your dad you know they have a white label credit card checkout experience and we also negotiated a deal with would pay to lower the fees because all the tabs that are integrated with us will you know will have would pay by default so it's a really beneficial for them and also they will be adding Apple and Google pay support for you an easier check out and also bank transfers for much lower fees so be looking into that no we don't I would feel more comfortable making money if Webster we actually took off where companies started to find their own business models so so far a little venture back so we don't worry about it making money in the short term and really want to help grow the ecosystem and then to work with the companies that's working with ourself figuring out that price alone is there thanks so much guys sorry for later [Applause]