Polygon 🛠 The Future of Identity is Self-Sovereign: Build a dapp with Polygon ID - Steph Orpilla

Hello everyone. Welcome to my workshop. It's called "The future of identity is self-sovereign." Create a dApp with Polygon ID. First of all, I want to thank the Polygon ID team.

Here are a bunch of ID team members. Can you stand up? We have people back there. Wow! They've created a really great product and I'm excited that you're all going to start developing dApps this weekend.

I think these are going to be some of the first dApps on Polygon ID. So you 've arrived very early, which is exciting. But first of all, GM GM exciting. But first of all, GM GM . I'm Steph.

I am a developer relations engineer at Polygon, along with my lovely co-worker Rahat in the front row. Another round of applause for Rahat because why not? There's a good vibe today. I'm also Oceans404 on Twitter. Well, right here on this slide, I gave you 1, 2, 3, 4, 5 facts about my identity.

My name, my job title, my company, my Twitter handle, and my profile picture. Well, that's five things you know about me. But how do we know that those things are true? Actually, we don't know, do we true? Actually, we don't know, do we ?

You can trust me. But when I think about identity, I think of things I immediately recognize, like SpongeBob. And I know this is SpongeBob, and maybe these police officers will approach him and ask, "Who are you?" And he says, "I'm SpongeBob." And maybe they look at him as if to say, "Are you really?

How do we know? We've never seen the show." But if you've done kernel work or read a lot about Bitcoin, there's a proverb that says: don't trust, verify. As you can see in this image, SpongeBob is wearing a name tag, and you can see that it is handwritten. Therefore, we believe that he has identified himself as SpongeBob, but we still don't know for sure if that is his real name, if it really is, or if he is just saying that it is true.

Therefore, if SpongeBob had a driver's license, it would be better proof that he really is who he says he is . This driver's license is issued by the city of Bikini Bottom. It has their address, their sex, their hair color, their eye color, and their date of birth. But if the police approached SpongeBob in Bikini Bottom and asked, "What's your name?", why would he have to show his entire driver's license if they only need to know one part?

Why do we need to show all this other information if we only need to prove one part at a time? So, let's reflect on that a little as we move on to the rest of the presentation. This isn't just a SpongeBob problem, is it? We all have to digitally authenticate ourselves to access all kinds of applications, including those from big tech companies and social networks like Facebook. You have to register and give your name, your surname and a lot of personal information, such as your mobile phone number, your email address, your date of birth, your gender, a lot of information birth, your gender, a lot of information , and nobody really knows why they need it.

They say it's to improve the algorithm and things like that, but what do you really get in return for everything you give? Regarding identity solutions, there are currently three different types of identity solutions. The first is centralized identity. As I said, if you log in to Facebook, you use your email address or phone number and a password. A centralized identity system is a single-purpose identity.

Therefore, you would have to create a new account every time you use a new application every time you use a new application . So you're a bit compartmentalized, aren't you? Because that identity is not portable, since you move from one application to another. You can't use this Facebook login to log in to, say, TikTok. At least I don't think you can.

I highly doubt that these systems communicate or that there is synergy due to competitiveness. But each application stores this information separately stores this information separately , which could pose a much greater security risk, right? For example, if one of these is hacked, they have your data. If another one is hacked, they have your data. But managing all your passwords and accounts across all applications is also a huge headache.

I know I have a password manager, and even that's a pain because there's always one password that's missing, and then I don't know what my password is because it's a centralized identity system . The next step is federated identity. Who has a federated identity to log in to work? I do. And everyone at Polygon probably uses, I think it 's Okta or Okta.

I'm not sure. Well, it's a way to log in to a bunch of different applications that are all within the same federation. This way, at least, you can use a single account and reuse your login details across all those applications. This makes this type of identity a little more portable. But unfortunately, it doesn't work for all applications.

Another drawback is that if you log in with, for example, Google, a large technology company has access to all your data across all the applications you log in to applications you log in to . Therefore, it knows what you are seeing and what you are accessing. I remember I used to log in with Facebook a lot, and once I decided to delete my Facebook account and then I realized I couldn't access Spotify, which didn't even know I was logged in. So I recovered my Facebook account immediately, but I thought, "Ugh Facebook account immediately, but I thought, "Ugh , no." Thus, decentralized self-sovereign identity comes into play.

This is a type of multipurpose, portable identity where you can prove parts of your identity for use in any application. This is really powerful because you, as the user, retain control over your personal data and also over your digital identity. And you also eliminate the intermediary that clings to your identity across all these different systems. Therefore, you don't have to give up your data to prove access rights to things you need to log in to. These concepts come from a truly amazing book that the Polygon ID team recommended to me.

It's called self-sovereign identity. The two main conclusions I drew from this book were that SSI, or self-sovereign identity, allows us to receive digitally signed credentials , store them in private wallets, and securely prove our identities online. And we, as individuals or even organizations like Dows or workplaces, have exclusive ownership of our digital identities, and we can decide how our personal data is shared and stored or whether we don't want it stored or shared at all. So, going back to my SpongeBob references , a great idea in SSI is this triangle of trust. We have an issuer, a holder, and a verifier.

In the case of SpongeBob, the broadcaster is Mrs. Puff, who has a sailing school and issues driver's licenses. The holder is SpongeBob, who is obtaining that license. And the verifier is a police officer. This explains the issuance of a verified credential and also its use verified credential and also its use .

In this case, the verified credential is the driver's license. Mrs. Puff gives it to SpongeBob Mrs. Puff gives it to SpongeBob . In this new sovereign identity system , instead of the police officer having to see the verified credentials, he can accept a proof.

He can do this because he trusts the issuer and that the issuer has given the holder authentic proof. Therefore, the issuer must be trustworthy and do the right thing to ensure that the verified credentials it gives to the holder are legitimate. Well, we can see that this happens with governments and also in cases such as COVID passports or vaccination passports. For example, someone issues you a verified credential. Perhaps it's a nurse giving you an injection and saying, "I've given Rahat this second COVID vaccine."

So, if there were a way to have proof instead of having to show that actual vaccination card , that would be fantastic. And we're getting into that. Enter Polygon ID. Therefore, Polygon ID is a scalable, privacy-based ZK blockchain ID. We have a very good architecture diagram on the right.

And then, on the left, it has different tenants and things about it. Therefore, it offers a universal identity. You can prove your access rights instead of giving up your data or identity. It also allows advanced chain verification via ZK Snarks. Therefore, these are four of the guiding principles.

And I think they come from that book of self-sovereign identity and from other extremely intelligent people on the team. Well, but Polygon's identity, Polygon ID, is decentralized. It is private by default. Use ZK for trust and reputation. And it's also open and without permits.

So, going back to SpongeBob, let's change it to what it looks like on Polygon ID. So instead of Ms. Puff or someone in government creating claims, you use an issuer to create a claim, and that issuer can give the claim as a verified credential to a holder, me, within my Polygon ID wallet application, and then I can generate a cryptographic proof that is verified on-chain with a smart contract to match my signature and make sure that's really my proof. So, if we go back to some of the problems we've seen with social media apps and other different things, on the left, I logged into Instagram a few weeks ago and it told me to add my date of birth. It said: "To continue using Instagram, you have to add your date of birth."

And I wondered why. Well, I looked into why, and it's because you need to be 13 years old. So, they need to know my date of birth to make sure I 'm 13 years old. But I'll show you how we can use Polygon ID to prove that I'm over 13 years old and can use Instagram without having to swipe and enter my real date of birth. So, it all starts with the sender.

So, I'm going to click on issuer. So, this is the user interface used to create these claims that you can deliver to the holders. I'm going to register. Actually, it's more like logging in. And I have the Polygon ID wallet app on my phone Polygon ID wallet app on my phone .

I'll show you more about that in a second, but I'm just going to log in with this QR code. And I see something that just says connect my wallet. So, I'm connecting my wallet So, I'm connecting my wallet , authenticating myself. And now I'm logged in and I can create a claim. Okay, I'm going to create a claim, and there are a few different default schemes that are drop-down menus.

I'm going to create a KYC age verification form because, remember, I want to prove that I'm over 13 years old in order to use the app. I'm not going to tell you my real date of birth, but I'll say 1990 8 24. So, August 24, 1990. That would make me much older than 13 years old. And I will send it.

So, this has created a claim that I can file myself. So, since you ca n't really see it on my phone, I'm going to open a Notion page that shows this, or actually, I'll start with the slides. So, I'm interacting with this issuer within my My ID wallet application. These are just a few screenshots of the application. Again, they can prove their access rights without revealing their identity.

And what I just did in that issuer user interface was create a claim. So now I have to make this claim to myself to know that that was my fake birthday. It's not my actual birthday, but you understand. To do this, I'll show you a video of what it looks like. Okay.

We just created a claim, which is this screenshot. Next, we need to generate the claim. So, when you accept the claim by scanning that thing, the QR code, it goes through this flow where it adds the claim to your Polygon ID wallet claim to your Polygon ID wallet . So, once you've added that claim, you can see it in your data claim, you can see it in your data . So now you can see that I have this KYC age credential in my Polygon wallet.

When I recorded this on screen before, I said my birthday was January 1, 1990. But now this exists in my wallet and I can check anything with it I can check anything with it . The demonstration application we worked on was a ZK ERC-20 airdrop. Well, what we want to do is airdrop tokens to anyone over airdrop tokens to anyone over ... I don't remember the age, but let's say 13.

I think it was a specific birthday. But to do that specific birthday. But to do that , we need to verify the statement we just created, which said that my birthday was January 1, 1990. So, what you would do is scan that test request or scan that QR code. It would generate a test with the information you already had stored.

Therefore, it is generating the evidence. A cryptographic proof would appear, and then you would click on generate proof. Use a biometric ID or a password. And it opens your MetaMask and allows you to claim that ERC-20 token based on the fact that you were of the appropriate age. Therefore, it is generating the evidence.

And then, if this is successful, we'll see the airdrop added to my wallet. Well, you can see in the screenshot that the contract interaction was confirmed, and now I have five ERC ZKP, which is just the token drop we created within that wallet. Well, that's a high- level overview of how this works. But I'll also show you part of the code for the verifier. And all of this is in different links that you can consult so you can see how the smart contract works and also how the front-end works.

Okay. Well, this is an example from the tutorial on how to deploy a ZK ERC-20 airdrop in 20 minutes. So, in reality, it will only take you 20 minutes if you follow these instructions and simply implement your own smart contract and update it as three different variables. But what you would do is download that Polygon ID wallet setup from the Apple Store or the Google Play Store. And then you would put it directly into the code put it directly into the code .

So, if you were to simply clone this repository, all you would have to do is install the dependencies, then compile the code that already exists there, and then run the deployment script. This would result in a smart contract, and what you would have to do after that you would have to do after that , where all the magic happens with the testing and everything else, is that you have to run something called set request scripts. And this is where we send all the things that make the test work. Okay, let me get into that. So, within this set request, we have a validator address.

This is the already implemented smart contract that is performing the validation, and this is something you can reuse for any of your polygon ID examples . All the specific things happen next. So, there is an age query and the part where we are actually verifying the age is on line 14 with the value. So, we're verifying that your date of birth is before January 1, 2001. And I already proved that with my claim that was issued to me.

Well, this should work for me. The other thing is that we also have an ERC verifier address . This is the ERC-20 token address that you can implement using the instructions above. The ZK test request checks that validator and also the age query to make sure you really are older than you said. Going back to the Readme file, we have two different contracts within contracts.

This is the ERC- contracts. This is the ERC- 20 verifier I was talking about. This extends an existing ERC-20 contract, as well as a ZKP verifier contract, in this repository. There are a couple of interesting things. There is a link before the test submission and after the test submission, as well as a link before the token transfer.

This is where all the customized logic comes into play to make the actual air launch happen. Before sending that ZK test, it is verified that the test challenge input is equal to the sender. Therefore, you should make sure that the user who says " make sure that the user who says " I am over 13 years old" is actually the person sending the transaction. And then, after the submission of the test, there is one more mandatory declaration. And this is just to make sure you don't claim the airdrop multiple times.

It's just a little extra logic. And this is where the airdrop is executed. It's like a classic token airdrop. But before these tokens are transferred, there is one more verification transferred, there is one more verification . And it's just to make sure that you, as the person who provided the proof as the person who provided the proof , have permission to receive the tokens.

So, once you've implemented all of these smart contracts—that is, just two—the last thing you need to do is design a test request. There is a query-based request language, or not a language, but a structure. You can read more about that in the Polygon ID documentation and on GitHub, but I'll show you the one I created. Well, mine is in QR testing. It's just a big JSON blob and I'm going to convert it to a QR code.

It will be in the QR code. When someone scans the link, they will understand that this is the contract and this is what we are consulting about. In lines 21 and 22, you can see what we are consulting. We are checking the date of birth and on line 22 we have LT, which is less than, and then 2001 0101. We are verifying that the date of birth sent by the test is less than January.

January 1st. I can't say January January. January 1st. I can't say January . January 1, 2001.

And mine definitely is. This should work. And as I said, this should be in a QR code. On our front-end, we need to have some kind of QR code that you can scan and that contains this data to start the whole smart contract process. I created a small code sandbox for all of you, so when you deploy this on your own, all you have to do in the code sandbox once your contracts are deployed is update this deployed contract address, and then you should be able to test with this interface to view the QR code and see if you can actually claim the ZK airdrop.

But that large block of JSON we saw earlier is in the QR code request. So, it's exactly the same. It has the contract address implemented and that little mark down here, birthday prior to January 20th or 2001. And that's just in a small QR code component. So, it's just passing on the value of that here.

So when we scan this code from the Polygon ID app code from the Polygon ID app , since I already have a claim, it should initiate an airdrop for me. Then, I see something that says "test request" appear in my application. So, I scanned it and I'm just going to continue with the test request. It's generating the test on my phone. And then, once it's finished generating the proof, I'll click on one more button and then it will start transferring that airdrop to my account.

And you can see where it happened if you look at this PolyScan link. I believe I am the only person who has claimed this contract. Yes, but five of those ZK ERC- Yes, but five of those ZK ERC- 20 tokens were airdropped to me about 6 hours ago. So I should receive another airdrop very soon. But yes, that's how you do it with an airdrop.

That was the code. Okay. Did I lose everyone? I know it's a lot. You can view the code on my GitHub.

I'll give you the links towards the end. But I just wanted to talk about some of the prizes Polygon is offering for the hackathon. We have $20,000 in prizes and $4,000 of them are for the best use of Polygon ID. You could create an application like the one I just showed you, or something completely different, to help people prove parts of their identity without having to give away their personal information. We have three other awards.

We have 4000 for the best public goods and ReFi projects. Hopefully, these will be local projects that help the Latin American ecosystem. We also have $4,000 for the best social dApps on Lens Protocol and $4,000 for the best user experience and user onboarding for any dApp you've created. And last but not least , we have a prize pool of $4,000 for everyone who implements any type of contract on Polygon. We ask that you have two transactions in that smart contract so we can see that you have actually used it.

And these are just some of the advantages of developing in Polygon. I'm sure many of you know about the speed, cost, scalability, and flexibility—all great. It's a great experience for developers. We also ask that if you participate in our prize fund by implementing something on Polygon, you send us a tweet with your smart contract and tell us what you're creating and why you're excited about it. We love hearing stories from developers.

It really motivates our whole team to keep going, just because we want to see what you 're creating and we want to amplify that work and maybe give you a grant or have you participate in our accelerator at some point in our accelerator at some point . Okay, these are all the resources I 've mentioned in this talk. You can take a picture of this, or I'll put a screenshot or QR code at the end so you can get them all when you're developing during the hackathon. But we'll also be at the booth and we have many different members of the core Polygon ID team here who can also help you develop. They are incredible, very kind, and some of the most talented engineers I have ever worked with.

So I highly recommend you stop by here. But thank you so much for listening to everything I just said. All the slides, the GitHub repository, and everything else are in this QR code, so feel free to scan it and you'll have all the links to start building. I'm really looking forward to seeing what you build this weekend and, wagmi, we're all going to make it. Thank you.

Wow!