Linking Outside the Box - Eugeniu Rusu, Fabian Kirstein

all right so let's get started so the name of the presentation is a blog to enable with centralized social network which might be ambitious but to decide I think the best I like the problem that we're facing the problem is probably familiar to a lot of people here which is the problem of centralized identities and what it basically means it's more than this and then the topic is kind of you don't own it identity that's provided to you by someone else be that Facebook bill at Google so it's dialing that you don't create yourself is identity that you can't revoke yourself that can be taken away from you or censored or among other things so this type of identity is mentioned which basically means your Facebook doesn't like you if any identity provider doesn't like you they can just be blocked or delete you and there's pretty much nothing most of the time you can do about it there's no real data ownership as in all of your data is stored on the identity providers servers so if you say I want to delete a Facebook photo you have to basically put your trust into Facebook that they will indeed delete that photo and that they are not storing it somewhere shopping this is required so mostly trust towards your identity provider so you really have to trust your identity provider you have to make sure that they don't do anything with your data that they don't claim you cannot be sure about these things and another problem is limited portability so in a nutshell a lot of times some identity providers will not allow you to export your data a simple example would be again Facebook or Facebook has a certain export profile feature but if you'd like fully migrated from one service to another a lot of times you're not able to get all of your data from them it's difficult to to migrate fully so and this is how most identity providers work in a nutshell this being the users that billionaire Tempe provides provides a MOOC the identities and amongst other things hosts their files and very conventional hyper centralized system and the solution to that is is a word is probably mentioned a lot all over the places which nutshell basically means that you have control over your identity so you don't live any external servers to create delete or manager right then you can do it yourself when authenticated I guess I guess some websites on the internet you can authenticate with your identity and you don't really have to rely on some third party to to handle this for you and again no external service can revoke or censor your identity and which is I think a very important point so the data should ideally be always on the user side rather than once and it should be portable and not locked down to one domain or one location so this is this transpose is directly to what we mentioned before and this there's a couple of ways to do some an ID and there's probably pin concepts for a while and one of the ways is heavily promoted by a development team at MIT led by Tim berners-lee which is solid spec or the social linked data specification it relies on a couple of factors decentralised again so this is basically this is your so profile document so it needs to resolve to a document that basically describes you who you are and perhaps some primitive amounts of that and also link to some other documents that further describe those other documents can don't have some specific access control rules associated with them so this part has to be public so agent it can be accessed by anyone to get some primitive information about you and then the further exploration can be restricted by access control rules and then due to the nature of how the maintenance work so no different perfectly valid but it is not unique identifier so the web ID really defines where your identity is stored it it basically said that this is you arrive which describes you and that's where the entry points to your identity should be stored now it doesn't really define how your data should be formatted doesn't really define anything it only says it is there where every agent hosts their own identity so if an agent wants to retrieve some data from you he should know how you stole your data you should be able to parse it read it and make sense of it and if service provider wants to do the same should be able to do the same thing so basically they have to speak the same language in a nutshell they all have to understand this comes pretty natural which is actually that word which you can actually see one example that is a way of formulating statements or pieces information using triples of subject and object and it defines some particular case it basically says that I know you I can put somewhere there it's a lot of people here needs to be used to should be used to describe it so your profile ideally should be stored in rdf for ya and a difference serialization format such as RDF XML but it should be when it linked data it's the first point and then there's a second point the ACL file so access control list so files that define who is allowed to do what with some files that you store in your system are also valid links data and the data in tandem with whether it simply makes sense because we linked data the next thing that is addressing entities by a certain your right or your right so every agent every entity is defined by the URI predicates are also defined where you arrive at your defined in a number of oncologist or predicates so if you're taking data and applying the web ID which you arrive identified users that works it is a easy way to show social relationships like this because now a parser could this statement the jumpsuit ratings card which is also validly data parsed debt and jump on and on and on and make meaningful perhaps extract some meaningful information out of that so exactly that's that's basically this tag that is defined by social in data were solid so they used RDF to store your file to store your duty sterilizing information they use web IDs to point accusers identifies for entities in the system they use access control lists to manage the for accession which basically is just another RTF file that says that this and this and these agents are allowed to divisionism these things on these files everything being a very pure right good thing that comes out of solid is the elimination of a network effect so in the conventional system we have the so called network effect where everyone is using the social network there's the reason why other people are using it as well you know why do you use what's happened not signal because everyone uses solid envisions a world where every user has their data on their side in predefined format and applications can simply hook into that data so applications can simply request access to your server to your user space get the data and do some computations on that or perhaps display it in a graph or perhaps it depends on the application [Music] system where everyone has their identities which they field over time they want the one identity and then a bunch of applications that they can use to manage different areas and aspects of their identity and different different functionality comes from different apps we don't have to use this big monitors anymore and then we talk about Yocum now so let's ask how do we get into this picture and they're also do a very short demonstration if that internet allows us to do so so first of all we are a tool that allows you to modify edit your web profile so we're a tool to visualizer web I get profile to modify this user space a data space to manage it in a meaningful in the easy way and we also allow for certain for certain interactions so I think it'll be a bit clearer if we just do a very quick demo so here we have the vari we have this one node so this is this basically is my node this renders the files on server than I own so the application basically renders it so at the moment I'm a simple note which doesn't really do anything doesn't really have any any connection so we can do things like obviously we can look at my profile where there's some primitive information so this would be my my web ID my email and that's about it show you it's a very sort of blank profile into things like link to other valid ID profiles so I think we'll linked probably two or three to this to really explain the interoperability the first one will be probably you are him so before so this is Jackie so this basically gets information from from your cleanest personal server and in this case this is supposed to be on a server owned by your home for development purposes it's just easier this way but I'll show two examples with people who self host their identities yes actually I can started to whatever data you at him made public to me and if I go to his profile we can see that we can explore his that already has a number of connections to a lot of other entities all of these being other people some of them self hosting some of them posting their data then to provider and then some general knows that he created some pieces of information his apologies to his servers if I get back to me so this is the example of linking someone who's on on a server that we host because for development regions but we can for example a good example would be Kimber knows me this is his card that he made public online and they start all of his information permission of our team is basically we take this you're right no server forgets I'm talking whatever that you make public comes back to us and we obviously can render some of it so this is what we've extracted from his profile files this is quite a simple computation is really snuffing nothing crazy and example we have another identity that's hosted on the freedombox right there is the thing that kind of has a circle around it it's a personal server it's post back it's a little personal server server on it so if I connect it and this nice little feature it's really not a good present but if you if you send the get request an HTTP request if you get data from the freedombox it it spins the little light spin so you might see the moment when I the data that's stored in the freedombox from whoever owns it because I think the name for this one would be last ii ii ii ii ii mmm the server's down thank you Jim oh gods but I'm not sure if it's worth recovering it now but the digit there's an adventure in there trust me when you access it the light blinks is the coolest thing ever that's really annoying though yeah but sorry maybe we can get it working a bit later we can show it to you people want to see things bling but this is so you can you can connect to other people who have their identities on different in different locations so a very extreme example would be the freedombox which is a server that a self host it has a number of privacy related functionality features only it's developed by the freedombox foundation you could host your identity really anywhere ideally obviously so posting it and talking about access control so that's a central rights or create something very primitive all created node which is best known it's just five the base yet launched to our solid server to our data storage and to that know they might given I'll be very ambitious and upload a picture and hopefully they'll make it there so this is a file uploaded to our policies and it's to our solid server it's it's not that crazy but what we can do so if we go to this personal we can copy the URL it is that and wait I want to show that this is so this URL is this this is basically what I know this which is publicly available so people can anyone can connect to this node anyone can visualize this not anyone can can see this node which is what you would expect and so what you can do it and you can edit the privacy settings of this node and element is public I can make it private where only icon at this know that I can actually add particular format authorization the people I know the general just web IDs out there in the world so if I a lot of Tim berners-lee real actors can somebody anyone has contact with him can you think you don't seem that have real access to this but so basically now only he has access to this file and if I try to curl it from outside I get denied I don't have the first session unless I I prove that I am indeed Tim berners-lee from the predefined course and this has been enforced on this is not enforced on an application level obviously this is enforced by the solid server the user is running so this is a natural kind of the things it was a bit different that you can really spend some time tailoring your I think you're making you know you spent some time adding valuable information about you and then you can use this identity to to interact with a lot of applications that are out there in the wild you don't have to create a new identity with every application you're using you don't have to register again the dream would be you basically go and you say you connect with my web ie and you'll be kind of like the Facebook Connect but monkeyville so basically presented what we do what what we are all about but we can factor the number of province and people doing that and and also a couple of questions for the big question kind of is is there anything more than defined by solid truly soft sovereign and some people it is to a certain extent because you don't rely on a centralized identity provider some people it isn't because if you rely on your neck and some people would say that feeling reliable electricity providers on a support but the peaks are weak point here to a certain extent is that it will not depend on DNS this is one problem of the current system another problem of the current system is that your identifier is this tightly coupled with the Transfer Protocol with a protocol so your idea is HTTPS forward slash forward slash whatever this is the problem there's no layer of abstraction between your identifier and the protocol so there's no layer of abstraction between who you are and where you are and this is probably not any case your your server goes down you won't change by different web ID what happens if you want to change the different domain name what happens all of the connections you've built until now are broken I'm not gonna say I'm not gonna say broken again because the connections it built so far are broken because not a point to to an invalid everything this is kind of a problem that they are so tightly coupled migration isn't it a bit problematic another problem is the protocols are employed at the moment into these we're not gonna dive too deeply but to make it very straight very currently employed this web ID TLS which basically uses client certificates to authenticate and they use I don't know if anyone is familiar with client certificates pesach this is this is a problem there's no easy way to terminate the session there's no easy way to logout there's no easy way to subtract this problem will build a proxy which the user self host on which we use as well for development purposes but the properties is quite straightforward really the proxy stores your client certificate your keys and then you props to the request through the proxy the proxy signing staff so you don't have to see this this is already the pop-up or the pandas easy way to terminate your session should you trust the centralized products and still not self posted so this has aspects of the web of trust there's a lot of agents interacting between each other you can link to other people you can give permissions to one another the idea of reputation and claims comes kind of natural to this so would be really cool if agents could state something about another agent and this is possible to a certain extent with the current implementation the trick is that this it's still on file systems its own server so there's no in case of hi Jackson in case of service being compromised in case of malicious ages being agent being present it's a bit difficult a one way to fully verify that that data hasn't been tampered with this another so without making claims there's a way to do claims now with the current solid infrastructure the question is could it be improved and making payments is something that kind of comes to your mind as well because this is all about sharing information this is all about sharing data so it's easy to envision scenarios where you would want to share something in return for some price perhaps even having a service provider like I don't know Facebook actually knows too much bad things about Facebook Google was asking you do you want to provide me your address I'm gonna pay you this and that much or do you want to give me access to your list of friends I'm gonna do this on that so there's a potential so early for for payments but the biggest issue is this DNS dependency and this is strong coupling between who you are and where you are so what we do here now we were together with five members gonna come in a minute is we kind of started looking at that it's only served in the starting phase there's no revolution coming search waiting for this to improve what we currently have perhaps to do to remove some of the dependency on some or some centralized services things like that and I guess five anyone probably come out and yeah I'm gonna go try to figure out where that doesn't work you might you might want to where's the blockchain yeah you lookin figured they may be a solution for those problems and more problems deuterium so they got a little bit of funding to work with me from far off and my colleague monitoring it together so we can investigate a little bit how maybe cerium can solve some problem the digital identity in the blockchain and there are maybe third time's involved for payment and some things and maybe pot again is this that ID proxy and because again the debate is very it's complicated to use nobody actually does it you have to install something in the browser certificate and so on so and this is also an issue you may want consult of a blockchain and we wrote down some general considerations about it in the first place the biggest problem is how can this video be integrated within the given technology spec so it's a link data type it's the NS face is basically a completely different thing and the second question is how can it then how does this affect the signup income in process and will it be secure because it's public it's a public lock chain how can we met claims and respective verifications because this is a potential use case form for the yellow comb song track and especially lemon balm is how can you search for other identities because now you need this net ID if you if you would put it in a sample instance you have second instance again so but you just need it I give junior type in your a key that I do eurocom and yeah what we first did kind of state-of-the-art analysis you probably know some of the projects I bet there's a new part and but the landscapes the length type of people working with identities and digital engine benefit but we focused on the most prominent ones and blocks take it from based on Bob James consensus is the company behind you part and other products and important also very interesting is JSON web tokens that you put if you don't know it and you probably similar that approach they want to do digital identities and the main mission there is especially it's the common it's similar to our vision that you want to replace come up with a name password audiences you just want to block in a different way so we don't have to remember the password all the time and a concept is the smartphone you have to private key on the smartphone and just like like with the Watts if you know it you scan the QR code and then you're educated but for now it's like this feels mapping gets lost your identity it's not they are working on a recovery process which is not in place we actually talk to the default guys about this they passed the contract and you can recover your identity because actually I may be somewhere here and you have this little social network which as part of your private key so they are heavily working on key recovery which is awesome issue for us and it's basically all of this because if you have somehow a digital identity in the blockchain and you're facing the issue how to lock in how to do I you have indicated and we talked to with helium guys here we talk to you pod and basically it comes down to this you still have to save your planet key somewhere there's no actually there's no way around it you can do it in a browser on you can do it in this probably can have it on a smartphone you can write it down but this is like some of the conclusion for our little project that you still have to do this is triangle might it's an addition to life system if you ever identified its and secure all secure you cannot read all three of them which is secure but our identifying it still not that you meaningful so what we did and we decide that we only because the project is just five months and that we cannot change the solid in the body infrastructure we have to keep it as it is it's based on yes so we designed an intermediate solution so to step towards a completely subservient identity so we took concepts from you part blocks the IDE and we didn't use you part because we didn't use it directly because it's a closed system somehow that this app you need to use this app and they advise us that we are not good idea to use the contracts directly because I cannot ensure the security if you don't use that so we did our own complex and based on their concept and what we're doing we are storing the backward if you are a Virginian mentioned just as an attribute in the blockchain identity and we are also putting the encrypted priority there so you get in your identities some herself solving the end of change encrypted the conditions and and this confounded little sister light wallet so the FDF just seen this then like wallet and this is a intermediate set was a complete so self-serving identity gap know which is at the moment sample but you can have it on your own system as well with nursing identity contracts we will also offer the seats knowledge you can see this there to to get your private key it's self-service so you don't have to write it to help and we have does that ID proxy which will not store any longer the the keys of the net ID but the key sign in the contract and just take each I'm using the consensus with you a moment to talk to the staff note and the private keys are only store for the browser and communicating and so smart companies and some Finnish deputies are working on this we will have a look at contract where you find the users and you will have your personal entity configure on your your attributes and and we are the global identity contract where you can find users and also the claims would be probably there yeah you didn't achieve ultimate ID and we have the additional attributes which can be stopped and other users in companies could verify which they attribute we are also still working on this is Ruby and chaste Beth token base that will be hash it out in the next month and just the use case and because actually a might happen upon over we are giving public services and usually if you want to meet to share your driver license and quite some to make it harder the option to so the drive my life and physically because I did it to me with the service and object we we are meaning to do this you verify the claim that you have it like this option and you do it once and you put it in the Box chain and you can use it all over again none of UK's in the future hopefully probably go to and they sign it and it's in the blockchain so everybody can see that Erica is allowed to ride a car that's the vision what we want to do with such an identity I didn't do that yeah we did we did in the lookup contract one of mana we can answer it I tried a couple yeah we calculated at least for the creation of the contract with the MEP ID we calculated 11 cents euro cents at the moment at the moment yeah yeah that's the thing all this your privacy you have to paper goodbye what it's actually like if you if you if you if you look at the payment option on general who will use it if it's 11 cents you me I didn't get the that's a good question this this project is at least for us is not about making money so it's research we we try to evoke this idea and yep there is no though we're business concept right now but actually it's always tough data if you want to buy data somebody's getting a feed so [Music] we're using we are deriving from the Assyrian private key another key and with this one we will encrypt the debye D prime key which key which it's deterministic we can create it or every time again from the if I'm if I lost the original key my original private key from material the web ID private key it's it's not the etherium private key it's like this this yellow computer system has a web ID and this web idea is also a private key it's signed over key and we are encrypting this key because it's on the blockchain so it's public your identity and the blockchain is everybody can see it and it's a party yeah but that that's the thing we were talking about that there is no solution right now you have to store your private keys on here that's its yeah I don't know you're probably a couple of you are using mysterium so you have the private key so he loses we have this mechanism this aetherium like wallet is offering this this method to generate a twelve word human readable seed it's 12 english words and we are actually offering to store this seat and not the where we so take cryptic private key but you have to remember or write down the scene yeah it still let's still state-of-the-art brain we really talked to a lot of aetherium guys here and it's like this and you thought is working on it but they told us that it would take at least a couple of months until there so we cover we've the social recovery process in place but then still it's not really self solvent because you rely on your friends to help you out because they're here yeah actually this was like it's a very like in the center this is a small project and and we had to set some some require mail yeah let's go and we said okay helium it's complicated enough for the time we have and it's like you have this programming language but basically non human readable identify that we solve different data structure on different not change so there's effort on that there's also XDI which is an alternative card yeah similar things but in the long pitch that ideal be to kind of a couple them or at least introduce a certain amount of portability where you can change alright then you can change your name the golden the holy grail for say at least for us at this point in time so we're doing the little exploration step by step this was a very simple straightforward example of integration 1 to see how this works how I will this use our needs so this is by no means a state of the art this is by no means a finished project is rather just kind of a big issue is also always performance scalability where we have a bunch of identities all the news absolutely and it's still very much development you know you see very smart people behind very smart people working on it so and it shows promise for a certain extent and this is really the and this to us this is subjectively the weak point because some people would argue that yeah and some people would argue that it is and therefore you have actually think as far as problems with relying and kind of web infrastructure going over lines nto and DNS is a smaller one the other one is I feel like while you have reliance on any kind of server or it's not fully self sovereign just because like regular people cannot operate their own servers like I try to operate my own store and everyone right so like it's if you build toward that model or like it's not it's the best you can possibly give us realistically federated there's some incentives that I get like in freedom box which is you know they sound like out of the box and you plug it into the internet than you have your so they survive in today's it really tries to abstract a little bit technical concepts for a lot of people but they're still troubleshooting but still maintained so in it has usually I mean it has challenges I think you make a very good point here actually that as long as you serve their property vulnerabilities and someone will argue that centralized identity providers like Facebook is probably be much more secure than they'll be more recent include a lot of service attacks to just militias intently general in your personal solid server so [Music] I think this is already out of the scope of this presentation we are really exploring these things as we go [Music] to [Music]