Unchained - How Casa Makes It Harder for Someone to Steal Your Bitcoins - Ep.106

Episode Date: February 12, 2019

Jeremy Welch of personal key security system Casa describes the company's various services and products, including its $10,000-a-year premium service for HODLers of at least $500,000 worth of cryptocurrency and the Casa node. He explains how he came to start Casa, why using seed phrases for managing security of crypto hardware devices is so problematic, and how customers should set up the keys in their possession for the company's multi-signature solution, in which any transaction requires the use of three of five keys. We go on at length at about potential ways in which an attacker could still force a target, say, at gunpoint, to move money to the hacker's wallet. We also discuss why the company doesn't offer a multi-sig solution for ether, why people choose to run Casa's Bitcoin/Lightning node and where people are using Lightning. Unchained Live With Vitalik Buterin in New York City: Get your tickets here! https://www.eventbrite.com/e/unchained-live-with-vitalik-buterin-tickets-56189456176 Thank you to our sponsors! CipherTrace: https://ciphertrace.com/unchained Microsoft: https://twitter.com/MSFTBlockchain and https://aka.ms/unchained TokenSoft: https://www.tokensoft.io Episode links: Casa: https://keys.casa Jeremy Welch: https://twitter.com/jeremyrwelch The Cutting Room Floor: Jeremy Welch of Casa, in which Jeremy answers by email the remaining questions we didn't get to: https://unchainedpodcast.com/the-cutting-room-floor-jeremy-welch-of-casa/ Casa blog post on the evolution of Bitcoin key management: https://blog.keys.casa/the-evolution-of-bitcoin-key-management/ Ways to store your crypto: https://blog.keys.casa/crypto-101-storing-your-cryptocurrency/ Forbes on Casa's $2 million seed funding: https://www.forbes.com/sites/jeffkauflin/2018/03/02/bitcoin-thieves-beware-super-secure-wallet-maker-casa-raises-2-million/#4c5b2e544230 Casa's seven guiding principles: https://medium.com/casa/seven-guiding-principles-at-casa-92f43e5e546a Announced after we recorded: Casa's new browser extension: https://blog.keys.casa/casa-browser-extension/ Learn more about your ad choices. Visit megaphone.fm/adchoices

Hi, everyone. I have really exciting news for you today. In case you haven't heard already, I'm doing a live podcast recording. Yep, that means on a stage in front of an audience, perhaps in front of you. And my guest will be Vitolic Boutterin, the creator of Ethereum. We'll be discussing scaling, governance, competition in the smart contract space, and more. And you'll have an opportunity to ask questions. It'll be in New York City the evening of March 20th. The doors open at 6, the show starts at 7, and we will be announcing the venue soon. Get your tickets now. There's a link to the events page in the show notes of this podcast episode.

Or you can just search Eventbrite for Unchained or Vitalik, and the event will show up. You can even find it on Facebook. Again, it's March 20th at 6 p.m. in New York City. Buy your tickets now. The link to purchase is in the show notes of your podcast player. I look forward to seeing you there. Hi, everyone. Welcome to Unchained, your no hype resource for all things crypto. I'm your host, Laura Shin. If you've been enjoying Unchained, pop into iTunes to give us a top rating our review that helps other listeners find the show. And if you're not yet signed up to my weekly newsletter, go to Unchainedpodcast.com and sign up right now.

considering using digital securities as a way to grow in 2019, Tokensoft's trusted platform provides the security and compliance tools to leverage blockchain technology and enter new markets with confidence. Visit us at tokensoft.io or on Twitter at Tokensoft Inc. Do you have an idea for a blockchain app but are worried about the time and cost it will take to develop? The folks at Azure have you covered. The new Azure blockchain dev kit is a free download that gives you the tool

needed to get your first app running in less than 30 minutes. Learn more at AKA.m.m.m.m. Unchained or by following them on Twitter at MSFT blockchain. Within months, cryptocurrency anti-money laundering regulations go global. Are you ready? Avoid stiff penalties or blacklisting by deploying effective anti-money laundering tools for exchanges and crypto businesses, the same tools used by regulators. CypherTrace is securing the crypto economy. My guest today is Jeremy Welch, founder and CEO of CASA. Welcome, Jeremy. Thanks for having me, Laura.

Let's start with the basics. What is CASA and what products and services does it offer? Sure. CASA, we describe it a couple different ways, but current one is CASA is the best personal key system on the planet. That's a somewhat technical description. And we view that we're headed towards this world where a lot of wealth and data, is going to be managed and controlled by private keys, public and private keys, by

cryptography. And so what our system does is enables you to manage those keys easily. And then we're building easier ways to manage all of this new data. That starts with Bitcoin and that starts with other cryptocurrencies, but we will get to other things. A less technical description would be that we are building a kind of sovereignty as a service. We are trying to build more independent systems. And if you want to live a life that is more independent of some of the big data companies

that gives you more control of your data of your wealth, then we will give you flat fee options on how to do that. And let's talk about just high level overview, your main products. What are those? Sure. So the direct products that we have today, we have the CASA node, which runs Bitcoin and Lightning. And we have Key Master, which is the key management application. The key management application today is running three of five multisig primarily.

So it's a $10,000 a year service and software package. And we help our users manage a multi-sig scheme that's three of five. There are five total keys. You have to have three of those keys in order to make a transaction. And the user controls the majority or the client controls the majority of those keys. So the client controls a total of four. We use CASA hold one key. And that key is used as an emergency.

recovery, then we assist the client if they ever have an issue, if they ever have a technical issue, or they've lost a key, we can assist them in getting their key set back up to speed. But again, this is targeted at these what we call premium hodlers, people that have a lot of cryptocurrency, $500,000 or a million dollars plus, and they want an easy way to manage that themselves instead of storing it on an exchange or outside provider. They want to self-custody. The cost of node itself is a Bitcoin and Lerner. Lightning node, and that enables you to route and send payments yourself based on your local

device. All right. So before we dive into the details on those products, let's fill in your backstory. How did you come to found CASA? I founded CASA. This company goes back, actually, a couple of years. I've been building companies for over a decade. I actually dropped out of Duke for a little while, and I joined these guys at Invite Media.

we built the first demand side platform. This was in the advertising technology space. And we sold that company into Google in about 2010. And so I got a really good view of what the entire internet at the time and kind of up to now has been based off of, which has largely been advertising technology and advertising systems. So, you know, did that company. We sold that in. I spent a year at Google, learned as much as I could.

I went back to Duke, where I studied a political. philosophy before dropping out and went back to finish up. And when I went back to finish up, I had all these questions. I was in New York with that company and with Google around the time of the financial crisis. So I had all these big questions as to how the global capital system worked. And I went back to school and started digging into these questions. And that's around the time that I found Bitcoin. So the kind of first public thing I did, a lot of private study. And then the first public thing I did was we did a Duke Bitcoin conference there. Matt Corolla, who is a Bitcoin core contributor, a few other people that are now in the ecosystem.

We were all at Duke, and we wanted to do something to get more people at Duke into that. But that was the kind of first public thing. And then fast forward a few years later, when I was building another company, this company started getting pulled and shifted more and more towards this ecosystem. And it really became CASA. So we actually started, funnily enough, as a home sharing app. And I'd been in the ecosystem for a long time. I knew the space. I was technical. And the shift towards this broader sovereignty as a service or more of a platform company instead of an application company happened because we tried to build an application first. So we were trying to build an Airbnb competitor actually with the Blockstack team. So we were going to build on Blockstacks systems.

And during that process of building an application in the space, we didn't ICO. We were never going to ICO. We evaluated a lot of ways to do this, but we quickly found that some of the kind of core, or I would say fundamental technologies around personal key management, around personal node management. There were major problems there. And by solving some of those problems, we can enable not just ourselves to do well with an application, but many other teams and companies. And so our long-term vision has always been about, you know, started as trying to build a decentralized application and to counter some of these older systems that we'd seen in the AdTech ecosystem. We went below that and started building, you know, foundational technology. And then now we're starting to give a much bigger vision with the node and the key management in one.

And 2019 will be a lot for, you know, for us, will be about a lot of building a coherent experience, not just for ourselves, not just for our direct clients, but for other developers, other partners, to be able to reach these customers and many others and simplifying their lives if they want to build more in this ecosystem. Yeah. I am a fan of Tim Ferriss's and he talks about how one model of entrepreneurship is to what he calls scratch your own itch. And in your case, I feel like that is what happened like you were trying to build at the application layer and then realized, oh, which is some of the really basic things around how to manage private keys are not easy to do. And so that's kind of like a more

foundational problem that needs to be solved. And I actually, this is something I've been commenting on recently in episodes. But one thing that's always puzzled me a little bit about some of the hardware devices is that they ask you to safely store your private, your seed phrase. Your seed. Yeah, your seed phrase. And I'm just like, oh my gosh, where would I store this without because like I'm the kind of person where if you ask me to kind of organize documents or something, then I will, if I kind of file them away, I will never know ever again where I put them. Like, I just will not remember how I organized. Like, I will not.

And so I just wondered if you could just sort of describe what you think are all the problems with how an individual might try to safely store their seed frames. Yeah. I mean, you hit the, you really hit the nail on the head. We talk a lot about how beneath that, that single statement of, you know, keep your seed phrase safe, is an entire discipline, right? There's an entire company. There's an entire, you know, you have to be an expert just to do that. And the brilliant thing, you know, Elena who joined the team, she was the CEO and founder of Trezer, one of the first Harbor

wallets, and they tackled the real problems that they were addressing and tackling around key management were actually against online threats. You didn't want to keep keys directly on your computer or any kind of hot connected devices. and they succeeded in that. They succeeded in solving that kind of course set of problems. But along the way, with the design of having some form of backup, they opened a new set of problems. And we are addressing this kind of new set of problems and the kind of broader ecosystem.

And when we do that with the multi-sig is we have what's called a seedless setup, where we don't know the seed phrases. We've built, we've intentionally built the system so that we don't know the seed phrases whenever we're setting up your keys. And you don't know the C phrases. You don't record them. You don't write them down. You generate all the keys.

And then we've made it really, really easy to swap in new devices. So what happens is if, you know, you lose a device or a device becomes compromised, you're attacked and a device is stolen. Then you just swap out a new device into the key set. And we've made that really easy. It's seamless. It's, you know, two or three taps happens in a few minutes. And, you know, no command line, no copy.

Happy pacing, just very fast. And by making that easy and then wrapping a support service around it, again, we're trying to address this entire discipline that you have to learn. We do view this whole process. It is going to be a journey for most people. Anybody that's used the treasurer, it's incredibly empowering the first time they try it. And they're, you know, whenever the funds actually land on the device and they're walking around, they're like, wow, I mean, you know, I really, I could cross borders with this.

I can go anywhere with this. And then the scarier thing is, if I lose this, right, then it's just gone. And there are these, so there are these kind of like scary things around it. But it's also incredibly empowering. It's like, you know, I don't know if you think back to like the first time you drove a car as a teenager. Today, we totally take it for granted. But the first time you get behind the wheel and you're driving this big car and you can go fast and it is, it's a rush, right? And it's really empowering.

And, you know, I think we're going to see some of the. or things around this technology is as it gets easier and easier. And I describe cars a lot because if you think about what goes on behind a car, the push button nature of just a Toyota Camry, you just push the button and it starts and you just hit the gas and it goes. But behind that, there's an incredibly complex engine, you know, tens of, around, it's over 10,000 parts and a standard automotive engine. And it just works.

And so I think that where we need to get to is even though, that we have these components like a treasurer, like a ledger, and we have these current experiences where it's like, wait, okay, this one component, even though it's supposed to be simplified, this actually is creating more complexity. Over time, we will get it to a push button, just swap in keys. You know, if you lose one, you can just go buy one at a Best Buy or some other store. I mean, we want to get to this world where it's just common nature to have lots of these key devices around and just much easier to use. Yeah, that would be comforting to someone like me because I am known for losing things constantly and it's super annoying. For me, even though it's my family who's

always complaining about it. I'm like, why do you guys care? It's me that like who's affected by this. But anyway, so I actually just want to unpack this multi-sig solution. You kind of briefly described it, but from a diagram I saw on your site, so as you mentioned before, you guys keep one key that's kind of like an emergency backup. And then the other four are accessible to. the user themselves. So there's one on their phone app, one that they would keep at home, one that maybe they put in a bank, and one that maybe they keep at work. So like for instance, in my case, where I don't have, you know, another place where I work, where would you recommend that I put that fourth key? Sure. So this changes. Each person is different. Some people store them. They have,

some remote properties. Some people use a series of bank faults. Everything has tradeoffs. And we advise clients on what the mix of those tradeoffs are. Some people, they have a, you know, a brother or a sister or a, you know, some sort of sibling that they'll end up storing it with, that they trust and that they're very close to and that they, you know, they maybe co-own some other properties or something with. And they do some already. They do some kind of, kind of combined financial work with. Sometimes it's another business partner, right? So it's not, it's not always just different locations, sometimes it's different people. The important thing about it is, you know, multi-signature, multi-location, multi-device. So even spreading out across different types of devices actually protects

you from what's called a supply chain tech to where someone could gain access to one of these companies supply chains and potentially, you know, cripple or cost problems with a single device provider. But, you know, the answer, again, kind of jumping back to that is that it really depends on the client. We do have these kind of core principles around how we approach clients. And the first one is sovereign customers first. And what's important about that statement is that the decisions, every client will be unique. And in a kind of age of a lot of companies that in the kind of Silicon Valley way of just scale rapidly and treat everyone the exact same, we are distinctly trying to go against that and treat every customer as unique as possible

and think about really tailoring our security recommendations to kind of each user's life because everybody's different. And they're all going to have kind of different security situations. So you may have a very different security situation and the location where you'll put it, but we, you know, we'll find something for anyone. And then, but how could you be certain that some individual users are not implementing it in a way that would leave them vulnerable? Because if we can't, yeah, that's, that's a, it's a great question.

I mean, we can't. And that's part of the point of building systems like this and part of the point, I think, of going down this road of Bitcoin generally is about personal responsibility. And we've, again, I think we've been through an age to where things were easier and everybody was treated the exact same and we over simplified things in a sense. We're now, there's a lot more responsibility. There's a lot. The consequences are a lot heavier. And we make it very clear to our clients that if you lose three of those keys that you have, three to the four, then your funds are gone.

The funny thing is that, you know, as we describe that, you know, that feels terrifying whenever you're seeing it on the screen and we've made it really easy to visualize and, you know, if one key goes down, then we have a, the entire kind of shield drops and then the, the one key

that you've lost goes completely red and it's it's very visceral visual experience by design, right? But the funny thing is that, is we think about, you know, if you have a total of three or five, right? and you lose one key and then you lose a second key, then you're at the absolute edge. If you lose another key, then it's done, right? You've lost all your funds.

I would probably end up in that situation. Well, the funny thing, though, about that is that that's actually the normal state of everybody that just has a treasure or a ledger. The normal state of everyone that just has a single device is this case to where if they lose that device or they lose that seed phrase, it's gone. And so we've built layers above that. And to simplify that, and the chances that you, you know, the chances that there's a natural disaster that affects, you know, your city and the other city that you have one and one of our customer support centers. And so you didn't have access to your keys as much, much, much, much lower than if you just, you know, your house was just in a fire and then your treasurer and a seed phrase got destroyed.

Right. So it's, and we're by distributing risk across, again, multi, multi-signature, multi-device, multi-location, we, we, are minimizing it as much as possible, but there's still, you can never take away the personal responsibility element of that. And we've seen it as an empowering thing. We've seen people respond and excited about the fact, but it's definitely daunting. It's not for everyone. Yeah. Well, since you brought up fire, I actually did have a question about a natural disaster type of scenario, because as we know recently, there was a fire that did wipe out a whole city. and there are times, of course, when we've got things like hurricanes and other sorts of natural

disaster, tsunamis, that kind of thing. So in those situations where maybe I even have spread my different keys out to different locations, but potentially I could end up in a situation where three or more of my keys have been lost, then what? Are the funds just gone? Yes, the funds are gone. And the, that is why, again, in terms of spreading these out and multi-device, multi-location, it's really important that you're spreading them across multiple locations. Most of our clients do it across multiple cities.

They will frequently leave the devices in fireproof safe in any one of the locations that they're in. We've heard of, we don't know the exact locations of devices that is up to the incline, but we've heard of bank faults, we've heard of personal fireproof safes, we've heard of a variety of things. And this echoes, and this is similar

to how people normally store their devices. But we've also seen cases, we're kind of hypersensitive to this. And so we're constantly reminding clients to check their devices. And we do regular, you know, kind of even when they're in cold storage, we do regular quarterly checks. And just making sure. So there's one problem that a lot of people aren't even thinking about right now, which is BitRot. So if you take just an iPhone and the error rate on an iPhone is such that Apple assumes that maybe it's 1% or a point, 05% of iPhones that they manufacture are going to fail within a year, within half a year, just because of the error rates and manufacturing process.

That becomes a lot more terrifying if it means that you're kind of managing personal funds and you have devices and key devices that tie into your personal data. And so, you know, we are even just checking. We have automated checks inside the system to where you can do these health checks of your devices regularly. But yeah, it is, it brings a lot more, I would say it brings a much more kind of visceral, tangible knowledge or awareness of systems whenever you're using this. Now, the reality is that the real world isn't actually that much different. I think what's happening is that, you know, by design, we're bringing this kind of to the forefront and making it really easy to understand what the real risks are and what the real situation is. But the reality is that it's not, you know, the world's not that much different. It's, you know, more car analogies, if you're ever in a car accident for a while after being in a car accident, most people are jittery.

They're very, like, they're careful and they're looking around and they're realizing again, like how fast cars are going. But then we get in these flows of just being, you know, being used to being in a car and no car accidents are happening. And our minds just kind of turn off to the real risks where, again, we just see it as these are the risks that are around us. always. It's just we don't think of it that way. And we're making a little more visceral, but we're also giving you more control and more safety checks to kind of protect you better. Yeah, but I just wonder, I mean, like this is a lot of responsibility for an individual, whereas if I use something like Zoppo, where they have the private keys in multiple geographies around the world, that's kind of a level of protection that I myself can't probably implement.

right? So why would I choose to use the CASA method as opposed to entrusting a company that can do it better than I can? Sure. Sure. I mean, it just comes down to kind of personal belief in the statement that you're not your key is not your Bitcoin. So company like Zappo, great product, great company. We've heard nothing but good things. We know some people over there and, you know, but it's just a different kind of model. We can't personally, maybe if you're a friend of one of the founders, employee or employees, you can go visit,

you know, the facilities to make sure that those servers and the keys and everything else are there. You are inherently trusting that company and that, that they are running those

and that they're not just kind of storing it on a server and someone's back office or in someone's house, right? You're trusting that those things actually exist. It is, to be honest, like, it is a lot of marketing.

It is mostly marketing. And they may actually have those bunkers and they do serve a real purpose, but you're still trusting, there's still that element of trust where we are trying to build the best possible system for you to self-manage and self-understand and have the full power. And this stuff, you know, it may be tested sooner. It may be tested later. I think that we're in a time right now, which we're very lucky with the bear market to where we're just able to build and build a lot of new features and there's not as much of a rush.

But whenever bull markets hit, everybody looks around and the prices are shooting up and everybody is like, oh, my gosh, you know, if this does actually kind of hit this. hyper-bitcoinization situation. The price is really, even if they just go to 50K at coin, even back to just 20K at coin. Like the calculations become very, very different. The amount of money on the books becomes very, very different. And the way people think about these systems becomes very, very different. And we're only, you know, Mount Gocks, there's the famous video, I think, of Roger saying, yeah, everything's fine.

And Mount Gox, something like a week or two weeks before it was just absolute mayhem. And they realized they lost all the funds. So it's, you know, it is one of those things to where it's personal choice. It is, some people are never going to want to fully manage this and fully take the responsibility for it. But for those that do and those that want to go down this path, they want to grow stronger through it and they want the absolute best protection, you know, we're going to offer that. So let's talk about attacks as well, which we started to do.

You mentioned earlier that if someone loses one of their keys, you guys can easily replace that. So in that case, the other four keys are still usable. You're just replacing the one that is lost. Is that correct? Right. So the client can go, they can grab a treasurer or a ledger. We work with both systems. They can grab any treasurer or ledger from any manufacturer. It doesn't have to be us. It can be directly from the manufacturer. It can be from another store. I can be one that they, an extra one that they have laying around. They can use any device and pop it in and reset. their key shield. We also offer for our clients, we are authorized resellers for both Trezer and ledger, and we hold extra devices in reserve. There have been cases to where there's a supply chain

shortages or other factors, it would end up taking a week to ship a device or, and if you're, you know, if you've lost a device and you want to get yours the next day, then that's a problem. So we hold extra devices for all of our clients. So overnight, no matter where they are in the world, if they need a device, you know, we will ship it overnight shipping fast as possible, most expensive, whatever it is, to get them the device as soon as possible. So what if I'm somebody, what if I'm a bad actor, as they say? And I will use my sound engineer Chris as an example. Let's say I go, hold up Chris, hold him at gunpoint, and he's a Kasi user.

And I force him to report that he's lost one of his keys. So then you guys give him. him a new key. So now the and so maybe what what happens is maybe I'm the attacker and I have brought my own treasurer. And so Chris now has the key on his phone, the key at his house. And now I, I have Chris report a key lost. Maybe the key at work is lost. And then I say, Chris, have them send the new key to my treasure. So now there's three keys at this, you know, one location where I'm holding him a gunpoint. So then can I force him to send out all of his Bitcoins that way? No. Is that no? Because you would still have to, yeah. So you still have to do it so you can swap in keys,

but you can't, you can't actually access funds because you have to, the funds have to transfer over. So we've simplified the two steps that we've actually done. We noticed this. We actually, you know, did user research and noticed that anytime someone lost or thought their device was compromised, We talked to some people that even just firmware updates that someone got scared that their device was malfunctioning. What would frequently happen is someone would buy a new device. They would reset the seed on the new device and then they would transfer funds from the old device to the new device. Or they would immediately transfer funds to a totally new fresh device and fresh seed. So we've taken the kind of middle step out.

And so what happens is you rotate in a new key. you have a new key shield and then you transfer the funds you do a wallet sweep to that new key shield to that new setup and with that new setup you still have to transfer the funds

so in order if you were if you were holding Chris a gunpoint you would still have to travel with Chris to several other of his locations to actually transfer the funds and do a signature to get the funds onto the new key shield even though he still has

even though he has two keys in his possession and I've not fashioned a third. Oh, okay. And wait. And so why? And I guess what I don't understand is that like, so in this situation that I outlined where we've actually, he's actually lost one of those, or sorry, or we forced, I forced him to report that he lost one of those keys.

Then how do you transfer the funds to the new device if supposedly that the other device doesn't, you know, we lost it? Chris, so you have, you're still having to sign with the existing. key sets. So you're still having a sign. Even though you've lost one key, you have four remaining keys, right? And of those four main keys, you have to still do a, you technically only two, if you're at a location to where he had two devices, so I say he had his phone and he had a device and this was at his home and his home safe or something, then of the old key set, there's still only two keys there. So he's going to have to travel to another location to

get another device, make another transfer. And it's that element of having to go multiple locations and interact with multiple parties that is the real security around all of this. That extra time for most attackers is not worth it. And in that extra time, we have the ability to flow even emergency lockout feature that just shuts down the account, locks out the account. So even as you're walking in the door, if Chris just tapped

that, that locks his account down entirely. Now, if you had all the devices, you could still get access to it. That doesn't enable CASA to do anything malicious because Chris still holds all the keys. It just slows down the process of executing new transfers because you're not doing it through the actual end interface, if that makes sense, through the iPhone apps and the web apps, and you would have to do it manually with a command line in a more technical way.

So all of that just to summarize that, again, multi-device, multi-location, that model, that protocol is what's helping protect Chris. We are here as a service to help run that model and help keep those keys up to date and help provide service, help debug problems. But at all times, the end users in full control, they have the full set of keys, Kasa is never in a position to where we can touch access, you know, end users' funds. and an attacker would also have to go these multiple locations, you know, to get anything. And then what if I get a hold of Chris's phone and then I flag a couple of his keys lost

and somehow can access one in a new location? Then could I generate new keys for myself and then hack his bitcoins? So repeat, repeat that again. So if I get a hold of his phone, it's sort of. It's sort of like we were joking about sim swapping before the episode. And so what I'm talking about is like it's not sim swapping. It's like if I literally just steal his phone and then I get into his CASA app, can I flag a couple of his keys lost and then issue myself new keys but claim that they're his.

Do you know what I'm saying? And then use those new keys to hack his bitcoins. Yeah, the important thing is that with any of this key management, the end user is doing everything. So we as a company, like, we can provide, we can, we can, we can help, we help, we provide a simplified UI and we provide some support service around it. But ultimately the end user is doing everything. So what's important about that is that you, even if you're, and I, and I've stolen Chris's

phone. And then I pretend that I'm Chris and I'm doing all the stuff. But really, it's all, I'm going to end up having the funds. You would still have to have Chris's permission. you'd still have to have Chris walk through all the what do you mean how would we know how would you know whether it was Chris or me giving the permission so the again the general point here is that is that you would have to get Chris held at gunpoint take him to multiple locations at gunpoint across a pretty large period of time just but I can't just but I can't just say hey those but I can't just say hey those devices were lost right correct just think of it like this think of it like this, okay? There are two stages in a key transition or in a key shield update, okay? The first step is in flagging a key as lost or stolen or compromised and then sinking a new

key set, okay? When you make that new key set, that is a totally new set of addresses, a totally new set, and there are no funds on that new key set. The second stage, the second stage is that you actually have to, transfer the funds from the old key set to the new key set. And to do that second stage of that transfer, even if you got some access to the UI and you tried to swap in some keys and you generated a new key set, you still have to transfer funds from the old key set to the new key set. And when you're doing that, you're going to have to go through the process of going to multiple

locations, potentially a bank, potentially offices, potentially, you know, other business partners or siblings or family members to get devices. Right. So can't I do that on my, can't I open up a safety deposit box at my own bank and pretend that, do you know what I'm saying? Like tell you that. But you're,

so what, I think that the disconnect here, Laura, is around the, it doesn't matter what you do. Separate this out into the new key set and the old key set. You can do all you want as an attacker to generate a new key set. But you still have to get Chris to transfer.

the funds from the old key set. And transferring the funds from the old key set is very hard. Transferring the funds from the old key set is going to require you to go multiple locations. Okay. And certain parties, even though the new key set is created. Yeah. Doesn't matter. Devices lost at those new locations.

Exactly. So it's like checking your IP or something like that when you do it. It's, it's, um, let's think of it like, think of it like, think of it like literally opening a new bank account. Sure. you can go to a bank and you can use a false name and you can set up a new bank account. But that's not going to put funds inside that new bank account. Even if you used Chris's name and you set up that new bank account, you actually have to go to his old bank account and somehow scam the...

Even if I've reported it lost? Even if you've reported it lost, you still have to convince the old bank account, the old people to transfer funds into the new compromise fraud bank account. And again, the calculation here is that the level of complexity required for you to generate these new keys, new key set, and go through and transfer all the old funds is extremely high. Going across multiple locations, needing to know multiple pins over multiple days, multiple hours at a minimum, potentially multiple days and multiple geographical locations is extremely high. and the chances that no one would notice are very, very low. And also keep in mind that the instant that there's a, you know, that a key is compromised in the system, we know about it as a company and we're calling to check on our clients. And if we don't hear back from a client and the key is compromised and there's something going on,

you know, then there are procedures. We have procedures with clients, with different clients for whether we would call authorities, whether we would call their family members, whether we would call, you know, what the kind of emergency process is. Okay, we're going to keep discussing this in a moment, but first a quick word from our fabulous sponsors. Within months, cryptocurrency anti-money laundering regulations go global. Are you ready? Avoid stiff penalties or blacklisting by deploying effective anti-money laundering tools for exchanges and crypto businesses,

the same tools used by regulators. CipherTrace is securing the crypto economy. Face it, regulations can stall or kill a fast-moving crypto business. New Financial Action Task Force and European Union cryptocurrency AML laws are coming soon. You could be hit with stiff fines or blacklisted, no matter where your servers are in the world. Prepare now. Deploy the same powerful ciphertrays tools used by regulators. Protect your assets, streamline your compliance programs, and keep your exchange or crypto business out of the regulator's crosshairs.

Learn how effective anti-money laundering tools help. keep your crypto business safe and trusted. Learn more at ciphertrace.com slash unchained. Ciphertrace is securing the crypto economy. Getting your blockchain app off the whiteboard and into production can be a big undertaking. From connecting user interfaces to integrating disparate systems and data, blockchain app development can be time intensive and costly. Well, the folks at Azure have you covered. With a few simple clicks, the Azure blockchain workbench can create a blockchain network for you, pre-integrated with the cloud services needed to build your app. And with their new development kit, users can extend their app to ingest messages from bots,

edge devices, databases, and more. It's free to download and gives you the tools you need to get your first app running in less than 30 minutes. To learn more about the dev kit and how to get started, visit aka.m.m.m. Or follow them on Twitter at MSFT blockchain. Issuing a digital security on the blockchain can be a significant undertaking, particularly to ensure compliance requirements are met. Tokensoft's trusted platform provides security in a world of uncertainty by working with top legal and financial experts so that your digital assets are secure. Tokensoft leads the market in providing technological tools to support tax, banking, and securities regulations for issuers of digital assets. we are honored to have supported leading companies in 2018. To learn more about issuing digital securities successfully,

visit tokensoft.io or follow them on Twitter at Tokensoft Inc. Back to my conversation with Jeremy Welch of Kasa. So when you say that like I as the attacker or anybody would, you know, if they need to kind of create new keys and you say that you require them to go to different locations, how do you know they're in a different location? We, that's, again, that's, that's the proof of the signature of a device. So, um, that comes down to using actually a treasurer to sign a signature to execute a transaction on that treasor, right?

Or ledger. But how do you know that they're not, how do you know that they're doing it at, you know, a place that's different from a different location? Like, how do you know that they're not just doing two different signatures, both from the comfort of their own home? My point is that it doesn't matter. My point is that, so I think what you're suggesting is that how do we know that the attacker hasn't gotten access to these extra keys and brought them back to the home and is doing these transfers at the home or something? What I'm pointing out to you is it is a challenge just to get one of these keys.

And if you're going to a bank safety deposit box to get one of these keys and the client looks under duress, or you're not the client and you're trying to go get the device under the client's name. Right. No, no, no. But the scenario I'm outlining is different. It's saying, I'm saying, I'm the attacker and I report that one of those keys is lost. I get control of Chris's phone. And so to your mind, you Kasa thinks, okay, that device at the bank no longer works. No, no, no, no, we don't. We don't. We don't. That's what I'm pointing out to you is that we don't. our system is not designed in a way that says that, again, I would split this. I'm trying to, like, create a simplified model on connecting this into the two different

steps of, like, you can create all the new stuff you want, but you still have to go get access to the old stuff in order to make a transfer. And so, and it's the protections that are in place around the old things that this attack would not work. So, again, I, like, just using a, just using a simplified case. case. Okay. Let's use a and using a the existing financial system, which I think will hopefully clarify things a little bit more. You have, you have a, you know, you go attack Chris. You get some of his, his information and you go open a totally new bank account at Bank of America. Okay. Turns out

Chris has been banking for a long time with HSBC. And you go open a new bank account in his name under Chris. You control it, but it's under his name. It's a fraudulent account. Okay. When you open that bank account, it doesn't have any money in it. Right. Right. But it's a new bank account and it's a fraudulent account. It's in his name, but it has no money in it.

The only value you're going to get is when you can convince Chris or can convince someone else to transfer funds into that fraudulent account. Right. So that's what I'm saying, if I have control of his phone. What I'm saying is that just by having control of his phone, that doesn't mean you have control of his keys. So it's like you would still have to, in the bank account example, you would still have to somehow defraud Chris to get him to send money from his old HSBC account to this new account. And so in our case, in our case, that's my point about the gunpoint. I could, couldn't I just force him to say like, hey, report this one lost and then send funds to this new.

Yeah, but again, reporting a key is lost doesn't doesn't send any funds that never sends right. That would be a massive security. And then also and then also get cost at a, you know, tell them, hey, this is your new device. But again, that still doesn't do anything. Like that just, just reporting it as loss and even setting up a new device, that doesn't send funds anywhere. What that does is that creates a new, that's the equivalent, that's the equivalent of creating a new bank account with no money in it.

And so there's no way that an attacker could force their target to get CASA to send funds to the new device? Correct. Now, what they could do is they could hold Chris at gunpoint and they could take him across multiple locations and they could take Chris to, and Chris, you know, wherever you are. I mean, you're the example of this case. I hope you're doing all right. Yeah, I hope you're doing okay, man. But, you know, I, what would it still have to happen is Chris would have to be taken at gunpoint to his bank to get access to this key to the safety deposit box and to send a request.

But I guess, right? But this is what I'm confused about. Yeah. So like, let's say that he's not held at gunpoint. Let's say he's actually lost one of his keys. And it's not at the bank. Let's say he's lost the one at the office. If he reports it lost, then how does he get funds onto his new device?

Because he has the, he still has access to other keys in the setup. Right. So that's what I'm saying, that somebody can hold Chris up. And Chris now has the two keys, one on his phone and one at his home. So, yeah, this is where I think, okay, I see what you're saying. Okay, so the disconnect here, okay, is that the total in the three of five, it has to be, it has to be three of five of the same key set. So in the old case, right, Chris has a total of five keys. He's now reported one as lost, okay?

You're attacking him and you're trying to swap in a new key. You've now reported one is lost. So in the old key set, he now has four listed, okay, as comprehensive, or, four listed as working and one is compromised. New key set is created. Total of five keys. Oh, but I thought you said that when one is compromised, that only one gets swapped in and the other four remain the same. Well, that's correct. That's correct. The other four remain the same. But it's not five. It's not a new set. No, no, no. It's a, it's a, it's a totally new set of addresses. That one new key with the old four keys creates a totally new key set with a totally new key set with a totally new set of addresses. So in that case, you now have two key sets. You have the old key set and the old set of addresses,

and you have the new key set. Okay. So basically, so wait, and so just to understand, so old key set has these five addresses, ABCDE, the new key set, even though it uses some of the old keys, even though four of the keys remain the same, now the addresses are, what is that, F, G, H, IJ. Exactly. Or X, Y, Z. Yeah. Yeah. And again, that's where it's like, that's where this new key set is like a totally new bank account.

It is, it is totally fresh, totally fresh addresses. And so you still have to, the stage that you're missing is that you still would have to attack Chris and have him transfer funds from the old key set to the new key set. from the old addresses, from the ABCD addresses, to the new addresses for, you know, FGHI. Right. And that transfer, that would still be very, very hard. Right. Well, maybe I could do it. Wait, with Chris.

Okay. I know that was a lot of back and forth. I know that that was confusing. Give me a lot of back and forth. Yeah. I know that was a lot of back and forth. And I know that was confusing. And I, you know, the, this is complicated stuff.

It was, it took us a long time to. map out this model. And the specific decision we made from a security perspective is that we wanted a more rapid response system and wrapping a lot of support around that to where we're, you basically have two kind of two approaches to security either. You're going to put yourself in a, you know, in a steel cage, cement cage. You're going to surround yourself with guns and, you know, everything's going to be secret and no one's ever going to know. And everything is like, tightened down as fast. as much as possible.

There's an alternative security approach to where it's like a rapid response model, to where it's your ability to rapidly respond very quickly. And we joke about this being like the Terminator model to where you have this T-1000 that keeps coming in the Terminator movies that keeps coming after him. And it doesn't matter if you shoot a, you know, you should have gun into him or they, they throw something at him or they hit him with a, you know, a big, some sort of construction equipment, it doesn't matter. He keeps reforming himself quickly and coming and coming after them. And in a similar way, we're taking a model, the old model of using just a singular device or using

a singular cold setup at Zappo or wherever with a singular bunker. What we're creating is this faster model to where, you know, yes, you have a, you have, you know, a bank in New York, and then you have a home in San Francisco and you've got a key at each of those and you've got to key at some other place. And you know what? Yeah, the house in San Francisco might burn down. But then you quickly, rapidly readjust and shift to a new key set in a new location. We're creating this more rapid response model. Then in each of those situations, you're kind of hardened down and you've got things in a fireproof safe and you've got things pre-protected. But it's that rapid response piece that's very, very different. And that's where the service is super important to. So I just thought of something

else because so what if I hold Chris at gunpoint or either that or I get control of his phone and then what if I report the two keys and the other locations lost and then also now so now I only have two keys in my possession because both the one at the bank and the one at my office have been lost and all I have is the one on my phone and the one at home then I call you guys or I make Chris call you and refashion the new key set and also move the funds so that way he but we can't that last step that last step you just said of just moving the fund that's the thing that can't be done easily and we can't we can't control that you the one maybe one but like if so but i could force chris to do that you you could you could attempt to yeah you could attempt to force chris to

do that and what we're and we've never proposed that we like totally lock everything out of the system what or we totally prevent any attacks whatsoever. We create a scenario to where to attack you becomes much harder. And the chances of someone detecting an attack increase rapidly because you've got your keys in multiple locations. You have a rapid response model. You have a big red button on your account that locks the account down and locks all access to just even generating or flagging keys as suspect, right?

And sends alerts to us. And so you have all of these precautions that, makes it much harder to actually attach or attack, and it slows down any attackers. And that's really important. I'm definitely not advocating that anybody do this. This was more like an intellectual exercise. I am not either. I am not either.

I had a question, which was, so in the three of five, so let's say that I want to make a transaction. Is there a time frame in which I have to have all the three of the five keys? you know, participate in, to make that transaction? Like, do they all have to, no? No. No. So you can, you can separate them by multiple days. You can do it totally asynchronously. So you could do, you know, three or four days difference. But yeah. And what if it's like a week or two weeks? Sure. It would still work. Now, you know, holding that, you know, that long and building a key set, it would still work. And we've also talked about building features that, you know, time out after a certain

period right now. It's, it's, it's relatively open. But there's a lot. There's a lot that we're still building. And I think that even even having time locks around accounts and around certain signatures is something that we'll build in eventually. The important, I would just say that the important way to think about this. So we started actually with Glacier Protocol and looking at the security model around Glacier Protocol and totally off, you know, totally offline paper copies and the maintenance around that, which is enormous. We looked at Jameson Lops set up. He had his own custom setup, and he would have to spend a day or two per year,

just going through and rechecking everything. And our end goal was to take this existing models that existed that we, that, you know, we're not reinventing the wheel. We're taking these existing models of cold storage and making them easier to use. We're building better user interfaces and better customer support around that entire process. And yeah, some people are technical enough to kind of re-implement this stuff themselves, but the UI and the customer support and the speed at which we can react and help you is not going to be present in any kind of custom situation. And so if you, you know, our company,

the positioning of our company is in building all these experiences. You can look at the cost of node as the same way. People were building lightning and Bitcoin nodes before we made the casa node. What we did is we made it much easier set up. We made it much easier to run. We simplified customer support and set up and, you know, if something goes wrong. And we've spent, you know, our engineers spend hours at times with clients to get them set up and get their node running and get them custom port forwarding setups and custom router setups. It's that element of we're taking these complex technologies and complex processes that exist and then we're simplifying it down to something that's usable and then, you know, applying all the customer support. And we're going to do

that in more areas. Yeah. And it was something else I wanted to ask was about the $10,000 a year service. Why do people have to apply for that? Because it is a, it's not a, you know, you could, we could probably pop up a form and just have people pay it out. But it is, it is something that the setup is pretty involved. You know, we do initial consultation to make sure that people understand what they're getting into. And most people, the odds thing that we've seen is that for a lot of our clients, when they do kind of ask all their questions and they finally realize, you know, what it actually is, the sale is very quick. It is, it is very fast. You know, we've had people tell us, they've been looking for, it's, it's, it's, it's been surprising to that end.

But there are a lot of people we talk to as well that, you know, they, they want it to do certain things that are totally automated and they wanted it to do certain things that custodial systems do that a security system that is more in your control just won't be able to do. And so we, we are very careful with clients in terms of like, you know, we, we are very careful with their setup and with process and we're not, you know, they have to apply because it is a little bit more involved at that level. Now, with the cost of node, you can just buy it. You can buy it the day. You know, it ships out. We caught up to, we were shocked at the demand, but we have pretty well caught up. And it usually ships out about two to three weeks after you're purchasing. But the, you know,

that is a much more rapid onboarding process. Okay. Yeah, I want to get to the cost of node in a second. But first I just want to ask also, so are there, what are the factors? on which he would reject somebody who's applied for the $10,000 year service? So first off, you know, we only support individuals and small teams. We don't support large institutions. We're not designed as a solution. We've had people kind of approach us around institutional setups. And although we do advise, we've definitely advised companies.

And, you know, this specific setup and Keymaster is built for small teams, individuals, families, family offices, right? Like those, this nexus of smaller teams or smaller families or, you know, one individual with one family member or a lawyer or someone that they're using as a trusted kind of outside party, those are the dynamics on which this specific system is built. We do have people that come ask us that they have a large corporation or a fund and they have $100 million and they're looking to, you know, they're looking to set up a system and they want to make sure they have control and they've heard about our design and our approach and our customer service and they're excited. excited about that. But we're just not the system that's built for that. There are other companies, Anchorage, which just came out about a week ago. Diogo, they're building phenomenal product. And the Fidelity team is building. They've announced their product last fall. They're building phenomenal products. I mean, just we've seen other teams that are looking mostly at that

institutional side. And we are not that. So we do have some filtering around making sure that we're addressing the right user. As far as an individual, there aren't, there aren't as long as the user is technical enough and sees, I wouldn't even say technical enough, it's just as long as the user knows that this is not just a regular bank. Like, they are running their own infrastructure. They're running, they're managing their keys. They know the security implications. You know, we do a kind of brief conversation around that, then we'll onboard them pretty quick after. And why do you not have multi-sig support for ether? Why is there only single key support for that? Yeah, that's a great question. So Ethereum is the approach of Ethereum, and we wrote a blog post about this,

Ethereum does have some multi-sig smart contracts. The logic around not supporting Ethereum is that we didn't think that the system was to a point to where we could be confident that funds would not be lost or if they were lost, that they would not be recoverable whatsoever. And the specific example around this is around the parody situation. And I'm not sure if you're familiar with what happened with parity multisig. Yeah, I am, but why don't you fill it in for listeners who maybe don't know? Sure. So the parody multi-sig situation, it wasn't exactly a hack. It was a developer, I think it was a young developer, like a new developer on their team that was going through and testing some scripts and happened to accidentally delete a certain piece of code that was critical to some of their multi-sig wallets.

that was your recoverable. They say it was an accident. Well, well, there's an open question. I mean, we know some of the parody folks and they're great people and very smart. And I, you know, this is kind of a shocking situation. But the more shocking thing to us is that, you know, we saw in the case of the Dow, we saw there was a fork and there was a reversal on the transactions. And the case of parity, there wasn't, right?

And even though it was a total accident, even though, you know, was totally unintentional, there was no reversal. So those funds are lost. That's over, I think it was over $100 million. It's just totally wrong. And in that case, we look at it from two ways.

You have to have the actual system and code has to be, has to work well, has to be logically sound, has to be well tested, has to be vetted. We,

you know, we think that Bitcoin is definitely to that level. We think that there are some other coins that are, that are approaching that level. But Bitcoin's by far, you know, leagues beyond most anything else on the multi-sig side.

But the other thing about Bitcoin is that there's only one multi-sig solution. There are a couple details of implementation on how you set it up, but there's kind of one dominant way to do it. And the entire community uses that. And what comes out of that is if there were a break, if there were an issue with this implementation, there would be no choice. But to either run a hard fork or do a soft fork or some other. fix to make that fix. In a case on Ethereum to where you have multiple smart contract implementations,

you know, parity is the one that got hit in this scenario. There was no change, but there are several others. And, you know, what if you're the one that got hit with a bug? And there's no guarantee that the underlying team would have the incentive or the core developers would have the incentive to fix this core issue that led to your hack. And so we just don't think that for, our users funds, for, you know, recommending to our clients, we don't feel comfortable recommending multisig on Ethereum today because it's not consistent or it's not, you know, fully sound on both the logical level and on the community level. So even, you know, there's been a movement to get some smart contracts formally verified and get a lot of outside tests,

and that's great. That would be this kind of first level around formally testing the code, making sure there are no bugs, making sure there are no holes. But, Again, I want to remind you that in the parity case, a lot of that code was tested, a lot of it looked perfect, a lot of it looked great, yet it was still able to be deleted, and there was still an issue and them not wanting to do a reversal. So just because a smart contract is formally verified and fully sound doesn't mean there couldn't still be an issue like the parity hack. Yeah. So we're reading out of time, but let's quickly talk about the CASA node. So as you mentioned earlier, it's both a Bitcoin node and a Lightning node.

But why would someone want to run a Bitcoin node when they can't earn money from running it? So the Bitcoin node itself, I mean, that is partially supporting the network on the lightning side. You can, you can earn money. It's around routing transactions. Now the amount, it's in Satoshi, so it's a much smaller amount, total amount. But, you know, you can't earn some. And today, a lot of running a Bitcoin node and running a Lightning node, it is a somewhat niche experience. It is a kind of early adopter experience that is changing.

There are now games and applications around Lightning that are, you know, we think 2019 is going to grow a lot on that side. And we've heard of even several teams that have shifted their entire focus towards Lightning and Lightning applications that, you know, that's not public yet. But I would just say that on the Bitcoin side, it's about securing the network in the case of Segwit 2X and the move to do the fork and the No2X movement. I like the impenetrable fortress of validation example that I think it's stopping to crypt that has this example. And Bitcoin running a node is about validating the broader network and validating the broader transactions. And even the miners are creating those transactions and creating those. blocks or creating the blocks of transactions, those still have to be accepted and validated by the broader community. So running a Bitcoin node, you are doing a kind of community service and validating

the broader network and strengthening the broader network. And I think that that's going to become more and more apparent and more and more of a kind of personal thing for people and contributing to the network. But on top of that, I think you're actually going to get this day-to-day use case and much more, you know, just kind of pure applications use case around lightning. And so do you imagine that eventually that lightning will be kind of how people end up using their node more often? Because I don't really know. That's how it is today. Yeah.

The majority of it today is all like. Yeah. What would say 90%? 90% is lightning. 95%. The way to think about the cost of nodes. Because there's not many places, right, where you can use lightning. No.

So first off, people are people, there's this thing. There's a, I, I, I, I, I, forget exactly what the hashtag is. It's like LN trust network or something. There's, there's a hashtag where people have started a chain. It's almost like a chain letter group, right? But they're sending lightning transactions to get to each other just to create this chain of transactions. So there's, there is this kind of like community experience around engaging with your friends in the Barber community and sending this around. So that's, that's one. That's a very base level. I'm going to connect with my buddy. He's got one at his house. I've got one in my house.

We're going to send transactions back and forth just for fun, just to be a part of the Lightning network, right? That's one. Two is that there are these applications. There's Satoshi's place to where you can go and you can draw on this page and you pay for it in Lightning. There are, there's a like a spinner application. There's now a tipping application, tipping.me. You know, there are and there are more people are building more and more applications.

And I think that, you know, where this goes is that we could see applications emerge to where you do go, you, you know, instead of upvoting someone on a comment thread with just a single vote, you're actually upvoting them with a Satoshi, right? You could see a Reddit being rebuilt on top of lightning and all of the, not on top of some other coin, but on top of lightning and on top of Bitcoin to where you're actually outvoting and being able to send Satoshi's as, you know, some mechanism to, and I think Yalls actually is allowing some of this in terms of payments to just read articles today. So there are a variety of applications now. It's still a small set. We're still in early days of this whole network, but I think 2019 is going to see a lot there. And our end goal with

the CASA node is, you know, we describe CASA's end, kind of in implementation set up as a node in every home and a key manager in every pocket. We want to get to a world to where the internet is rebuilt around nodes and around validation and around kind of more personal control of data and also around better key management. And if we, you know, those two things in combination, we can rebuild a lot of applications and services. And so this is just the beginning in terms of, you know, Bitcoin and Lightning are most important.

But we are envisioning a lot more applications, a lot more ways to use those devices now that they're in the home. And we're, you know, we'll be announcing, making a bunch more announcements throughout the rest of the year for that. Yeah, well, that's what I was going to ask you, because I guess like right now, it sort of feels like you're targeting these small niches, right? The people that have half a million dollars or more of cryptocurrency, the people that want to transact in Lightning using their own node at this very small number of places.

But it sounds like your vision is that in the future, this behavior will be more mainstream. Is that what you're saying? Yeah, 100%. Oh, interesting. 100%. And I would liken it to, I mean, in the early days of the internet and you had 28.8 modems and dial-ups and people weren't even dialing up through ISPs. They were just dialing to each other and dialing into message boards and sending messages around in the early days of the internet. And somehow we got to a Facebook and Google and this massive applications-based world where people write entire documents and watch videos and watch TV and all of this data is streaming over the same network. And a lot of of its advertising built, but the incentives around Bitcoin and Lightning and these other based systems, we can rebuild a lot of Internet architecture and a lot of application architecture around these instead of around the advertising-based systems that we've seen before.

And so that's where we see the market going. And again, it's still early days. We're not proposing that the devices are built today are ready for the kind of common person. But the Kasa node is built if you want to try Lightning. And if you want to try these early technologies, it is built for average people to get, to plug into the wall and to just, you know, get up and running. So we do have, we're working on a lot more. I can't share all the details there, but there's, we're turning, what I will say is that we are turning Kasa into a sovereign experience at every price level. And we want to make that easier and easier for people so that it's not just about Bitcoin and Lightning.

It's about broader applications, but about this ability to kind of opt out and to kind of take more control of your data and take more control of your kind of computing life more broadly. And so over 2019, we'll be launching a lot more around that with multiple price points and multiple support points and multiple products that kind of fit into this sovereign experience. All right. Well, we'll see if you guys are able to capitalize on this sort of sentiment that's going against the current model of the Internet. I don't know. I could see it going either way. There's momentum against right now, but also there's a lot of, what's the word I'm looking for? Not the opposite of momentum, but oh, inertia where people are just lazy and willing to sign away their privacy. All right. So I have so many more questions. I didn't get to ask you, but I was going to ask you, is it okay if I just email you a few and then maybe you could write them up and I can print them on, publish them on the website? Yeah, sure. It won't be a ton, but, but yeah, well, I'll just try to. be selective because we didn't get to everything. Yeah, no problem.

In the meantime, where can people learn more about you and CASA? Sure. So you can go to keys.kasa is the primary website. If you want to buy a node right now, you go to store.ca, shto-casa, s-t-o-r-e-a-C-S-A-C-A-C-S-A, and you can buy the Lightning Node today. You can also apply, again, for the key management service. Keep your eyes peeled even in the next few weeks. We have a lot more coming and excited to announce the team's

working insanely hard. And I, you know, as it's, we've got a little bit bigger team than most people realize. And you know, we've got Elena and James and Lopp and a few others. Just the team is amazing. So we've, we've been grinding away. And I'm excited to release some of our new stuff in 2019 and come to see what the world thinks. Yeah. Actually, one of the questions I'll ask you for the, for to put on the website is about your team because I do think they have interesting backgrounds. All right. Well, thank you so much for coming on Unchained. Of course. Thank you, Laura, for having me. Thanks so much for joining us today.

To learn more about Jeremy and Kasa, check out the show notes inside your podcast player. New episodes of Unchained come out every Tuesday. If you haven't already, rate review and subscribe on Apple Podcasts. If you like this episode, share it with your friends on Facebook, Twitter, or LinkedIn. If you're not yet subscribed to my weekly newsletter, go sign up right now on Unchainedpodcast. And also, go check out my other podcast, Unconfirmed, if you haven't already. Unchained is produced by me, Laura Shin, with help from Rayling Gallup Holly for actual recording, Jenny Josephson, and Daniel Less. Thanks for listening.