Identifying the Users of Tomorrow | ETHDam 2023

foreign [Music] so moving on we have a panel about identifying the users of tomorrow this is a topic that I'm actually personally quite interested in around decentralized identity it's also very very relevant to privacy and consumer privacy for business privacy and where we're obviously what the whole topic of this conference has been um so I want to remind you again there's the slido feel free to ask questions and without further Ado I would like to introduce the three panelists to the stages to the stage we've got Julio from fractal cons take a seat we've also got George from claros and I'm really going to struggle with this I haven't met you before so uh uh zevaldine no come up and then you're gonna teach me how to say it oh good well thanks a lot for for coming guys and um yeah we're gonna start here and please say your name correctly I'm sorry no worries no worries it's fillet tongue twister I make too much fun of people who make who don't pronounce it so um I'm zavez I'm one of the founders of Audi ID which is a fully private which a fully private way to verify government IDs so we've developed one of the first ZK ways to directly verify attestations about users so let's say I'm over 18 without going without sending your identity data to a third party to prove that cool thank you we can carry the on the intros hi I'm George um I work for Clarence I'm an engineer we built the clearest court system as well as roof Humanity which is an identity Solution that's uh yeah decentralized all right hi everyone I'm Julio I'm a co-founder at fractal and we do identity verification in a way that caters well to crypto companies and protocols um but that's what we focus on verification itself cool thanks a lot guys um so to start off um because I think decentralized identity did verifiable credentials all of these things is now starting to become like one of the trends that's in the space I was wondering if between the three of you if you could try and shortly to find what decentralized identity actually is and kind of what it stands for so I think did is a direct consequence of having self-custody over your assets so you've got your own private key that is your identity basically and all the derivatives of how deities are used today is basically wanted to be saying something about another identity so I'm signing a message which says something about you and therefore that is part of your identity um so for me I think identity in a way it's it's something that has been around for a couple of centuries and now with technology it's it's kind of moving into a direction where people can own the identity and they can own the reputation and they can really build something out um the question was a bit about the future as well um there's a couple of competing systems right now I think they will all shine in their own way I think some will be very subtle suited for D5 some will be very well suited for for freelance jobs that sort of thing and um yeah it's still very early on to say uh at least so identity is not something that is inherently centralized or at least not you know that sometimes the issuance is if you have a government ID the the creation of that ID is a centralized process but your identity is a lot more than that and identity has always been decentralized like you you store your documents on yourself you show them to whoever you like the issue is web 2 centralized a lot of our identity the internet doesn't come with an identity layer so web 2 did a lot of centralization efforts and for me decentralized identity is not something um you know new and unique that only web 3 can bring it's more about going back to the roots of what makes sense which is it's your identity you keep it you own it you do whatever you want with it instead of delegating that to a federation or to Google or to whomever um so yeah I see it as going back to the roots a very important route I think um just interested from a show of hands of the people that are here who's familiar with the the travel rule for crypto transactions okay that's maybe around just under half or so um so the travel rule is becoming quite important and I'm wondering if one of you maybe wants to give a very quick explanation of that and then we're going to touch on the Travel Rule and how that interacts with uh identity in the space sure um it's uh it's quite simple it's one of the um one of the AML measures that essentially mandates um anybody that facilitates a transaction to send along information about the sender and the receiver of that transaction so for example when you make a bank transfer the bank you make the transfer with will take some information about you and send it along with that transaction to the receiving Bank on the other side and they also need to know who the receiver is going to be so this is I'm not a lawyer but this is kind of the gist of it and how much of the ecosystem roughly do you think is actually already implementing the travel rule where there is identity actually being sent to and from well I think it's very little right now because it's not something that has come into Force so that we've had a lot of discussions in the EU for example recently uh with the TFR um and it is something that um centralized um like exchanges asset providers are going to have to implement um it's not something that applies to and I quote the regulation sufficiently decentralized protocols and applications and it remains to be seen what that means um but this for me is actually really cool because it pushes if you don't like it then you move away from a sex and you go into decentralization uh proper because the rule doesn't apply there or at least not for now yeah yeah and the reason why this is relevant is ultimately we're talking about identifying the users of tomorrow and it's becoming increasingly important or necessary that exchanges and Sexes are kycing users but that does have a privacy concern so I'm interested in hearing from from you guys around kind of what your privacy concerns would be around the implementation of the travel rule obviously yeah Sexes that exist in the space well at least my take on this will be that and that combined with any other form of more more uh centralized density verification is that well user data would have to be sent around between between institutions so this institution has to keep a copy the next one has to be keep a copy or if not a copy then both of them have taxes this um same thing with kyc or at least the way it's currently being enforced and um and that that creates a lot that creates a lot of honeypots and lots of opportunities for us to really push regulation forward and make an example of how it should be built instead of just blindly complying with it hmm yeah I don't think I have anything to add to this um yeah I don't think I do either I think it's actually a good thing because we should not be using centralized products if we can avoid them and if privacy here is a concern for you then well use blockchains the way they were meant to be used yeah and so that's where um I guess can you guys talk a little bit about how digital identity really can enable kind of a more privacy-centric operation of kind of while complying with regulations or all of these upcoming regulations right so at least at least the angle we're taking without it is trying to do as much as we can in building a fully a full ZK instrument which can prove that you are not on the off hack list you can prove that you're not on the adverse Media or peps or whatever other sanctions list out there you can prove that your eligible age of an eligible jurisdiction jurisdiction et cetera et cetera et cetera but you're just not storing your identity document with that provider and with the way with with the way regulations are being written vague enough so that this might comply if there is a precedent for it and then that's what we're trying to push for personally so I don't think Regulators have been very transparent or forthcoming yet with what they're expecting so it's a bit hard to kind of say now whether we comply with that or not but in terms of privacy um we I've not people know our system of humanity but the data itself is is public but then there are other projects like sysmo that comes on and they release a feature where you can verify someone's a human without actually knowing who that human is um again with the same CK kind of um stuff so this varying of Technology um probably provides nice avenues for the future but in terms of regulators um I think it's still too very to tell where that is going to go and yeah where everything will end up it depends a lot on uh on Goodwills so um as you were saying like indeed there's a lack of regulatory Clarity and it might be that regulations are being written to push us out um but uh if you if you assume the best in Regulators which often it is the case they're they're operating within a certain framework that was given to them and they're trying to make things better for everyone within that framework then you know it's not a conspiracy um and so I found often that folks there are very very reasonable and if they understand how we are working towards meeting the regulations that they create and towards informing the regulations they will create the very often receptive and they're very often understanding because at the end of the day they are they are um to protect the people and if you show them how what you build does that even better um or makes that less worse at least then often I found folks to be very receptive and um I'd say maybe this is a little bit too much of a game but if if the audience right now was the regulators and you had to you could say one thing to The Regulators given the you know how much the future depends on having verifiable identity and all of that stuff what would you guys say you don't have to be custodian of all information in order to prove that you've done your job or you've done the checks um well It's Tricky I mean if you if you look at Innovation I mean the Russians tried it with the internet they tried to kind of stop that and it didn't really help them further if our countries now wherever you're from uh do the same thing what they end up doing is is risking a lot of innovation being in that country and you know probably moving away um so yeah with any kind of innovation and Technology it's always good to be gentle and transparent and like you said to assume the good in in people and um yeah to care for it to nurture it um I would say that um something that is probably important to enforce is to use the fact that your identity can be stored in a decentralized way so if you want to protect consumers from leaks that happen all of the time actually mandate institutions to store personal information in decentralized networks so that they don't become honeypots and it doesn't need to be a network they could also be a data wallet but we do have the technology it is a lot safer that keeping things in S3 and so just enforce that yeah I think that's a very valid point it's one of the reasons why I'm interested in the topic is my big concern is that vasp providers become honey pots one way or another of user information and that the ecosystem doesn't necessarily know that it's happening that's like uh yeah um so I guess that uh in a few minutes I'll ask some of the slido questions so if you have any questions please do put them on there um so I guess like my big last question is what do you think is holding back the adoption of decentralized identity within the ecosystem right now foreign I think the main thing is a user-focused or a use case focused approach there is many people building identity for structure pretty much everyone um but we've got to make the idea to too many did Frameworks but who has the IDS here in the room and have you used it for something so it's it's about building actual tangible real world use cases and his use case that's not just spanning hey you can use it in Advent you can get an extra nft or something but but an actual tangible real world benefit that even maybe your mom can feel as well well then then we can properly scale the IDS yeah I fully agree and I would just add to that um identity is such a building block if if the space can figure out how this works the amount of public good it can do anywhere in the world is is kind of huge you know wherever you are um if you can get a loan through an identity that's on chain it can have massive impact in the real world and um yeah I think right now there aren't really any killer apps yet I don't think we have helped enough people um but come five ten years time it might look all very different I I completely agree with that it's a matter of use cases today the by far the biggest identity use case on any kind of place in web 3 is kyc compliance AML compliance that's what people use it for and as long as that's all that people use it for then there's not going to be a lot of changes the only one that we see is that as in more and more crypto companies actually build all or most of their back ends in blockchains then the decentralized identity stack actually fits the way smart contracts work a lot better than a system like oauth for example like contracts on call apis and so it is definitely not going to come from somebody being like Oh man my identity is so cool I want to decentralize it no nobody nobody gives a and um is it is it more private yeah who cares about that nobody like apple is the only company in the whole world that ever managed to make privacy like part of the debate and only because it was cool because apple is cool that's it now nobody actually cares it's not going to come from users from normal folks that feel like oh if my identity is kept this way this is better for me it is going to come from builders in the space taking responsibility and actually using decentralized identity systems um because then they become the they become something that people have to do or have to participate in in order to play in the space um so it's on us and on that note could you both sorry could you all give me two uh yeah decentralized identity use cases and basically why you're super into that particular use case a little bit quick fire two use cases and why you why you think that that use case is very important that's not kycaml that's not KO cnno okay so so for me one of the is actually proof of personhood so and then the other is proving your age online I think there's many use cases for upcoming regulations with adult entertainment gambling and things like this yeah I think human Registries can open up new avenues for or for defy um I also think it can maybe help also in governance um reducing uh little trolls and and that sort of thing and kind of build a different kind of system that is more positive but um with anything that's in the future it's always hard to tell so whether it's these two that I mentioned or you know five others we'll we'll see I think that uh two things that we're going to see um not too long in the future that identity does enable are going to be things like under collateralized loans so actually making loans accessible for the purpose that most loans are supposed to be used for um which is something that you can do if there's um if you can tie a to a person that you either trust or that you know that you can bring enforcement against um and but honestly the reason I'm primarily excited about it is because the more the more fractal users that actually adopt the the centralized identity solution than the less passports I've got in a Honeypot that I need to protect and sleeping at night is really good so that is primarily why I'm excited because I don't want to be a Honeypot I want that as little as possible in my life cool thanks a lot and I also just realized I'm very intimidated by all of your beards I'm very jealous right now it was quite as bigger yesterday okay on to the audience questions there are two right now um the the first one is how unique should be a did what are the consequences of having multiple dids so I think this is mostly only by London when we're talking about the proof of personal good concept so when you when you're trying to say that one person has to have one identity and that's it to um to prevent all kinds of people attacks governance vaults Etc et cetera so in this case that would be very critical and that's actually that's actually one of the main challenges in building such kind of systems is good is that we can do proof of personal code in one way then proof Humanity does it does in a completely different way so if someone signs up for the two systems how do they duplicate among the two because most likely the end use case some Dao which ones do you enable this for governance will have to cover multiple systems because no single system is going to identify every single user and so yeah how do you do that is a pretty challenging topic um it's a good question um I think what's most important is that users have Choice every platform has different trade-offs you know something you have to sacrifice whether it's a video of yourself or a passport or you know whatever it is so to give users options in what they can use multiple or one um eventually you know it might get Consolidated into a dab where you can use any of these platforms or or not um but at the end of the day you know the more choice to users anywhere is is a good thing yeah I agree with that I think it's it's a lot about choice and not just in terms of choice of you know who you choose to make statements about you and to publish those statements like you know as a fractal is it someone else um I think it's also it's important to realize that for most use cases that identity is involved it's kind of irrelevant to know whether or not you're unique so for scenarios of say one person one vote it is obviously critical uh for scenarios of compliance it doesn't really matter I can have if I have an account with a provider with one of my documents in an account with another provider with the same document or a different one if I'm trying to buy a token that is a security All That Matters to the other end is that they have they have identified me uniqueness doesn't really matter there so um your identity is something that you should be able to compose and reveal at will given a certain use case and being unique showing that you are unique within a certain set is only one of those use cases the IDS are supposed to be unique by definition and but not in terms of corresponding to a unique human and meat space just hdid and you can have 20 if you want to and that's fine yeah super interesting and a big I think this really is a big problem in terms of how to do that I hadn't thought about it in that clearly clear context yet um interested in your answer to this question from the audience are we moving in I guess the direction that is desired with the European digital identity project you mean ebsa uh I guess so so I'll I'll comment on the the European blockchain Services infrastructure or initiative I think I think the identity is something that's separate from that actually so what am I what I'm aware of is that something related to the Absa is building a digital identity framework for for example sending out your University diploma as a digital credential which then you can prove on or your test or your covet test certificate or other things like this so I think that's yet another example of let's build another identity infrastructure now this one actually has a much better bigger potential for scaling um versus let's say a commercial LED standard standardization solution because then they can force all the universities and all the public institutions to actually issue his credentials here and I don't know where everyone has to support them because there's there's massive volume here so it solves the chicken and egg that many other identity problems are struggling with with that said it also underlines the fact that there will be massive fragmentation in the way the IDS are being issued and used right now because you've got the ebsi then the India has their own uh um their own system and then let's say the the way passports or ID cards are signed is a completely different digital system because they've got NFC NFC chips which are assigned and so and for the end consumer of the did there's there's a big hurdle like the end consumer I mean the platform itself there's a big hurdle of how do you actually integrate accommodate and and use everything seamlessly um yeah I'm not familiar with this initiative so I don't really have a comment uh yeah I'm not sure exactly what initiative it refers to although like uh if it is about pushing or forcing institutions to prepare themselves to issue verifiable credentials much like you should be forcing social networks to you know allow for the easy exports of your Social graph to something else then it makes total sense because like folks are then in control because they have portability and they can vote for their feet if it is about that fully down but I don't actually know except obviously the European's way of doing this is authoritative in the end it's still the centralized network but it's permissioned at the top and then they can change the history and things like this so yeah I think this I think one one comment I have on on this is when you compare the governance systems to for example the European Union to I'm going to be blunt about a country like China that ultimately is very Pro blockchain they really have the ability to force a standard upon their entire economy which is a power that the European Union just doesn't have and from a speed perspective in terms of rolling out technology like this and obviously different variations in different colors it really is a benefit that they ultimately have over over the European Union when it comes to pushing out technology I use benefit very Loosely um so yeah uh I guess one one more question is um how do you make did's chain agnostic that's probably to do with integration so at this point deities will almost certainly be issued in different places like I said Indio issue there and we'll issue them in their own system Europe or issue the mineral system then polygon ID will have some credentials and then fractal has their own credentials and stuff so how do you build a layer on top of this which would integrate there which we which will make it seamless and and and actually bring real world use cases to that the issued credentials um I can only speak of my project with Humanity 2 is releasing soon and it's going to be on ethereum and gnosis chain it's not entirely agnostic but it's it's going to be less constrained to just ethereum um how the technical details work probably best to uh yeah refer to our early developer Andre who's working on the project and smart contract and bridges um but um I think creating a identity on layers where it's cheaper to do transactions it's going to help tremendously with onboarding and uh yeah paying 100 to 200 Euros for a gas feature it's actually to make your identity is is a big fee for anybody so I think it's a good good thing well let's say the IDS have nothing to do with the blockchain blockchains are one place they can be stored one place in which they can operate they're already born chain agnostic so as we build let's try to maintain it that way and we do that by making sure that we all follow the the good work of the w3c and we follow their standards and by doing that you still only are becoming interoperable in one layer which is like the you know the format in which the did should be in and the format in which verifiable credentials should be in and still across different providers you might have a game that is you know once gives you a credential for a high store a high score and that's going to be high underscore score rather than high Dash score or just high score a single word so that's another standard that like would probably be convenient if it would exist it is not going to exist it's extremely unlikely folks are going to even if they follow the same credential formats they're still going to be very very opinionated about what they put in there users are able to issue credentials themselves so a lot of interoperability is going to exist through curation and through making sure that there's translation layers that can help aggregate related data from credentials by different issuers into a coherent representation um so I think that's also going to never go away cool thanks the very last question I have and you only get to use one word as an answer how many years are we away from mainstream usage of dids I just want to hear a number two five five okay well there we have it we're somewhere between two and five years away from mainstream adoption of dids thank you ever so much guys for coming