The Evolution of Identity - Michael Sena

well up next is a conversation about how identity is evolving and here to speak with us about this is michael cena of three box labs in the ceramic network michael take it away thanks david all right so i see my slides up here um cool so i think this next block uh is going to be about identity for about an hour so i have a 30 minute talk now and this is followed up right after this with a panel on decentralized identity so if it's interesting to you i encourage you to hang out stay around uh ask questions and engage the panel um cool so here we're going to talk about decentralized identity um basically go through a little brief history lesson because the decentralized web hasn't been around for that long and we'll talk about where we're going next um i feel like decentralized identity is one of those topics that seems to come in and out of fashion every year or two um and it seems like it's back on the uptick now as developers sort of are beginning to think about how to create decentralized applications that can actually rival what's possible in web 2. we're sort of beginning to move beyond just the let's put a thin interface on a smart contract instead thinking about how can we deliver great experiences and cool and so who am i um i'm currently a co-founder of three box labs and we're a software company um we've previously made the three box sdk which is the most widely used identity system in ethereum today we have over 40 thousand identities and over two hundred thousand connected databases um three box labs is in the process of as we mentioned in opening ceremonies sun setting three bucks and now we're beginning to work on ceramic network and the idx standard um and together these pieces really can deliver a complete solution to decentralized identity um and sort of fill a lot of the gaps that have been lingering since for the last five years uh previously i was a co-founder of viewport it was the first self-sovereign identity data system on ethereum we founded that in early 2016. um you know while i was at uport we were a founding member of the decentralized identity foundation um along with microsoft and a couple others and we were early contributors to the did spec zero and we'll talk a bit more about dids but they're basically the the w3c standard for decentralized identifiers um and you can find me on twitter and email so let's dive in so i won't read through all this but basically the word decentralized identity is so convoluted so we're going to start out by walking through some definitions um and just setting some common understanding then we'll sort of go into the main problems that need to be solved previous approaches and then look ahead so kicking off an identifier um it is as it sounds it's a unique identifier and it can be globally or locally unique so we're not now we're not talking about specifically decentralization just a digital identity in general um next authentication is literally just demonstrating that you can control an identifier and this obviously happens different ways if you're using a server-based application or using a web3-based application information in this context is just data attributable to an identifier and discovery is the method used to look up information and silos these are obviously bad so an identity is basically just the collection of all data associated with a unique identifier and as we said this unique identifier can be locally unique or globally unique in the case of um decentralized networks they're globally unique in the case of servers they're locally so it kind of the same definition applies to both and when we frame identity this way it's just identifier plus data um you can really sort of bundle all of these other concepts of identity under it so there's proof of humanity systems anti-symbol systems like everyone talks about digital drivers licenses or verifiable claims and selective disclosure and pseudonymity and all these other terms but they're all forms of data or not or the absence of data and you can and when we're thinking about constructing identity systems we shouldn't build our future on any one particular implementation like identity is more like a framework and an abstraction and depending on the use case of the application that's how you want to plug in certain kinds of data um but but the identity protocol the foundational layer should not be opinionated it's more like how do we map data to an identifier and then whatever types of data are suitable for your application you want to be able to plug in and so that's sort of the starting basis and this definition holds true of identity whether you're thinking of people you know in the town square like pre-historic pre-internet times um where people were their unique identifier was their face and it was a locally unique identifier their face their name and the words they spoke and the things they did were the data they were generating and that sort of word was the identity system it was a local in-memory identity system uh and if you sort of fast forward to web three networks you have you know an example being a a public key controlled by a private key and that public key is doing transactions on a blockchain and the transactions and the payloads it's signing are the data that's associated with it um so it's all kind of the same and when we think about authentication and its role in digital identity it's really all about allowing others to verify that the the rightful owner of an identity is the one creating and in some cases also accessing data and so like in meat space like i said people see you physically say or do something and that's you know their observation of you becomes the authentication you know if they hear something from gossip that you did something maybe they're aware of it but they really can't authenticate it and so they're really just making a judgment um on web 2 platforms this obviously happens the way we all know with servers so you know you sign in an email password you get a session token and with every request you make to the server you send along the session token that's how they they attribute the data to you um and it but in web3 networks it really happens using cryptographic signatures so the notion of authentication is not authenticating into something it's more just like proving that i own this key and everything happens client-side in a completely serverless way um and that's how it sort of flipped there's no like communication between client and server it's rather just all client-side and with identity in every model of identity there's always this problem which i've called the known universe problem can also be called the problem of silos where another person entity or computer's understanding of you is limited to the data that they already know about you or that they can easily discover about you and you know in web 2 this data is stored on a server and it can only ever be accessed by those who can get into the server that's you know the application admins um myself if they don't you know censor me from the server and and others depending on which data is meant to be publicly consumable within that platform and in web 3 you really have this thing like i said where data is signed by some public key is signed by the private key but it's associated to the public key and the information can really be stored anywhere because in web3 there's not one server you know different apps can store data in different places maybe some apps are storing data on ipfs some apps are storing data and textiles some apps are letting users interact with the blockchain and um and as it stands all of those networks use different keys today so you really have different identities for every single web 3 network and there's no unified way to discover this data so actually as we move from web 2 to web 3 we haven't yet built out the right infrastructure to to deliver on the web 3 vision of you know user-centric data discovery and information portability and all the good things that we love about web3 we just don't have the infrastructure yet because we haven't solved the identifier problem and you know we already talked a bit about this but just to recap so web to server-based identity systems if we look at what developers are doing today we can kind of see what's missing in our stack and so um you know in in a server a user has what i'm calling a locally unique identifier and it's usually related to their username or email and it's locally unique because it's only local to that server that identifier is not persistent anywhere beyond that um unless you're sort of using an oauth system in which case it's more like a it's siloed in that server but others get permission to it um and an example of like if you're building an application and adding identity to it if you're building you know you're using some kind of relational databases say sql and you likely have a user table um it stores all your user ids and then it maps them to other data sources so you have other application data like likes or tweets or blog posts or follow lists in all these other databases and they're grouped by category or type so it's like all people that follow all other people in a database if that's not in a graph but you might be like all the blog posts in this database um it's not user centric and you're using this user table to build all those mappings you can look things up by the user and use foreign keys to build relationships between these databases so you know in your blog post database and your user table database they're connected by foreign keys that can point you in both directions and discovery of all this information is obviously limited but in web 3 we have crypto identity systems and we'll talk about some of the implementations um that we've seen over the years and you know starting with the most basic and simple um and moving to you know more advanced but more powerful solutions um and so we'll start with externally owned accounts so public keys is identifiers this is like the most basic where you have it's not even a one-to-one mapping it's just the public key is the identifier and everything signed by the private key uh is associated to that identity and you know this is like the whole concept of like web 3 is all built on the premise of authenticated data like almost whatever web3 network you use there's some kind of a a key system and you know depending on wallet implementation like those keys have to be able to perform signatures whether the user holds them or they're custodied in some way the system still works the same and this system is good at what it's good at but i wouldn't really call it an identity system and what that means is it's good because it's simple they're already supported by all blockchain wallets which you know you go to any wallet today you have a key pair um and it's good and fine for on network transactions where you know you have this key it is to provide you access to transact in this decentralized network of course it's good for that um but where they don't really qualify as identities is because the management key so what i'm calling you know the private key the signing key and the encryption key are all the same and i'm not going to go into too much detail on that in here but there are you know many published studies and known vulnerabilities that can be exposed when you do this it's not secure you can never rotate that key so if if anything ever gets compromised you're losing your entire identity and key management is super brittle so you um you know if if it's just a key pair you don't really have some of the advanced functionality that you might have um and additionally they're not really good for anything not on the network because they're made to do things on the network um and second is this supposed to be second let's do this one next um so smart contracts as identifiers and this one this has been around since mid 2016. uh when we were when i was at uport we won devcon 2 in shanghai because we demonstrated the ability to deploy a smart contract as an identity and use a set of friends called social recovery to reinstate your ownership of that contract in case you lost your key and um so that that notion of social recovery is a new um and smart contracts are pretty great um i don't actually really think they're super great for user identities but they are good for some things so they're good for on network transactions controlled by a set of keys rather than by one key whether that's holding funds and transacting funds or interacting with dapps um or interacting with other contracts um you know use the message.sender to to forward all sort of transactions through that single on-chain entity um and obviously gives you more robust key management options um some drawbacks are that it's really expensive now um i think you know and this has been why these haven't taken off more even just as like being built into wallets for fun management um and additionally it identity is still siloed to the network um because you can really only control a smart contract with with eoas and other accounts from that network um you can't like plug in you know i can't authenticate an ethereum smart contract with my near wallet um and so um they don't really work as universal cross-platform identifiers they sort of are good for an inter or intra platform identifier that makes any sense um there are other deficiencies here but i think we can kind of skip ahead a little bit um we've also seen we've also seen um people beginning to call domains identifiers um they do have some they do have some good properties to identity um i would stop short of calling them an identity system in the same way that i would stop short of calling dns an identity system um you know what they do do is they resolve uh a human readable name to a machine readable address and that's the core function of dns um and sure you can put things in the txt records and like sure you can use it however you want um but at the end of the day it's really good at you know addressing uh a machine readable thing with a human readable name it's good for naming um some of the drawbacks are registration and transaction fees um and some are permanent some fees are recurring and so the fact that you can lose your identifier um is not a desirable property for a persistent identity system um also the fact of name squatting and all of these other things that are sort of like known bad practices um in web 2.

like you you normally sort of try to use a a string of some kind and not use like a human readable name because you're more likely to get collisions or competition and you want to keep the identifier like abstract and behind the scenes in the same way that you're keeping like your ip address abstract and behind the scenes um and names can change domain names are transferable um if you're actually using the domain name as the source of truth for an identity uh it shouldn't be transferable like that's a flaw not a feature um and you know it supports key types from ethereum and it's still an uh silo within the network um and lastly in the same way that you could store anything in a txt record or at a well-known url path um there's no standard for interface for data like there's no defined schemas there's no defined things so like you're just interacting with arbitrary blobs in the txt record like um so it's not really that's the reason why dns hasn't really been used for user data management in the same way and you still always have to go through the process of registering so really what what the next evolution in web 3 um has been is really this movement towards decentralized identifiers and i say movement towards because you know we've been working on some of these things for for a really long time there you know there are now over 60 and 60 implementations of the did spec um and and there's now uh an eip on ethereum um for implementing a did interface for signing and encrypting data um over the json rpc and ethereum which can also be implemented by any other wallet on any other chain um but dids are really a way to go from a decentralized identifier a globally unique identifier a urn and you resolve a document and that document contains at a minimum a set of public keys used for signing an encryption and so basically like um it allows you to in the same way that you can just use the raw key pair to do this it actually separates them into multiple functions and as i mentioned uh it's supported by the w3c microsoft diff um it supports many many key types you just keep throwing more key types in there um depending on the implementation of did because it's a very lightweight spec there's different ways it can be handled like some just derive a did document from your public key in which case you know it's pretty inflexible and doesn't have all these capabilities um while others like the three id did method on ceramic um gives you a mutable did document where where you can rotate keys in there and you can change which keys are authorized to sign on your behalf um all while you know securely managing that rotation um in a strictly ordered consensus-driven way um and it's it's just a better way to to sign and encrypt data now in the w3c um there's the did spec is is fairly large but flexible and there's many ways you can use it there's not like one way you have to use the ids um but they're a much better way to to represent an identifier rather than an account or an authentication method and really we like to think about now is all these blockchain wallets can directly authenticate transactions on their local networks but they can also authenticate the seed of the did and and then allow that tid to interact with anything else that's not unchained um and so with this model you you you know at least in in the cross chain implementations of did like 3id you begin to have this persistent identifier for interacting with every other service and then you have the chains from each block chain or each web three technology the the wallet keys from them able to control that identifier um that way it delivers on some of the promises of user data portability because as we said in the beginning an identity is a uid plus data and you know if you can map your blockchain wallets to to that uid you can you know through the graph or any other indexing service look at all the transaction history and that's still there but you map them to a did which then use that did to sign and encrypt all other data that's kept anywhere else and you have a nicely unified type of the system and the last piece i'll talk about is discovery and obviously web 2 doesn't have this problem because like i said there's a user table and all that data is just neatly controlled in a central server and in one application is normally doing the the read write access so you know you know the app knows where it's storing its data and how it stores data so discoverability is not really a problem um but on web 3 user data discovery is really fragmented because as i mentioned there are many different ways that it can be done depending on the application architecture and design if you have just accounts that are enacting interacting with the blockchain and then you have some other app like ethereum near polkadot you have some other apps that are just interacting with ipfs or just text style and each of these applications has their own data model and place they're storing data and way they're managing keys and way they're setting up accounts and so there's no single place unlike a server where i can go to discover all of the user's data from across all these apps um and that's really been a barrier to adoption of decentralized identity and why it had one of the reasons why it hasn't been a reality is because each of these platforms using different keys and different data models and there's no way to tie them all together um in a semantically meaningful way and so without this um without this standard way to go from a cross-platform cross-key identifier like a did two various pieces of data stored all over the web generated from all different apps we will never be able to realize the vision of an open internet now some people are of the opinion that um like some in the in w3c or in diff that there's this notion of an identity server which they call an agent or a hub and a user will pay someone like microsoft to run a hub and every app will just write to that single hub um and and discovery of data will be done in the hub and indexing is done in the hub and that doesn't seem decentralized at all to me ultimate seems like you have a decentralized identifier and then you have a centralized server that is running not all the data from one app but all of your data from all apps so that seems like a more i don't know that that's the right way and so what what we need is a system for data indexing and discovery that is decentralized so a decentralized identifier a decentralized system of indexing and discovery that can tie into any type of data store and so a path forward it seems like the ideal architecture for web3 apps is a platform agnostic did controllable by any or many different key pairs linkable to accounts and keys on any blockchain or web3 text you can resolve in any direction it should be linkable to domain names and web 2 accounts as well and can connect to any type of a data store so developers aren't forced to use one data store or another they can continue to build that their apps using the stack of their choice and when the data association shouldn't be associated by app because that creates application silos again so if we actually want to solve the problem we should be like linking data to a user in a semantic way so you know saying this is the schema of data that's i'm going to associate to the user and then it points to a record which contains that data and any app can use it it's not like tied to one particular app and if we move in that direction um we'll be much closer to this this web of interoperability and that way you know app if i'm querying this type of a thing i don't have to worry about which app first created this data it's more just like what schema do i want and can i get it and you can represent a lot of data like this and it's really important that there's also a standard developer interface and api for getting and setting like it shouldn't be complicated and it shouldn't be implemented in many different ways across many different apps because then we'll never collectively get to where we want to go um and so i'll quickly talk about idx this is what we're working on um you know we've obviously been been building these types of systems since early 2016 um and we've been in the market and we've been asked a million and one times from a million and one people like you know different questions that led us down this path um but idx is a cross-platform identity standard and it really is built around this concept of an index that is a key value map effectively where keys are definitions and they map to records which are objects and they're semantically meaningful and those objects can either store data like a profile or it can store pointers to additional data stores like maybe a blockchain registry or maybe a server or a textile data store or a ceramic document and so um or a proof that binds my did to my ethereum address um and so you know if we can organize data this way in a cross-platform way not tied to any specific network um then it actually sort of serves the function in our applications as a user table would except now it's not you know collections of databases organized around topics but rather it's a single user-centric mapping to all data stored anywhere and here's how it works i mean it's pretty straightforward you developer publishes a schema on ceramic they include the doc id of that schema and their definition which sort of creates the semantic meaning that doc id of that definition acts as a key in the index and then when a user is interacting with an application a record is created and the doc id of that record acts as a value in the index you have a docker id to dock id mapping and that index is really lightweight and it lets you eliminate users from your server connect all these accounts together you have the flexibilities whatever data store you want you by adding your data to the index you're making it discoverable and consumable in other applications it lets you you know search and import data from third-party applications and all the while giving users control um and it's simple to use and this is the direction that we have to head i mean if we decide that we don't want to go in the direction of giving users interoperable control of their information and actually bridging these web 3 networks now we'll start to be building ourselves in a direction where it becomes later impossible to do so i think it's critical that we start thinking about these things now because the more entrenched users get in these accounts on these networks the harder it's going to be to undo and i also don't think that we can um succumb to the pressure of just throwing things on a server because i don't think that's why any of us are here so thank you thank you michael that was a fantastic conversation and an introduction to identity and how it's changed over time and kind of where we are right now in 2021 with decentralized ids love your approach