EB109 – Tim Pastoor: Rethinking Identity As A Decentralized Web Of Trust With Identifi

Transcript

[Music] this episode of epicenter Bitcoin is brought to you by Ledger makers of the unplugged NFC Hardware wallet have peace of mind in knowing your private keys are protected by industry standard physical security go to Ledger wallet.com and use the offer code epicenter to get 10% off your first order hi welcome to epicenter Bitcoin the show which talks about the Technologies projects and startups driving decentralization and the global cryptocurrency Revolution my name is

Sebastian kuo and I'm M Roy today we are going to talk to uh we're going to talk about identity and reputation with Tim pure he is an entrepreneur and his startup is called two-way doio they're building on a protocol called identify which tries to build uh a Next Generation decentralized identity and reputation Network so first we'd like to begin with an introduction from Tim Tim can we have your intro I uh used to work in it from age 17 um and I work my way up from a from a help desk uh support engineer all the way up to it manager um and I got interested in Bitcoin uh

relatively early on I was already working on complimentary currencies before Bitcoin uh but it took me a while before I really un understood the importance of uh of Bitcoin and uh the whole aspect of decentralization so somewhere in 2013 I um I started thinking about the idea of what if we could decentralize identity so what if we could issue our own identities without having a government or anybody else uh issuing it for us so we could decide for ourselves uh which data and which Communications we want to link to our own identity or identities and that's how it all started and somewhere um halfway 2014 I bumped into Marty momy uh also known as Sirius within the

Bitcoin Community who was the first developer after Satoshi to be working on bitcoin and um when I bumped into him um I asked him when do you think we'll see a truly decentralized uh identity and reputation Network or or something that comes close to that and then he showed me identify and it didn't take me very long to uh to see that that was actually something I was looking for and I was trying to come up with uh and it was already several steps ahead of me um so from that moment on I got really interested in identify and I think about three months later I quit the day job to uh to work in this full time okay so U you've talked that we don't have a really good decentralized identity

system today but we do have centralized ones like I don't know Facebook some some people might construe Facebook as an idti system system and you always have the government ones what are the big challenges with these systems that you think necess necessitates a decentralized solution well for example if you look at uh Facebook you uh just to mention one because it basically goes for most centralized identity systems out there uh when you look at Facebook then you create an identity on their platform so thereby it basically becomes their identity um and anything that you upload to Facebook is linked to your identity um but they will always keep ownership

of that so I think that's a that's a big problem because this way you don't have any control over your own data uh of your own Communications for example when I uh log into Facebook uh the connection itself is encrypted then I send you a message and on your end it's decrypted but Facebook will always have the master key so they will always have the ability to uh to decrypt that information so this way there's no real there's no real privacy there's no real encryption because um they always will have control over that information so I think that's a big issue where it comes to uh to centralized identity systems um and another issue but that's that's mostly social identities because there are

several types of identities you have your the identity that you are yourself uh which which lives inside of your head uh you have your legal identity so that's probably the the the one that's being issued by the government for example um and you have your social identities um such as Facebook Etc but also in the offline world so there are several types of identities and nowadays most of them are issued through centralized parties so you don't have any control over that and they basically also have control over the revocation of any of your identities because they can simply just pull uh your identity and um from there on you have no control over it anymore whatso ever so this way

people they people have the illusion that they have their own identities on the internet but most of the time they they really don't no so I guess as a thought experiment you could say that the only sort of decentralized identity we have is the one that we construct ourselves like if I you know tell this group of people that uh I'm a startup founder and I tell this group of people that um I train like particular martial arts and I tell this group of people that I like kittens um well that's the identity that I construct and then I'm the one that controls that so in a sense uh that's probably the up until now up until we

have these decentralized system probably one of the only forms of decentralized identity that we have right uh yeah I agree um so so when you when you name that example where you tell people different things about yourself it's where you the use of uh in an electronic fashion it's it's a user the person uh has control over what information they want to share with other people and that's that's basically the only decentralized form we have right now and decentral decentralization really means that each uh party so in this case each identity can control for themselves which information they want to share with uh with other parties um so the user has to be in control in a

fully decentralized system so with all these traditional centralized types of identity systems that that we've mentioned so far we've mentioned Facebook we've mentioned government IDs and and there others um what are some of the problems that we see there you know identity theft is obviously one of them what can you talk a bit about that and perhaps some of the other issues that uh that these systems uh present yes of course um when you look at identity theft for example it's it's mostly because um if I want to have my identity verified by certain parties if I want to trade say Bitcoin on a certain website um then sometimes they require me to send a copy of my identity documents um

there are basically three issues with that the first one is that physical documents have security features and as soon as I make a photoc copy of that the security features disappear because that's the whole idea of the feature um so as soon as I send anybody a copy of any of my physical documents um the security features disappear so you will never be able to really verify if that that's that's a real copy or if it's Photoshop um next you will have to send it over a communication Channel where it can be intercepted um by man in the middle attack for example so um that's the second issue there and then the third issue is that once it does arrive on the other at the other end of the

line um then it all gets stored in a central database so this way um you create information Silo with a lot of sensitive information with a lot of sensitive data and when you do that you become a Target to hackers so the whole thing the whole idea here is that if you don't have to process and send sensitive data then the the chance of becoming a target for hackers also decreases and if somebody let's say I create an identity which is verified by a bank for example I would simply have in a decentralized system such as identify I would simply have a public key with a verification from uh signed by the private key that belongs

to the public key of the bank for example and then it will only say that I'm over 18 or that I'm a citizen uh of a certain country so if somebody steals that then they will only know that a public key belongs to a person that lives in a certain country or is over 18 but they won't have my social security number then they won't have my date of birth or any other sensitive data that can be used for identity FR uh identity thrud so uh you've you've mentioned the identify protocol in uh in this conversation can we know what what it exactly is all right yeah sure it's um it's not very easy to explain because it's a relatively New Concept um the software itself identified like I said earlier

was created by Marty Momi uh he started working on this back in 2013 and the software itself is a fork of the Bitcoin demon um so it uses the the the same sort of networking mechanism um it uses the same sort of command line interface Json RPC API the same public key cryptography but what it doesn't use is um uh mining proof of work scheme uh or an objective logic consensus um so the major difference is that there is no blockchain so if I uh store anything within my own database I will simply connect to other peers in the network I will start flooding this information to

other PE on the network and if another note trusts me then they can sign the public key of my note and from that moment on they can verify any information that I'm sending thereby they choose to store it in their own database that's a very brief summary of uh of how it works but feel free to ask because it's a bit of an abstract concept at the moment yeah so so first of all let's let's let's go to one key difference between Bitcoin and identify which is that in Bitcoin there's a consensus mechanism and a global database that that keeps let's say an objective record of Truth like you know what has happened in the network till now because you can look at the database and and and and see all the entries in

it in identify there is no consensus which means there is no Central global view of truth right right so um there is no objective consensus so when you look at Bitcoin you want to make sure that coins haven't been spent before um and the majority of the network is basically always able to agree on whether coins have been spent or not when you look at Nakamoto consensus this is purely about objective logic but where it comes about where it comes to Identity uh it's mostly all subjective logic and with subjective Logic the problem is that a majority of people will probably never agree on whether a certain statement about the world uh an identity uh is true or false

so I could say that blue is a nice color but you could deny that um I could say that you are a good person a good Barber or good car salesman and somebody else could refute that information so that's why the cons why the consensus mechanism itself uh doesn't work like uh it does for Bitcoin and so the consensus mechanism is purely subjective so I could verify for example that your Facebook account belongs to you somebody else could deny that and then anybody who has me in their trust network will see that I have verified that your Facebook account belongs to you but if somebody else has denied that then the people within their trust network will see that according to the the people uh or the the person they trust um that

they say that it is not true so in in essence what you're saying is like in in Bitcoin if you are a node you have this one database that is the global record of truth and you can verify that that Global record is correct because you can always verify the proof of work in in identify when I'm running an identify node I basically have to choose a set of peers and uh I can see what what these peers have done in the past like who this who these peers have approved as being good or not being good and depending on my peers I develop my own view of the of the world the world

meaning the identities and reputations of other people and all of the users of the identity system can come to different conclus conclusions about the state of the world yes that's correct so um like like the example I mentioned with the barber um when I'm looking for a barber I may be looking for one which is cheap and nearby um but somebody else may be looking for a Barb but that is just very good and they don't really mind to travel really far or pay a lot of money for that so if I say a barber is good then the people within my network pardon me will probably uh know what I mean by that or they will have

their own interpretation of what I mean by that and this is where the subjectivity comes in because um what's true for one person can be false to another one let's take a short break so we can go to Paris I stopped into lame bcoin the House of Bitcoin at The Ledger offices and I met with Ledger CEO Eric lar so he could tell me all about The Ledger wallet Chrome app The Ledger wallet Chrome app is the perfect companion app for your Ledger hw1 or Nano we have very powerful and cool feature you can use multi accounts for instance personal accounts business accounts this is very useful also when

you want to make a transaction we use a second Factor verification you can either use a physical security key or cryptographically securely pair your Android or iOS smartphone to your Nano this way when you issue a transaction a payment the transaction will pop up on your Android or iOS phone and you will be able to verify the amount and destination address finally The Ledger Chrome app has an API with which you can easily integrate third party applications for instance if you want to create a multi- signature account with coin guide or cop it will be done using The Ledger wallet Chrome app Ledger is making Hardware wallets easy and

convenient without compromising on security if you want to get a secure setup for storing your Bitcoins go to Ledger wallet.com and use the code epicenter to get 10% off your order we'd like to thank Ledger for their support of epicenter Bitcoin if you are actually not using Global consensus then why are you using the Bitcoin D software at all why why are these things linked at all um well I think uh right now I have to speak for for Marty the the man who uh develop the software itself but when I look at the the networking mechanism uh so the way you connect to other peers the way information is being flooded to the network that's basically uh for for a large part the same as how the Bitcoin

demon Works um the same goes for the public key cryptography uh the command line interface the the the Json RP C API Etc so there are a lot of uh similarities between the two but yeah the major difference is the is the mining mechanism or the Nakamoto consensus so so basically what he he had this technology that had many of the components that he was looking for and and and use some of those components to to build to identify while removing the Nakamoto consensus objective consensus mechanism and replacing it with a subjective consensus mechanism which subjective consensus can we call that

reputation is that synonymous um yeah you could see it as reputation but reputation is more than just what I say about you um so it's more than saying if a person is a good Barber reputation is also if I um verify or deny deny that a certain connection belongs to your identity um so it's it's it's it's much broader than just um um giving rating for example like you do on eBay or uh or on Uber or Airbnb okay and I'm interested in this web of trust this trust network uh so web of trust is a terminology that has been around for a long time it's used in pgp and other uh trust-based systems uh

that have to form the sort of subject subjective consensus around facts can uh can you talk about how the web of trust is is built in identify like if if I'm if I have an identity on identify uh how do I what does that look like like how do I link to other people that and how do they um how do they uh provide uh assertion or not that some facts that I'm saying about myself are true how does that work uh well when you look at the pgp web of trust a great example out there is the Bitcoin OTC the Bitcoin over theor web of trust um what you basically do is you create create a

key pair so you have a public key and you have a private key and if I choose to sign your public key with my private key pardon me then I um thereby add you as a first deegree connection to my own web of trust so uh I can do this with multiple identities and I I create a personalized uh trust Network in this way and if I add you to my uh uh as a first connection to my network and for example if I don't have mayare um in my own network as a first connection but you do then mayare becomes a second degree connection through you uh for me so this is how you create your own

network and how it works to uh in degrees so it works in an exponential way so if I have let's say that I would have uh 200 people um within my own network on a first deegree level and if these people have um let's say also a certain amount of of people as first-degree connections which I don't have as first-degree connections myself then I might have 200 people in my first degree network but to a second degree I might have 50,000 people in my network and in a third degree I might have already have like seven or 10 million people in my own network so this is how you create your own network and you start relatively

small but the larger it grows uh the the more exponential the the the power of the network becomes so the the further it scales the the better it works okay so I'm interested in also like how what what does that look like like so for instance if we imagine uh a user interface for for identify so say you have a mobile app um we can talk about the client in just a minute because what's interesting about identify too is that you don't need uh uh heavy noes it works really well with lightweight clients so you could have this on a phone or something that so on your phone you'd have you'd create a a a private key and through some sort of through some way you would you would

send your your public key to someone else you know it could perhaps be linked to Facebook or something like that or some other social network the key would go to say mayor that I would send my key to and then mayor would sign my public key with his private key and that creates a connection in my first Network yeah so in the case uh the the example that you're mentioning where you run it on a mobile phone it's a bit of an hypothesis at the moment because right now the software only runs uh within Linux um but it should be able in the future like you said it's the the software itself the demon is relatively lightweight especially if you compare it to a note like the Bitcoin demon for

example so let's say if you would have uh if you would both have uh a note running on your own phone then you you could connect to each other by uh signing uh each other's public key so the node itself also has its own key pair so what you can do is you can use your private key to sign Mayer's note uh or his public key that belongs to his node and vice versa then what you will do from then on is any information that you store on your own note and that you decide to publish with the world will be flooded to May hair because he has added your note to his own notes web of trust and by doing so he chooses to store any data that you flood towards him so um if if any information comes in he can

verify this by the signature he will see that the public key that this signature belongs to um is within its own web of trust so it's a trusted key and then these messages will be stored uh in his own note can you explain what you mean by any information that I flood to him so there are several type of uh of M messages that you can send you can uh after you've created a keer after you have your public key you can uh for example add a URL to your Twitter account uh or your LinkedIn or your Facebook but only the URL so the software itself has no need to look at the profile behind it and you can also add a Bitcoin address or a name or a

nickname or that you live in a certain country so that's one type of message that you can send which is a connection so you connect any type of identifier as an asset or like an attribute to your identity which is the public key um the other type of messages are uh the ones where you refute these kind of connections so if you see that mayair has um um added my Facebook account to my name and you see that it's the wrong one then you can simply downfold it so you can say no this is not correct so that's that's another type of message where you refute a connection and then there are the messages where you can send the rating so I can say uh

Sebastian is a is a good Barber or a good car salesman and I can attach a score to that so I could say is a good car salesman and I give you an eight out of 10 for example so these are basically the the three types of messages that you can send over the network of course that will be refuted right away because I'm a horrible car salesman and and even worse Barber so um so let's take this scenario where uh like Tim you are the barber and Sebastian is in my is a first degree connection for me in in identify and let's say Brian is a second degree connection cuz Sebastian is connected to Brian MH now in the first scenario we

assume that um like because Sebastian is a first degree connection if he sends me a message I accept I accept that right MH now uh now if if I have like say hundreds of thousands of first-degree connections then my mobile device cannot on my I wouldn't want all of the messages that these connections make to be stored on my device cuz it would be like a lot of data right so even though they're sending me messages I I might only keep a very small fraction of these messages right now so let's say now actually Sebastian has rated you as a barber but I have not kept that message on my

computer because I I don't keep uh whatever he sends to me I trust whatever he sends to me but I don't keep it with me and now I want to go to your shop and you are the barber and I want to see what does my web of trust say about Tim as a barber how do I discover that Sebastian actually put something for you there uh well if you don't store messages then it's of course um rather difficult to to to make any decision based on that but uh I could still be able to show you those messages uh as a barber because uh he has sent the ratings to me um I can choose to store those ratings and whenever you walk into my shop and you say well do you have any

uh rating from these persons for example I could also show it to you the other way around uh it doesn't sound very effective or very efficient uh this way but it it is an option where I can show you the message and you can still verify that Sebastian has um uh has signed this message because you can check the signature and the public key and yeah if that suffices for you then that will be probably be enough information for you to base your own decision on and if you still don't trust me because you say you could say okay maybe you've generated this yourself uh the the chance is highly unlikely but you could still assume that then you can still double

check it um with Sebastian if that information is correct or not and that could be automated so in a sense like what I'm trying to ask is this kind of approach seems to have like an inbuilt search problem right like um so what is what is really happening is everyone's writing like let's say let's let's assume a world in which everyone is using identify and everyone is putting stuff about all of the interactions that are happening if say I go to buy barber shop I put a rating for him there I go to a card wash I put a rating there so everyone is generating a lot of reputational data and uh it seems to me that like in order to actually figure out what my web

of trust says for somebody I actually need some kind of search engine um I actually seem to need some kind of search engine where uh if I go to a shop I can see what my web of said about it m mhm but then the search engine is itself a point of centralization because we don't have a decentralized search engine right mhm right so um what you could do with um the example where you don't store the information yourself maybe there's there will come at some point where there are so many messages that you simply can't store them on your phone um in in that scenario you will need very you will need many connections and a lot of

messages look looking at what uh what what mobile phones are capable of nowadays and uh what the database size of an identified database is but what you could do is you could also choose to trust a public note to store this information for you so somebody could provide a service where they um say okay if you want you can also trust us you can flood your information towards us we will store it for you and you will pay let's say certain fee uh that could be per month or per API call per query um and where it comes to to searching it's it's very interesting I think because um if you look at centralized search engines they they basically always work based on blacklisting so um

if you look at Google page rank for example the the most well-known reputation system in the world probably that basically everybody uses every day um you see that first they try to crawl through all the data so they try to find all the data on the web and the thing they do next is they try and filter out irrelevant information so for example stuff that has to do with child pornography or terrorism Etc um so they decide what you will get to see but what you could do with something like identify is uh you could you could turn that concept around so you could have all the information available and then I could filter by my own first-degree connections or second deegree

connections for example if I go look for Barber um I could either Google that to see what uh which Barber is closest by but I could if I would use something like identify I could um uh look for a barber I could first see if anybody uh if any of my first deegree connections say anything useful about it if they don't I can then filter a bit more outwards uh by my second degree connections to see if any of them has to say anything useful about any Barber uh which is relevant for me and this way I can uh personalize um search even further in a decentralized fashion okay so um in identify do you have any like

uh any name space at all or do you have a global list of names or global address book or something like that um well the the namespace itself is undefined so it uses the public key Nam space uh you create a key pair and you can basically attach any type and any value um to your public key so I could say um the type is name name is Temple store I could say uh URL and Facebook account or uh I could say is over 18 yes Etc so the the namespace itself is totally undefined so uh this way it can be used for um uh for example if you look at namecoin you have certain

name spaces which are predefined that you can use so you could also use these within identify uh but you're not limited to uh to anything that's that's predefined in any way so so there are no name spaces as such with identify but you could always use something like one name or other services you can bold them on if you wanted to yeah right um you could uh for example attach your one name account to your identity uh you could attach um your Uber your Uber profile to your Identity or your Airbnb profile or you could create separate identities so that

you create one identity that you link to your Uber and one that you link to your uh to your Facebook account for example so this way you can um you can decide for yourself which identity you want to link to which of your uh to any of your Social identities yourself so with with a system like this and it's same goes for you know social networks and things like that is you know you need you're it's mostly reliable relying on on network effects and uh you know because you want to be with your where your friends are and if uh uh if most people are using identify or some other identity system um well I guess my question

is are you concerned about fragmentation in this space because there's other protocols out there there's like the blockchain ID protocol uh which of course one name is using then you have keybase which is mostly for pgp but you know one could imagine that they get into more identity um based stuff uh and and then identify um can there be multiple identity decentralized identity protocols in the space s of competing with each other are they compatible is what what are your views on that yeah I think so I think that um identify could be complimentary to uh to many of those systems so for example if you take one name um and blockchain ID I think it's a

um uh it's a good example to prevent men in the middle attacks so if I want to verify an identity and I do it through website then I can I still do it through centralized mechanism and I can still become uh a victim of a man in the middle attack but when you publish for example your name in your public key to the blockchain then you can double check it on the blockchain which is immutable so this way you can prevent man in the middle attack so um I could create a one name account and I could attach it to my uh to my identify profile this is this is all in a public setting where we use it for uh to create our own personal networks on a more of a global scale but

what you could also do uh this is a bit more hypothetically but theoretically uh the proof of concept should prove that this works is that if I have two information silos um I could add two identify notes to each end and then I could add a request Handler so I could say okay I have two information sorry I have two information silos which are U um very difficult to connect to one another or to have them exchange data among each other so what I could do is I could put an identify node or two between them with a request Handler and then I could send specific requests for specific information and when I do that I already know the public

key of the other notes so any request that I sent can be encrypted uh purely for the note on the other end and when that request is being handled by that Noe they can they can check according to their own web of trust so to see if that information that that's being requested if they uh if that can be returned and if it can be returned it can be extracted from the database uh it can be encrypted for the receiver on the other end because both parties know each other's public key and then it can be sent back to the other party so this way you can not only use it for humans but also for machines so you can also um create trust networks for machines okay

and we we we'll come back to machines in in a few minutes because that's something that that I think I'm really interested in as well but uh but first coming back to identify uh let's talk about security a little bit and because if if you're dealing with a decentralized identity system conserving and preserving the Integrity of your of your private key is really important because then someone can just take your identity uh what what happens with identify when your private us are stolen well if you look at the the Prototype on identity. fi um it's a prototype for a front end so anybody can download it from the GitHub can run it for themselves and what you can do there or it's it's an example you can log in uh which your Facebook account on your

node and when I log in with my Facebook account the only thing I do is I set up a session with with Facebook and the note can verify that uh that I've set up the session so then the note will know that I am in control over this Facebook account after I've done that it will create key pair for me so if I lose my control over my Facebook account for example I can uh reset the password and uh through my mail I can use the Forgotten password function uh function on the Facebook website uh and then I can reset my part password through my mail and then I can log in again um on my uh on my identify note and then I will have have access to that same key

pair again um so that's one solution that can be used you could also use more privacy friendly options so uh so so just sorry so you're in that case the key pairs are being held by identify and release to you when you sign in with Facebook did I understand that correctly the right now um when you when you have a note then the note will generate keyar for you so in the future you could run your own note that's the idea or uh you could generate this on the client side uh you could use something as a bit o for example which was created by Jeff gar and the team at bitpay um which uses the same principle where you have the idea that you type in um an email

address and a password but this way you can actually generate a keyar on the client side so this way you don't have to send a password to the other to the other end of the line uh and you can still prove via a signature that that's really you so the only idea there for uh logging in with Facebook or Twitter or Google or Mozilla Persona um is that you prove that you are uh the owner of uh let's say a Twitter account and when you do that then the note will verify that it will sign for you that um that this Twitter account or this Google account has been checked so next time if I lose control over that account I can reset

password and I can have access again to uh to the keyers and so you one could also I guess use something like the phto protocol or something perhaps a bit if you really want to have control over your keys you could use something like a like a ledger to store the the private keys on on some other device or even on your mobile um with the secure element type stuff like I mean in in the future I presume that the idea is that this is somehow connected to biometric information right that you can prove your identity through

Iris scan or or fingerprint data or some other biometric information uh yeah that could be personally um but this is this is my personal point of view I'm not a really big fan of bio metrics um because if you ever lose you know it's not really difficult to go door to door and get Fingerprints of the door knobs um and after you've uh you've changed your fingerprints 10 times you've run out of fingerprints you can then use your tow prints and then after time after 10 times you've also ran out and the same thing goes for your iris that if you uh if somebody has a copy of your iris or knows how to duplicate this in any way then the rest of your life you will have issues with that so that's that's just a

small side note why I'm not a really big fan of biometric um but what you could also do is use the multi principle so if I have uh let's say I have three devices I have my laptop uh a tablet and my phone they could all have their own identity and as soon as my phone gets stolen for example I can use the other two devices to download uh the public key that belongs to the node on my phone and I can thereby automatically update everybody in my own network that my phone has been stolen or that it has been compromised um and as soon as uh if it turns out that for example my phone was uh was in fridge um because I accidentally put it there then um I can

simply upot that key pair again and then I can let everybody in my own trust Network know I can flood this information to them like oh I found it again um this device is still trusted so I think the the the multii principle really interesting here also where it comes to generating key pairs uh through social media accounts for example so if I would lose control over my Facebook account and if I had no way to regain access anymore I could use two other accounts or three or five to downfold that that account and um update everybody in my own trust Network that that account uh has been compromised today's magic word is

identity i d n TI Ty y head over to let's talk bitcoin.com to sign in enter the magic word and claim your part of the listener [Music] reward in the conversation that went by uh the question of like identity for devices came up like is the internet of things and identity linked in some way yeah I believe so um because let's take the example of a fridge um if I would run an identify node in my in my fridge somewhere in the future and my neighbor would do the same thing then

when my neighbor um orders food let's say uh they order milk and once the once the milk arrives once it has been delivered it turns out that the milk has uh has expired um what you can then do is that if that fridge is in the trust Network of my own fridge it can send a message to my fridge that they have ordered milk from a particular supplier that it has arrived maybe on time but that the milk itself already was expired when it arrived and then from there I could um if I control my own fridge I control the Noe on my own fridge I control the software on my own fridge and I could set a threshold that if

anybody if any first deegree connection uh receives anything that has expired uh not to order from that supplier in the next two or three days for example but this way you can use you can tie identities to devices um and when you look at um you could run an ident another example you could run an identify node as a sort of a firewall so uh for the Internet of Things where it comes to your home where you have an a garage door connected to the internet or uh the lighting in your house if I would use an identify firewall uh sort of firewall uh a note running within my own home I could say only my phone only my tablet can connect with

that device and if it doesn't contain the right signature this message then it will simply do nothing so in that case somebody could hack my Wi-Fi connection but as long as they don't have the private keys that belong to the devices which are WID listed to control those devices they still can't do anything to it so we talk a lot about it uh you centralized systems and and how they'd be great for iot there's been a lot of talk about that and of course you know there's been some proof of Concepts rent by IBM and and others but it I I have a hard time seeing how that's going to play out exactly and so let's taking identify it's it's obvious that this is would be a good system for um for iot for devices

to have identities and you we can go even further and say that like a an ethereum dap could have an identity uh but spefic specifically regarding iot what incentive would device manufacturers have to implementing this type of technology in um in their devices well I think first of all security um because if your uh if your fridge can hack your car uh then we have a big problem so you want to ensure that only trusted devices can commun can communicate with each other so I think that's probably the the most interesting proposition for for Hardware suppliers and is that so is there an in specific incentive for them

to implement a decentralized system like this because they already have security systems that you know will manage permissions and things like that you know they're centralized of course uh but if if you had to go to a device manufacturer and say like um because I mean we'll talk about your your company later that's essentially I think one of the things that you do is try to promote this techn ology if you had to go to I don't know um Fitbit or like Samsung and you had to tell them all right I we have this technology it can benefit your customers how would you sell it as opposed to like a centralized system of permissions that they would Implement well I think that the major difference there would be that um if if

any hardware supplier would use this uh within their own Hardware then they would have a very big Advantage compared to the competition because because a decentralized system it it means that uh you as a user who buys their Hardware has control over whatever you buy so um it's very privacy friendly it's very secure and I think that's a very interesting selling point especially because they're doesn't necessarily have to be a trade-off with usability here and that's normally the issue that if you want security then you have a trade-off with usability and the other way around um but with this system you can have Security on the back end and you can build very secure uh uh ux friendly applications on top of that and

I don't think there's any system out there at the moment which uh which lets you do that so I think they would have a big advantage over any of their competition if they would do that this is like a very interesting concept what you are saying is uh basically just as we think that humans will have U so in your system every human has a subjective view of the world about um the reputation of other humans or you know similarly like machines could have their own subjective view of the world about uh the competence of other machines right so uh yes so so basically um yeah I I don't I don't even

know how to how to take a good example with it but uh like like my drone could rate your drone that your drone has a tendency to run into I don't know windows and break them or something like that so and uh and some other drone could look at what my drone has has has rated your drone for and conclude something about your drone something like this right yeah it's something like that or you could um you could connect it too so you could have drones uh that that establish permissions for each other for example or if they build up a good reputation with each other because they don't fly through each this airspace I don't know um then that they

will start sharing more permissions if the owner of the Drone decides that that's a good case but you can also combine that these devices with humans so um I could use this software to find a drone operator which is best suited for me to deliver uh fragile package for example um but another which is maybe a more interesting case where it comes to Hardware is probably a trust based mesh routing so if I trust certain uh routing devices then I could choose to send the information only through trusted parties um and you could all do this through a public key cryptography so I think it's it's a very secure way to um connect both humans and

devices I mean like like your ideas they all seem seem very awesome it's like what I like about about what we have talked until now is U it's decentralized um the data is open and um and and basically this can scale infinitely right like if you have if you basically solve the search search problem how do I figure search for data then then you can you can you can scale it really well like the the kind of questions I I I'm I'm I'm having in my mind are a it it seems like complex system right like everyone needs to everyone needs to have their own identity certify the identities of other people people then

give reputations on on other people and only when it gets to a certain scale it it becomes useful and it's it and it seems very similar to the um pgp web of trust so I'm kind of wondering and and and recently I was at the ethereum Devcon and there uh in in ethereum team you have this person who's called Vin Gupta I'm not sure if you if you have heard of him uh he's an old cifer punk from the '90s and he was talking about this pgp web of trust and what he was saying is that the ideas were of building a web of trust have been around for a long

time the the ideas for building a web of trust have been around for a long time and the reason they did not they did not actually permeate through into society is because their user interfaces and uh applications were just too complex like nobody wanted to handle private key keys and nobody wanted to go to key signing parties and build this actual web of trust do you have any ideas in on this Dimension how do you make it usable so uh uh Phil simmerman who is the inventor of pgp oh sorry not sure what's up today okay I'll rewind um so Phil

simmerman the inventor of pgp he uh recently said uh I read a news article about this that he believes that pgp isn't us friendly enough and he used that as the excuse for why he doesn't use it himself so the inventor of pgp claims he doesn't use it because it isn't user friendly enough so um when you look at identify then on the back end it's very technical it's rather complex um as you can see right now it's already difficult to explain the concept itself it's rather uh abstract but once you grasp that then you can build very secure applications on top of it which can be very use friendly so if you go to

identity. fi for example um I I'll admit it's not the most intuitive user interface at the moment but it's a prototype it's also a proof of concept to prove that you can build something on the front end which is relatively uh user friendly uh which communicates through the API with the back end uh to combine it with secur secur and this way you don't need the tradeoff between usability and Security in order to uh to use a web of trust mhm okay and and and do you see like any any use case like like part of the challenge here is like p network effect like I I already have a list of friends on Facebook and you could think

of my friends list as me having signed the public keys of my other friends really um you could see it that way so there are already these networks that handle identity and reputation do you see any particular place where um identify could have a foothold that well one of the most interesting possible use cases I see myself is probably bitcointalk.org um it's interesting for multiple reasons first of all that uh Sirius who Marty Momi who created identify is also the guy who set up uh Bitcoin talk.org originally um so there's there's a nice connection there but I primarily mean it because if you go to bitcointalk.org if

you are familiar with the Forum then you'll probably know that there are a lot of trolls there are a lot of suck puppets uh so so for most people there's a lot of irrelevant information there so if you would have a browser plugin that would connect to your identify node um you could simply downfold all the trolls and if you would do that and I would trust you and you would decide to share uh your own web of trust with me or your own filter of what you have filtered so um then I could apply this filter to my own view so this way uh you could make it a business to downfold trolls and I could pay you for example uh uh per update to uh to use your filter on top

of uh on top of bitcointalk.org forum so this way I could filter by relevant information based on my own web of trust and I think that that forum is a very interesting example and I'm curious to see if anybody will pick up this idea well that could be really useful in a lot of places not just Bitcoin talk I guess right yeah everywhere on the internet um agree so let's just sort of I would like to talk about the future of identity and where you see this going so right now obviously the most trusted source of identity I think without a doubt is national identity cards so the the identity that the government vets um is is our true identity um at least in a broad Circle and perhaps in a in a close

Circle that's not necessarily always the case um but uh what where do you see what do you see as the future for govern government identities and will we continue to to have government identities as sort of The Trusted ID you know when you go somewhere and you need to show your ID that you'll show this or do you see that as something resembling more identified that's more decentralized and where you have multiple parties vetting your identity um I see I basically see two possible scenarios the first one is the one where big corporations will issue our identities and uh will therefore have the control over the data and the

communications that is linked to our identities we already see this with Facebook and Google and Linkedin Etc um but I think it can go even further because right now here in the Netherlands they're working on a on a new digital ID system and it will basically be controlled by the big corporations so that's one option one possible scenario I see the other one um which is a bit more hypothetical is the one where the whole world would be using identify um so what you could do there is if I would create an identity uh I could have it signed by the government so next I could simply bring my public key to anybody else who

also trusts uh the government that has issued that verification to my ID and I could simply show them look I am a real person and that has been verified by the government um so if they then also have that government within their own web of trust they can verify the signature but you don't necessarily need the government for that because if I live in a small village where everybody trusts the local barber again or the local butcher then they could do the same verification they know that I am tempestor I come there every day so if the butcher uh has verified that I am tempestor then most other merchants in this small village will also trust that I'm tempestor because they trust the butcher so in this way it becomes um

this way you see that information silos start to break up and that humans themselves can have more control over their own identities um another interesting thing there is where it comes to those verifications you could theoretically have a hierarchical deterministic verifications so for example the the DMF or uh the the D as it's called in the UK um can issue a driver's license to me which could be hierarchical deterministic which means that every time I have to show my driver's license for example at a routine check when the cops pull me over I could show my identity I could uh create new verification out of the master key that

uh the the that DMV has provided to me and I could then show them okay look this is my identity and it has been verified that I have my drive sense then the cop can could simply uh scan a QR code for example and they will see a green check mark okay this is all right they can double check it with DMV with their note and they will see okay this person really has a driver's license but next time that a cop pulls me over I could create another verification from the same master key uh so I could I could create a new identity per interaction uh and this way it becomes much more difficult to link uh multiple interactions to one identity so I think

that's much more privacy friendly but these are just a few of the options that I see possible uh with a system like ident like identify or any other system like that that will hopefully one day come out on top so what you're saying is you're decoupling uh the fact that you have a driver's license from your ID from your identity so essentially you can tell that police officer okay I have a driver's license but while staying private and I guess you could also do this for age verification so for for instance if you're buying alcohol uh you could simply prove to the person in front of you that you are 21 if you're in the states if you're C parts of Canada

you're 18 uh and if you're in France or Europe then you're like 12 and uh and without showing your um without actually giving up your your identity which I I guess could be valuable but I think could also be seen by the state as U something that is undesirable um I I had one last question before we move on to uh to your company tway uh all right so we talked about the this idea that um devices and perhaps even applications could have identities do you see a problem arising from the fact that humans and artificial

intelligence applications devices share the same type of identity system do you see problems perhaps arising from that or do you think that's totally fine I don't really see a problem there because um if the user has control over the machine then it shouldn't be a problem but when Once artificial intelligence and uh deep learning Etc uh finally becomes like a real big thing then uh you could have some other implications but I'm not too scared of that at this moment yeah the the the machines could all down vote as uh in in Mass right yeah they the machines turn

Mal and they'll all downward us and screw us out of the web of trust yeah but the thing is that if somebody down fot you they only remove you from their own personalized uh Network so it will only have an influence on themselves and the the parties that decide to listen to them and trust them of course um because they can also see that information and they can see that a certain machine perhaps doesn't trust a human um and then the other machine which is controlled by another human uh could be able to decide for itself whether it still wants to communicate with the untrusted human or so to say so that's that's a very interesting uh that's a

very interesting case to think about bit more uh but as long as people keep control over their machines I don't see this as a big issue because um identify itself it doesn't try to automate trust uh it just collects everything that's being said it presents it so it organizes trust and then the human will always have to make the decision on uh what they want to do with that information or not okay cool so uh so one final top topic before we close off this this great interview uh is um yeah you have a company which is two-way doio right and this company is different from the

identify protocol itself identify is the protocol and 2way doio is the company so what is 2.io trying to do and what are you going after uh the main goal at the moment is to uh to stimulate the um the development of identified self so uh what we're trying to do is we're trying to create a platform for uh for developers to make it more accessible identify the software itself uh so that's a documentation we're working on setting up a forum uh a Weeki for the documentation and we're also trying to create a platform where developers can come together um to build things together based on identify so that's one

one that's that's basically our main goal um and we're trying to support this through building custom solutions for customers um and we also do consultancy work where it comes to blockchain Identity and reputation cool well uh that sounds uh very interesting and of course uh you know I I think this you know this is a really interesting um sort of idea that we could have decentralized identities it really disrupts sort of know CES and perhaps Millennia of the way that we've thought about identity much like Bitcoin has really disrupted the way that we think about uh about money so um no I thought I think this was really a good interview and I'm really interested in seeing where this going to go in the

future so thanks a lot for coming on today thanks very much and I really enjoyed being on and if you have any further questions or uh anybody in the audience if you have any questions feel free to reach out to me uh you can go to identity. fi and uh look me up or simply Google me great and we'll have links to that in the show notes as well so uh that's it for our show today uh epicenter Bitcoin is part of the LTB Network and you can find a lot of great shows and content about Bitcoin cryptocurrencies blockchain Technologies and all that stuff at let's talk bitcoin.com we release new episodes of epicenter Bitcoin every Monday you can subscribe to the show on iTunes SoundCloud or your favorite podcasting app on iOS or

Android and also you can watch the videos on YouTube of course and uh if you're L listen to the show you can always leave us a review on iTunes or or anywhere else really that you can leave us reviews we greatly appreciate it and if you do so just send us an email at show epicenter bitcoin.com and we will send you a free epicenter t-shirt that's right you just leave us a review it could be you know just whatever you want to say you know just uh leave us a review and we'll send you a T-shirt and uh of course uh you can always send us a tip and the Tipping address will be in the show description there is one more thing I want to add we're looking for developers so uh we're looking for a WordPress developer to help us build a new website it's not a very big job but

uh we still need someone to help us do it because I personally don't have time anymore to work on that kind of stuff uh so if you if uh you know if you can if you're good with WordPress and uh building templates and things like that please reach out to us you can reach out at show at epicenter bitcoin.com as well so thanks so much and we look forward to being back next [Music] no [Music]