Decentralized Identity & Reputation by Sina Habibian (Devcon4)

cool so thanks for joining me here today I'm going to be talking about decentralized identity and reputation so first of all I'm Sina I was previously the engineering lead at Rubin a project for a scaling computation on Assyria also helps launch this project called eath prize where we interviewed over a hundred engineers around the space to pinpoint shared problems around development you know like deploying a test net or doing security audits and helped fund resources towards solving those problems and more recently I've been exploring open problems and helping at the theorem foundations with the Grants Program so today I'm going to talk about identity and I think identity is one of the most important problems any of us could be working on in the blockchain space identity plays into a whole host of things that we're all excited about so I'm just gonna kind of talk through a few of them the first is you know if you if you're familiar with some of the protocols that are being built you know that aetherium addresses are pseudonymous you can create a new one at zero cost and because of that a lot of the protocols that exists like you know Casper live peer for you know decentralized video streaming true bid for computation the only way you have of keeping your participants honest is to make them deposit some stake and then if they do something wrong burning that stake and that by definition is a one-off game now imagine if instead of staking eath or some amount of monetary collateral people had to stake their reputation and their persistent identity and if they did something wrong it was a reputation that would take a hit this would give us much stronger guarantees around the space there's a whole host of application layer things depend on identity one is governance you know if you want to do any kind of quadratic voting you need a sense of identity on chain lending relies on identity to be able to underwrite the loans determine how risky someone is because you just can't give money to someone who's an and could disappear air drops which are you know means of economic distribution and bootstrapping networks it's one of the very interesting like crypto native primitives that we have having identity would would help people do these in a more nuanced way and raid limiting and pricing so some of the web to services that we all use and and which are great you know for example Dropbox make extensive use of these techniques for example you know there's freemium models where as a new user you get free access to the service or there's tiered usage models whereas a pro user you get you get a discount on what you're doing and you just can't replicate these models on the blockchain right now and finally the problem of sampling which is kind of theoretical but if you if you can basically pick an address from amongst a number of addresses and right now you can't do this because they can be Sibbald this would change everything this is basically you know in some way it's what proof of work and proof of stake and these various mechanisms are trying to get at is selecting a leader or sampling a number of people from a large pool and even in the real world we're seeing identity become or digital identity become more and more important so the odd power program in India it's a identity system based on biometrics and has over 1 billion people using it now and you can use it to sign up for bank accounts take out loans ear esident see an Estonia of course and you know China's rolling out this virtual ID which you know could speak to alternate ways that we could you know provide a more self sovereign way of doing this so today I'm going to talk about what we mean by identity and reputation and then talk through some of the nuances through the lens of three particular applications governance lending and security tokens so an identity is basically you know the atomic actor within the system so if we're talking about a cerium right now each a cerium address could be an identity when you're you know buying a toke zero X or Y or you know staking some eath in a protocol that it's that I that's the identity and these addresses can obviously be backed by by a human being who's controlling the private key or they could be back or they could be a smart contract that has interesting mechanisms around you know different different spending limits access control mechanisms and if you know you build up a history as you engage with the network through your identity and this speaks to the importance of being this identity being secure and why if you have a multi-sig and you have ways to recover your keys is it's important and obviously it plays into the user experience which a lot of other people are talking about at this conference the next kind of part of this that that you should know about is that this idea of a claim which is you know you have all these identities dispersed around the network and each one of them can claim something about another one so you can you can you know identity a can say that identity B has passed kyc or that they're you know a resident of this country or they they have this income and these could play different it's just kind of a primitive that you can use within different applications and you don't really need to enforce any kind of authority here any you know any I can claim something about someone else they can claim something about someone else and there's a lot of awesome teams working on pushing this stuff forward project like Zeppelin TPL bloom you port GRC 725 and 735 there's different architectures you know like storing these claims in a in a smart contract registry storing them with the user in a more self sovereign way and this is kind of an area of active experimentation and what do we mean by reputation reputation is you know when you when one of these identities kind of builds up trust over time so it goes from this state of being just this anonymous you know a theorem addressed to to an identity that people can trust and you can think of this analogously to the real world so think of you you know just hearing of an engineer for the first time who you've never met before you don't know anything about them how do you know if they're any good or if you should you know work with them this can happen into one of two ways really either someone you already trust goes on out on the limb and it's like no this person is amazing like and and through that through their you know trust you you take a chance on this person or that that graph of trust isn't there and instead this person just shows up and does some good work over time and through their own good behavior they build up their reputation so we can use the same two kinds of ideas on blockchains so let's talk about governance a little bit governance is really important in this space you know as it comes to decentralized networks upgrading without you know a central party making that choice when it comes to allocating funds and making decisions as a whole and we can't really replicate the model that exists in the real world which is one-person one-vote because obviously you know you can spin up multiple addresses and Cybil the system and so what's been happening so far is coin voting which is you know you have the scarce resource which which is the number of tokens you have or the number of the amount of eath you have and you stake this eath and it's your voice in this vote is determined by how much you stake and this this works but you know it has this problem of being plutocratic which is people with more money get more voice in the system so this all speaks to this need for decentralized civil resistant identity civil resistant meaning you can't you can't you know one person can't spin up multiple identities and it's decentralized meaning it emerges from the network and this is this is one of the hardest problems that exists in the space and I think anyone who wants to work on interesting research problems should go and attack this and I'll just talk through kind of a thought experiment of how how you can think about this one one method of approaching this though no system has been built they fully achieves this so think that there is some protocol let's say you know one of my favorites zero X wants to upgrade their contracts this is you know a couple like sometime in the future and the system is fully decentralized and they want the network to vote on whether you know this change happens or how it happens and one one way you could do this instead of doing the coin voting is you could just announce that any theorem address who wants to have an input on this we're just going to airdrop a hundred you know vote tokens onto them and so you just give this to everyone on the network and obviously you can't just like you have these people to vote with these tokens because it would be civil but what happens instead is there's a campaigning period where anyone can you know use the existing social channels to campaign for their voice to be heard so you know the core 0x team people in the community developer is anonymous you know reddit commenter is everyone would make their case for why why they should have an input into this and you know they would list their aetherium address next to their name and during this month of campaigning you go and allocate your vote tokens between all these other people and whatever proportions that you want and now once the month is over you take the vote so everyone just cast their vote once but instead of counting each vote as equal or equal to the number of tokens they had instead you know the naive way would be how many vote tokens that they get allocated to them by the community which would already be pretty interesting but what you could do is actually run PageRank on this which is you know google's algorithm for ranking websites so you would say you know this person you know person X received all these vote tokens to them so they're their voice obviously matters and you can imagine you know well in a mirror from 0 X receiving all these vote tokens but then you wouldn't stop there you would iterate the algorithm again and you'd be like who have these people allocated their limited hundred vote tokens and those edges themselves have more value and this wasn't determined by you know any centralized process it's just a property of the network people someone gets a lot of votes from the community and because of that their own votes become more important and then you know in turn that person's votes become more intense so this this process converges and is a really interesting idea the problem is that you know this approach also can be Sibbald so you can you know if you have the real trust graph here of all these people you know allocating their tokens within the real if your Mikko system someone could just spin up a thousand addresses and replicate the exact same structure on this side and this is why this is an open problem so some ideas there are having globally trusted peers you know maybe like 10 50 or 100 or dresses that kind of everyone agrees should be trusted and you kind of start the graph from them and you're like who do these people across who do they trust and this has a way of like bringing the network to grounding the network another approach is to requiring a scarce resource to create an edge so you know you could use those 0x tokens to to create these edges and that makes them means that one person just can't create an infinite number of them and the final one is you could you could pattern match from the top down so you could say that you know these addresses seem to be trusting themselves within this cluster but no one from the outside is trusting them and the next problem is how do you actually incentivize these these people to allocate these tokens correctly so what's what makes you spend the time and the due diligence to find out who to give your tokens to and what prevents you from giving this to just you know bad actors in the system and you know there's ideas around using collateral and requiring people you know lock up some value that they get back in time or if these edges actually come to existence as a byproduct of existing behavior so a great example of this is in the web itself where you know Google didn't go to all these people and tell them to point to each other so that the PageRank algorithm could work instead someone who's building a website personally just wants to have good links going out because that means that their website is more interesting and they get more traffic and you know they're just doing that in a selfish way and and that in turn means that this PageRank can be built on top of it so there's projects exploring this encrypted as well like source cred which is doing it for a github so this you know this is a really interesting area to explore and you should all kind of look into it next kind of application will look at is lending so lending you know intuitively makes sense as a place where we all should look for applying this blockchain technology you know it's a global network you can write code instead of legal contracts its self enforcing but then again there's a problem you can't just extend the line of credit to an anonymous person because they can disappear they can take that money and run and so there's a few ideas I'll kind of talk through a spectrum of them here and my goal is to show that the identity systems that we build are nuanced and and relates to what we're trying to achieve on application layer so there's existing companies in the web 2 world that give out loans to people without credit scores and you know they begin by lending really small amounts so you know let's say it's a village in sub-saharan Africa they start by lending out five dollars a month or until the loan is paid back and then as this person builds up reputation they increase that amount and this is actually worked you know these are successful companies actually like making a difference in the world but the critical thing is that they all rely on this person's real-world identity so they they you know reads there you use the person's contact list and GPS location and if they have identity information and they use these things to underwrite that person's risk and know that in the future if this person you know exits the system that they don't let them in again so this is how these systems have been able to build up trust over time and that's not really available to us in the crypto space if we want to build fully anonymous you know decentralized learned lending systems and the example of this kind of was shown and you know earlier when this awesome company BTC jam which was doing Bitcoin lending in the developing world you know a lot of people were very excited about it but there was just a lot of exit scams so people would build up their reputation by borrowing paying back in time not defaulting and as soon as this value would get large enough they would just run away with the money and then they'd start over again so how do you solve that another idea is okay let's not do this decentralize Anonymous thing let's do peer-to-peer loans in a user's own community so in their own village people trust them socially so so you can do that and you know that wasn't possible before either we can use blockchain technology to enable that there's a few questions there again more on the social layer rather than on tech tech tech technology layer which is you know do that desert community actually have the capital to lend like is that a believable idea and the other one is do people like to borrow or lend from people they know you know if you think about it right now would you take out you know a loan from your friends or would you lend to your friends and how would that impact your personal relationship so some people you know there's some research that shows people actually behave better if you do that because of the social accountability and there's there's a bunch of people who think that you know people would rather have this relationship with some bank and not involved or you know have the separation between the personal and the financial life so again things that we need to all think about and you know the the you know the on the other side of a continuum is okay it's it's actually not using the blockchain for peer-to-peer you know lending for you know building up reputation we're just using the blockchain to simplify the payment rails and make it global and automate you know the settlement and you know the case here is that even the peer-to-peer lending market places like Lending Club and prosper and these companies that have been built over the last ten years even though their peer to peer most of the volume comes from institutional investors and the catch is that if you talk to these institutions they actually can't go off of peer to peer claims like they don't think it's not good enough if you know 10 a theorem addresses or your friends in the community say that you have this income they actually needs to know that and you know when it comes to the KYC naml they actually need certify the authorities to do that so so you know again it's like you you need to think about how what the application is as you design the identity reputation layer the final thing I wanted to talk about is security tokens which have been getting a lot of you know attention recently and the case makes sense you know so the idea is that there's all these real-world illiquid assets like real estate art private company equity and you can tokenize them you can open them to global markets you know people can people can own fractional amounts and and you know it seems like a value add and maybe this would open up ownership to you know people who aren't in the US you know someone could own a piece of an American company even if they live in Asia or in Africa so we actually like looked into this because we were kind of researching identity broadly and it turns out that if these issuers are in regulated countries themselves and because this is like in the name as a security token the compliance means that they're actually on the hook for who buys these tokens so they need to you know run all the traditional processes that they would have to in the real world on the buyers so you know kyc AML accreditation o fact list debarment lists and and that's fair enough and you know then you think about what you could really change on the identity layer and you realize that again peer-to-peer identity is don't because this issuer is actually legally on the hook like they will go to jail if they if the government realizes that someone did in half the KYC AML so they need to rely on certified authorities to do that and another kind of nuance again that emerges is so you could you know you say that you know let's put let's put the KYC AML self sovereign the user host them and this is what you know awesome company like bloom is doing right now so it's the station's come from regulated authorities but the user actually holds them they reveal them when they want but there's other things you need to navigate here so the these providers the K the tester is actually there incentives are right now you know if a user is going to buy five different tokens each of those platforms does the KYC wants and this like provider like makes money from that so by putting this stuff on chain you're actually like lowering the redundancy so there's a lot of kind of case-by-case nuances that you need to navigate and so just wanted to kind of give some context you know beyond the key management and the user experience and these things which are all really important and we need to work on to make this stuff viable for people who aren't you know born in the space like so they can actually use this stuff but we need to actually think about what use cases we're building for and design with with that in mind from the architecture layer and that's what I'll leave you with [Applause] yeah we we do say they have about four minutes to anyone have once to ask a question okay down there hello demetria's Pollak knows is safe let's imagine that you have solved most of the problems that you you are talking about in this in this case what would be the major problems for the adoption of the decentralized identity decentralized meaning it's not pegged on the real world it's emerges from the network maybe in this case like maybe it depends on the problems that you were talking about but in a sense what would be the adoption barriers for yeah so the question is what would be the adoption barriers to an identity system and I think there's you know you there's multiple aspects to this one part of it is you just need to have like a very compelling use case where people are coming in and using you know because this technology still it's it's hard to use and one thing you notice is that identity in the web 2 world has always emerged as a byproduct of an application that people actually want to use so there's been attempt to build more self sovereign identity on web to you know from 10 15 years ago but eventually what became people's identity was their email address because they were just using it to communicate with everyone it was their facebook login because you know everyone had it and people had originally joins to build relationships and stay in touch so I think a key part is actually having use cases that pull people in and then beyond that it's you know security so you know having you know there's a lot of good ideas around having different keys with different levels of permissions different key recovery mechanisms because you just can't you can't you know lose your identity and most people aren't gonna aren't going to like have the level of understand the SEC knowledge ease like be able to do that stuff hands-on and the user experience so you know even having to understand you know claims or transactions or delegation or all these things need to get abstracted over time which I think I'm hopeful will happen given how many great people are working on in this space but it's all stuff we need to figure out thank you we're working in the south sovereign identity space and would be curious what's your opinion about the major challenges to get the the current understanding of south sovereign identity either the approach of you port or sovereign or whoever where do you see the major challenges to get its owner on a broader level towards people even here in the room so basically take take that crowd and not just the ordinary person yeah if you like I think this speaks to why it's important to think of the design consciously up front so you know if you let it purely emerge as a byproduct of the application then you don't really know what's going to happen you know all these claims might be on chain and like it might be you know might complete lack privacy or you know some the the dominant service that's getting all the traction might just store all the information in a centralized server so it's good that we're thinking about it up front I think I mean I've seen some approaches that are pretty interesting like again talking to the bloom team while you're here would be like they have a pretty interesting go to market strategy yeah I think is Hughes cases user experience security it's kind of things