Web3 without mnemonics: AA×Passkey – How to define the next decade of crypto?

After spending a long time in the Web3 ecosystem, even if you are careful and lucky enough to avoid losing your assets due to theft, you’ve surely heard people asking for help like this: “

I never took screenshots, nor did I share my mnemonic phrases with anyone. I just used my wallet as usual… why did my assets disappear?” The common denominator among these cases is that victims have no idea how their systems were compromised.

Some people installed corrupted browser plugins without realizing it; others stored their mnemonic phrases in their phone notes, which were then synced to unknown servers; some had malware on their phones, causing clipboard contents to be silently uploaded; and there were even cases where people entered their mnemonic phrases on fake websites, and within seconds, their wallet balances became zero.

This isn’t an exaggeration. In fact, most phishing scams in the crypto world involve a common flaw—mnemonics. This article will explain why mnemonics are becoming the biggest vulnerability in asset security, and how account abstraction (AA) and Passkeys could potentially redefine the concept of asset ownership.

I. The limits of EOA mode: “Mnemonics” become a curse

We must admit one fact: the problem with EOA accounts isn’t simply being “not secure enough,” but rather that they’re inherently too complex from the start.

As is well known, in the traditional EOA model, mnemonic keys are the cornerstone of encryption. A seed phrase consisting of 12 or 24 words represents absolute control over the assets on the chain. This also constitutes the most prominent feature of cryptocurrency security in the eyes of newcomers: “Private key/mnemonic key equals asset”. As long as you hold this key, neither exchanges nor validators can freeze, confiscate, or override your operations. However, this complete decentralization is also like a double-edged sword. It represents “absolute control” but also means that “single points of failure” cannot be avoided. First of all, there is no way to “regret”. Once your mnemonic key is leaked—even if it’s just a screenshot taken years ago and then copied or synchronized—your wallet becomes forever insecure, and you cannot reset the mnemonic key like you can do with passwords in banks, Alipay, or WeChat apps. The only solution is to abandon the wallet and transfer assets. But this means that if attackers are faster than you, you have no chance to “undo” or recover anything. Secondly, it serves as a “perfect honeypot” for hackers. After all, mnemonic keys give hackers too much power. Trojans, fake wallets, disguised plugins, phishing websites, fake customer service agents, etc. – hackers don’t need to break through the robust cryptographic defenses of the blockchain. They simply need to exploit your lack of awareness. All attack routes ultimately lead to the same goal: to induce you to reveal those 12/24 words.Finally, for modern users who are accustomed to using FaceID and fingerprint payments, understanding and securely storing a paper-based mnemonic phrase represents a significant cognitive challenge. This not only hinders the widespread adoption of Web3, but also imposes a psychological burden of worry about losing such phrases.

It’s like guarding a door that can only be opened with the same “key” – a key that is both exposed in users’ daily operations, as well as vulnerable to risks from various devices and systems.

It is against this backdrop that, since 2022, wallets that rely on mnemonic phrases or do not have plaintext private keys have become increasingly popular. From MPC technology to CA wallets, people are seeking a better solution – one that allows users to maintain control over their Web3 assets, while still using a method as simple and secure as using FaceID to unlock a phone.

At this point in time, with the combination of Account Abstraction and Passkey technology, we may indeed be on our way to ending the era of mnemonic phrases in the next decade.

II. Passkey: Turning Yourself into a Key

If Account Abstraction serves to liberate accounts from the reliance on a single private key, allowing for a more recoverable, upgradable, and configurable system, then Passkey represents the ultimate tool for transforming user experiences.

Many people may be unfamiliar with Passkey. However, as a password-free login technology based on FIDO standards, it has already become the standard for the next generation of password-free technologies, promoted by tech giants like Apple and Google.

In the world of encryption, its significance is particularly profound.

Simply put, Passkey is a digital key stored in the security chip of your device (such as a phone or computer). You no longer need to remember, save, or enter mnemonic phrases; you can simply use biometrics like Face ID/fingerprints to log in and signatures.

In fact, many people already enjoy the convenience offered by Passkey without even realizing it: when logging into an app on an Apple device or browsing a website, you only need to “scan your face,” use your fingerprint, or enter a PIN number—all this can be done without having to enter a password.

This experience is addictive because it’s both seamless and secure. Therefore, if Web3 wallets support Passkey, users could theoretically avoid touching their private keys at all. Even with account abstraction, the process of transferring funds could be completely automated, creating an unprecedented “seamless” experience.

So why is Passkey inherently more resistant to phishing compared to EOA models? Because it possesses two capabilities that traditional mnemonic methods cannot achieve:

● Your private key never leaves your device, and it cannot be “stolen” by hackers. Mnemonic phrases are just a string of characters that you can share with others. But Passkey is tied to your hardware device, so your private key never leaves your device. Hackers cannot trick you into providing your fingerprint or facial data through phishing websites or corrupted browser plugins.

● It eliminates the risk of fake websites from the ground up. 这也是Passkey最核心的杀手锏之一，依赖WebAuthn/FIDO2的绑定机制，Passkey协议会强制校验当前网站的域名，意味着即使你误入了诈骗网站(譬如很多发短信骚扰的imToken高仿诈骗网站)，你的设备会发现域名不匹配，拒绝进行生物验证，这是系统级的防御，不依赖你的人工判断。

同时，Passkey的体验也足够丝滑，不抄助记词、不截图、不备份，只需轻触指纹或刷脸即可完成登录、签名与授权。

也正是因为如此，AA配合下的Passkey，在Web3世界可以视为是一种体验与安全同时跃升的方案，而不是让用户更小心学习使用的补丁。

三、下一代的Web3安全与体验哲学

从这个角度来看，当AA遇上Passkey，我们终于能构建出一种更符合直觉、更安全、也更面向未来的账户模型。

你可以这样理解这种新的安全与体验哲学：

● 人即钥匙：账户由设备本身保护，Face ID/指纹就是你的签名;

● 物理隔离：安全是硬件级的，存储在安全芯片中，不能被导出，更不会被木马读取;

● 云端漫游：凭借iCloud等同步方式，账户可以在多设备间安全漫游;

● 系统防御：It doesn’t require users to go out of their way to distinguish between legitimate and malicious websites. Instead, the system automatically intercepts potential risks in a more intelligent manner.

All of this constitutes a new paradigm: instead of relying on users to learn and protect themselves, the system takes care of everything automatically.

Take imToken Web as an example. It’s a web application that operates without any management layer, with tokens being the core element. This allows users to create or log in to their accounts quickly and securely, without having to set up or back up private keys/mnemonic phrases. They can enjoy various token-related features anytime, anywhere.

For instance, using imToken Web gives you a “four-no” experience, meaning there are no barriers to use it.

● No barriers to creation: You don’t need to write down 12 words by hand, nor do you have to worry about mistyping mnemonic phrases. Just click to connect to your wallet, verify your Face ID/fingerprint, and your account will be created instantly.

● No fear of phishing attacks: Since login relies on Passkeys, fake websites cannot be verified by domain names, so they can’t trigger signature verification. Your private key will never be exposed.

● No worries about gas costs: As an AA wallet, imToken Web supports direct payment of gas using USDT/USDC. You won’t face any difficulties just because your account doesn’t have ETH available.

● Seamless device compatibility: With system-level synchronization capabilities, your PassKey can be synchronized between your Apple or Google devices. Even if you lose your phone, you can simply log in to your system account (Apple ID/Google) on the new device, verify your biometric information, and your account will remain secure and recoverable.

What’s more interesting is that this low-barrier experience opens up entirely new ways of interacting with the system.

Based on this, you can even send tokens using imToken Web, just like sending red envelopes. For example, you can choose to “send via link”, set the amount and expiration date, then create a link and send it to anyone via WeChat, Twitter, or Telegram—even those who don’t have a wallet.

The recipient doesn’t need any initial setup; they simply click on the link, and can securely and easily create an account and receive the assets using a “passkey”.

In conclusion,

In the future of Web3, it shouldn’t be just geeks who can survive.

In a world full of uncertainties like Web3, tools like imToken Web, which combine cutting-edge security technologies like AA & Passkey with a simple user interface, truly reflect the importance of wallets as a means to explore opportunities in the next decade.

So, if you’re tired of worrying about storing mnemonic keys, if you’re afraid of becoming a victim of phishing attacks, or if you simply want to recommend an encrypted wallet that’s easy to use without any training… then it’s time to look forward to or try out a future without mnemonic keys.