TL;DR it's high time we thought beyond the simplistic binary choice of centralized services vs self-custody for storing crypto, and found new ways for users to manage their digital assets securely and easily.
You're woken in the night by an insistent tone from the screen at the foot of your bed. At first you assume it's a test siren for another firestorm or Belgian drone strike, but then you remember: The Fraxel XX is dropping today, and you've got white list.
The mint window opens and you buy your NFT by gesturing funds from your pocket—where your pocket would be, if you were wearing clothes, anyway—to the image on the screen. (Because it's a trusted address you use to buy a new device every three months, per government guidelines, no further authorization is required.) For a brief second, you consider flipping it for sick gainz on OpenBlur, but instead redeem it for the physical device with another gesture.
Annoyingly, the drone delivering your new device takes almost 20 minutes to arrive, and you've long since destroyed your last one in frustration by the time it gets there. Five years ago this would have presented you with a major headache, forcing you to dig up your private keys from their hiding place embedded in a block of concrete buried in your grandmother's rose garden. But this isn't the Dark Ages any more. This is 2028.
Ruby's "DeFi In The Future" series is an attempt to look past the noise of the crypto sector and figure out what the signal is telling us. In five years' time, we know the blockchain space will be very different. Here's our attempt at describing how.
In the first blog in the series, we looked at how new forms of collateral, including real-world assets and NFTs, are set to on-board trillions of dollars of new liquidity and provide new options for users to manage their finances. The second blog explored the relationship between CeFi and DeFi, and how each would ideally stay in its own lane, with stablecoins acting as a DMZ and interface between the two.
This one unpacks the problems of private keys, and how control of our crypto might be handled in a secure but user-friendly way.
Centralized Systems, Centralized Problems
In our last post in this series, we looked at one of the major problems with CeFi. Viz, that it goes full Gollum when faced with any form of value. It wants it, it needs it, it must have the Precious.
The other deal-breaker for CeFi is the single points of failure it unavoidably relies on. When it interfaces with crypto, that poses a serious issue, since allowing CeFi to control your tokens obliterates the blockchain's #1 value proposition: Decentralization.
Decentralization isn't just a useful property of blockchain: It's the critical innovation on which the whole nine yards of all the other benefits are built: Transparency, security, immutability, censorship resistance, self-sovereignty, and trustlessness.
Centralizing one element of a decentralized system—à la FTX, Celsius, BlockFi, Gox, etc—doesn't slightly centralize it. It just centralizes it, period. (You can make a system more decentralized, but a single point of failure is a single point of failure.) Given that Bitcoin was launched with the aim of removing all forms of centralization, Satoshi—wherever and whoever he/she/they are—must be grimacing.
CeDeFi can work perfectly well, of course, so long as you're willing to play the TradFi game. There are plenty of CeDeFi services that have not suffered the same fate as BlockFi and Celsius, but running a platform that way requires trust from users, and competence and integrity from providers. These are things that:
- Crypto users don't like to give
- CeFi corporations don't like to provide
TL;DR CeDeFi is essentially TradFi, and users should engage with it on those terms, or not at all.
Absent extensive TradFi-style regulation and guarantees of industry best practices, the alternative to writing off your "investment" as a gift to the latest crypto bro grifter is self-custody. However, as things stand, that means getting your head around private keys and handling them safely.
While that's currently the gold standard of crypto ownership, it's something that even experts (including Bitcoin core developers) don't always manage flawlessly.
The Problem Of UX
One of the big problems with current DeFi platforms is the Geocities-style user experience.
Think back to 2014. When you found a new coin you liked, you had to download a new "Qt" client and sync the blockchain for a few hours or days before you could make a transaction—assuming you weren't stuck with a command-line interface. Web apps and lite clients were a new idea, and even they weren't super user-friendly yet. The idea of a mobile wallet was like Hunting the Snark (in Lewis Carroll's original sense of the search for a mythical animal standing for an impossible-to-achieve goal, rather than in the more recent and blockchain-specific sense of trying to find a Succinct Non-Interactive Argument of Knowledge, which is only impossible if you don't have the private key).
DeFi now feels a lot like that. Getting to grips with MetaMask, interacting with decentralized applications, bridging tokens to new protocols—these are not things we can realistically expect the majority of users to do, ever. The geek is just not strong enough in most people.
CeDeFi was an attempt to on-ramp the large number of users who were interested in the concept of staggeringly high returns, but uneasy about handling the tech. Sadly, they completely sacrificed the core benefits of blockchain in the process, just like they relied on centralized exchanges like Mt Gox, and later FTX, to store their crypto.
Creating better UIs is a part of this, and we'll get there, just like holding and moving bitcoin is now possible with a user-friendly mobile app rather than a cumbersome qt client. (While we're on the subject, take a look at Ruby's new website sometime.) But a part of the deal-breaker in the blockchain UX is more fundamental.
Private keys, the clever bit of technology that enable you to be your own bank, can also be a huge problem.
Not Your Keys -> No Keys
Consider, for just one second, the irony of the security of funds held by a user in a decentralized protocol being entirely reliant on a single private key.
Private key management is almost certainly the largest pinch point for regular users, along with the broader implications of being self-sovereign, aka full responsibility for everything that happens, good and bad.
We're going to need better solutions around this: Platforms that don't require users to put all their eggs in one basket, whether that means managing their private keys solo or giving up control of their crypto to a third party.
Providers like Argent have already done great work in this area, with a non-custodial wallet that does not use a seed phrase. Instead, Argent uses multi-sig and enables "social recovery" through guardians—people, devices, or accounts—that help maintain and manage security but do not have access to your assets. For example, a guardian account's approval might be required to authorize a transaction to a non-trusted address, or to recover a wallet in the event of a lost device. This is user-friendly but also absolves the user of being fully and solely responsible for their account.
Technologies like multi-party computation (MPC) enable users to transact from joint accounts or with 2FA devices, without any one of them holding the entire private key, or leaving a trace of which devices/users signed a transaction on the blockchain. This would allow, for example, a user to submit a transaction from a TradFi platform but approve it with a separate device. MPC is already routinely used by crypto custodians like Fireblocks and Qredo. Meanwhile, ZenGo offers a consumer MPC wallet that requires all transactions to be authorized using two "secret shares": One on the ZenGo servers, and one on the user's local device. Accounts can be recovered from a file stored on the user's separate iCloud or Google Drive account, with their email address and a biometric (face) scan.
"Not Your Keys, Not Your Coins" has been a rallying cry for the crypto community to pull coins off exchanges and self-custody them. That was a fair response to the incompetence and dishonesty of Mt Gox, FTX, and many others. But now, crypto adoption is at a point where we need better nuance and a greater breadth of solutions than these two extremes.
Your new Fraxel XX beckons you seductively from its nest of velvety packaging, a world of possibilities embodied in a sleek obsidian rectangle. You chuckle sagely at the naïveté your younger self displayed in thinking the Fraxel XIX represented the very height of aesthetics and technology. Compared to the Twenty, that thing's an Etch A Sketch.
You recover your DeFi wallets in a few moments, adding access to your new device using secret key shares obtained following brief fingerprint/facial/DNA analysis, a call to your best friend, and a conversation with your favorite AI, uh, "buddy".
Since you've saved yourself a few Salvadorean Bukeles (SBK) on your new phone, you also ask her to invest it—she has many talents—in the best medium-term farming opportunities. Then you borrow against the collateral to fund sundry cognitive and other enhancements as a "thank you". After all, AIs are (legally, anyway) people too.
Follow us on Twitter, join the discussion on Discord, and subscribe to our blog for regular updates.
