The UX of user consent -- permissions and self-custody

Captions as YouTube publishes them, usually machine-generated, so product and people names can be misheard.

1. 0:08

   all right this works thank you so much for the intro um this is a perfect audience for first time talk I'm giving Which is um how does user consent get had in web 3 and specifically the ux of consent and the way in which permissions basically all around us um so as an intro I am Henry Stern I'm one of the co-founders of privy and um this is something we spent a lot of time think about so I'm excited to chat about it um I'll start by by talking about you know why I think this is insanely relevant to

2. 0:40

   the work that I do on a daily basis so privy is uh a toolmaker we build onboarding tools so you can get any users on chain very easily regardless of whether they're very new to crypto and they have no idea what crypto is or they're very deep in the weeds and I think our point is a user is a user regardless of how they come in and that means being able to onboard them in a way that's most natural to them so we

3. 1:03

   build embedded wallets we build uh connectors and we build basically user management tool behind them and it's up to apps that use us to sort of mix and match these in the way that fits the user experience that they want to build the best um and so accordingly a lot of our work is about abstracting away complexity on behalf of users and here I'll just kind of show it you know users come in all shapes and sizes and we

4. 1:28

   think it's really important to meet them where they are so there are three screens here um one is uh from a fantastic app called Blackbird which is building a restaurant loyalty program whenever you check into a restaurant you can tap your phone against a puck and you can basically earn uh rewards in the form of fly and an nft sh that you've been here um the second is from Zora which makes uh minting assets insanely

5. 1:53

   easy and helps creators basically get their art on chain and their Creations on chain and the third is from hyper liquid and the maybe thing that all of these folks have in common is that we have worked with all of them in order to enable very sort of natural ux for their users but obviously the ux that you expect from somebody coming in to trade per on chain and somebody coming in to eat at a restaurant is insanely different and so the question for us is how do we make sure that in spite of

6. 2:24

   this sort of Mantra user a user and hopefully all these users have keys they remain in control of the experience um so that's I think really what permissions is all about at its core um you know the question is how do we get users where they want to go without exposing them to needless complex interactions along the way with the understanding that complexity is different for any given user definition

7. 2:50

   of one user's complexity is part of another user's product experience you know being aware of a multi-chain world is very useful in this world and it's completely use useless in that world and so we need to build systems that are flexible enough to account for both ends of the user Spectrum um so with this I'm going to talk about three main things first the core tension behind any abstraction behind permissioning systems today second what I'm seeing in the space

8. 3:16

   today that gets me very very excited about the work going on in the permissioning world and sort of abstracting away that complexity from users and then third where we go from here and why I'm so excited to like be talking uh to all of you guys because I think the work uh that's being done is uh is insanely important and honestly uh very easy to forget about unless you have proper activation energy to actually

9. 3:41

   standardize the work going on here to create a sort of uh maybe post chain world is the way I rephrase it um so first the problem with abstractions at a high level abstractions create intermediation and intermediation to some extent implies trust trust in a system Trust In A Product Trust in organization and trust is a good way to mean that like things can go wrong and so you have here two screens for metamask on the left is a raw signature format on the

10. 4:10

    right is a sign in of ethereum format um this is a form of abstraction there's been a decision made here that the important information can be pulled out in this format and with it you're drawing the user attention to particular parts of the signature so it's a lot more lendable and I think we still have some ways to go um but it also creates risk because maybe if you're clever you know you kind of need to scroll down here you can tuck away some information

11. 4:33

    under the fold get your user to approve something they didn't mean to approve and basically uh fool them into granting you fa faulty permissions um so uh the main point I'm trying to make is uh I think it is just a fact that abstractions strip users of some Power by abstracting away the raw medal you are making decisions on their behalf and that implies some version of trust and

12. 4:58

    you know why does that matter well there maybe three layers to this the first is unintended consequence uh let's say I give a permission to a system to trade on my behalf with certain limits uh maybe I uh forget to change those limits maybe the market changes out from under me and I end up making a very bad trade because the fundamentals have changed without my intending to do so uh the permission system worked as intended but

13. 5:22

    maybe the permissions weren't expressive enough to get me to do what I actually meant to do um the second is suboptimal outcomes uh by abstracting away for example the layer below the settlement layer um I'm making decisions as to what the settlement layer is and maybe there's some me Searchers in that settlement layer and maybe I'm exposing my users to faulty prices because they're being

14. 5:45

    front run and I'm doing that in exchange for stripping them away from the complexity of having to choose that themselves so it's a trade-off that they're making and trusting me to make that decision on their behalf and then finally probably most obvious and scariest is militia's Behavior Uh what if a evil app what if an evil client what if an evil tool wants to rub your users and what if they basically do some

15. 6:06

    version of pig fattening where they get them to give more and more permissions until it's time to rug and you can do this uh all inone go so I'm saying this not because I think there's no way out but because I think the constant the attenion is constant and I guess in my mind it's really important that we embrace the fact that permissions will always be faulty because abstractions

16. 6:28

    will never be per perfect the system evolves and I think it's a little bit ludicrous to think that we're going to cut to some perfect abstraction that captures both things Upstream from us the apps that are evolving every day and downstream from us The Primitives that are changing just as fast and so I think we have to build in a world in which we know that permission system will only capture some portion of user intent and we have to build the safeguards that

17. 6:51

    allow users to basically uh get right when permissions failed them um there's probably my favorite piece of writing in in computer science overall is this this paper called uh Reflections on trusting trust by Ken Thompson and he sort of talks about how you can never be sure that a program does what you think it does you can read the source code sure but maybe the compiler injected some hidden bug in there you can read the

18. 7:15

    compiler Source coach sure but there's a way you can bootstrap a compiler to sort of Auto inject that bug in an invisible way and it kind of devolves into unless you're smelting your metal and making your own chips uh you should not use anyone's software anyone's Hardware if you don't want to trust and so I think we're starting off with an Insight which is even in web 3 even with trustless systems um you are still picking where

19. 7:39

    you want to get trust it's just a question of understanding uh where that trust goes and I think uh if we can assume that permissions break down we can actually build secure systems in spite of that fact cool so I will take a step back for how I think about permissions in helping uh developers build with privy to me It Gos down to scope how much power is given to the system interfaces how do we present options and what options do we present to the user and Escape hatches

20. 8:11

    what do we do when the permissions break down and how do they escape this really pleas out on two battlefronts in my opinion at the very sort of bottom of the stack which is to say standards and at the very top of the stack which is to say you um I am already long so I'm going to skip this slide and move to getting concrete so where are Provisions today what am I seeing that feels like very very interesting uh experimentation in the space that allows me to kind of align on where we are so I'm going to go through four cases

21. 8:43

    basically what I think are very interesting experiments around permission system that kind of show why this is a complex space and I think again these are all systems that benefit from the type of standardization that's being pushed on us here today in that at the end of the day we need standards in order to build trust diff users in order to build systems that can be audit it um

22. 9:00

    so the first is phantom phantom has done awesome work as a wallet to try and push the ux so what's possible with an EA System and they have this feature called autoc confirm autoc confirm basically lets you pick apps you can go in your settings and you can turn on autoc confirm over here and basically make it that after you approve a first transaction for 2 hours you don't need to approve anymore it'll autoc confirm for you while you're on this uh smart

23. 9:24

    contract site um they did this I think in really cool ways and they're uh maybe four that I find interesting and worth remarking upon the first is um it's not completely open to begin with they pick basically six Partners whose smart contract Suites they trusted um in order to do this so this allows them to push the ux forward without taking a risk that some Ro partner basically makes an

24. 9:47

    upgrade their smart contract you know that should feel weird in N of itself and then uh rugs their user after the permissions been given in 2-hour window the second piece is they built in the fenses they use Blowfish in this cas um to do transaction simulation on any transaction that runs through and make sure that if anything un happens they basically get to yanked the permission immediately and act as an Arbiter and

25. 10:11

    then finally they default expire the permission after 2 hours and again I think this type of scoping in not trying to make it a foolproof experience that works forever under every use case but starting bite-sized allows us to actually take risks with the type of ux we can present because we're scoping uh to to you know a pretty known problem space and again this is fully opt in so it's not turned on on your behalf in Phantom you have to go and look for it

26. 10:37

    um but I think it's an interesting view where the future might go the flip side of the coin here which I think is really interesting comparison is obviously uh session keys in AA systems um so here I pick zero def I think they're building great smart account Suites um but the reality is a number of players basically are building out session keys with essentially the same prise they're really I think two four pieces the

27. 11:01

    session Keys one is enabling you to uh batch transactions quickly so you don't have to make individual clicks and U enabling you to uh have more sort of complex and intense expressed at the Smart contract layer um so I look at this and I'm very interested in basically how composable and programmable it is you're no longer bound by a single company setting up these permissions you actually have a

28. 11:26

    smart contract speed that anybody can take a crack at and audit that does this for you but then again the problems remain a hold specifically around the ux so this is fantastic from a standard stand view point ux remain complicated how do you actually show this to the user where does the user go to get recourse if uh they decide that they actually gave faulty permissions to the system I these are all questions that as we think about permissions in

29. 11:49

    the space it's really important to think about them as endtoend problems let's not stop at any single layer in the stack let's try and play it out all the way that the end user L topping buttons on their phone um the third use case or case for this that I find very interesting is foraster frames um so frames are really an extension of the open graph standard that inals simple interactions for folks scrolling through a feet basically you can drop something

30. 12:14

    in and you can interact with complex systems um through basically a handful of buttons in the screen um now obviously The Logical extension is to try and move them so that they can move uh onchain items so that there can be transactions done through chains uh through frames and obviously that implies huge danger CU you don't expect when you're moving through you know your foraster feed or worldcast feed as it were uh that you click a button to like something and you've just lost the entirety of Your World contents and so

31. 12:45

    the question of permissions here is absolutely whole we've unlocked fantastic ux but that ux only comes together if we have a permissioning system that's Nimble enough and robust enough to actually sort of make good on this promise of ux it's very easy to get ux if give a about permissions um and it's very easy to lock down a system if you don't give a about ux but getting both right is really important um the three things I I'll I'll talk about here that I've been impressed by

32. 13:10

    the first is the extremely rapid way in which the warcast team has been able to move towards standardization uh within a matter of weeks they basically um put out what is now basically a standard that people can comment on they're basically pushing the standard via a single client implementation workast and then hope it will be a standard that's available to every client building on the protocol and so I think this is maybe an exert in

33. 13:34

    favor of bdfl ism I think any protocol Builder should probably have a default client that they build with or build for in order to make these trade-offs really really Concrete in user terms um and then you know what does this come down to it comes down to questions of UI and block list this is a screenshot from the actual sort of spec that they put out talking about how do we actually display what's going on to the user so that they

34. 13:57

    can know what they're doing on Chan finally um I'm going to show for just a second and a half I think the most exciting thing that we're likely to do in 2024 on our end is build a global wallet system so what does that mean embedded wallets in in privy today are app specific and that was a very intentional decision we made when we launched which was knowing ux better ux implies uh tougher permissions we were like let us scope the problem down so that if there are any issues the uh

35. 14:27

    spread of damage is limited to a single ecosystem into a single um so we've been running this system for about a year we have really good data on what works what doesn't ways in which to improve the us and we now feel ready basically to open it up so that if you sign in in this example to Blackbird but you already have a FR Tech or fore ERS or a wallet you can actually come in here and get your assets working across apps um I

36. 14:51

    think if you give away operability in using web 3 you've kind of given away half of the point of these systems to begin with um but again this is really complex provisioning work and in a sense this is us becoming a PO policy engine behind the scenes um the one thing I'll call out here uh you know we're doing a lot of what I've called out as as liking from other folks for obvious reasons we're experimenting with select Partners

37. 15:14

    on this first to make sure we get it right we are pushing the most basic capabilities up front and moving towards more complex use cases we we iterating here um but through all of this we know this is going to be faulty and the first you know sort of interop little feature that we ever launched was key export which felt like an necessary launch item for us because we know that at some point the system will limit you one of the advantages you get with a better wallets for example is you were scoped

38. 15:40

    to a given chain what that means is if you send the wrong asset to that chain you can't really recover your assets in app you need to pop the wallet out and take action outside of the app and so this is Again part of the trade-offs or permissions inherent in the tool that you're giving a user there is a sort of implied permission set that you've given them so in that I think my three takeaways on how to build is one making sure we scoke problems down and focus on

39. 16:05

    ux two ensuring we have standards to make sure that these systems are inter are extensible and three um recognizing that basically any titer permission any abstraction creates an opportunity for silos to exist and so looking both at sort of the inter permission way of breaking out silos but as well as how you pop out of the permission system for the user so that power users can get uh

40. 16:30

    what they need is really important um with that I'm going to wrap up I think the core challenge for Builders today building in the space is there's a real draw to minimizing your app to restricting what users can do in the name of simplification and in the name of better products uh but obviously you're taking away from sort of the users's freedom to do what they want with the system just kind of the entire point of these open systems to be with and so balancing that tens between restricting what your app

41. 17:00

    can do and at the same time going whyde sometimes at the user's expense because you have to show them you know raw hex code which no one wants to read um is sort of a big part of basically where I think permission systems come to play ultimately permission system are the patch between basically the high level generalistic standard and the underlying product that gets built I am super excited to say that I'm into this this this you know into Denver probably as excited as I've been about

42. 17:33

    the the future for Consumer facing applications built on the centralized rails um it seems clear to me that like crypto as a money moving apparatus is here to stay um but I think it would be a disappointing outcome that that's all it was and I am seeing more signs of people building uh for new spaces that are more or less Financial I think some of them are very financial and that's great and I think some of them are only t potentially Financial that's good too um and we're seeing just a rate of experimentation amongst Builders uh

43. 18:04

    looking to cater to mainstream users that we haven't seen before um and in a sense I think grappling with these permission systems and making these problems very concrete is of the utmost importance in actually building value in the space long term because I look at the sort of development of core protocols I look at https or HTTP and ncape I look at the basics of cloud computing naws where I look at like and

44. 18:28

    distribution networks and aami the way these turned out is because they were built to solve very concrete problems um I I kind of like to think sometimes what if AWS had been built by say JP Morgan and not a book seller how would like internet infrastructure be different today um and so in that sense it feels really important to me that we actually build for these use cases today even if our permission systems are faulty and

45. 18:52

    even if they need to be iterated um we should make sure we scope these systems appropriately so that we're not introducing to much risk to the user and they have an escape hatch to break out of these systems when they're too limited but we have to build for these use cases today otherwise we will never be able to go for them um so thank you for putting this on I think it's awesome to look at this stack in this way and I I'm very excited for us to hopefully help create more standards around uh the

46. 19:18

    permission systems in designers and in midle wals thank you