Fission 🛠 Webnative Simple, user owned data - Ryan Betts & Andy Vivash

foreign [Applause] good morning good afternoon good evening depending on where you're calling from uh welcome to day two of workshops for fvm space War pack um we have Ryan and Andy here from Christian who's doing a workshop on web native simple user-owned data if you have any questions you can ask them right in the zoom chat and they'll be more than happy to answer them um and with that being said I'll hand off the light to our two speakers welcome everybody today uh and I will uh reiterate yeah good good morning uh good afternoon good evening good night um so we're gonna talk today uh about web natives a project that we're working on at uh vision and specifically uh a new feature an experimental new feature uh we call Walla dot um and so what this is going to set you and your teams up with uh and and your end users is a simple user own data uh backed by a filecoin wallet um so just before we uh dive into the demonstration [Music] um a little bit about fission so we build identity data and compute solutions for the future of the internet um we refer to ourselves as a applied research lab and we're really committed to uh Humane software and we want to set people up with better better ways of building it uh and we're fairly ecosystem obsessed we say about how we go about that uh so we're focusing on doing that from the protocol lab we want to make sure that we've done all the happy lifting uh so that you guys can focus on bringing your ideas to life um and we do this uh by working on some today stuff uh and also a lot of Tomorrow stuff um so we started referring to some of the protocols uh the aforementioned protocols that we work on uh as our Edge Computing stack um so I'll go through a couple of these uh uh protocols right now um the the two today ones uh that we're going to be uh diving into that are a part of web native app is very moment uh or for you can um which uh you may have seen or you can toucan uh kick it around uh in the world but ucan stands for user controlled authorization networks um it's uh decentralized authorization protocol um and uh it's actually soon to be supported by our friends over at web3. storage um so presently most of the time if you're going to do authorization in in an app you're going to use Access Control list uh that model doesn't really apply so well when you get into this world of decentralized applications and so you want something that's object capabilities based um uh where the person and the thing that they're able to do with the resource uh that same question is actually just kind of sorry all all contained together and so that's a concern that you can help stay care of for you uh there is a working group that you're invited to join um when a fast is the other thing so this is uh user-owned end to end file system that's built on on top of ipfs you'll find this probably popping up in a lot of places throughout the protocol Labs ecosystem and Beyond and if you're interested in these you can go to surgeon.codes and find links to them or you can also hop on our Discord we have a regular working group meetings I did a bunch of organizations uh not just Vision uh Health to Steward uh and then some of the tomorrow things so ipvm you may have heard the term compute over data you may have heard um uh uh about how uh ipfs wants to bring Computing uh uh to to the data layer uh so ipvm is one of the efforts that we're helping to lead uh in in that regard uh and then lastly uh ride Zone DB uh which will be a database structured data um on top of ipfs and that's being incubated in a group within fission called uh fission reactor so um uh by the way I should also mention uh who I am I just realized I skipped over that um on they had a design of vision uh so I'm just a designer so uh please forgive me as I uh bungle some of the technical status uh these things and then Andy uh who will be writing the demo um is one of the developers on the web native team so uh you can win it fast those those two protocols that are ready today uh web native uh is our SDK that wraps those things up so even though you're invited and encouraged to dig deeply into those protocols uh you don't necessarily have to understand that in detail or how they work in order to take advantage of web native um we refer to webnated as a true local first Edge Computing stack uh why true um because it honestly does just run at the edge on on your user's machines there's no Cloud needed um so if you want to uh dig into this after uh during uh web data.devs is where you can find the full site dedicated to that uh and what's it going to give you uh it is going to provide you with um passwordless authentication uh via one of three strategies uh so the initial and most stable one uh that we implemented uses the web crypto uh browser standard uh to provision uh non-exportable keys that lived in the browser um and uses you can and some magic uh to let those things be syndicated across the different devices that you possess as the user um the second one which is what will be uh diving into today is wallet off um so this is an off strategy that works with EDM compatible wallets uh presently the only wallet client that supports it is metamasko this is experimental but we're excited to see it stabilize as a new standards emerge um and then finally passkeys which is under construction right now um and uh we can talk about in in another session in the future um the other thing it's going to give you uh as I mentioned private and secure data encrypted at rest user owned and ipfs based which means it's uh you know integrated seamlessly with with filecoin um and this is going to give to every user their own public and private file systems uh and then really important via local first ux right so everything works offline by default uh this means you can easily uh as a user collaborate collaborate across from multiple devices and in the future um we have other users uh and and even in a in a more synchronous workflow uh and critically Dell cloud is needed to make this work um so you may have noticed in an earlier slide or if you layer it all the efficient uh we really love having math constant stuff we uh giving about a lot of stickers um and so for wallet hot uh our the digital designer uh Bruno made this great mascot uh named Wally um uh and so if you track us down to realize we'll we'll hook you up with one of these um but before we dig into the demo itself I just wanted to uh clarify some terms um so I noticed that the term wallet often gets used a little bit Loosely within our industry um and while this doesn't necessarily matter for end users themselves that they get a little bit of terminologically confused I think for us it's it's really helpful to be a bit more precise uh about what we're referring to um and so uh during the course of this uh presentation when we say well a client we're talking about the metamask rainbow uh Etc the the app that you're going to use the browser extension that you're going to use um that brings a UI uh to you where you will interact to sign a message review your balances and assets um that's going to provide uis for the wallet structure which is uh uh also maybe called uh best referred is the recovery method this would be like your recovery phrase or maybe your social recovery factors and also the many accounts they represent if you're in fact using an HD wallet and you have many accounts derived from that same recovery phrase and then finally and this is the thing that we're going to be calling the wallet today um that there's the account AKA wallet and its public address so this is the public product key pair um uh that your assets are actually attached to and that you use to sign the message but without any further Ado I'm going to hand screen Sharon over to Andy uh okay um hey everyone uh thanks for all that Ryan uh I'm gonna quickly walk through a demo of our wallet off app template um so if you guys can see my screen here uh this is all available it's all open source on GitHub in our web native examples uh GitHub org um so this is basically an app template uh built on spell kit based on our web native app template uh which just uses the traditional web native flow that uh Ren can described this one has been configured to work with our web native wallet auth package uh which is also open source on our vision codes uh GitHub org um built by Steven vandeville to see who's on our team um and yeah we have spelled and react versions about these uh made them basically so developers could really hit the ground running uh if they're at a hackathon for instance or if they just want to get a project up and out the door really quickly um yeah so without further Ado I will check out walletoff.vision.

app anyone can can go see this if they want to and right upon Landing um we set it up so you'll be prompted to connect your wallet uh in this instance I haven't connected yet so I'll just connect account two yeah so all that good stuff um and so yeah right off the bat here we basically asked you to sign a message um and the message you're sending is specifically the message you're seeing here so hi there would you like to sign this so we can generate a did for you so this is how we actually create the did or the decentralized identifier that we'll be using um throughout the web native program so click sign and here is that same message just uh hashed in uh Basics keyboard encoded um so we'll sign that and so there's some things happening in the background here that I'll kind of talk through but essentially we're registering the user uh within web data itself um and the next thing that's going to happen is here with me I didn't miss screen shares slowing things down here of course it wouldn't be a demo if everything went smoothly so let me just uh give this a quick refresh should I just look there we go okay it took a while um yeah so uh essentially um after your web data file system is mounted to your user uh or for user actually before in this case uh we need to decrypt this message um so this is using the decrypt uh Json RPC method that I believe Ryan mentioned um currently only supported by metamask uh the browser extension not even the mobile version um so what we're decrypting here is essentially uh the user's read key stored in their web data file system which gives them access to all the child notes within the tree um so let's decrypt that then that will give me access to the rest of the application here we go um so here this user does exist already but uh the wallet wasn't connected to the software which is why I went through those steps uh if you're already connected and you refresh you just have to decrypt the message um so here let me just check out my photo gallery uh yeah so these are all my public photos that I've already uploaded to webnative um this is just a drag and drop interface you can pop these open and check them out um this could easily be configured to work with any type of files we just have it constrained to a various image types right now um and then if we wanted to go to my private files bear with me my internet is having a bit of a hard time okay we will give that a minute anyway um so let's pop open a Public Image here so here when you pop this open you'll see uh you have this view on ipfs options so um as you can see you have your actual ipfs uh URL here this specifically is using the vision Gateway but um view this on any idea best Gateway uh and what we've done here is basically taken the uh user's wallet address um hash it and that's uh now the actual pointer to the file system here for the public files um if we go back to the app and pop open the private photos bear with me I don't know why things are so slow right now okay well it's been regardless anyway uh so if we were to open up a private photo here um it would basically have a disclaimer saying uh it would still have the link to view it on ipfs but we'd have a disclaimer saying um that uh due to ibms not being able to actually decrypt this file uh you won't be able to view it so you'll basically just see a broken string which is as expected um if you use this for an actual application you can obviously remove that um yeah so there are a few things kind of happening under the hood here so we're using two Json RPC methods uh one is I get encryption public key and one is decrypt um as I mentioned already decrypt is basically used uh before loading the user's file system before loading the existing file system uh to decrypt the user to read key to access their whole file system which is stored in their web data file system um and then uh youth get encryption public key is actually called uh before loading a new file system so I would log in with the new user uh we would get the encryption key from metamask and we would use that to encrypt the user's read key and then store it in the file system and then the before load existing decrypt method would be used to read that key um and I believe Ryan might have also mentioned that these methods are being deprecated So currently uh there's a bit of a security concern because those two methods basically use the same key for both signing and encryption which uh presents a few potential security uh attack vectors that uh people are particularly happy about the ecosystem so that's why we're actually part of an alliance called the genomestic standard Alliance or uh Casa where we're trying to work forward to uh get some get some alignment on encryption and decryption methods that work uh both cross chain uh so per any chain really um and that actually you separate keys for both sounding and encryption uh so we're working with people from Brave uh signing with ethereum wallet connect uh while doing a bunch of different people to basically try to push a standard board that really works for everyone so we're hoping to get to that point uh pretty soon um and yeah it looks like my demo just froze of course um this with that being said uh I will pass it Dr Ryan thanks okie doke um so yeah some caveats for peace uh you know and adding stated this clearly uh but this uh wallet off all flow only works in the metamask browser essentially for now um we wouldn't recommend it uh for production apps yet um that said uh as I mentioned the the web crypto uh API uh auth strategy the one that's uh very stable right now um You can of course also use that to integrate into filecoin um our belief is just that uh when wallet auth is ready it will provide a much better uh account recovery and account connection flow across various devices um because your backup and Recovery uh will basically be delegated to whatever best practice you use uh for yourselves with your evm compatible uh key pair um so on file coin if you're in uh and uh someone's actually asking in the comments do we have uh do we intend to support uh layer twos uh and any other exam compatible uh chain and the answer is uh holy yes uh the really the only thing um of preventing us from doing so right now uh is the adoption of an encryption decryption uh standard by uh specific wallet clients um so uh a couple more things to just uh go over uh if if you are indeed really helpful uh interested in helping to push uh wallet ux forward either within wallet clients or uh on the damp side of things um I would love to talk to you uh first and foremost but then as Andy mentioned uh there's some really uh bright Minds uh involved in Casa the channel gastric uh standards Alliance um so you have people participating there from wallet connect and Venom app and uh bridge and uh many other organizations Bruce Etc um and more voices are always highly welcome there uh uh you know there's a active uh Discord and and multiple meetings to dig into the stuff deeper uh Spruce ID uh has a couple of uh standards that they've put forward in the ethereum ecosystem Seaway which stands for sign in with ethereum and uh recap uh both of these uh are looking to improve the informed consent practices for authorization and sign-in requests so these are standard message formats for signing into an app and then also for granting that app authorization to do certain things with certain resources um uh and and this would help us work towards more of like an IOS and Android style uh very accessible and manageable uh set of flows for for making sure people are only like uh letting daps do what they think they should do and they understand it clearly um while the connect and file coin it'd be great to get these things working together um open a PR uh take a look at what's going on in that ecosystem and if you're going to be at Denver uh sign up for wallacon because I think it'd be great to see some filecoin uh representation there um the encryption decryption standard uh is forming under 5630 right now if you want to dig into that unrelated to anything we've mentioned yet today but two other things that I think are are very fascinating to follow uh are account abstraction which uh is happening under deep fourth three three seven and I think uh within the file coin set uh 0055 and then finally Eep 5003 off usurp which is um a provocative standard uh for how we might take existing EOS and convert them into contract accounts without having uh anybody need to pay uh exorbitant gas fees to transfer all their assets and then move to a different um public key um so what could you build given what we've shown you today uh some some real quick ideas uh uh but far from an exhaustive list but a persistent place to Stage files uh for a user before they commit it to the file query Network um easily syncing private State across devices with no back end I don't know if anybody's ever uh been collecting some uh favorites of ens domains they might register on one device and then end up switching to a new device and realizing oh shoot these are trapped on one device um so with the with web native you should be able to sync that State uh privately across both if you're on a wallet client team uh I'll really really would encourage you to look into these encryption decryption standards so that they could unlock um and voice your opinion on on what you think uh and uh special presentation of the Seaway and recap message formats I think it'll be great at some point when wallet client teams adopt uh uh a dedicated ux for messages that follow these conventions um and then one little plug from Fijian if you're really interested in this far future stuff which I know a lot of uh people uh within the political Labs Network in Falcon have a real Explorer mine mindset we're Gathering some bright Minds in Toronto for an event we're hosting at the end of April called causal islands causalislands.com is where you can find more about that and uh with that uh thank you very much and good luck and uh I think we've got some time for questions if uh if anybody would like to ask them feel free to come off me if you want to ask your question live right hand regarding the best key my about Dedication that you mentioned can you expand a little bit on that sure yeah so like one of the things that um uh I I think is an Achilles heel in the web 3 space right now is uh account recovery um specifically uh like management of your private key and so I think that there's there's uh like tons of discussion about this what to do um uh you know people no matter how much you attempt to educate people on how to do the right thing with a passphrase um you know they'll struggle uh even even people who are like well aware of the risks will still struggle to do the right thing um and there's so many uh opportunities to to to Really critically make a mistake along the way right um and so Key Management um is something that pass key itself uh is uh quite focused on uh and so passkey in case nobody's familiar with it um is uh the uh is is a uh because I'm a designer I'm gonna struggle to explain this like with the most precise language uh it's it's intended to replace passwords um and it's being adopted at the operating system level and the browser level by uh Microsoft iOS Android and one password I think you can almost pass they're also adopting it um and so would it is is it is um uh a like portable non-exportable um uh uh signing key that uh you can use to author to authenticate into into an app and what this might mean for wallets is uh and for um web native itself uh is that because these things are going to be very very conveniently baked in to people's workflows uh and normal folks should uh eventually be signing into all of their favorite websites using passkeys um you should be able to then provision uh someone with a wallet uh via a pass key um and or provision them with their private encrypted at rest uh web native file system using a pass key and then now however they're managing that whether they're using like the built-in iOS keychain or whether they're using one password this is going to be available on all their devices um uh so it's like kind of it's not really easily explorable from to outside of their digital personhood but it's very easily portable across all the different devices they use without putting them at risk of divulging the secret accidentally um so that should provide it like for a certain threat model should provide a really interesting uh and very very usable approach to a highly secure uh account mechanism I hope that explained yeah goal it works pretty well the only stuff is that the current set of mobile devices on our keys and only have p256 security keys or signatures so the idea will be to find out tool somehow see if there's possibility to migrate or interview with the SEC p25 2K by six keys because so otherwise it should be like a song different signatures on the common one yeah and I think this is where actually account abstraction uh could play a really interesting role uh at least when you're talking about doing this um in an environment where authoriz uh authentication is kind of mediated via um uh a blockchain um it I think it is in on margins or one of the layer twos that has adopted uh Eep 4337 there is um uh there's a site called cartridge.gg and I think if you go to cartridge.gg create a slash register you'll see um a flow where uh behind the scenes you're actually you're using a pass key but it's provisioning you uh contract based account and this is because um I guess you can just have uh uh uh novel uh encryption key uh curves um uh supported by contract accounts um so maybe there's something in there uh where where we can make that work but yeah as you mentioned for now uh with some of the browsers there is uh uh limited support for things that uh for supporting passkeys integrated with the web crypto API we're hoping to crack that nut soon thank you does anyone have any other questions all right I guess if that's all the questions for now um we can end this Workshop here uh Ryan and Andy thank you so much again for taking the time to do this workshop for um this hackathon um for the rest of you this Workshop is also available on YouTube so feel free to go back to it and use it as a resource for your hack and in the future um and with that being said I hope everyone has a great rest of your day we have another Workshop today um in half an hour so I hope to see you all there as well it's a hard speed