Crypto has really come a long way. It used to be impossible for me to onboard most people around me because I knew I couldn't tell them to put money on a chrome extension, or store seed phrases, or pay network fees, or worse, buy a coin to pay for network fees. However today it takes literally less than a minute to setup a peanut.me or a Gnosis App account.
These accounts only give access to a few whitelisted battle-tested products and use cases that are maybe a bit boring to the rest of us but are the future of mass adoption, like stablecoin payments and low-risk DeFi. Meaning that they also protect users against two other problems of crypto that are correlated: complexity and scams. If you've tried to onboard someone to crypto, you know that a common objection is:
There are too many things in crypto and I don't know what to trust.
I tried to launch a wallet a few years ago, and part of our thesis was that we absolutely needed to reduce complexity, not just in UX but also in what the user has access to: no WalletConnect, no browser explorer, just a very curated and opinionated set of tokens and protocols.
Today it exists, and I feel comfortable onboarding non-degen people... except for one thing: account recovery. I don't feel at ease knowing my friends and family have to take good care of seed phrases, password managers or even passkeys. I'm convinced that it's close to the last thing we need to build for mainstream adoption because it's everyone's assumption that you can always just get accounts back, particularly if they are bank accounts. It's the expectation and we have to meet it, otherwise centralized and custodial solutions will always be the default. I'm not even against these solutions if they have a trustless element, like a custodial backup with an onchain time-lock.
Actually, I think that's a great solution as an opt-out default. The difficulty in making it a default is how does the backup provider know who you are? It comes down to 3 things that always come up in proof of humanity and anti-sybil discussions:
- you know something: passwords, your mother's maiden name and favorite teacher, ...
- you own something: passport, biometrics (FaceID), ...
- people know you: vouch system, guardians, ...
All these can fit into a category I call Proof of Same Personhood.
Passwords and the "you know something" category in general don't interest me because they require users to remember things that they might have set up long before they ever need to recover their accounts. The "you own something" is much better but require some amount of setup and care on the user's part, maybe scanning a digital ID card they already have, or receiving a card from the backup provider, in both cases making sure to not lose it. The "people know you" is super interesting and one that I think will evolve a lot more in the near future through trust networks like the one from Circles. It means things like social recovery: sending shares to friends and family.
For a default solution, "knowing something" like your email might be good enough, but ultimately I think we want a combination of having something (like a passport) and a few people that can vouch for you to a custodian/guardian (which could be a ZK verifier contract).
Although the technology for it exists today, it's not really done, and pretty far from being a default. Passkeys improved default recovery based on something you own (your devices) but are not the best at long-term recovery as it's relatively easy to lose access to them over time. Most recovery systems used in practice (from seedphrase to passkeys) have too many failure modes.
So if we want to design a default solution, one where the user always has a strong path to recovery without having put a lot of effort in setup, we need to think about how to prove who they are, and how to reduce friction in proving who they are. It also needs to be opinionated yet flexible; opinionated on the overall recovery flow and sensible defaults, but flexible enough to leave the user with a sovereign choice (not locking them with a custodian).
I couldn't find anything that did this well, so I started building it. It's now BackupBuddy and we're building towards that vision.
I believe in a self-custodial future in which users have access to a kind of "app store" for backups; from default options to advanced recovery systems (ZK identity, institutional guardians, biometrics, ...) and even inheritance.
The first iteration of that for us is an API/SDK that lets wallet and non-custodial app developers provide an email-based backup to their users for simplicity as well as a simple but reliable ZK identity backup. It also lets the developer be the default guardian (even with minimal proof of same personhood) with a long time-lock.