I'm Having an Identity Crisis – Panel Discussion

your identity I'm also just like super interested in seeing how identity and reputation I don't know two magical things it's a blockchain and how it's going to evolve over the coming years so yeah hey my name is Michael I'm a co-founder of three bucks excited to be here yeah so that's a quick background an intro I'm obviously really interested in identity it's formerly a co-founder viewport as well so I've been thinking about some of these things for quite a while how you doing I'm Scott him from Portis one of the cofounders thank you for all coming to our talk today and we're excited to dive in a bit about identity I'm Johnny product design lead at you port you port is a identity protocol layers people developer tools some consumer facing stuff building on dids and verifiable credentials cool I'm Sean from for traumatic and yeah we're trying to solve identity with key management hi I'm David gold CEO topics the company that's built the first version of the field protocol and the field protocol is doing for blockchain when HDTV did for the internet making it easy to use through a service layer that handles workflow data confirmations about sending of transactions and other first off I'd like to thank you for keeping that short that was amazing off to a good start all right so I really want to kind of set the stage and I want to kind of understand what it does identity mean in this sort of decentralized universe I think a lot of people are familiar with you know like government-issued identity but how does that translate to the blockchain and you know what is it all mean well I'll start what the heck about that um I would say that identity it comes in three forms the first form which is probably the one that's most common in the blockchain world which is simply does this person or computer have the right to access my platform where my software so that's an identity thing second is who is that person if it's a person and the third thing is that I need to know something about that person right not just who they are but some specifics about them maybe what drugs they're on in the healthcare world or something like that if I'm a doctor right I need to know that so those are to me are the three levels of identity and they relate to each other but they're each different yeah I was gonna say that the only gets a little nuanced thing that I think about is trying to separate the term identifiers from identity and that identities can be attached to many identifiers and and even one identifier can represent a couple of different identities if people are acting together in some some way so that's like a thing that I think often gets conflated and they think that eat the dresses are identities but yeah I think that there's a little bit of something we should be aware of when we're using those words I guess you know a port is the simplest form I of identity we look at his private keys and why we think about private keys as identity and where that really stems from is why blockchain was even created which is all about trust so I I enjoy thinking about having trustless systems and why we need to have that identity and creating different safeguards which will enable usability and also still have that security at the same time but for us they our core belief is just identity as a private key to that I feel like the private key is very important and I think the key acts as a sort of a container of identities right and I feel like to really make identity meaningful you have to look into kind of have a composite of identities right maybe there's token issue about government maybe there's a kyc token right in the future that would be actually legal and available through a world right there could be identities as issued by you know different applications so I feel like a person's identity really is a composite of different identities that is contained in the key which is very important yeah I think the pattern or sort of like what we can extrapolate is that like sort of how I've been thinking about things as that identity is an industry it's really hard like when the blockchain first got started the term self sovereign identity was like really popular and thrown around and I think it sort of attached us too strongly to that word when you really should be thinking about identity in all of the ways that everyone's saying because it's like it can be a private key like it can be a more persistent identifier some people use it as like proof of individuality which is like your government ID or you know anti Sippel which is like you're likely not a robot and so all of these things sort of come together I think to like deliver more complete decentralized identity systems but it's like really hard to pick one thing and sort of get aligned on because it's so many at the same time I think these are all really really absolutely points and I think that overarching lis what you guys all kind of touched on was like when we think about government identity it's like maybe like 50 different types of identity wrapped into one and on the blockchain we're kind of deconstructing and reconstructing it in a different way so on that note you know what are you sort of excited about you know like in the far future what makes you most excited about having identity on the blockchain beyond just you know like an authentication mechanism or a private key like you know big bold idea 10-year vision like what excites you about identity anyone I guess one of the biggest things that were very exciting is that this can kind of fundamentally change how identity is done in a traditional web 2 world in a traditional web 2 world that entities are issued by kind of centralized repositories of identity providers like Facebook and Google but you know in an in a blockchain word blockchain is actually that any provider by generating the keys and then you know different parties will have different ways of managing the keys instead but they're not necessarily that the creator of the identity right and there's a lot of potential that can be built on top of that that it's inherently better than traditionally how we trust really really big companies on kind of managing these identities so I think there's a lot of potential there it's kind of iterative improvement unlike the web to definition of identity yeah I mean I would say it's the self that the potential for self sovereign control of your identity information so back to those second two categories you know am I Who I am and details about me my birth date or or do I own something specific that I'm trying to sell you all those things and be able to actually control those and yet the other party can trust that that's the potential getting there will take time because it can't just be solved by block chain but blockchain is a key part of it yeah I agree having control over your own information and data whether it goes into voting whether it goes into advertising or even capital markets it's in the next 5 10 15 years to me that seems very exciting to be able to have total control over your true identity whatever layer that may be of identity but control over that seems really exciting yeah I think to achieve these things like sort of control of your data wherever you are is gonna require like innovations in in these sort of decentralized registry systems because the blockchain is effectively just a decentralized public key infrastructure that you can sort of look at you know in a trust less way and say like yes this key corresponds to that signature but where will really start to achieve the interoperability is when we start to connect all of these different things because what we haven't talked about is like if identity is just one private key and you're using that private key to control your data like in effect the data is then siloed on that private key so once we start to get to like interoperability abstractions on top of these registries so now you can have you know 100 keys for all of your different contract wallet implementations on aetherium and maybe you have some keys on other blockchain networks or even traditional authentication systems like being able to tie those together in a unified way it's like really I think where we need to get to to actually deliver on sort of these things I'm also excited about those things but I a little bit of a different thing that I'm also excited about is and maybe we'll get into this sometimes it gets a little bit of a different rabbit hole but reputation and reputation in my view is really what we care about when we're talking about identity it's about identities over time and how confident am I that this identity is going to behave or do things in certain ways and reputation is notoriously hard and ripe for exploitation authoritarianism and all of these things but if you're able for able to solve this problem of moving your identity data around attaching it to different identifiers we at you port think we can do this using dudes and verifiable credentials so not putting any data on chain so if we can keep that privacy problem if we can address that then I think we have the chance to build really hyper contextualized reputation and so you don't run into the problem of a one reputation system to rule them all like we're seeing in some nation states that are trying to do that but I think for you know facilitating online interaction it really comes down to reputation and so that's like a kind of like a a holy grail of all of this work if we can do that and make sure this is ethical you know when we think about the blockchain you think about privacy the amount like complete control over what we're doing we've even all of these things however you know if I kind of imagine just like identity thrown on top of it I know imagine my entire financial everything and all of my data and who my doctors are what pills alone and whatever it is right then also being linked to my name and then also being on a public blockchain so you know take this question however you want put it down on there but you know what are the risks what are the concerns how do you mitigate them you know what are the challenges that we have to overcome yeah I mean I think the main thing I would say on that is I agree with the concern if in fact the solution was I'm going to put all that private information on a blockchain unencrypted that's just nuts nobody's gonna do that because everybody it's no longer private so then you say well put it on there encrypted really before we're thinking people will say eventually you know blockchain is gonna have some issues of quantum computing that sort of stuff but you don't have to put that information on the blockchain necessarily to make it provable you can have it off chain and put a hash of it on the chain and then others can still know that that isn't crap in fact the correct data that you're sharing with them and that probably is the better way to solve that problem I see it as optionality so you know before blockchain it's it's all centralized people will know it now there's an option for it to be decentralized now so there's the option for people to be kind of on a more public space and one like really weird use case that I been thinking about it's you know maybe some user would want to build a public record of their transactions right to kind of prove that they're credible so maybe they can get like zero collateral loans or things like that right the public record is something that's kind of like your credit score that you kind of want to build to the outside world whereas say your private transaction the things you want to keep to yourself there's still a way to do that yeah I think that obviously the encryption stuff putting a even encrypted data on chain is you know it's it's not even gdpr compliant and likely in the coming future won't be compliant really anywhere I actually don't know maybe somebody knows like what the current state of the regulation and and the view point is on hashed data on chain I think most I think most of the time I've heard it talked about that it right now we're operating under the assumption that it is okay but I don't think that's been settled so I guess there's like a regulatory risk there one of the things that I bring up though is I'm worried about some of the emergent identity like leaking on chain and you don't really realize it so like one of the things that I the use case I think of is you get an NF team that is like a membership of the subgroup and then you use that same address to interact in some other context so maybe this is you get an NF t saying you are the I don't know gambler of the month on some gambling platform right and that's sitting in your wallet maybe even you get it out of here while you send it you burn it but then you use that same address to go and vote in sum if there's a blockchain voting thing or apply for something else right some government job or I don't know if you have an archive node you can run back through these things that I'm sure this will be the new form of doing a background check and they'll be able to see these hyper contextualized assets sitting in your wallet and now you've tied these things together and those are like these edge case kind of things that I think can emerge without us thinking about it and I think that is how we got to the web to privacy problem and so yeah that's like a that's one I struggle with of how can we prevent that because I see a lot of hacking teams and stuff going down this road of don't realize that the contextualization of like an NF T or the asset says something about the person that holds it and that's some form of identity leakage one of the problems we see a port is sometimes is people forgetting their password and for us you know they're encrypted in their password so when someone comes on they do an email they password and it's with end-to-end encryption so if you don't remember your password essentially you lose your identity as if you lost your phone so on a simple problem in the future if if it's truly 100% non-custodial and everything is only based on their password and they lose it well that's a lot of assets gone and we want to make sure that they're not caged in in such a problem and implementing maybe smart contracts that could pool at your private keys maybe from a hardware wall where it's safe and having some type of time delays can stop that but you know going down this path you want to make sure that we stay true to the ethos of blockchain technology by giving this trust this free experience but still not caging them into something where you know they have full ownership of themselves and data and I feel like it keeps coming this way so keep summarizing but ok so the two pieces that we've talked about one is like where's the data kept is it encrypted or not so it's sort of like how are you handling the storage management of that like where as where does it reside in the second piece is how are you controlling that data with those keys and so those are two totally different concepts like one I agree should be encrypted if it's private off chain can handle that in many ways but the the more complex pieces like sort of not tying that data to a specific key pair but rather if I like authenticate into an app with you know Portus or Fort mattock in that key that in their system like the app should only ever be able to see the data from that key but not from like all of my keys and accounts everywhere and so I think it's like privacy management both at how like multiple accounts are linked to the same data so you're not sort of like using one key and disclosing everything and at the same time treating how data is stored and encrypted in better ways these are all really excellent points and what Johnny touched on I want to kind of dive deeper into right is this I think everyone on this stage has had experience with users and users shooting themselves in the foot and so when we think about identity reputation on chain data all of those things you know how or what can we do to sort of protect the user from themselves so that they can actually understand you know the implications of their decisions right and a good example is the and ask for any name service right your first instinct is to go by Taylor Monaghan not even but now you know my name and that is completely linked to my ether address and I may realize that but if users don't realize that right so what are sort of the you know the usability the user experience hurdles so that we can both kind of protect users and also provide them with this valuable you know thing right yeah I think that I'll stop kick us off this time no I honestly think that this is a question for wallets and like we don't make a wallet so I'm sort of I just we like provide support to wallets and and our interact like yeah we interoperate with all of them and so I think wallets will differentiate according to these things and that will be like the wallets value proposition like ultimately the wallet owns this relationship with the user and in some ways can even be trusted to act as their agent so with things like you know meta mask snaps you can like have your wallet have permissions to do things and so I think like the term wallet and the fact that there's kind of like one-size-fits-all approach to wallets is like broken and instead you'll actually see different wallets serving different use cases some are more privacy-preserving some are dead simple and sort of catering to different niches of users because it's not like the problem with global platforms and global networks is like trying to reach flat consensus on everything and like that's just not how it works for everyone and so many different use cases for the blockchain many different wallet interfaces and we'll see what happens it's about turning back on the change so at you port for you know a while we had a mobile app working on a mobile app we're still we're thinking a new way to allow maybe other people to take some of open sourcing the mobile app and allowing other people to build the contextual you know interfaces using our tools and stuff so I don't know that we're going to be specifically in this business moving forward but like while we were working on it you know I was working with Michael on it for a long time we had this selective disclosure flow where you're telling the user what they're about to disclose about themselves and this this data is sitting on their phone and so it's relatively safe it's not sitting on our server or something like that and you're gonna you're gonna give up this data and I really think at the UX level this is like a huge problem and I think that the potential for the entire goal of building a more privacy-preserving web with web 3 can be undermined in the last mile of identity which is that UX that moment when you go to disclose so if you remember the Cambridge analytic a hack that wasn't really a hack this is the scandal that was a failure and in my opinion could be framed as a failure in product design and UX design it's you see a login with Facebook button and you don't know what the implications of that are and users don't read as Taylor you know and so users don't read and they don't read that fine print that says you know that there was a one little line in that fine print that made all the difference which was this app will get not only your name and your email and access to your public profile information but it also will get access to your friends profile information and nobody understood the implication of that and they just clicked ahead because the positive UX the frictionless Ness was hard to turn down and that's gonna be a hard thing even for people or even for people building on you port or our own you port app when it's selective disclosure helping the user understand what they're consenting to so what is informed consent is a whole other thing right and a very complicated topic and but I would just wanted to add on that there's some interesting research by Alessandro aqua Steve and he I forgot which university he's with but it talked about how users change their privacy behavior at the at the moment of disclosure based on how the privacy benefits and risks are framed and that's something that I've been looking at and how to apply that to an actual product environment how we can frame what the users about to do in a way that is in helps them act in their best interest and preserve privacy rather than give it up yeah to add on to that that's a very good point because user have different kind of requirements on privacy and things that are they're okay with and that's one of the incentives why we started to do this white label SDK which is no longer in a 1 login button which like all these things that's in a super centralized nature and getting into all the different applications now we're letting the applications kind of build out their own kind of identity and what kind of privacy that these applications specifically require instead of you know one account for multiple taps where we're making it you know one account one for one day and as a user you're gonna have different accounts work with different apps and this would also help a lot in terms of privacy concerns as well because that's kind of gated to that to that address right and for us you know this move you know in a way cannibalizes our initial products but you know what we're really wanting to do is have expand the things that you can do with with key management say you know users is one of the keys right for a smart contract wallet or or you know other kind of composite identity solutions so this is kind of yeah like super agree with that it's funny one of them one of the first things we like to try to protect with boring users as soon as they sign up as soon as they create an account we immediately send them an email being please go into your wallet and backup your private keys write down your phrase so that God forbid you forget your password you couldn't recover your account right now we have over 50,000 users and over 60 companies using us and I can't tell you how many people actually forget their password and you would think being from web to this is you know they may have that subconscious feeling that okay if I forget my password no problem because I could always just hit hey I don't remember my password please reset it well I'm sorry this is de blockchain you know you're in full control end-to-end encryption we don't have your private keys we don't have access to it I'm so sorry you know the best I can do is delete you know your account and you know you can start over so creating mechanisms in which there may be entry points into the levels of you know start maybe with like a burner wallet access where it's low level security private keys are on their device and then from there they can merge over to you know hire security wallet from there maybe implement some smart contracts which they can then do account recovery but with time delays so it's it's always this balance between security and usability while protecting the users because not it you know we're still so early in this ecosystem that not everyone is ready to be fully decentralized and you have to baby step them into this to protect the user okay I actually wanted to know if anyone in the audience we liked maybe couple minutes left if anyone in the audience had any like burning questions that they wanted to shout out to yeah okay I'm just gonna repeat the question really quick so he's asking with you know passwords or any sort of authentication mechanisms can we use like a fingerprint or another biometric like an eye scan for either account recovery or access or anything like that in regards to your identity yeah yeah so and and and and you can solve some of the problem with that and that's already being used today most of us probably are experiencing this on different devices where you put your fingerprint in and it's actually populating your username and password for you so effectively you're logging in with with your fingerprint if you're doing that I mean it still can be corrupted right at the end of their fingerprints being turned into data and if somebody can hack and manipulate and copy that data the computer on the other end doesn't know that there wasn't a finger put on the fingerprint right and so in the case of malicious acts you know the one circumstance where companies in my mind need to know you are who you say you are is in the case of either you effed up and forgot something or you got hacked right that's when they need to know and I'd be able to say I need to know you are who you say you are so that I can actually help you recover something because I don't want to give the wrong person access so that would still that would still be a need out there for companies and that in my mind is really the one big area where companies need to know who you are otherwise most of that second category of I need to know you are who you say you are is all about government it really is all about government except that one case of when when users get hacked or or make a big mistake right and I think the with the blockchain II brought more to the world about like asymmetric encryption right was public and private key and I think there's there's a future where you know while yours you know device right and and you may be able to let's say encrypt your your private key with like your biometric data right I would think that like I was think of those things more as an identifier rather than something more like a password right there's password as like in your head despite like how simple it is or how complicated is if you use a password manager or use biometric to secure your password but in essence it's really more like an identifier and I think the public should be more like aware of that rather than seeing it as like the kind of holy grail form form factor of authentication I'll just add one thing to that I do know a company that is doing something in that space with biometrics and figuring out encryption for private keys I forget the name of the company at this moment in time but if you talk to me afterwards I can look up the company for you in let you know yeah I think I've I don't know if this the same thing you're talking about but I've there's another kind of I don't know I would consider it a little bit of a pipe dream where some people have claimed that they've been able to generate key pairs based on like a deterministically generate key pairs from biometric data I don't know if any of that's really real or and and stuff but maybe somebody knows but I think that even that is a problem the problem really happens with key rotation and you can't rotate your thumbprint if your thumbprint gets gets compromised and so we've seen like let's say it's facial recognition right and we've already seen and and and let's say we managed to create a deterministic private you know cryptography and based on your biometric data of your face let's say and then we find out that people can build these realistic 3d models right and you can't rotate your face now right and you're compromised forever moving forward in that regard so biometric if you're not careful they lock you into a single key forever right and I think that's like a major problem excellent points well we are out of time I just say thank you to all of our panelists and all of you for joining us and obviously you guys have any other questions we're literally right here come ask us thank you [Applause] [Music] you [Music]