# Uport – Usable Key Management for Multiple Identities Across Multiple Chains

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2018-10-09
- Duration: 20:24
- Topics: Science & Technology
- Watch: https://streameth.org/watch/yt-XuGFPlkoJtY
- YouTube: https://www.youtube.com/watch?v=XuGFPlkoJtY

## Description

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on IPFS and more.
https://archive.devcon.org/archive/watch/3/uport-usable-key-management-for-multiple-identities-across-multiple-chains

Exploring how private keys can be securely managed for multiple identities with an intuitive mobile user interface like the uPort app. In addition, we explore the notion of how identities can communicate and transact across multiple chains with varying consensus systems.

Speaker(s): Michael Sena, Rouven Heck, Pelle Braendgaard
Skill level: Intermediate
Track: Developer Infrastructure


Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon 3 was held in Cancún, Mexico on Nov 1 - 4, 2017
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/

## Transcript

great thanks for hanging with us on day three and we're you port so it's great to be back on stage in front of all of our friends again so much has happened since last year and we're excited to have the opportunity to share an update with you about what we've been doing I'm Michael Sena I'm product lead for you port I'm a company by Reuben heck project lead in Pelle brain guard technical lead and we will spend the next 20 minutes sharing our progress with you so if there's one thing that you take away from this presentation it's that we've built a theorems user platform so we've been working on we're hoping to answer the question what is you port we've heard it from so many of you and it's about time we share it so thanks so if you're building an etherium application and your goal is to have end users we should talk because building user friendly etherium apps is hard you know you need to solve account management and login so account management for users in a way that begins to protect their privacy or protects them from themselves and bad behavior as an extension of that we have key management solutions to help your users avoid danger also we can handle things like onboarding new users without ether or gas also sort of abstracting the concept of gas from end users in general we can also do things like know your user kyc and reputation system so if you're building an app and your goal is to have end users you should probably think about solving these and we have a comprehensive solution and so at a high level you port makes a theorem easy you port aetherium today is not really easy you need to be pretty technical you have to have an on-ramp to acquire ether or you need to interact with too many low-level things in a non user-friendly way so we built four components the first are all aetherium app accounts are in one central place for the user that's easy for them to manage users can create a complete user profile that they take with them throughout the web as they interact with various applications third you port enables the storage the user center storage of credentials and other pieces of sign data that enable a shared user centric data platform fourth we offer mobile factor authentication and signatures for everything so basically user clicks a button on your app and we have a mobile signer so I'll pass it over to groov an impeller to explain some more of the technical details and actually how we implement some of these things but yeah looking forward to working with all of you hi so I'm gonna talk a little bit about how you port manages your users accounts au port account is a it's something that we wanted to create a form of permanence with and what that means that it is something that just because you change devices or you lose your phone or anything else happens that you should not lose access to this so we have a fairly simple architecture with a your identity itself represented by a very simple smart contract called a proxy this is ultimately controlled by a user's device where the private keys are stored and these private keys never ever leave the device in between then there we have an upgradable access control system a spark contract that we call the controller and to handle recovery we don't want as I say we don't want people to lose access to their identities so we have this smart contract layer to be able to handle recovery of your users accounts and identities this allows us to do things like social recovery and many other future kinds of recovery so last year we presented a much simpler model there was one good test network Rob stone we had one account representing a users identity you use this for interacting with all the different apps and this was a great way to get started lots of developers used it but we started seeing a lot of changes happening in the etherium world so first of all there are a lot more different test networks right now there's also a lot of private chains users started having different accounts or a lot of more apps in it so this was a problem that we couldn't just solve having a single account identity on a single chain so our new architecture supports multiple accounts and multiple chains and it supports is roughly the same smart contract structure that we had before but we have obviously improved our smart contracts they're way more efficient right now so we can support easily support having a separate account for each DAP that wants to integrate with us per user and we can support this over multiple networks the other thing that we learnt over the last year is that users really want to manage their interactions and for all the different apps in one place regardless where the app logics run and what this what I'm trying to say with this is a pelagic isn't just run on in the browser or on multiple aetherium chains they're still web 2o server style apps and there's a lot of hybrid apps as well in between a new port actually manages account management for all of these and it's particularly useful for the hybrid solution in the middle so we do this by having the mobile app maintain all the different accounts it's a glue that works for integrating the different apps so for a traditional web 3 you write your your app just like you would normally using web 3 or any of the cool new developing developers library set out there we have au port connect library that automatically takes your web 3 code sends transactions to the phone for web - oh the process is very similar to say a Facebook connects the only difference of course is that there are no centralized servers that you interact with and the identity is always under the control of the end user finally a problem that we tried to solve was onboarding of new users a lot of non-technical users and even technical users not familiar with aetherium that coming in and want to try all of these new things and they at the moment we have to every single time explain about the difference between main net covin rinkeby what's gasps how do you fund your accounts all of these things these are huge problems for most developers when their apps hit real users so the first thing that we're doing to solve this is by having a a much smarter login flow that our first version so a developer can go in and specify what network that they want account created on and then if the user already has an accounts for your particular tap on this particular network that will always be returned if not a new account will be created on the fly and this means that the user never has to worry about whether your app is on rinkeby kovin maenette or even private networks the other big issue is fuel gas is an obvious thing that we all have to pay for our aetherium transactions and it's a stumbling block that you know it's very difficult you want to get people onto your new app and try it but first I need gas they need a theory or either to pay for pay for the contracts that alone is a big issue there's also the less obvious issue of lots of non-technical end-users following links on Twitter sending main net eath to a Kovan account or Kovan smart contract so this is obviously a really bad experience so we're solving this by having a all the transactions that go through you port are automatically fueled by our transaction fuelling service and neither you nor your users have to worry about that and again in the future and I would like to give it over to Reuben I'm going to talk about user credentials and I think it's to my concern so for users after after defconn when I represented you put in in the role from from today and we realized that because of a feedback off from the community how to interact and make it much more user friendly for for users and more personal so when you log on to adapt and like a simple thing like a nickname or some photo make it a bit more personal so it's all about like how can we give badges or information from a user back to the user because we don't want to store them centrally so that's something we explored and we talked a lot with the identity community and we realized there's a lot of opportunities to use the identity from you as an individual as well as from the table to create credentials in form from badges or actor stations to the users that come some form of like verify the claims so what we did thanks what we did is we built an ability for the user to make this very very easy so we have libraries now to issue these kind of attestation to the users this can be in form of on train as well as off train stuff we had the conversation we're building an identity platform so a lot of the information you get a nickname is maybe less critical but there's a lot of information about my name my birthday that I have a certain degree or maybe have achieved a certain certificate and because I achieved an online course or something else all of this data is something you don't really want to have unchain Eve not encrypted so we spend a lot of time in our focus during this was off chain attestations in a very very easy way last year we had an experiment here Piper was doing this DEFCON 2 attendance where people went to him gave him the theorem address and he was basically recording this in form of an smart contact and we tried to do a little experiment later let's see how the Wi-Fi works but and if you have you ports the light is app you will see QR code at the end of the talk and hopefully get an attestation about being a tenant or having eternity so obviously after your credentials have been issued and stored with the user we need to make it as well easy for the developers to receive this beta data back so what we built is a library that you can easily receive the credentials and can validate them and that's a very critical and very interesting part because what we allow now to do is that anyone can issue that say kyc attestation so there are enough companies in the world who have done kyc before and they can issue this form to me now in an in an acrid n Chelan attestation which is signed from the issuer that can be a bank that can be a crypto exchange or anyone else we're now working on an integration of a couple of like kyc providers at 12 so it's more native as part of this and now what you can do if you have done this once you go through this process and now you go to a token a launch platform and you can reissue this information so it's a very very easy much more user-friendly way to to get this validation and can rely on this as a developer as long as you trust the issuing parties I think that's a very like nice way because now we get a lot of feedback in the community that people want to use this for many other tabs so whether it's Mountain Port because you've managed certain assets whether it's a poker platform or whether it's gnosis there's like multiple reasons why you want to know something about the user there just can be abstract it can be he's older than eighteen or he lives in a certain state or not in a certain country there's a lot of value in these kind of add stations and it's all like digitally signed to my identity so it's very secure and powerful so ultimately what we built was this is really the foundation that you create an identity which is not just a random number like a random address it is now the ability that you have a privacy-preserving ability to use as a user interacting with adapt so you build the trust without revealing too much information and that's a very powerful foundation anyway and also the foundation for any reputation system because think about this if you are issuing to a user that in your decentralized IBM be he was a good host and he has a I know he can drive a car because the driver license other things all these things are part of a very good foundation for any type of reputation so if you go in on a certain website the next time and you can issue transaction of the last 100 interactions with I know you're a baby platform you can just take this anywhere and issue this to this new job and that will make it much much easier to build digital interaction so what I will show you now hopefully if the Wi-Fi works how did your signatures work so that's something we demoed last year ready so we all know that to do any kind of interactions with the blockchain or with aetherium is you need to have an ability for signing so pay Laurie mentioned it the the phone has the private key and we have our architecture which were smart phone networks but I will try to do and let's see how that works with the connectivity here is to show you how this could look like so and I do it live so I hope it works so what you see here first of all I'll show you the application itself it's very simple it has at the moment a couple of information about yourself so in this case we just have us and a phone number this is data which is taught on my phone this is not stored anywhere else we have verifications this is the stuff which we hopefully can give you as part of this experiment or at least for some of you and you see that you haven't batch you have attended this conference so that might be an interesting thing for next time if you go somewhere and you want to demonstrate this that you and I have a certain experience oh you have learned something or get a discount for for other other means so that's kind of the the verifications as peda mentioned there multiple accounts your support now so in this demo I just have at the Mona riekki account on this and what I show you now is a mobile phone app so what we have here is the Mobile Safari it's just a simple dab and what I do is I connect now my you port with which to stop so what it does it jumps like the Facebook connect into doesn't work into the into the app it pulls now information about the so you see the logo you see the details which are requested from this application and now I can confirm this what you see on the bottom is is a first attempt to build some trust into this whole inject me what you see I've done this already 67 times that's important because there's so many web sites which suddenly get spoofed also it gives you an additional level of trust as love is not the final version but that's the first start so what you do is you log in and now what it does if the network is not fast enough it will show my name and just a photo that's something which is just local there's not need to be store because it's a tap it's only a metaphor but it gives the user right it could use experience that he's now locked in and not your friend or someone else what they're doing hours very simple and what we have in years you can buy a certain set of shares which just like an example of an interaction with a smart contact so if I click on buy shares what it does it jumps back into the application and now what you see here is a transaction screen and that's very important so and what you see is the smart contact you are interacting with it gives you what kind of function call you're doing and as well the 56 shares I just requested to buy and that's just important because at the moment how do you know where the Tyrian that what you're about to sign and I think that's kind of the the user experience we want to build in that can be in the future maybe more customized screens and they will look a bit more beautiful but for now this is the starting point so what I do now in the moment I do prove I need now to use my private key therefore I need to put my finger on it and to unlock the key which is in the secure Enclave and do the signing now and now it will take a few seconds obviously so that's kind of what you guys know so back to the presentation so what we did just recently was in the city of soup a little project with them and it is a four-step thanks to you best if you down it your mobile application generate your additional identity and you go and to a portal on this portal you can enter like a certain set of information about yourself your name and your ID card this is only stuff which you would give to the city of soup as a portal and then the second step you go into the office there with your ID card and prove that you are the person who claims to be this so it's an out like a real in life validation and what the clerk then can do is they go to their internal portal and click one button and it pushed a notification back to you as a user this information now contains that does your name you're a citizen of the city and someone has validated so suddenly we create this a connection between your theorem address and your real person and someone has validated and if you trust that the city of Suk's process all the clerk's are doing that only if it's right you can never trust this at the station or this badge from the city of soup so we are working with a couple of integrations like using this sort thing now for the city itself for like simply a voting so they don't do like voting voting against Malak opening times of the swimming pool or something else as a testbed but it's a it's a start and as well we are working with mountain port and others to integrate this information now into our into into their platform which allows them to trust immediately there's eternity much more so now and that's that's the end of the presentation this is the QR code if you have you port try to scan it I don't know it was the network connectivity here whether it works and now we have live streams so it's not technically attendance but let's say you listen to this life because in five minutes we were turned off what happens now you go on this it will ask you whether you are willing to give us right to send you a push notification it's a service via operate at the moment and what it does is basically sends a request and in five seconds or so after that and we would send we will sign a signature or service sign a piece of data and they send it back to you as a personification and that's the badge of attending here in DEFCON and with that I'm closing and please visit our website and look into integrating us thank you [Applause] [Music]