# Unintended Consequences of Product Design by Taylor Monahan (Devcon4)

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2019-10-09
- Duration: 33:30
- Topics: blockchain, smart contracts, distributed ledger, Science & Technology
- Watch: https://streameth.org/watch/yt-ULU0yfpSsKk
- YouTube: https://www.youtube.com/watch?v=ULU0yfpSsKk

## Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more.
https://archive.devcon.org/archive/watch/4/unintended-consequences-of-product-design

The little choices we make when building a product—regardless of how much thought we put into them at the time—can have long lasting consequences. I'll cover lessons learned while building MyEtherWallet & MyCrypto, why we decided to ultimately make the hard choice to remove private keys from MyCrypto.com and move people to the desktop app, and how others can be more mindful while building great products in this ecosystem that promote a secure and decentralized mindset for both product creators, their teams, and ultimately their end users.

Speaker(s): Taylor Monahan
Skill level: Beginner
Track: UX & Design
Keywords: decisions, keys, user experience

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon 4 was held in Prague, Czech Republic on Oct 30 - Nov 2, 2018.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

## Transcript

[Music] all right hi everyone how's everyone doing today hi I'm Taylor Monahan I'm the founder and CEO Mike crypto previously ours with my ether wallet we did a little brand fork we are a distributed team of about 20 people we're all over the globe front row right here this is my team so find us afterwards ask us questions and if you want to work for us we're always hiring so definitely definitely talk to us so today I'm going to talk about the unintended consequences of product design and some of you may be sitting here going what the heck does that even mean and basically it means in the early days we screwed a lot of things up we made a lot of design decisions that we're just not necessarily the best decisions that we could ever make and they had some unintended consequences that you know led to things like lost funds confuse users and generally just bad things happening in the ecosystem now I want to be clear I'm not giving this talk to be negative or to call out certain products especially my own but I want to make sure that everyone in this ecosystem is able to learn and grow from other people's mistakes so that we don't repeat history over and over again I want this entire ecosystem be safe and easy to use and better so let's start with the most basic interaction that you do on my crypto which is creating a new account if we have to go back in time to 2015 and in 2015 a theorem had just launched there was no real way to interact with with etherion blockchain and we created a really really simple interface and when I say it was simple it was really really simple it had a single button a single little field and it just said hey generate a wallet it wasn't called my crypto it wasn't even called my ether wallet it was just called ether wallet and how'd it get hub pages URL and basically what we asked users to do was type in a simple password and press a button and then it would spit out all of your information just like that and by the way loved this interaction from a UX standpoint it was as frictionless as it could possibly be one click and you had all the information that you needed Helmut how could we make it simpler the problem was is that even though we really really wanted to make the process really really easy and quick it resulted in people simply not saving their private keys so if we go back and look carefully that field right there under success your wallet has been generated is your address and that's the piece of information that people need in order to send funds into their account and so what people ended up doing was instead of saving the private key saving the key sir files leaving the qr-code any of that stuff they would just copy the address send funds to it and then some point down the road they'd be like oops I don't have any way of accessing my wallet and we saw a ton of loss from this so how did we sort of solve this problem what steps did we take to mitigate that loss this is the new interface on my crypto and basically what we do now is that we have you enter a password we have a whole bunch of algorithms that make sure it's a strong password which is also a huge positive and then you click cranial wallet and then it forces you to actually download the keystore file so in order to continue on you have to download this file and even then we still don't give you your address we give you the ability to unlock your wallet via the file that you just created and what this does is that it ensures that the user has not only created the wallet has backed up the wallet but that they can also successfully unlock the wallet now and then obviously again in the future and this cut down on the amount of loss and incorrect backing up of keys that we were seeing so so so frequently and it had a positive really positive impact on our number of support tickets so what can we learn from this sometimes friction is a good thing you need to force people to save the necessary information you need to force people down this path and sometimes that path does have some extra stops and it does require some more clicks but if the ultimate end goal is to get people into this ecosystem safely and six fully and for them to backup their keys maybe you do have to literally force them to do that or at least guide them down the safe secure road and not let them take this alternative path so my next example is one that is really really really terrifying I've seen it with a few jobs already it's happening more and more frequently and it's this practice of saving private keys or other secret information to local storage so this is ether Delta which was one of the sort of original taxes and in 2017 almost everyone was using this if they were using into centralized exchange and ether Delta has a create account functionality and just like we used to it just sort of spits out your private key you doesn't ask you to back it up or force you to back it up or any of the above it just gives it to you but it's kind of ok because they just save it to local storage and for those of you that don't know local storage it's kind of like a cookie it's a way of saving stuff to the browser so if you leave the website or close your browser and then return to the website it can read this data again and so it can basically re access your account or reallocate your account without yuri entering your private key so looking closer there's a private key that they spit out of you and there it is saved in local storage right there and this is incredibly dangerous local storage is not a secure place to sort keys ever don't ever put keys there don't put secrets there don't put anything there but it's especially dangerous when we're talking about cryptocurrency websites because they are such a huge target for attackers and hackers and I know I said earlier that I wasn't gonna sort of call out specific products or you know shame people but I'm kind of just gonna be frank with this I'm shaming either Delta ok because in December of 2017 they got hacked their DNS was attacked ok they rerouted the DNS from the real valid ether Delta site to a fake one it looked identical to get their Delta people didn't know the difference people were going in unlocking their accounts people are sending money to a fake contract all these things but the worst thing was that anyone that read the news that day and got scared and said Oh shoo I've used ether delta before and simply visited ether Delta then had their private keys and their funds solon and the reason for that was because the private keys were saved to local swords the user had to take no action beyond simply visiting that website okay this is an immensely harmful thing to the ecosystem to users and to everyone safety and security again cryptocurrency websites are a huge target and we have to be secure and we have to be safe and that's your own personal security your company's security your website security and most of all your users security so we know the intentions of ether Delta and other similar jobs right they're trying to make this process easier they're trying to make it so that people don't necessarily have to backup their private keys they're trying to make it so that if a user leaves the website and then comes back they don't have to go through this other process it's all about reducing friction and that's what we want to do when we talk about user experience by unintentionally they painted a huge target on their back like let's be real for a second saving private keys to local storage this you're an immensely popular website people see that you have users people can see the amount of money flowing through your website you've literally just painted a huge target on your back you've waived it the hackers and the attackers and said hey I'm right here come and got me and then when they did come and the attackers did successfully find an entry point it resulted in way way way more loss and for me this is simply unacceptable so if you're a dick job developer and you're trying to make the experience more frictionless I applaud you but don't save secrets to local storage okay it's not philosophical it's not complicated it's it's not it's just that just don't do it don't do it unencrypted don't do encrypt it don't save secrets the local storage all right so moving on some of you might be sort of arguing with me a little bit and being like but Serg is good I can save stuff there right yes sometimes don't save secrets there but local search can be really really helpful because you can save things like user preferences or settings you can remember what language a person uses or what currency they like or whether they like the dark mode of the light mode and you can also do things that try to simplify the user experience one example of this is the this is the original the the OGE and a staff experience so if we travel back to last year when you wanted to bid on it ENS name you basically had to go you had to bid on the anis name and then you had to wait a couple of days and other people would bid on the name and then you would reveal that name and because it's all decentralized and it's all on the blockchain you had to save three pieces of information you had to save the bit amount you had to save the mask bit amount and then you had to save the secret string which is just like a jumbled string of characters that acts as a salt for all the other information so that it's not public on the blockchain so this da sorry this stop really wanted to make make the experience as good as possible so instead of telling the user hey you guys have to backup all this information and please don't use it and make sure you save it and all of this they decided hey let's just save that information a local storage and they had the best of intentions with this they wanted to make the experience more frictionless they wanted to make it easier they didn't want to have to explain to the user what this bid was and this mask bid was in the secret isn't why they have to save it all that stuff the problem was is that especially in the cryptocurrency space we use incognito mode we use different browsers we use different devices we use tor we use all these things that protect our privacy and one of the things that these things do is is it prevents things in local storage or a cookies from persisting right so if you're in the incognito mode you close that browser it's gone so shortly after the first sort of bids were were replaced and then we're ready to be revealed the support tickets and and on social media and everywhere were through the roof and people were like I can't figure out where my bids went I can't figure out what this Greta's I don't know what this is etc etc and unfortunately there was no way to even recover this information because it had been saved in local storage the user never saw it they never backed it up and you basically just had to say sorry your eath has locked up in that auction luckily the developers of the stop where we're really really on it and so the second they realized this they changed the interface that basically once you place a bid it forces you to sort of download this bid and educates you and it says hey so you need all the secret information we know it's complex but save a backup just in case anything ever happens to your browser you can get it back so we know the intentions of this stop and I'm sure many deaths that are currently out there and to come we want to abstract things away we want to hide these complicated and complex interactions from the user and we want to have the user perform less actions because at the end of the day these are does just want to bid on a name or reveal a name they don't want to understand the inner workings they don't want to know how the sausage is made unfortunately in this case it resulted in confused users who couldn't reveal the auctions and and there was simply no way to recover the information and that's a real shame I don't I don't want to to my own horn too much but this was sort of how we handled the same interaction so I had learned my lesson from the whole private key spitting out the address not having people back up I'd already learned that so when the E&S came along and I was making design choices with this we basically told the user to screenshot it we told them to back it up we gave them an easy way to copy and paste the string and we told them this every single step of the way we told them this as they were replacing the bid we told them this before they sent the transaction on the confirmation modal and then we even told them after they said we're like hey by the way if you're too lazy to back it up before please really seriously do it now and you see the little red bar there like this is the middle sap the next step it was like really starting to yell at the user because if the user had him backed up by that point we really needed to do something to grab their attention so what can we take away from this example we know that we don't want to save secrets localstorage it's sometimes acceptable to save non secrets to local storage by make sure that you don't rely on that information because user environments can and do change so I like to play this game where it's called best case worst case and when you're looking at the design or you're looking at your product you want to say what's the best possible outcome and so in this case the best possible outcome is the user can place the bid reveal the big get their name everything's hunky-dory they don't have to take any other actions they don't have to understand how it works flawless the worst case is that their action cannot be revealed and their eath is locked up which essentially makes the eath lost and for me that's not an acceptable amount of loss that's not an acceptable experience so then you have to ask yourself what steps can we take to mitigate that loss how can we change this design change this interaction change this experience to make it better and if you think about the same sort of game the best case worst case with things like user settings right so a user says hey I really like to use your your app in dark mode and they change it best case when they return to your site again it's in there cool theme they're happy they don't have to take an action and the worst case is okay they have to click the drop-down and select their little dark mode again and that's like a sort of perfect perfect thing for a local storage because it's not the end of the world if you lose that information it has no value to hackers you know all those good things all right and then so I want to we've been you know pretty heavy on the crypto sites and I want to remind people that these aren't product design UX choices that we make are not limited to cryptocurrency this is everyone everywhere and even the big boys make these mistakes and make choices that do have unintended consequences so we're gonna take a look at Google's recovery emails and phone numbers and how they've set it up and what this sort of results in so when you first start up a new Google account and this is like Google I mean like everything Google Gmail YouTube I don't think Google+ is the thing anymore but you know it used to be they ask you to enter some information so you got to your name you got to do your user name or your email address and then you got to do a password that's all are pretty standard the next step is that they you ask you to verify your phone number and you can't skip this step you have to give them your phone number and it has to be a valid phone number because they're gonna text you a little code and you're gonna have to enter the code on the next stage and then once I've verified my phone number it asked me for another email not just like an old email address and then some other personal information that you could enter you can go and fake him row I give them fake info you know and then once you've sort of successfully set up the account you've given them your phone number which has to be your real phone number and a recovering email and if you go deep into your Google settings you're gonna see it's like halfway down the page nested under security this place that says recovery email and recovery phone and then that's this is this is the danger zone right you may think about having a recovery email and a recovery phone number is a good thing because it allows you to recover your account if I forget my password and I click little forgot password it's right there it's like hey we'll help you out we'll get you a verification code you want to use your email address no you want to use your phone number okay cool the problem with this is that attackers and hackers can also recover your accounts and what ends up happening is that your your let's see so right now you have an email called Dan loves crypto so much at gmail.com and this is probably super secure right like you've got ufa on that [ __ ] like it's the best the problem is is that it uses your your email from a couple years ago your libertarian dreamer email and that one is also recovered from that that email you use when you're applying to colleges your your very professional first-name lastname which is also can be recovered with your you know your old gamertag from high school that you don't admit that you still have and so even though you've secured your dad loves crypto so much email and you have two FA on it ah really your queen bees in your Gemini and every exchange account that you have linked to your current email is only as safe as your literally your old camera time from like 2006 and this is where the problem happens is that hackers will either get into one of your old email addresses and then work up the chain or they'll just port your phone number and if you're in crypto you may think that you're a small-time and you're like oh I'm I'm just attending Def Con I'm just a person who watches the livestream every single one of you that's in this room if you are knowledgeable enough to be here or be watching the livestream you are a target there are thousands of attackers that do nothing but try to social engineer the phone companies every single day they try to port your phone number they try to do a sim slot and they try to get in to all of your exchange accounts all your old Gmail accounts they try to see what information they can get they try to get your PayPal and they will take your money and the best sort of money that they can take is your cryptocurrency because it's anonymous and and it can be you can go swap it in a Manero and now nobody can talk it and then they can go do whatever they want with it they can go buy new domains with it they can cash it out into their bank account and nobody knows right so this is these are the things that are happening and while it's a good thing now user accounts can be recovered and this is especially important when if you're adopt developer and you're working in this ecosystem like you want to figure out how to recover things be very very aware that these accounts can also be recovered by hackers and so what you know what choices can we make to mitigate that because it's not necessarily realistic that every single gmail user uses like au Baqi right like I'm not quite sure that we want to tell everyone in this world that they have to have this Hardware device however Google has a lot of information on us like they literally they read all your emails they read all your web browsing history they know everything you do on your phone they know if you're like a high target person they know if you're in cryptocurrency they know if you're a celebrity they know if you're a politician one thing Google could use or do with all of that data is they could figure out hey we got these average users and we've got these high target users and they could force those high target users to not use insecure backup right they could say hey you your target for hackers let's make sure that you get that hardware wallet or you use Google Authenticator you some other mechanism for 2fa and and that's something to keep in mind if you're building in this ecosystem is that every single one of your users especially right now or high target right they are at risk for being attacked or hat and you need to prioritize the security and the safety of your users not just your usability and then just PSA you guys all have Google accounts please go secure them and don't get hot okay so we're almost done I talked earlier about one of the biggest mistakes I've ever made which was this sort of account mechanism where we were just spit out your address and people wouldn't back it up and you know it was it was a mess and it was it was painful for me to watch that loss and everything but this is like one of my biggest mistakes ever and it had a huge effect on not just me and my company and my users but everyone in the ecosystem because people started following sue we allowed from the get-go people to enter their private keys or their keys or files or their mnemonic phrases other see phrases on our website we actually encouraged it that was the flow you created a new wallet it could be your private key you unlocked your wallet we their private key you sent your money around that was it the problem with that is so let's go back in time when I first got in crypto everyone said don't ever put your private key on website and I was naive and I assumed that meant because the creators of the website would steal my funds at some point when I created my own website I was like hey I'm not gonna steal people's money therefore it's okay if we have people put their private keys on our website and was that was just wrong right because the attack vectors are not just a website owner stealing funds the attack vectors are the user isn't on the correct site they're on a phishing site they're on a scam site they get in the habit of entering private keys on web sites all over the web or DNS could be hot too BGP could be hot the internet could be hacked I could be hacked you could be act like there's all these different things and we did a lot to try to educate people we basically we added so much friction to the experience and we really yelled at people and we told them don't use this method don't put your private key on our website check these boxes acknowledge that you're being unsafe this isn't recommended we created this atrocious 10 freaking page modal that you had to click through and it forced you to click through and the buttons hopped around and we were just adding friction left and right and the reality was is like you can yell and shout and stomp your feet all you want but the user is always going to take the easiest path and if we allow people no matter how much friction we add to use their private keys on a website they will use their private keys on a website and it will eventually at some point result in loss so we've removed private keys from websites if you go to our current site right now when you try to unlock right now and you try to do this we explain to you yo this is not secure we're not letting you do this anymore download our desktop app right we push people down this alternate path and and we don't have analytics but if we did have analytics this would be painful you can started be watching people drop off right here like it's just insanely large right the numbers would be like you know 100 people arrived and like only 25% continue on and that's painful from a UX perspective that's painful from a product design perspective you want to get those numbers up but the reality is is that if we allowed people to continue doing this unsafe thing people are going to lose money period and so even if I'm losing some users because they're unwilling to click the button that dollars the desktop app I'm ok with it because at least I'm losing losing users I'm not having those users lose money I always want to lower the barriers to entry I want to make this as simple and frictionless as possible by unintentionally by allowing our site and even recommending private key usage on our website I inadvertently created like heaps of phishing websites heaps of scam websites registrar's getting hacked BGP which is like the innermost depths of the internet it's like how the internet works like hackers are attacking that to get my ether wallet now all these things because we put private keys on the website we put mnemonics on the website we put key server files on the website we seize on the website and all these other websites do it as well so it's not just our site it's all the sites it's all these scam sites all the phishing websites and people will just sort of copy and paste willy-nilly wherever it is and so this is again not philosophical not complicated if you are building adapt if you're building a user experience if you're building a product in the space I urge you do not allow people to put private keys or mnemonics or key store files or other seeds on your website create an app do a Chrome extension use madam asked use trust wallet like some other mechanism the hardware wallets they're great like I eat any of those but the reality is is that if it's on a website you have to trust that the website is the same the website the code is the same as it was yesterday as it is today you have to trust that the register wasn't hacked you have to trust that the internet wasn't hacked you have to trust that the users on the right website you have to trust that nobody's scamming you there's all these different things and the easiest thing to do is just eliminate that and focus on actually building your product rather than everything that we did for so long which was like oops design pretty onboarding modal's to try to force you to be safe like just let's just be safe by default right all right so I've got three minutes left we're gonna move fast I'm sorry why have we learned what are the glorious huge takeaways from everything that we've talked about today first do not underestimate the people using your product okay your users are talented they are smart they are intelligent you can educate them you can teach them they can get into crypto because of you and your product but they are also really really really good at screwing things up don't underestimate them on either end of a spectrum and be prepared for everything next people will always always take the easiest path if you allow them to not backup their private keys or to just skip some other of their other piece that they need of this puzzle called cryptocurrency they'll take it and they'll skip right over it and it will eventually have a negative effect on your product and your reputation and their experience and all of that education it helps a lot I have been like really like constantly applauded for my work in sort of the education sphere and I'm telling you like it go it does it helps a lot if you really nail copy on education if you're really nail like little helpful tool tips and stuff it does immense things for your user base but it really only goes so far like we saw people always take the easiest path and so you know the education if you find that your educational sort of materials start being angry and start yelling at the user it's time to take a step back and say hey how can we just build something that is secure and is safe by default because it's obviously telling these or yelling at the user or making onboarding modal's isn't working anymore and learn from others mistakes so work together talk to each other listen to this talk read articles about bad things that happen in this ecosystem study them and do your best to not repeat history which goes hand-in-hand with be really really mindful of the attack vectors out there again this space this whole block toon cryptocurrency world is it's really different okay it's like everyone's used to undo buttons everyone's used to you know being able to be a little bit lacks the reality is is that the ROI that attackers got for stealing a private key is so high that they will do almost anything to get into your website or your app or your back-end infrastructure or your hot wallets or whatever it is and always consider the sort of the best case worst case that game that we played earlier where we say what's the worst possible thing that a user could do or the worst possible thing that could happen and what's the best possible thing it's not gonna happen and how do we sort of you know find the right balance and I just want to remind everyone that building the decentralized future is really really hard and this is why it's so important that we all work together and we all learn from each other and we all build each other up and that we all individually strive to be better and we push those around us to be better we want to make sure that whether you're developer in this space whether you've been in this space for a year or two years or five years or two months it doesn't matter everyone has their role to play and if you're seeing another developer in the space that sort of may be making a lazy choice or not thinking about something even if you're just a normal person who's reading Twitter you have the ability to ask questions and to point things out and to questions people's choices and I still to this day read so many of our support tickets and so many of our Twitter jion's that our Facebook messages and all of the above and I always always always cherish the ones where people are questioning my choices and are pushing me to be better because sometimes honestly I just didn't think about something and being aware of that is half the bottle because then I can fix it and then lastly building together makes building this a centralized future a whole lot easier okay we can't the space is too small to have real competition yet okay we have to all work together build build this as this whole ecosystem up and we we need to think about it as US us being everyone in this room everyone watching a livestream everyone on crypto Twitter verse the world and the world is the world out there that doesn't even know what cryptocurrency is and has no chance of using it we cannot be fighting with each other we cannot be instigating Twitter drama we cannot be dealing with these little tiny pieces of [ __ ] we need to be looking at the big picture and the world out there and conquering it so I've met with a lot of people at Def Con and I've been noticing this little trend of people that are like one foot in this ecosystem they're like I kind of want to go full-time but I'm not going full-time and I don't really know what to do every person has the ability to make this ecosystem better okay it doesn't matter if you don't know how to code because we need the people that can write copy that can design that can make the experience better we need the people that are the mothers and the daughters and the grandmothers and we need the fathers and their sons and we need people from all over the world that have all different backgrounds that come from different experiences that come from different upbringings that have gone to different colleges because in order for us to build a global ecosystem that anyone in this entire world can use the people building the ecosystem need to reflect that world it cannot just be one demographic of people it can't just be the technical people it has to be everyone so if you have one step you have one foot in I need you to step all the way in I need you to think about your unique skills your unique experiences and I need you to figure out what you can do to make the ecosystem better and then I need you to email me at jobs invite crypto calm because we are literally always hiring and thank you so much I'm Taylor Monahan from my crypto I love you