Identity Solutions for Web3

Transcript

going through lunch um thanks everyone for coming my name's dan kelleher i'm vp of engineering at civic i'm going to talk a little bit about identity on web3 past present and future a lot of the focus is going to be on tokens tokenized identity that's probably not much of a surprise but i will talk about other things as well oh i always forget to properly introduce myself and give people links that they can follow part of this is i really want to continue the conversation after this talk after this conference so please talk to me afterwards if you have any uh opinions about identity on web3 in general

or um if you don't catch me afterwards then talk to me on any of those things uh i will over share now over compensate because i usually forget to put up that slide and tell you more about myself than you need to know really so i'm from ireland but i live in berlin and i've been in the space the crypto space slash decentralized identity space those are actually two very different spaces for about four four and a half years and i like dancing and listening to jazz music but that's irrelevant enough about me let's talk about you for a minute um i think we've got enough time to go around the room do you want to stand up and introduce you

god imagine imagine somebody trying to force you to put information about yourself public that you didn't want to put informat put out public but i would like you all to think a little bit about uh how you answer that question when people ask you it in various settings right business settings or meeting the in-laws for the first time or going out on a date usually those answers are different i i guess and um [Music] web 2 has these very convenient guided rails for for allowing us to curate identity in this way right uh linkedin profile will look very different

to our instagram profile facebook profile uh our tinder profile and how does that work in web three right when we take away the the guide rails when the guide rails are there for a reason right to make uh to come to convince us to give up our information largely when we take that away and say right you're on your own this is you now is it your space this is your private key go have fun with it how do we um present ourselves okay so i reckon there's probably one or two of you in the room that present yourselves in the same way right you go on a tinder date and you talk about your nft pro portfolios

please don't do that that's not a good strategy that does not work there are probably other actually i don't know i was going to say there were others of you in the room i don't know if there are any of them here because this is a kind of a community conference but i reckon there are some people watching later on at home on youtube that are sitting here kind of with their arms folded and their eyebrows raised and going like what are you talking about identity on web3 i trade and defy i have a private key i sign my transactions what more do you want from me and that's that's a legitimate in my view uh position to take and back when i started in the space

that's really all there was there was no concept really of identity on web three there was barely a concept of web 3 to be honest and that all went out the window with those guys nfts right not a surprise that really changed people's perception of web 3. it brought non-technical people non-financed people into the space and somehow like it or not people really identify with these things it starts to form a it's a new aspect of their identity and it's not just pictures it's the fact that they own them in some form or another the fact that it's theirs has an influence

and it evolved as we all know over the last couple of years not just to be i own this possession of some kind but i'm also a member of a group a member of an inside group a member of a community an organic community as opposed to one that is kind of curated for us and guided in the web 2 sense and it doesn't just stop at profile pics of course we have proof of attendance tokens like the one we received for attending this conference and others we have tokens indicating that we made charitable donations to groups that we that we agree with we have tokens that represent memberships of all sorts of communities

governance tokens for dowels in-game items the list is really going on and on and developing as we as we um invent new things to do in the space and they all get combined into our wallet in the form of tokens and then we present those to other people and that's right now is the de facto way in which we represent our identity on web3 more or less right there's lots of variants to that but it's the de facto way in which we do it in fact the word token itself has sort of changed its definition through this process over the last couple of years it used to be

basically this address has this amount has x amount of something right so you would it would be a reasonable question to ask um how many what tokens do you have and how much of them okay it might be a slightly impertinent question to ask but it makes grammatical sense anyway nowadays a more common question maybe or at least a question that makes grammatical sense is what does this token represent and so the word token now means something more like this property property x can be associated with this individual or entity and that's if you think about it that's quite a huge shift

and they're often by the way you know these soul-bound tokens or non-transferable tokens i know we don't we don't all love the term soul bound if you don't like it just pretend i'm saying something else when i say it because i might accidentally say it a few times um there you go um but you know what i'm getting at and they are effectively the de facto standard like i said and we we know that there are risks right with this sort of pattern there are concerns about privacy about how you who do which issuers do trust what happens if they disappear does that centralize control in a handful of of issuers

interoperability and and so on another important one is how do you keep your data well i guess one of the most important ones is how do you keep data private but still share it publicly with trusted counterparties counterparties that you choose is it an all or nothing is it i keep this data completely private or i make it available to the inside the outside world the entire outside world and another issue with tokens is largely or not largely but frequently this choice is taken away from us right we get tokens pushed to our wallet um right let me stop for a second i want to talk a bit about civic

um so civic as i said we've been in the space for actually before i started we've been in the space for five or six years and again as i mentioned when we started there was no real concept of a web 3 identity um so what we focused on but we were actually issuing kyc tokens on bitcoin back in the day of all places if you went through a kyc process with civic in 2017 there's an attestation to that on bitcoin and at that point we were offering a self-sovereign kyc service to non-law

companies who were looking to provide a more secure more privacy conscious kyc solution to their customers but as the space has developed we are now we have now moved towards providing an identity layer or identity primitives and products for web 3. um we still believe in issuing tokens by the way i'll get to that in a moment um because there are although there are lots of concerns about it there are also lots of benefits to it um one of the products that we're releasing this summer it's kind of an alpha mode right now it works on solana some features work on ethereum too but

there's more ethereum features coming in in the coming months is civic me it's a essentially an identity portal where you can combine aspects of your identity from multiple chains that means nfts that means passes that i'll get to in a second and it also means personal data that you want to store and share with others on a permission basis and another product that we that we talked that we uh have been working on and we have been had live in production on a couple of chains for the last year is civic pass civic pass is that sbt token um platform that i was telling you about and

okay i hope you like metaphors because there's a metaphor coming um i'd like to think of civic pass as like sunscreen for sbts okay i'll um this metaphor worked a lot better about two days ago imagine it's super hot outside we all love going out in the sun right it's it's a nice place to be it's fun it's attractive to go outside and just play right but if you don't wear sunscreen you're going to get burnt and you might not get burnt or you might not feel the damage immediately it may take several years before the damage accumulates sunscreen for sbts means that we provide built-in to the system protection against the worst components

of issuing tokens associated with someone's identity while still gaining the benefits the playing in the sun bit of having tokens in the first place before i go into the mechanisms by which we protect our users i want to talk a little bit about uh some of the benefits or one particular benefit which is why we do it in the first place as i said tokens are the de facto way in which we represent identity the moment on chain um and one of the benefits of that is that it makes them super easy to integrate into smart contracts

so smart contracts can cheaply evaluate if a if a token exists in your wallet there are mechanisms using zero knowledge proof and that attestations as well but they don't solve all the problems we can get to that um maybe off offline but essentially if smart contracts across multiple chains can check simply if you have a token associated with your wallet we have civic paths integrated into d5 protocols that want to protect against or restrict access to only members of non-ofx sanctioned countries and and people who are not on ofx sanctions lists in order to attract um

market makers who would otherwise be unwilling or unable to take part and we've seen how regulation is coming into the d5 space sometimes it's coming super ham fistedly having primitives like that in the space already is a good way of convincing lawmakers that there are solutions to the concerns that they have already built in they just need to be adhered to we also have civic pass integrated into nft platforms both for tokenized ownership of real-world assets and for bot resistance and finally we also have civic paths

integrated into governance platforms to provide civil resistance and proof of humanity how do we do it safely well we've based um the design of civic paths on a number of core principles or best practices i'll go through them relatively briefly now the first is uh privacy right this is the one the main one that we're concerned about the uh the more you issue tokenize that passes the more proof of attendance tokens you accumulate in your wallet the more information you're giving up inadvertently and you can't take it back there's no right to be forgotten here

it's there forever if it starts happening widely then there's a kind of a snowball effect we issue only very high level of access control passes that are merely representations on chain that you have a particular verifiable credential for those who don't know a verifiable credential is essentially a set of claims that are issued from a trusted issuer to a subject and those claims are signed by the issuer they are then held by the subject so that they can be shared to anyone that they want and that's necessary because in a lot of cases

third parties require this information for regulatory purposes they definitely don't need and don't want to have that information on chain all they need on chain is that something that the smart contract can check check to make sure it exists if that pass exists then the the user can transact if it doesn't they can't they don't need to have see anything more than that there's a tendency there's a temptation the naive approach would be take all the claims stick them all on chain right i'm over 18 put an over 18 claim up there i'm under 19 but i didn't get that one but if i would before under 19 put that one under there you see how it snowballs right that's that's the design principle in civic paths not to do that um the other sorts of paths we issue are

similar they are simply representations on chain of a verifiable credential or some uh fact about the user that doesn't give away any personal information interoperability so we believe that i think a lot of us believe that the future in web 3 is multi-chain we're either talking about l1s and l2s or we're talking about non-evm chains which may require you to have then different key material different wallets and we believe that and civic pass is designed to allow these passes that are issued on chain one to be transferred trustlessly to other chains and we use dids to connect people's identities across multiple chains into one unified

identity another aspect of that is pluralism of identity the ability to keep your your personas separate if you so choose just like you might choose to have different representations of yours of your personality on web 2 platforms like linkedin and tinder so too must that be possible and it's even more possible on web3 and finally an important one is decentralization remember a few slides back i mentioned about uh how do we trust the issuers who are the issuers um and what happens if they disappear

so when we talk to smart contract integra smart contract developers and and teams that are building d5 applications they have the sensible question well does that mean if civic goes away or civic changes its mind about what it wants to do that that um our smart contract doesn't work anymore and so no we built that into the protocol as well so the protocol is the the civic past product is based on the identity.com gateway protocol and in the gateway protocol there's this concept of a network so a network is essentially a dow-like self-governing structure of issuers that agree to issue passes based on a set of common

uh rules and the protocol is designed such that a pass issued by one issuer in the in the network is treated equivalently to a pass issued by another so when you integrate your smart contract with civic pass you're actually integrating with a gateway protocol network and that can have multiple issuers in it um we're interested in integrating with issuers on ethereum by the way and in smart contract developers on ethereum we're currently on a couple of chains but not yet on ethereum we've built the the groundwork but we want to do the last mile with some with some customers or some integrators so please catch up with me on that as well but that decentralization i think is a

huge difference to um typical kind of nft voting or other similar sort of voting mechanisms or gating mechanisms that are just if you have a token issued by this address then you're allowed to get in if you don't then you're out of luck and um we want to make this more open and i find that this network pattern as well creates a nice seam you know a proxy between the fully trustless decentralized smart contract component and the uh the issuer component that inherently requires a certain amount of trust this network builds the trust and then you you trust the network but there's so much changing i really

don't want to leave the conversation there i'm going to finish up now but um please get in touch i've i've got so many opinions and thoughts about how the space should be and how the space could be and i'd love to get involved with with discussions with you all and maybe you might have some questions now as well thanks very much hi great talk um the interoperability aspect how does that how do you guard against other issuers using the same gateway protocol as you from sort of influencing your civic id your

civic identity profile um so i'm trying if you're saying using the same gateway now you mean issuers joining a network that they haven't been accepted into no so you're saying that the decentralization aspect is if civic folds then is it that protocol that you're using is interoperable with other ones right yes how do you how does civic guard against that same network being used to sort of influence your civic id yeah so it's it's um it we're developing that aspect is kind of a bootstrapping side of things but it's it's envisioned to be essentially a dow so there will be a number of uh constraints or requirements that uh issuer would need to meet in order to be accepted into the network and once they're in there will be constraints and

requirements that they will need to meet year on year to stay there we're also we've also in the white paper for the gateway protocol there's a staking mechanism that will slash stake if if uh they if too many uh uh passes that they issue are revoked but the the network sees the the consumers the smart contracts see just the network you can check which actual issuer civic or anyone else is behind the pass but they just see the the parts and then the network associated so at the moment it is possible that someone else on the same network can almost influence on the on the reading like a reading approachable level your id um they they can issue a pass against

your identity yes against your decentralized identity yeah and so it's up to the dao that's running the network to ensure that no bad actors join okay but what they what it doesn't say what it doesn't look like is that this past comes from civic this past will come from some other issuer that is on the same network and from the user's perspective it's possible to check that it is from civic so you're filtering it for your system you're doing only from civic that is possible exactly cool thanks um how do you think how are you thinking about the difference between certificates and quality or rankings so there's like okay i i went to a

university or and then there's i got these grades or i was the number one number one person so how are you because yeah a certificate is just saying you did you know you did graduate it's a good question um so the simple answer is that if there's any kind of quality or or sub data i guess involved in the in the credential then you pass that to the third party the relying party off chain that's a peer-to-peer um communication between me and the organization that's interested now if there's a smart contract that says i'm only going to accept people who got zuma come lauda ohio in a particular university we would personally be very concerned about representing that on

chain now that doesn't preclude other people from doing it and at the end of the day it's a personal choice matter we have some protocols that allow you to derive passes from other passes in a trustless way so you can basically go here's a basic pass here's some additional information here's a more specialized pass so we do allow for people to do that refine their tokens so to speak but i for one don't love that pattern because as for the same reasons it just leads you back into the same pattern as before might be something i mean people some of these things like a university degree is a prestige factor so if you have a first or someone come out or something you'd want to present it and there's probably nothing particularly wrong with that but if you're forced to

because the issuer issues everything at once then that's a huge problem i guess the other question i would ask is also about the certification of the validators themselves right so you're getting a verifiable credential but the credential issuers reputation like whatever you know the name of the college for example like oh is this a good issue or a bad issue or is that also something you're thinking about um we are thinking about it we're not building many tools for it right now um but we have a an open source wing like i said identity.com and they're always accepting uh submissions and proposals and suggestions it is a common

concern or a common question across the entire um decentralized identity space and there are interesting proposals such as again staking reputation in order to uh at least guarantee to some extent the reputation behind it you obviously you could also you have dids that have certificates pki certificates on them so you can say this issuer owns i don't know gov or dot dot whatever they have edu or something like that it's a hybrid between the for the web 3 approach and the pki approach which is in my view a totally reasonable one i think we're done are we

all right thanks very much everyone have a nice lunch