Published On - June 30, 2022
Your Keys, Your Problem
Being the custodian of your digital assets has long been touted as a key benefit of Web3. If you are in possession of the private key that underpins your Web3 wallet (self-custody), no government or corporation can prevent you from accessing and using the funds in that wallet.
Why is digital asset custody important?
This is a good thing if you have a reason not to trust these organisations, as has been the case in many parts of the world where we have seen currencies collapse, or corrupt regimes seize the assets of individuals on a whim.
It also means that you are protected against hacks from custodial providers such as cryptocurrency exchanges, of which there have been a number over the years. At best, these exchanges make their users whole again, at worst such attacks wipe their businesses and their user's assets.
The challenge with being your own custodian or self-custody of digital assets is that it's hard to do right. It also forces users to use the relatively clunky wallet UX which is the current norm in Web3 (for context, when it comes to digital asset custody, there are private keys and public keys. We're focussing on private keys in this article). The lack of middle ground between using a custodian versus self-custody has been a stumbling block for years, but a potential approach is gaining traction which could change this, which I'll get onto shortly.
As any Web3 native will attest to, wallet technologies still have a way to go before they can facilitate mass adoption. Your mum or dad may have some cryptocurrency on Coinbase, but try explaining how to use Ledger Nano, Metamask or one of the other leading cryptocurrency wallets themselves for self-custody. Just as storing large amounts of physical cash or gold isn't straightforward, it's the same story with digital assets management, which is why most people just store money in banks, and their cryptos on exchanges.
Let's touch briefly on the basics of digital asset custody. Broadly speaking, there's two types of custody:
- Self-Custody: In self-custody, cryptocurrency owners are solely responsible for safeguarding their digital assets. This approach offers complete control but demands a deep understanding of security practices, making it more suitable for experienced users.
- Third-Party Custody: Third-party custodians are professional services that manage and protect cryptocurrencies on behalf of their clients. These custodians offer various security measures and expertise, making them an attractive option for those seeking hassle-free asset management.
When it coomes to types of storage for your digital assets, there's the option of cold and hot storage:
- Cold storage: Cold storage involves storing private keys offline, usually on hardware devices like hardware wallets or paper wallets. This method keeps digital assets away from potential online threats, making it highly secure for long-term storage.
- Hot storage: Hot storage refers to storing private keys on devices connected to the internet, such as online wallets or exchange wallets. Hot storage offers quick access for frequent transactions, but it is more vulnerable to hacking attempts.
Overview of current private keys landscape
We can unpack the challenges with self-custody, by imagining you have a very significant amount of your favourite cryptocurrency you need to store.
source: tenor
Given the amount at hand, you purchase at least one dedicated hardware wallet to store your crypto assets on. Your funds are now stored away from your computer. However, you still have to keep this crypto hardware wallet(s) somewhere safe, as it's probably only secured by a pin code. Are you ok with it being in your house? Or perhaps you want to use a deposit box somewhere?
In addition to the hardware wallet, there is a 12-24 word recovery seed phrase that needs to be written down when you first set up the wallet. This enables you to recover the wallet on a new device, should your hardware wallet become compromised. This seed phrase needs to be stored somewhere too. Given the seed phrase gives full access to your funds, you wouldn't want to keep this in a single place (it needs to pass the wrench test). You want to split it up and keep it in different physical locations. You also want to have at least one backup of this seed phrase in case one of the places it is stored is compromised — this could be due to an environmental event such as a flood or fire that is completely out of your hands.
source: xkcd.com
You may also want to consider the geographical distance between the different copies of your keys — perhaps you want a significant distance between your key's locations so it’s impossible for them to be recovered in a single day. You may need to fly to some of the locations. This is something the Winklevoss twins did to protect their bitcoin wallets, with them spread across multiple bank vaults in different US states.
Assuming you have appropriate controls in place, you may also need to ensure that the recovery process is possible without you. Maybe you have a spouse who would need to figure this out in the event that something happened to you.
By now, you should be starting to appreciate all of the nuances of what self-safe custody looks like in reality. There are still plenty of other topics you can take into account such as how you ensure there's no spyware on your machine and that you use air-gapped computers.
The point is that doing self-custody right entails a lot of hoops to jump through. This is why for the vast majority of users, it's simply not sensible to burden them with this, as once their keys are lost or compromised, they're gone for good. Paying for a custody service seems like good value given the overhead required to do it properly which we have just outlined. This could easily cost $1000-plus annually. However, there are risks with such an approach and you don't truly control your funds.
Exchanges are becoming wise to this by in some cases, offering insurance for their user's funds Coinbase offers £150,000 protection for each user account in the UK) which is similar to banking guarantees offered by governments in some jurisdictions, such as in the UK where the Financial Conduct Authority (FCA) provides deposit and savings protection up to £85,000 for funds held with banks and building societies.
This still falls foul of the utilitarian view at the heart of Web3 for most people, whereby they don't control their assets. But a middle ground is emerging which has the potential to appease both Web3 businesses and Web3 consumers in the form of semi-custody wallets. Semi-custody wallets use a technique called multi-party computation (MPC) where wallets can be split between multiple parties or devices in order to transact with a blockchain. A threshold is defined that sets the number of parties required to successfully perform a transaction out of the total parties storing parts of the key.
For example, a key could be split between a device, a user account and an exchange with a threshold of two. This means that two out of the three parties or devices need to be used in order to authorise a transaction successfully. In practical terms, this means that a user can have an MPC wallet they are in charge of primarily via their local account and device, but there is a backup party in the mix should the user lose their device or forget their local account credentials.
This approach ensures that they get the best of both worlds — digital asset security in part underpinned by an organisation adept at managing digital assets but also the flexibility to remain fully in control of their wallet.
The crucial detail is that the user controls the majority of the split keys to retain this control. It seems feasible that this approach could become the new standard for the management of digital assets, with Coinbase recently launching its own MPC wallet.
Whilst the MPC wallet is not going to prevent scam websites from trying to steal people's funds or replace the need for cold storage. It does leave me optimistic that combined with some of the other technologies such as hardware wallets, it could provide a far more robust approach to safeguarding these digital assets than what we have now.
There are still many challenges associated with solving the UX in Web3, but MPC wallets seem like a positive step forward for the industry, and if your average user no longer has to know what a seed phrase is, that’s a big win for all.
Have any questions or comments? We’d love to hear from you! If you want to find out more about blockchain, its growth, and newest developments, then check our blog or listen to our enlightening Web3 Innovators podcast.
