Simple but secure: solving blockchain's biggest UX challenge

There is a challenge when it comes to developing blockchain applications, and that is ensuring complex processes are simplified for the user without compromising the security that underpins them. Experienced users may be able to navigate wallet approvals, smart contract interactions and transaction signing, but for those newly initiated to blockchain, these additional steps can make transactions feel overly complicated. It could even deter them from continuing to use the application in future.

So, does the developer have to choose between security and simplicity? Or is there a way to maximise user experience without simultaneously maximising risk?

Ensuring transactions are easier to understand

Focusing on ensuring an application is technically robust, without identifying where users may struggle to understand the process, can prove a significant barrier to adoption. Equally, very few users will want to learn every single technical detail about every transaction before being able to fully utilise the application. So, the developer must create an easy-to-understand experience by focusing on the user interface and experience as a core part of their work.

Take for example, transaction approval. An experienced user may understand that before they can stake 100 XYZ tokens, the relevant contract may first need permission to access these tokens. Whereas a new user may see two apparently similar actions (the approval to access and then the approval for the transaction) and wonder why.

To resolve this, developers can choose to explicitly show the user the journey through the process, identifying clearly what they must do at each stage and making them aware that two approvals will be needed. Or the interface can be designed so that both actions can be implemented at the same time. 

Either way, users must be able to see what they are approving, understand what happens next, and then recognise when the process is complete - an experience which they will be familiar with from transaction flows in conventional applications.

Equal priority for security and useability

The importance of a simpler user process cannot come at the expense of security: the application is handling instructions that can ultimately move assets with real monetary value, so secure state management is an essential development criteria.

A crucial consideration is how transactions are signed, with the potential for a wallet instance to be created directly within the browser with the user's private key, the transaction prepared, and then the private key used to sign and broadcast it to the network. However, while technically possible, if the application suffers from a cross-site scripting vulnerability with such a sensitive piece of information within the browser environment, then a malicious script could potentially access the key and use it to sign transactions. Equally, hardcoded keys can be exposed through front-end code or source maps, or an attacker could alter details if they gained control over the JavaScript or user interface runtime.

With significant repercussions if any of these scenarios happens, a more secure approach is to have a dedicated software or hardware wallet – creating an important separation. This means that while the app prepares the transaction request, the wallet handles the private key and signing process. 

By ensuring the user receives a recognisable confirmation step to review what they are approving, and avoiding the application handling one of their most sensitive pieces of information, this shows how security and user experience can complement each other. In this instance, the separation also provides peace of mind for users.

The wider front-end experience

Secure transaction signing is just one part of a complex jigsaw involved in developing a robust blockchain application – and the front-end itself must be treated as part of the security architecture.

There are multiple interconnected risks associated with the front-end, but all of them have mitigations which can be developed without negatively impacting user experience. For example, interfaces should be designed to minimise the risk of users being misled about what they are approving or where they are sending assets, to combat phishing and UI manipulation. Protections are also necessary to prevent malicious code from interfering with behaviour through cross-site scripting and browser injection.

When it comes to dependency security, third-party packages need to be carefully managed, particularly when they relate to authentication or other critical functions – not least because compromised dependences can introduce vulnerabilities into an otherwise secure application via supply chain attacks.

Lastly, smart contract interactions can help prevent the application from interacting with unintended or malicious contracts, for example through whitelisting trusted addresses.

Building blockchain applications people can trust

The challenge for developers is not about making applications more secure or more user-friendly. It is about achieving both at the same time.

Users should not need an advanced understanding of blockchain architecture for every action they wish to undertake. But there is a balance between keeping technical complexities behind the interface, and ensuring users have enough information about the transaction process –simplifying the experience should not mean hiding information that is genuinely needed in order to make a safe decision.

The strongest blockchain applications will be those which achieve the balance: reducing the technical burden on users, while still giving them clear information and meaningful transaction control.

Ultimately, that's what the blockchain user experience (and therefore the adoptability of the application) comes down to: making complex technology easier to use without compromising on security.