Jonny Howle ~ Identity as a Means of Adoption - uPort

[Music] also very excited about our next talk which is about identity which is a topic that Johnny Hal who's our presenter is very familiar with he's gonna talk us through the the future of identity and weaving together web 3 identity and adoption so please give Johnny a warm welcome hello hello check alright ok so thanks everybody for coming to listen about identity and a actually a bunch of kind of other things I'm trying to weave them all together into one kind of coherent vision for how aetherium and web 3 can gain adoption by building identity the right way it's gonna cover a lot of topics privacy trust network effects a lot of usability a lot of usability and it's a little bit more of a conceptual talk as opposed to I'm not gonna be writing any code up here or anything like that first things first so I'm Johnny I'm a product designer on you port I've been working on identity for about a year and a half now maybe close to two years and being part of you port and having you port integrated here at East Enver I encourage anybody who wants to come give us feedback on how it was to use you port to either yell at us or give us a high-five if you see us in person we'll probably be over there at that table most of the time or you can find me on our dedicated outrage channel which is Twitter at Johnny Austin Tx if you want to yell there so you port what is it in a nutshell we want to make self sovereign identity practical usable Universal there's a lot of other things that go into that but I think that those attributes kind of describe the overall vision pretty well this is the big statement that kind of a cap slates this presentation which is I think the way that we handle identity will make or break web 3 it's not inevitable that web 3 generates the self sovereign identity we want there's other avenues that could we could go down that are better or worse for users obviously web 2 didn't end up handling identity the way we wanted it to and I don't think web 3 it's a given so I think we have to build it and we have to build it the right way with some principles in mind so I spoke about identity a little bit at Def Con I wanted to recap some of those concepts which this kind of builds on it's around identity trust reputation privacy a little bit about ethics and things like that so I'll run through that pretty quickly here all these kind of dots you could think of those as representing the different identities you have you don't have one identity identity isn't this essential quality it's kind of like an emergent thing the thing that we say when we're talking about any set of data or information that refers to some individual obviously you can have devices can have identities and things like that but for the sake of this for usability we're talking about what it means to be a person online so you have all these different contexts maybe you're anonymous on some gaming platform you have a different identity with your family with the people you work with and all of those things kind of interact merge morph and form who you are as your how you understand it subjectively as your identity and that's what we're attempting to deal with online so identity kind of manifests itself in some cascading spheres so you have this individual identity which is the easiest thing for you you know you that you intuitively understand and then you have these other layer social digital D central sovereign social is super-important to something like aetherium peer-to-peer technology and it's it's interesting because this is where reputation and trust emerge out of the concepts of identity and how do our identities interact with each other so I would say that identity multiplied by time gives us reputation it gives identity some valence gives it a direction it helps us make gives us two points on whatever graph and helps us make predictions about how an identity might act in the future and I would say that that's really what we care about we care about reputation more than what we we often refer to reputation as identity but there's little nuance there and I think online what we care about is reputation and you port doesn't bill itself as a reputation platform per se but I think that this is essentially what we're all trying to do we care about identities insofar as we care about what they're gonna do in the future can we trust them and to what degree let's go keep it moving okay so the way this relates and is important to us cryptocurrencies blockchains all of these things are peer-to-peer technologies and identity interacting with another identity now the interesting thing and this is Indiana Jones attempting a atomic swap in real life which he wasn't able to pull off if you've seen the movie and that's the thing for most things that we want to do to change the world with these technologies we can move the assets in this atomic swap fashion right no trust needed either both happen or either the debit and the credit happens or neither happen right in real life you can't do this with physical goods and services so you get this asymmetry right you get trust lessness and the movement of movement of the asset and then you have to have some sort of trust architecture built on reputations and identities for the movement of the good or service you're attempting to pay for and I think I would say that this asymmetry actually makes the process worse right when you can't reverse the transaction it makes the amount of trust you need to move the good even higher because there's no reversal of the money it's easier for somebody who gets you to send Bitcoin and then doesn't give you the good to get away with that so we need to do something to mitigate this so new atomic swaps in real life I think the role of identity has often overlooked when we're thinking about the mechanics of trading this is a side note if you're familiar with gdpr it's a big deal in Europe it's about it stands for general data protection regulation and essentially what it means for people working in this industry is you don't want to put any personal identifying information online not only is that a risk legally it's also just probably a bad practice it's it's it's worse than even what the data aggregators that we dislike are doing so I would be careful of that so to wrap up this front portion everything is reputation that's what we care about all the data of round identities helped to serve the building of reputation and reputation is the basis of trust it is our trust so what's our the possible futures for web 3 as it comes to identity data how we handle it so there's there's three that I can kind of think of there's a Zuckerberg future you can imagine a scenario where Facebook allows you to log in to taps but they hold on to your keys they sign the things for you they attach all of the things you do on web 3 to your Facebook profile and then we get the adoption we want from if you're a DAP and you want users you get your users but we have just re entrenched all the terrible things about web 2 into web 3 and we don't want that to happen but it could happen and people are going to try and make that happen there's also the China vision the ji Jinping vision of identity so if you're not familiar China has a pilot program out right now called the social credit score and what this does is trying to watch is everything you do all your private messages when you shop what you buy where you go and all of this is filtered in to a overall reputation algorithm that's not transparent you have no recourse to it and essentially it's it's a it's a control and surveillance mechanism this is what I fear when we if we put personal identifying information on chain but we've built if if we do that what we'll build is a globally accessible surveillance network like a like an immutable Palantir on steroids and I don't think that that's what we want what we want is this self sovereign future but it's not inevitable so we have to build it so what are we willing to do for adoption are we willing to do anything I would encourage I would I would say no I think that there there are some standards and some principles we should have when we're thinking about dealing with identities in web 3 so this is a trilemma it's similar to Zuko's triangle but it's a little bit more aimed at identity so we have this usability privacy and sovereignty and there's this gap in the middle where these things don't overlap so an example of usability and privacy that might be something like your encrypted messaging apps telegram whatsapp signal wire or something like that if you have usability and sovereignty this is something like a system that puts your information on chain right you're still sovereign it's pretty usable because DAPs can just look at the chain and get the information they need to do what they want and then you have privacy and sovereignty and I think that this is pretty well represented by something like PGP which I wanted to talk about so PGP is a really good case study for us to look at PGP stands for pretty good privacy it it was it attempted to allow people to use a set of key pair to sign messages in email and send those messages to some other key pair where they could decrypt now this is John Kallis on Twitter 2015 talking about why PGP never took off he says we have done a good job of teaching people that crypto is hard but cryptographers think that ux is easy and PGP works it's just not usable for regular people and there's no guarantee that our key management and the way we handle encryption and and messaging and all of these things in web 3 is going to be any easier I don't want to see us go the same route as PGP this is Tim berners-lee he's talking about the failures of PGP he also believes that the reason PGP failed was because of usability says the workflow was horrible in many places like you need to do X in a dialog box but there was no link or a button or an explanation on how to do X he went on to say you had to do this Chee deists multi-step process download someone's key bla bla bla you didn't know what it any of it meant and this ultimately was why PGP never took off so how do we avoid that how do we find this overlap between these three spheres and solve the unsolvable trilemma well you port and other people in the space believe that it can be soft so and I think we solved that with a theorem theorem now makes this solvable so I want to talk about network effects and why solving it in the right way is key to seeing this mainstream adoption to seeing all the apps in the depths that are being built upstairs actually get users so Joe Lubin says this and I think it's right I think I think the thing that theorem can do is it has this different character to the network effects that can emerge if people are owning their own data and can move it at will so this is your typical Network effects over time as you accrue users the value of your platform goes up with every additional user we have this second order of network effects where the network can go up with every new dap and every new user right these two things start to create an extra feedback loop that that return positive value to the network and increase adoption at a faster rate so we've actually seen this type of compounding Network effect before and that's kind of represented by Facebook so when Facebook and you know there's lots of other ooofff users out there so you can login with github you can login with LinkedIn login with Google but these types of things were great for usability on the web they reduced the barriers to entry are the barriers to use for tons of apps and websites one click signup the problem was is that you don't own your own data and you've typically overshare so there's two things that Facebook does to lock their users in why the usability is great but it comes at our cost first thing they do is they build up a locked-in reputation they don't make it easy for you to go use a facebook competitor right so if some Facebook competitor comes out they're not going to just put a log in with Facebook button on the Facebook competitor and allow you to port all of your data into it then they decrease barriers to use with approved applications this is the UX right they keep you in Facebook because of how good this UX is 78% of people when presented with the option to log in with Facebook Connect choose that so we have sovereignty of aetherium you have the privacy of PGP and we need the usability of something like Facebook Connect so this is where I think web 3 if we can do those things web 3 actually will surpass the web 2 value because we'll be able to decrease the switching cost so when you own your own data you decrease the switching costs from one app to another it right now in facebook the switching cost is incredibly high you have to rebuild your identity and rebuild your reputation on some other platform nobody wants to do that all their friends are there all their photos are already there and they don't make that easy but if you owned your own data switching costs you know approach zero which means competition moves to the user experience level and we get a more perfectly competitive market so here's what that looks like this graph is kind of take on Clayton Christensen's disruptor innovation disruptive innovation model so the important things about this are this this the space in the middle right maximum performance needed minimum performance required that's the you can actually over build and you start this is like clearer TVs that even eyes can't detect right great it's it's objectively a better TV but it serves nothing to the end users and then you have a minimum performance required so I put this orange dot here to kind of represent where we are and now that I look at it I think it's pretty pretty ambitious to put it there I don't know that we're there yet I think people in this room find that aetherium provides the minimum performance required for a lot of things but for mainstream users I don't even know that we've made it there but the key thing is the web is actually getting worse as data aggregates and we see all the hacks and all of the data breaches web 3 can keep that from happening if we build it the right way and we have to get some separation before the switching costs are worth it it's not going to happen just at the point where we crossover web 2 we actually have to do I don't know what the estimates are 10x better or something like that to induce a switching cost but because of the interesting nature of aetherium and the way self sovereignty can work in this ecosystem we can actually get that separation I think here's an example of how you port thinks that this could happen so you have a user and they're gonna use you port and they're going to use you Joe let's say they're a musician let's say for the sake of this they're kind of like many of us interested in a number of things they're a they do programmatic music right so they know some tactic code they make music out of it they post it on you Joe so let's say they do that and Oh Joe sends back to them the data the reputation that they've accrued on Oh Joe for them to store now that is pretty typical of app experiences you might even say that's harder than a web to app the key is as you move forward it gets easier and easier and easier so if you have you port and you go and you're in calorie integrates with you port for instance and they calorie wants to hour on calorie our our user wants to write an article about how to do this programmatic music that they've done right they can come to calorie without calorie needing to talk to you Joe they can bring their reputation the songs that they're referring to proof that they created them proof of how popular they are and bring that as evidence of why you should listen to me about this topic right and nobody can stop them from doing that then you keep going then you go to get coin maybe you see a bounty for some Python bounty and you write your your music in Python you can bring with it the fact that you have written an article on this on calorie and calorie doesn't have to talk to get coin you can just do it yourself and nobody can stop you and this goes on and on and on so bounties now you want to you know fulfill a bounty for some musical score that's written programmatically you then want to go to civil you want to apply this is an interesting one so civil is really based on reputation so if you wanted to apply to civils newsroom and have people vote on whether or not you should be in all of this data that you own now can be brought to civil nobody can stop you from bringing that data to civil and you can use that to elevate your standing on their platform and bootstrap your reputation and then finally let's say you go to AA police and you want to you want to apply for a job this data that you've collected all right that our users collected is probably more robust and more valuable than any resume could ever be and the reason this is different from web 2 is that you would imagine let's say Facebook in the middle there and what would happen is these lines would be connected between the DAPs right so they would have to if you wanted to get your gujo information to calorie in web - well calorie or Ojo needs to build some api or something like that to allow calorie to pull that information right and that is a ton of developmental overhead and that is what decreases the the it increases the friction and it decreases the network effects and increases the barriers to exit and increases the barriers to try so the interesting thing about web 3 is if you own your own data as soon as you on board for one compelling use case into the dap world you're already on boarded essentially you're one click away from onboarding and bootstrapping your reputation on every other single dab and that is just a fundamentally different change and it's going to speed up the adoption of of web 3 so it takes us along this curve right so as that happens we get to move up here I think that's the most important thing and if we build that we can see the mass adoption that we want we can see every DAP up there that gets a user make it very easy for all of the work they put in in that daps context to be valuable in any other interesting context and node developers have to get involved in making that bridge work right it happens just by virtue of building adapt I think that's how we get to a mass adoption so thank you you can find me there again at Johnny Austin Tx I don't know if we have any time for questions Vivek question time good cool how's it good yeah I was there like I'm oh there's my cube again thank you for a great speech my name is Ivana von etske from smart Dec let me bring in a little analogy between data ownership and permissions for mobile applications so when you install a new application it asks you for instance for access to SMS and so on most of people just press it without reading even if for instance game wants access to photos and SMS and so on so you port gives people an ability to own their own data and not to give it to some other applications while Facebook doesn't the question is do people really need that or maybe most of the people will just give their data and don't care about this feature which I can see the very important yeah I mean I totally agree and this is what I'm why I called out that Zuckerberg future I think there's this thing we talked about a lot called the privacy paradox right sure everybody's heard of all the hacks and all of that but I'm sure many of you I won't make you raise your hands probably still have Facebook I still have Facebook and I work on this and that is a hard user experience problem to solve now the privacy paradox paints this paradox as intractable right you that's unsolvable I actually think it's just a matter of switching cost right it's just a matter of how much more value is out there in a platform that is self sovereign right like web 3 could be so one thing that we focus on in the design and that we're on bird we're testing we've been testing is how to how to get around this dark pattern of hitting users with the wall of information making them feel helpless to understand or read it all and just hitting accept right because they're already invested and oversharing Facebook counts on this right they've they've been they've had pushback from regulators and things to make it easier but they're due the bare minimum and some applications like LinkedIn I think they don't even they just give you kind of like a summary like oh this application will get your basic profile data no user knows what basic profile data is and yeah that's a hard user experience problem to solve that's where design comes in right if you want to give users control you have to give them the controls to do it and yeah it's not easy something we're working on zero knowledge proof sand non-reusable proofs that like ID entry is working on and things like that can help mitigate this and make it less reliant on the user experience designers to make sure that this doesn't happen but yeah it's an ongoing it's an ongoing problem and it's definitely not completely soft at all thank you yeah why people should right yeah so one way is to integrate with an event you want to go to and so people have you port the other the other way is I mean one is just a user experience question we want to make it as easy as possible to get started with you who are people are used to downloading apps of course they're inundated with them now so you have to kind of provide that value upfront as soon as possible and make it very clear that's a little bit of a chicken in the egg scenario but I want to stress that you port also is not it's open source right so if somebody wants to use what you port is built and you port identities to in some medical context right maybe that's how you on board is to maintain your medical records somebody can go build a you port like app that generates you port IDs and does all the signatures and and all of that stuff and does verified credentials for medical context and they can they can onboard users that way now we want to make it trivially easy that if they want to expand to take medical identity that they've been asked to have by their doctors or whatever to take it to other context they can port that very easily just into the U port native app that's at use case agnostic right so there's a couple routes there we are also counting on the competition at the application layer to build the best user experiences for very specific use cases that take advantage of self sovereign identity we just want to make it as you accrue identity in different context where do you want to aggregate it to and that's why the U port client exists so it could happen a couple of routes we're obviously trying to get adoption at events and things like that organic adoption but their adoption might also come from these other avenues where you're serving some very high-value purpose at first and then now just as a bonus to the user they already have a self sovereign identity set up and now they can use it across all these interesting gaps right so I think that that could also help aid in the enough scaling up our user base and it's not really our user base right we want to make you port of a protocol as standard right and I think we'll be happy if you're using decentralized medical records app that's built on you ports identity protocol just as happy about that as we would be if you downloaded our app Thank You Johnny Cheers [Applause]