Verify Private Data with TLSNotary Plugins

[Music] so welcome everybody I hope you're excited to start hacking it's uh fun I have some experience there and I liked it a lot so I want to help you with TLS notary so I'll start the first part just introducing what TLS notary is and then I'll give a very quick demo to to get you started but we also have a uh at the ethereum foundation so uh if you have further questions you can uh find us there so first the motivation why would you consider using TS notary so I assume everybody knows https so TLS is the S the secure in HTTPS and it's used to get data LS can get data from a website what is data it could be identity information from a government website it could be balance information from a bank it could be social information or just gaming stats that you want for bragging for example so what DLS uh is a very helpful way to get data securely from a website but it doesn't have a solution for sharing data with a third party uh which I will call Bob in today's talk and so Bob could be a kyc provider a creditor somebody who wants to use that data and so what I expect for in this heck on uh most of you will have the perspective of Bob where you want to help Alice um to provide her with a service but to do that you need some information from her and so um as I said thls make sure you can get data securely from that website so you know it's origin you nobody nobody changed something in between in that channel and also that nobody can listen in uh but because it uses symmetric encryption you cannot simply pass on that data to somebody else and so that's where TLS notary steps in so we have a solution where Alis and Bob can do the TLs transaction together and so it has all the properties of TLs but in addition it makes sure that Alice can pass on her data to Bob um securely uh Bob does not has to trust that Alice doesn't cheat he can check it and also it does not need any changes to the original website so this kind of unlocks uh all existing data on on the internet and your app can compose different sources and provide uh Implement new applications that way so what's the secret source of TLS notary we do the TLs connection with the multi-party computation so that means that Alis and Bob have to do uh all the key exchange uh together and so the advantage is that Bob during that TLS connection only sees encrypted information and at the same time Alis cannot do any requests or uh decryption without the cooperation of Bob so Bob also knows that Alis cannot cheat uh of course there's no uh free lunch either so uh there is a cost um so there is definitely higher latency in that con action and also there's a high bandwidth so lots of encrypted messages that needs to be exchanged between Ellis and Bob um but the good news is it works um in in a lot of cases so I told Bob only sees encrypted information that would be useless um after the TLs connection is closed Alice can then share the actual decrypted data with Bob and so TS not has an option there to toce to uh offer reductions so what I showed here with the the red squares is that that's kind of information is redacted when Bobs get the data but still Bobs know that the unredacted data is all correct um it's not easily available yet today but you will also be able to do uh zero knowledge proofs on that data that's hidden so instead of disclosing your address you can give information about it's not in the US for example um so in a nutshell so if you want to share data in a secure and privacy preserving way uh consider a TS notary for your hecton projects so use cases is everything where both privacy um and security are important so things like identity financial information so you could prove real world uh assets like you could make your user log in to the Tesla website or to whatever website to prove he owns stuff or that he bought stuff in in certain stores if you want to have like a a Marketplace um or also like I heard somebody at the boot earlier said they were looking into like uh gaming assets stuff or like gaming statistics all these kind of things uh become available to do stuff and com line it in new ways uh even if the website doesn't offer an API for that itself so again the data becomes composable so it's already used in the wild so uh ZK P2P did the hackaton in India where they they prototyped this it's now available online uh open layer did hackaton in New York where they built this uh uh bragging uh website where you could prove your Gam stop wins or losses which is nice and opacity Labs made something with data from 23 and me where you could uh prove your NE undertal index or your uh inclination towards boldness um in the uh previous version there was only three parties sometimes you want reusable proofs where both ver A and B wanted uh in that case you can separate the MPC the multiparty TLs to a trusted neutral party and then have the Prov store that proof and then if the verifiers trust that notary they can actually use that proof without being online together uh with the pro to do the actual uh TLS transaction so uh now let's switch to the demo um for the demo I'll show you um our browser extension sorry uh so uh the advantage of the browser extension is that so to log into websites you often need to cookies and we have prepared a demo here where we will prove that we received a DM message uh from myself to the TLs notary account so when you click this you get this checklist with steps like first make sure you're logged in and then it needs like you you need to select uh a direct message so when I do this I can click the check button here and now it starts notor rizing so checking this uh requests so I'm now using a a notary service uh on my own laptop to make sure it's uh it's fast enough and we're not limited uh by Network speeds and then you get this proof uh where you see I don't know if zooming in works yeah so where uh some stuff like uh access tokens Can Be redacted and then you get the the response and there should be uh my GM is in there that's the response we got for the server so now we have this signed data that your app could use so uh this is extensible so uh if we switch to um via scod here you see that you can uh Implement typescripts where we have have a a config do Json where you configure the steps that that needs to be done they each have then an implementation where you check whether you can move to the next step um and it also has some uh but that will change in the future but already has a permission system where you also kind of protect the user of not having crazy plugins that that steal all the users data um so but it's already very approachable um for you to start uh developing plugins and then the most interesting part is mostly that you need to get access to cookies so in this case it's from uh the Twitter servers and then you compose a request where you set the necessary headers so for example here we reuse the authentication token that the browser was using and that way we we get the response we need and we can even do some uh reduction in there and then it's just a matter of um oh if only I could type to do a build and uh what's actually happening here is we built a wasm plugin I don't know if you heard of exm before but not that important um but now we can open this uh build result which we can now add to the browser extension we can add a plugin here and then uh yeah it's already in the correct location so the user gets some information like don't just install everything so this one will get have access to these kind of cookies um will allow it now and now I can run this proof that I have a Twitter profile uh so the the proof should arrive um uh shortly uh I I think I SP run through my demo what also uh important to know so that's the side to get the data of course your app will also want to use that proof to verify that the proof was correct so if you go to the tlsn extension repository there's uh we added the wiki for this uh hackaton where you also have this uh tlsm connect provider where you can as a website connect to our extension request access to proofs then you get uh again you need the the user's consent and then you can verify the proof and use that data in your application either it's to do something onchain or offchain uh T notary is very flexible only your imagination is is the limit and also the data size so uh if possible look for apis that give you just the result that you need and not like if it's server side rendering that's uh too much data for TLS notary to handle today but we're of course always uh pushing that limit um uh kilobytes yeah so so like the lower kilobytes are no problem but then like then at like 50 kilobytes that's already uh started to get tough all yes well so the the request is to the Upstream server so oh at the verif fire side there's no no problem but so the the limit is because it's all in so MPC that's like garble circuits oblivious transfer so there is overhead in there and so there's lots of communication between the approver and the verifier if you do it with the notary then it's similar with with with the notary uh word mentioning is that at psse we do run an example notary server so in the hackaton feel free to to use that documentation is on our website um so that that's definitely an option um and then for the hackaton we have two bounties so uh TS notary itself is written in Rust so feel free to also just Implement a server that something funky in in rust or use our new uh plug-in system to just fetch the data do something with it so we have a price pool for new plugins so that just like figuring out how do I get data from the data s sources and if you have new use cases uh yeah that's also we're very curious like uh what you guys will will build with so in that case so the question is what if uh there's extra features in the back end so in most cases I think you can solve it with selecting the correct cookie um if they of course they can change their API any day and then you need to update your plugin uh but that's also painful for them and of course also please respect the terms of Services of the data source this is not a hacking tool so uh yeah also keep that in mind yeah yeah so there there's a this trust assumption so um what does it mean so imagine that the approver is running the notary then we're back to square one um and then then it doesn't help so the notary needs to be neutral uh if the if the or if the if it's two parties and they collude again so if it's about a lot of money it's more careful you have to be more careful than if it's just like if you need to have a Tesla to be in an anonymous Tesla chat group it's not that bad if somebody cheats but if you're if this is a multi-million dollar deal then you need to be more careful definitely um there are already startups like looking into like uh IG layer Solutions with slashing if notaries cheat this kind there's we're also like looking into doing like this is like a two-party computation like it's possibly also possible to have like do your request if it's high value do your request with 10 notaries that will be probably a high cost then but if it's worth it it's um not sure why that's relevant but so there are solutions you could also run a notary in trusted environments there's all kind of research also going on there but maybe we should discuss that at the boot yeah yeah more questions oh I have have to wrap up sorry so for more questions visit us at the boot that's also where the real experts are I'm only the spokesman so um thank you for uh all the good questions and I wish you a good hackaton [Music]