Defeating Big Login with Sign In with Ethereum by Gregory Rocco

to sign in with Google button a sign in with a Facebook button assign it with Amazon button assign them with Microsoft button a lot of these large Tech Giants have kind of Consolidated power over identity for many years now but they've also provided a very good service in the meantime and I think besides well first I'll introduce myself like I said earlier I'm a co-founder of spruce I'm one of the co-authors on a specification called sign in with ethereum at Spruce we build a lot of Open Source libraries around signing with ethereum and personally want to give users control over their identity and data and going back I think for one of the first questions to answer is how exactly did we get here and I think the first step in the entire process as the web was forming was death by a thousand passwords when users wanted to First log into sites and services every site or service had a different way of authenticating you a different account that you had at each service and a different password to remember for each one shortly after a bunch of folks got together and specified what's known as open ID connect or oidc which kind of looked to solve that million password problem giving users rather the choice of choosing their own identity provider and letting applications verify the identity of a user in the process and this was bundled with something called oauth2 which also didn't just let you know the authentication happen but also allowed some authorizations to happen so you could think of this sometimes when you're signing in with Google and The Cider service also wants to access some additional information on your behalf that may be linked to a Google account for example now what this ultimately ended up leading towards was the NASCAR problem although users were able to basically choose their identity providers at the same time we ended up with websites that kind of looked like this basically a large number of tech Giants ultimately ended up sweeping up becoming the identity provider of choice because as users these were sites and services that we used all the time you all mostly have Google accounts we all mostly have Amazon accounts we almost only have Facebook accounts so as soon as we saw that button it was very easy to relinquish that control and say hey I'm going to log in using that encount instead of something that I control or at least an identifier that I have a little more control over and kind of go through this passwordless login flow because I want to sign in using my Google or Microsoft account so ultimately we all Consolidated it across a number of different providers that all wanted to be there when you wanted to log into a slider service namely the incentives ended up being a little mixed with a lot of third parties that you were signing into they sometimes may have been asking for more Scopes than originally intended so wanting to know a little too much about what's in your Google drive or wanting to know a little too much about your Google contacts or wanting to know a little bit too much about your Facebook social graph so starting to dig in a little more on the information side for users and users kind of relinquishing this information in favor of convenience and the second thing is it became an even bigger gravity well for large tech companies that wanted you to sign in using their identifiers because it ultimately LED back to a link to their services now the question is how can we stop this and I'm not going to say that these identity providers were like doing evil from the start but rather they provided an excellent service I can't tell you how many times I've personally signed in with Google or signed in with Facebook or signed in with Amazon because it was there for me when I needed it it became a lot easier than using passwords in the process but it is in fact possible especially with users controlling their own identifiers especially with users with wallets especially with users with key pairs to move towards systems where users in fact do control their identity do control their identifiers and do control their data it is in fact possible and we can move towards this model of not your keys not your crypto which we'll only talk about to not your keys not your identifier or your identity in the process because those keys at the end of the day that you're using for all these transactions using your wallets are keys in fact that you control it's an identifier that you control for example if Google were to ever pull the rug on you wouldn't just lose access to Services you signed into Google with you would also lose access to Google services and and kind of everything in between with an ethereum account you are ultimately at the root of control with those keys and thus signing with ethereum was born and a big part of it was a standardization effort where we defined a common signing format for wallets to authenticate with dapps and it was a standard that was initially pushed by the ethereum foundation and ens in combination with us over at Spruce and specifying it was the first step in the process but really encapsulating this idea of your keys your identifier and defining a standard way for ethereum accounts to log in to sites and services now this became a big step because in the DAP world you had a lot of sites and services that may establish a session with a user on a back end and required some kind of signing flow so openc is a good example of this if you've ever used openc you can go in you could connect a wallet you could send some blockchain transactions but the second you wanted to edit your profile they'll typically make you sign a message and this message in your wallet says hey you're signing into openc you know click the sign button and we'll you know be good at the end of this and a number of other dapps started using similar processes with different signing messages so some dapps would say hey sign the magic message and all of a sudden you're logged in some dapps would give you like a bunch of letters and numbers to sign and say great you know now you're logged into the service and what sign with ethereum did was basically standardize that format so you as the user know hey I'm actually signing into the cider service when you're using your wallet to actually sign in and start that session with that dap now it's kind of the first step in the entire process it's letting users sign in but the other thing that this kind of traditional identity thing did was it allowed users to bring some data with them to sessions so apps and services would have things like an email apps and services would have some things like basic you know profile information that would come from a Google account that would come from an Amazon account that would come from a Facebook account a lot of the work that we're doing now really is trying to unbundle a lot of these large pieces of this and reconstruct it where the user is in control using their ethereum account and my co-founder Wayne kind of dubbed this unbundling the login how do we take all these pieces and put it back together with the user in control rather than large check Giants and a lot of our work right now is focused on it was initially focused on signing with ethereum but the second part we're focused on now is how do you get to that second part where a user is in fact bringing their data to an application that they control rather than kind of logging in with an existing Tech Giant and maybe kind of bringing their data with them and The Cider service kind of keeping the data on their behalf so currently we're working on that second part right now which is enabling users to control their data across the web with something we're calling Recaps and what these are are called capability authorizations so you could think of it almost like a hall pass so if a site or service wants to access something on my behalf I could write them the equivalent of like a hall pass like you could do this thing that site or service would then countersign that and present it to you in order to like retrieve data from a Data Vault or credentials you have stored somewhere so in fact the user can not only log in using their ethereum account but also bring pieces of them with them across the way and consent to everything across the way which is a big part of the standardization effort now a big part of this too was also not leaving anyone behind the process it's all great that a lot of us are in fact users of key pairs we all have wallets in some way or another if you're here more than likely I'll say there are some folks here who are new to this but part of it was also making sure that you know there are sites and services in the traditional side that still use kind of oauth logins that can in fact integrate this kind of stuff so some of our work is also focused on how do we enable sites with these traditional login flows to also enable flows like sign in with ethereum so we've collaborated with folks like auth xero to integrate these workflows so if you do have these General traditional workflows as a large tech company you're able also able to kind of integrate this as well and kind of bring users along the way or kind of get users just started on signing in with ethereum once they're comfortable to do so while still offering another a couple of other options the question is now how you can help it is in fact possible so if you are a developer some of the best ways of getting this stuff off the ground is trying out libraries around signing with ethereum starting to get users you know signing in using their ethereum keys we work on a number of Open Source libraries there are other companies in the space also working on libraries around letting users sign in using their ethereum keys and honestly that's the first step in this entire process if you want users truly controlling their identity and data it all starts when the first step when they're actually signing into sites and services using their keys so for consumers a lot of a deal specifically with asking sites and services hey can I in fact sign in with my ethereum account for developers it's hey how can I enable this flow on my site and slowly growing that more and more not just in the web 3 space but also in the web 2 space asking sites and services can we in fact do this and enable this for users and part of it too is we work on a lot of Open Source software at Spruce we're more than happy to help any developers along the way and really would love to get more people involved more people learning about these standards more people participating in these standards process and starting to use these libraries and workflows so thanks I'm Rocco from Spruce and uh hope to talk to some of you soon because