Jesse Leimgruber, Isaac Patka ~ Take Back Control of Your Data: Using Bloom API for Finance and Iden

[Music] alright guys we have the decentralized identity talk starting now so please come in if you want to learn about decentralized identity and how you can integrate it and win up to $5,000 I'm gonna jump right into it my name is Jesse lime Gruber I am the founder of bloom I'm here with our head of engineering Issac and in this workshop today we're going to give you a high-level overview of how you can integrate decentralized identity in 20 minutes or less exactly what it is and a very simple way to get started we've put together an incredibly simple package to get started in just a few minutes but before I jump into it I want to give you a little bit of context on why I think this is interesting to you guys about six months ago we launched our bloom app which allows people to set up a decentralized identity it has rocketed to top ten in the utilities in the iOS App Store with over 300,000 installs and more than 40 applications already built on bloom this is not prototype technology this is not early-stage technology my co-founders built the identity verification company that currently powers coinbase and we took those learnings and put them into the bloom app we're integrated with companies like BMW American Express and dozens of other apps so I want to really really stress that if you build on bloom you will be given robust documentation incredibly detailed documentation and getting started guide this is not you're not going to run into the bugs that are typical with a blockchain product we have over three hundred thousand on chain users that have gone through this flow and as with anything there are prizes we have $5,000 of prizes that we're giving out in addition to additional grant money possibilities if you need login in your application if you want to review verified financial data if you to collect someone's bank account information social network handles our app lets you do that any app that needs login can get access to our $5,000 in prizes it is not the type of protocol that you need to build your entire product around it is drag-and-drop similar to Facebook Connect anything that uses login can get there and this is important because our system does do things a little bit differently as everything in decentralized world with 10,000 companies pooling and selling data the ability to control your own identity data is critical and that's exactly what we bring and it's not just controlling your own data you can receive that data so if you don't like countries like China that make interpretations about their population you can pull that data in and make say your own credit score or your own financial system that's the type of thing bloom allows for Isaac will go into the workshop of exactly how we're gonna integrate this but I want to highlight a couple of final points we are really trying to make the future of identity happen here with good UX first and we're well on our way our technology is currently integrated with partners like BMW American Express it's pulled over 300,000 users you can download the app in the App Store and try it out and we're really really excited to talk about some of the possibilities on building together in previous hackathons we've had projects build things like eliminating fake news verifying anonymous news citations without having the raw person's information so sighted an anonymous source you could click it and see yes this was a source at Apple you know or something like that we've had people build projects like DocuSign making digital identity signatures actually provable and actually material as opposed to just signed by and you don't know who's sitting behind the computer so there's a lot of possibilities of what you can do with a robust identity API and there's is even more possibilities because we've put this in together into such an easy way you can pull down and deploy change to parameters and get a full decentralized identity integrated into your app or DAP in literally 20 minutes and Isaac's gonna show you exactly how to do that right now take it away Isaac hi everyone I'm gonna start with a quick video demo of what it looks like once you have bloom ID integrated into your application so this is the this is a screen cap from the try it out section of our website basically what's going on is we have a QR code which has a unique token that allows the front-end of react to the data being received on the back end the QR code also encodes who's requesting the data what they're requesting and also metadata like privacy policies and you should policies so somebody has already downloaded the bloom app and they're going to share their data with the bloom website you can see that this user has already verified like their phone number their email the fact that they have a Facebook account they pass a sanction screen so they've got all this kyc data that you can receive and verify on the backend if the user gives permission to share data specifically with bloom it's a simple slide to share and on the backend we've received all of this data so that the sanctioned screen the Facebook the LinkedIn the driver's license right so we integrated this on our back-end just to show people what it would look like but if you integrate this QR code or it's actually like a deep link on mobile then you would receive that data you can perform a few verifications once you receive that data you'll see that the person that shared the data with you is the person who owns the data because they sign the payload of the share with the same key that you they used as their subject during the on chain attestation all of these add of stations take place on main net so we also you can also verify that the data that was there that the data that you were sent when it was verified on chain and that it was never revoked so these are all the things that you can get when you just integrate a quick share kit so the best place to start is the bloom starter repo on github so the bloom starter is currently we have a typescript Express and react implementation which you can one click deploy to Heroku and this is what it looks like it's very bare-bones but what this allows you to do is receive the users data right away in the first five minutes especially if you already have like a Heroku account set up so this QR code is ideal for when somebody is doing an omni device flow like sharing data on desktop from their phone but there's also a lot of cases where mobile mobile only application flows you can't obviously scan a QR code on the same device so when you pull this up on your phone it is smart enough to render a deep link instead of a QR code so this is what it looks like on the browser in Safari so instead of a QR code you just click verify with bluem you give permission to share your email with the bloom starter a Heroku app and you're logged in so there's a lot of different applications that you could use for this something as simple as signing a user in to your application could use this but also things like sharing contact information we were talking with some hackers that already thought that they could use this to simply share a verified email with somebody automatically add them to your contacts list and then move on so this Heroku app right here this bloom starter is available right on the github repo it's just a simple one-click deploy so sure so another thing that we think is is critical in addition to building a lot of code that you can pull down copy and build your app around in a few minutes is we've put after working with dozens of developers we have optimized an incredibly robust set of documentation which I'll show you here every single facet that you could need is already documented out with sample code from signing a user in signing logic receiving attestation data such as verified financials or verified identities we have a share kit and a receive kit which is literally not too different from integrating something like Facebook Connect and user and with Facebook except rather than Facebook owning that data and risking data breaches which actually happens that data is stored locally with the user so if you're familiar with integrating any other login system this is not materially different except the data that you receive is incredibly robust address data identity data verify kyc data as I said my co-founders built the company that currently powers coin bases identity verification flow those learnings have been rolled up into bloom we've had people build fiat applications exchanges things that are really sensitive with government regulations and bloom lets you meet those in literally just a few minutes so do you want to talk about some of the different kits that we have on here sure I also just want to take a quick dive into like how we perform these verifications and how the data is structured because I'd like you to be able to trust how we're verifying this data so a good example is like a driver's license so when you tip when you verify a driver's license you can parse out all sorts of different information like date of birth license number address but you might not always want to share that if you simply want to do like just represent that you're over 21 and you've been verified a lot of people have talked about using like zero knowledge proof for these purposes but that's kind of hard at this point because the tooling is not available yet so what we do is we actually structure all of the different components from in attestation into into a Merkel tree because everyone uses Merkel trees for everything and then you can share just selectively disclose say your date of birth without disclosing your driver's license number we have a specs repo which I really like it's got all these great diagrams showing how the data is structured if you want to dig into this stuff I love talking about it so if you want to critique it tell me how hugely improved take a look at our specs repo all as I said all of the add of stations are on main app so what's actually on main net is something that doesn't reveal any data about a user that they would not assume this in for you guys that they would not want you to know because one of the most important things is not allowing correlation attacks with identity if somebody shares you just that they're over 21 and then they share to somebody else their employer they could potentially collude to build up an identity about you so by having the on chain component just be and hashed with a nonce like just basically you there's no information contained in it unless the person explicitly shares data with you so if you look at our attestation logic contract which it gets we pretty much have a transaction in almost every block these days I also do a lot of like infrastructure work for queueing maintenance actions so if you want to learn how to do that also stop by so on ether scan which I think a lot of you would be familiar with you can see in the event logs just what this data hash is and that data hash is like the root hash of that Merkle tree and then as one of the components of the proof you see okay this data was included in that set of data yeah all this verification stuff is already written for you in bloom starter so just clone it run it modify the header and you've already built your hackathon app cool so one thing that we're really excited about here is the ability to offer prizes and we've already had a lot of people come to us with ideas we're offering $5,000 in prizes and as I said as well as the ability to receive you know additional funding and support from us on an ongoing basis we've got three categories of prizes and again you do not need to build your entire hackathon project around bloom this is super fast like fifteen or twenty minutes if you just wanted to use bloom for login or receiving data you can do that so we've got three categories of prizes the first is most creative submission pretty much open to anyone simply using bloom for your login will qualify you for this $1,000 prize the second is best lending application as part of bloom we've had countless applications build one-click loan applications which you know you receive their address and their bank statements and their financial information so it's very easy to do a lending application it also is compliance is you can do fiat bank wires so $1,500 prize for best app location in lending and then a $2,500 prize for the best application involving decentralized identity this this can go a lot of different ways but showing previous hackathon winners crypto source 1 or $2,500 prize to make a clickable news citation so if I wanted to share with journalists that I worked at the NSA and there had been a data breach but I'm definitely not gonna want to share my name since that's classified government data well with bluem you can simply share the fact that you're employed by the NSA without needing to share your identity this makes new citation secure and verifiable by anyone super unique use of decentralized identity another one was a DocuSign clone that's also won our prize at a different hackathon which is verifying signatures they made a very simple DocuSign like application but rather than just signing my name this actually signs it with the flow that Isaac showed super unique use of decentralized identity cool one more ux thing so i've showed you what it looks like from the developers perspective but what does it look like from the users perspective so when the user opens up the bloom app for the first time they'll see all the different data sources that we currently have available for add of stations so you can see that we can verify your phone number your email all your social media accounts your sanctions like the fact that you've received a sanction screen there are some things that we are in the process of implementing so for the purposes of your demo you think this is a cool application of decentralized identity I want to have my relationship status attested to my bloom ID for some reason then go ahead and do it mock it we might consider integrating it for everyone so yeah and there's also open source so if you want to integrate any of the stuff on the load on the lowest level and do this it using our smart contracts do that but feel free to mock any sort of creative bloom ID applications that you can do so this is a quick video of when I just went through a sanction screen I just like to show off our UX because UX is essential and crypto here's me not knowing how to find January just a quick confirm and then what happened here is that we reached out to an external API check the sanctions list and then the private key on the phone signed permission to publish this attestation on chain and then it went to main net so and a token payment happened so a lot of as deep as you want to go we can talk about it but this is a simplest way to get started um we'll have a minute or two for questions a few final points this bloom app and I you know really want to stress this we really are open to feedback if you you can download it in the bloom app store it's in the utilities category just search bloom or bloom identity we've had about three hundred thousand users install it but no one gives feedback like developers and engineers that's one of the main reasons we're here even if you're not building on bloom please download our app we're giving out Patagonia's sweat shirts hoodies water bottles so if you have any good feedback or building on bloom you know definitely come by our booth on the second floor upstairs Issac another engineer of ours Eddie and myself will be there to talk with you guys outside of that we're really looking forward to the types of applications you can build everything's on the table $5,000 in prizes will be providing technical support upstairs but there's more than enough documentation on bloom Co slash Docs and our bloom starter kit to get started and with that we've got a two or three minutes for questions if you just speak it all I'll repeat it the question is how how does bloom differ from you port go ahead Isaac so one of the main differences I think is our focus so we traditionally focused specifically on lending applications and that's what our platforms kind of optimize for but you can use all of the same like lower level specifications for other identity applications we do I'm part of like the w3c verifiable claims group so we are very interested in being in or operable with other decentralized identity solutions so whether it's the D IDs or with the verifiable claims back so I don't see a reason why they you can't associate like another decentralized identity with your bloom ID identity is a fragmented specific thing like it's not like you just have one identity that you share with everyone your identity is whatever you choose to share with a specific person at a specific time so it doesn't need to just be one identity to you I might be a developer at bloom who lives in the US but to somebody else I might want to share like my driver's license so identity is fragmented and all solutions are welcome one more one or two more questions good Hey welcome to the show here I'm a CPA I'm an ex-banker and you know I'm into audit nice so one of the questions that I have at this point I know it's kind of a fair question at this point is where do you guys stand with being audited or SOC ooh amazing amazing question so we are integrated with partners like American Express BMW they require that we're soft to compliance that's a critical component to this there's also in the last few years we've got GDP our California Data Protection Act you know so the entire landscape the audit ability and data storage is changing the way our system works is the user controls access to this data blooms central servers do not actually have access to the raw data so under accounting privileges auditing you know concerns this is you what's called user provision data so it's the same thing as the user filling it out and submitting it we don't have the ability to provide central lookups because we're just a facilitation engine between the user actually sending it to the counterparty as far as actual security measures we comply with all of the requirements that you need to are you are you complying with any kyc stuff at this point I know you mentioned that earlier yeah yeah you know I mean are you getting into industrial-strength KYC naml my co-founders built one of the largest kyc companies in the u.s. it powers most major US financial institutions banks for account opening coinbase if you opened up an account on any US exchange or a bank account you probably went through their system so that company was started years ago and was the learnings were rolled into bloom so yes industrial-strength kyc absolutely thank you great questions guys we'll be upstairs on the second floor if you have any more questions I think our time okay one more question they say one more question all right well do them quick I was just curious about cases where the user needs to have their some of their control over the data limited in particular in the case of sanctions checked when you have anti tip-off legislation in place are there mechanisms in place to make sure that a user can't basically watch their their sanctions check to see if so that they can't that Oh interesting so they can't know if they're on a sanction list or not if they're there all the way on a sanctions list they can probably know that yeah are the sort of partial sanctions lists like the watchlist things like that where they're you know they've they're not supposed to know they're on it because they're being actively investigated and the idea is to kind of hide that from interesting question that's a good question we don't give people to feedback whether they pass or fail that we only give the feedback whether you're definitely not on it but not getting that attestation doesn't necessarily mean that you're on a list so we don't return back like which list you're on or whether you are on it not on it we'd have to look more into the actual regulations around that to talk about the specifics yeah thank you a good question time for one more quick probably this is super technical but like how long does it take to sync with the network when you upload your own personal information so like how long until a main net attestation sure so it gets the transaction gets broadcast immediately and then I have this whole mechanism that retries at a higher gas price every second until it goes through so it's on the order of minutes so when the data when you receive the data on the receive kit side you can if the attestation has now taken place on chain yet you can still verify that the data has not been tampered with and the signatures all exist you just don't have the benefit of the on chain timestamp yet unless you want to wait a couple more minutes got it thanks alright guys we've got these sheets of paper they're also upstairs the detail how you can get started links to everything and our prizes so please grab one they'll be at the front of the stage download our app please give us feedback we've got tons of swag upstairs $5,000 in prizes any app could integrate it and we would be super super excited to see what you guys build thank you everyone really appreciate it