Usable Security in Web3 by Antonela | Devcon Bogotá

foreign [Music] is redefining the level of control people have in ways that was deeply different and how this had been done before not only that well 3 has started with literal Financial value even though this is an empowering proposition we see how meaningful has their money compromised every day I'm Antonella I do block security at metamask my folks are there before that I will let the user experience team by the tour project for half of the decade deploying privacy and Hyson technology is not a crime wallets can be a lot of things we can Define wallets as a container of private keys and their system affirmations to manage them every time a dove asks the wallet to execute a transaction the wallet is asking the user to confirm the usage of this case Dan Finley and Eric Marx made a beautiful definition wallets are built around the responsibility of myriad in the the interactions between untrusted applications and users keys on the computers getting appropriate consent from the user if we map a thread model of a non-cotiller wallet like metamask we will discover that the two more important assets that we have at stake are a pair of keys and the permissions to use this keys this talk is not going to be about very Keys it's not going to be about artifacts to protect this privacy like Oh see it's phrases passwords fast prices or attacks or that today I'm going to talk about permissions and I want to talk about permissions because permissions is the elephant in the room usability topic Dev foreign users in this ecosystem there is a lack of Interest or protocol level on how protocol decisions affects everyday people's lives and the responsibility of giving users the chance to understand what they are giving permissions to falls on wallets when we talk about permissions we talk about an invoker requesting a wallet access to certain user information it can be different depending on what the rehab is prompting the user to do during a connect flow for example the rehab is requesting access to users public skills the address to be able to push requests in this way and this is the user-facing interface on how the request looks on user's computer I'm sure some people has been facing these screens before the wallet is making an epic effort to expose and Trust information in a secure environment in a legible manner so the user can consent to execute or not this transaction we do things like treating childish and treat analysis human review we have a lava mode for preventing supply chain attacks you should check out on kumari's talk from yesterday we have fishing detect block lists to Medical efficient attacks our vanity program and more people who work on security knows that this is called elastic security or Security in that but this is not enough to enable users to consent in transaction and I will stop and I imagine that some people is questioning why we are talking about consent in a usable security talk and Friends because they are not secure systems without consent consent is the radical idea that one person must voluntarily agree to the proposal of the size to another thinking about this why Building Technology he still gives a feminist perspective to active concern to apply it to their social information system that we work with every day these are not my ideas these are ideas that came in the backbone from the feminist principles of the internet for open human centered design processes basically when we talk about consensual technology we talk about having control over our digital bodies which of course include our data and for sure our money so how a transaction based on concern should be a few people has been thinking about this they're finding a framework on how to approach a consensual way to having interactions I really like the five principles defined by false uh Alien media you can check this and more in the website it's called senseful touch.io good consent is freely given is revocable it's informed it's enthusiastic and it's specific and what we mean by all these things the fact that the consent is freely given puts the person in a position of doing something with another that should be made without pressure with force or manipulation anyone can change the mind on what they do at any time trust is not forever this is why transactions should be revocable people should be able to understand what the trade-offs are of this decision people should be able to read what they are going to consent to people should be able to comprehend what is going on consent should be enthusiastic if someone is not excited or really into it that is not consent consent should be specific saying yes to this now today here in Bogota in October doesn't mean that I said yes to other things so we started questioning our interfaces and how they can become interfaces that could enable people to give real consent the use of a security design question that we put over a table with our teams with designers with developers with project managers with people working on metrics with people working on communication if we build a transaction flow grounded in concerned how could it look like um you spoke and we are listening we read social media we read the forums we read and we are working hard on improving our confirmation screens even when new transactions methods are being defined right now in other rooms on protocol level without considering how to expose users to a consensual interaction let's see the case of approvals to allow a smart contracts to interoperate tokens and provide a better user experience what interacts with that in order to perform operations that require interactions with a man contracts like minting stacking swapping users are first required to permit the invokers more contract to transfer a number of tokens on their rehab sometimes the dive required improving this infinite amount of these tokens even if the user trust it up it could be problematic this is our current tokens allowance screen we have the original mind requesting this transaction we have the contract explicit who is asking for this interaction but the point here is we don't have allowances in the first screen of this flow and we have been working on that and we iterated this this new UI aims to empower users to the final allowance that they want to give to the lab we split the flow into we now have gas fees in the second screen which was something that people was looking um too much on the first version and now we have a specifically who actors are interacting in this transaction we are allow users to verify contracts we are making explicit which assets are being transferred we are adding friction to warn users when the site is requesting um the entire collections on a MSC to be transferred users can yeah I say that before can verify contract details and more things echo in on what Taylor said this week we should be responsible of what technology we build we should be there which will technology that we expect people as developers as wallet developers we have the responsibility of critical thinking about how to expose users to give consent to a decision that directly affects the digital values and these allowed us to explore opportunities to design the centralized technology that respects people but practicing open design methodologies balancing security and usability it's complex we do a lot of complex things here these requires inadequate thread modeling the possibility of including people in your development process [Music] and trying to understand people's mental models too much with the flows that we propose as a facilitator of consensual transactions we are trying to generate more Open Spaces to discuss ESL Security in the decentralized circle if you are a product if you are a designer if you resonate with this you can find me I will be happy to talk about this if you are a security researcher if you are a hacker if you want to punch our services we and get money we have a hacker one program in place hackerrone.com metamask if you are a developer and you have ideas on how to improve metamask you want to extend it you want to connect your API to metamaski expose in a metamask UI you should check out meta multiply IO slash snaps and edit stocks from yesterday I personally believe that there is a long way to go to rethink how the information systems to which we delegate trust interact with consent this is an open call and I invite you to think about that with me thank you very much Antonella and we have several hands up we are going to start here but we have to there oh we have a lot of questions Anthony hi uh super presentation thank you a quick question the UI that you presented is there is a date when they're going to be released we are working on that uh later Quarter Two quarter four uh yes yes you can we work in an open environment we have a GitHub repository so you can check stuff next question we have some one two and three hello hello um thanks for your talk uh and you presentation is told that as a security researcher you have to do balance between user experience and security how do you draw the line of saying the issue is supposed to know the thing uh and I have to teach the the user that did you think that happened now good question um I don't think we are here to teach users I think we are here to inform people to make informal decisions on the balance between how much information we show in our screen and how this information resonates with people and also the time that happens between the people make a decision and read may vary and change I think that is the most fun part finding this balance I think it's super important also to work with users if you have a product if you are building a pro a product whatever you should have users in your development process so you can expose users to your product early and you can get feedback and that it's so rich because you have people using your pro before your life or whatever so that'll answer your question a little bit there is one two and three and four we have time okay so and I see the fifth here please thanks great talk it's part of the your definition of consent uh you you discussed uh revocable and uh you know where does metamask or the ux fall with revocability and helping the user know that they can revoke or what what they've given consent to in the past beautiful it's a protocol issue it's not our problem now we should work together on protocol level to make sure that I mean to comprehend that we are human and we can make mistakes and I know that Rick vocability is like a Hot Topic in this space there are a lot of ideas on how to make transactions revocable you can do things like I don't know having a space of nouns in the middle and you have a certain time that you can revoke and stuff they are smart people thinking about that um but yeah it's it's an open question hi great and great work using is consent how do you think two is possible to handle a psychnic message concern specifically when we sign some structured information on metamask you will see an adjacent that is really hard to understand and there's been a lot of hacks lately based on on our erc20 tokens able to permit user to sign message in order to allow for transactions so it's very hard for a user to know if you're approving uh genosis multiple or giving permission to someone to spend your tokens on your big house have you thinking any kind of mitigation for this problem on metamask there are a lot of initiatives they want to make transactions readable they are you know I mean I remember five right now but there's a lot of people working on that I think it's the next step for big adoption should we having transactions in every double Manner and I seek companies making their own versions of this we should aim to have a community level consensus on how we are going to expose these two users I think it's like it's more powerful if we were all together then if a company says that they are doing clear singing or something like that so yeah I think it's a work in progress and I hope you are willing also a solution for transactions uh to be real hi uh thank you so much for our presentation today I feel like I learned a lot so uh one question I just really want to ask is uh about metamask product design so I as far as I know initially melamas didn't want to launch the swap function and you know on they launched a swap function I just wanna I just feel like uh in the current space the switching network is really you know a significant problems that in you know improving ux I just want to ask more about what's the future plan on Madame mask about this interoperability issue and uh does metamask having plan to solve this network switching problem yeah amazing question um I can open my computer and show you our designs after the talk and we can discuss it we are working on network abstraction it's super interesting because super early in the moment right now and the options are infinite like I don't think the version we are going to ship first is going to be the best one but I think it's something good that we are going to iterate and we are going to learn also how people is using different networks um we are thinking we can talk in our about it but yes please find me and we can discuss like how the research knowledge hi I actually have two questions if allowed but one is a follow-up to the question before last about signing um and permissions and how those interact and even where they are readable if there's one particular thing that's being asked for over and over and over and over and over again the user will get alert fatigue and just be clicking and to avoid that I was seeking to have a permission for that particular thing that gets repeated many times and uh was here for the hackathon last weekend and wanted to use made a mask snaps to make that easier and was told oh no I actually made in my Snaps doesn't support working with the permission system to do that I was wondering if there are plans to allow snaps to work with the permission system in the future uh to follow up on that good question I think the most powerful thing about snaps is like the list of formations we have available right now it's not static it's something that is going to grow in the future so I'm not uh here to say when but that may be something that is in the pipeline and the other question was you showed earlier some designs where you were making it clear that like oh you can set a limit for how much of a token a particular dab can be authorized for and you have a line in there like oh you can raise this limit later but you aren't telling people that there's a cost to do so it's like a financial cost of doing so later and I think that that seems to undermine this idea of consent a little bit because you're not telling people that there are going to be costs if they want to limit things now and then add it later do you have any thoughts about why that decision was made to obscure that I agree um we we are not exposed in future cost of the transaction and maybe something that um could be part of some documentation on user-facing education material or something like that estimating how the thing is going to cost in the future it's weird and but I don't know maybe something to explore thank you for that question and the last one hello yeah thanks for this uh great presentation it's really insightful and so I have a question around the of the fact of give it consent you mentioned that um it's quite complex because it's either you give too much permission and you fall into like an area where it's dangerous as a user or you you give too much restriction and then you hurt the usability of a user because the user then cannot do that much what's your opinion on that like how do you find The Sweet Spot of a right balance like this right area where it's not too risky but in the other on the other side is not too unusable the equation um it's it has different parts first you should have an interdisciplinary team working on stuff because it's more powerful you have more views when people when building something for people then there is something very strong having enough meta mask right now and is the fact that we are building approach for the entire world put us in a position to hire people from all over the world so basically we have people working everywhere and this is powerful because you have people sitting and tables making decisions that have different biases mental models this is one part the other part is talk with users I think talking with users is um it's so insightful you are going to discover things that you even imagine in the first second three rounds of user testing so the worst team users first and try and iterate I think the finding the balance is the most fun part of being working on this thank you very much we have time for one last question in Spanish can be also if not in Spanish if not muchas gracias santonella yes I'm