#HITBCW2021 - KEYNOTE 1: Alt-Payments And Crypto: The Future Is Now

### Overview In this keynote address at HITB CyberWeek 2021, Matt Johnson, Chief Security Officer (CSO) at Ledger, examines the rapid expansion of alternative payment systems, cryptocurrency, and Web3 technologies. Framing the current landscape as a transition from an information revolution to a "revolution of value," Johnson compares modern blockchain adoption to the early days of the internet around 1998. He emphasizes that while adoption and transaction values are surging—particularly in rising economies and cross-border contexts—widespread hesitation remains, driven predominantly by security fears, scams, and a lack of user education.

### Key Topics - **Web3 Evolution and Adoption Pace:** The shift from Web1 (open protocols, decentralized) and Web2 (centralized corporate platforms monetizing personal data) to Web3 (community-driven and decentralized). Crypto adoption is comparable to the internet in 1998, but accelerating at an even faster rate. - **Self-Custody and Security Architecture:** Core crypto tenets including self-sovereignty, transparency, and self-custody ("not your keys, not your assets"). Relying on centralized exchanges means users do not truly control their assets. - **Market Realities and Cross-Border Utility:** How rising economies (such as Nigeria and El Salvador) lead adoption out of necessity to bypass inflation and lack of traditional banking. Over 80% of crypto transactions operate across borders. - **The Cyber Threat Landscape:** The surge in scam sites, phishing campaigns, blind signing risks in NFTs, and counterfeit hardware. Surfacing data shows that 71% of surveyed individuals view cybersecurity as the primary barrier to entering digital markets. - **Developer Empowerment and Mass Education:** Why security must integrate directly into developer workflows via emulators and automated testing, and why mass adoption cannot succeed without broad public education.

### Technical Details - **Endpoint Security Focus:** Blockchain shifts security focus away from network perimeters to endpoints, relying on four pillars: decentralization, transparency, self-custody, and self-sovereignty. - **Hardware Isolation & Verification:** Ledger protects private keys by keeping them permanently offline (e.g., on the Nano hardware wallet or Ledger Vault HSM solutions for enterprise). Transactions utilize a "what you see is what you sign" model, forcing physical review of recipient addresses on an isolated secure screen to prevent address spoofing and blind signing. - **Threat Intelligence and Takedowns:** Ledger’s offensive research team (the Donjon) analyzes ecosystem threats, noting that more than half of identified scam/phishing sites are registered via Namecheap. Ledger reports taking down over 500 scam sites (averaging 4 days per takedown, with a goal of 4 hours) and collaborating with platforms like Etherscan.io and Bitcoin Abuse to flag malicious addresses. - **Vulnerability Research & Verification:** Emphasizing a "don't trust, verify" approach, Ledger engages in offensive research against competitors' hardware wallets, blockchain phones, and Hardware Security Modules (HSMs), while sharing findings, tools, and bug bounties (including phishing intelligence bounties) openly with the community.

### Takeaways - **Security and Usability Must Converge:** Complexity is the enemy of security. Developers must be equipped with friendlier tools, emulators, and automated code review so security is built into Web3 applications from inception. - **Mass Education is Prerequisite to Mass Adoption:** Just as early ATM users had to be educated never to share their PINs, crypto users must be taught never to disclose their 24-word recovery seeds. - **Proactive Ecosystem Defense:** Securing the Web3 space requires an active industry-wide offensive against scammers, counterfeit devices, and malicious domains to lower the barrier of entry for mainstream users.