Interep: An Identity Bridge from Web2 to Web3 by Geoff Lamperd | Devcon Bogotá

foreign [Music] I'm from the privacy and scalings Explorations team in the ethereum foundation and I'm going to talk today about interrep which is a project we've been working on it's in the identity space so brief introduction to what we do it's there's lots of projects in the trying to bring identity into ethereum and they tend to be like uh have some identity source and and build it up from from the ground our approach is a pragmatic approach where we build on the identity that we already have in our digital uh in our digital lives um and we bring that across to ethereum so we can have an established pool of uh or established identity pool and we we can integrate that into our ethereum applications um so yeah very much a pragmatic approach building on the identity sources we already have so what we aim to do is build a bridge from existing digital identity sources to ethereum uh integrate with providers of those identity sources and then privacy is very important to us so we build on the semaphore framework and integrate with with that so those building blocks all come together to form the basis of an application so identity um we spent a lot of time in our social networks uh um some people more than others but you know people spend a lot of time on their Twitter accounts and building up putting out a bit of our personality in into those accounts uh so we spend you know every tweet you you write is a bit of humanity that goes into that tweet that represents you and we build those up in our social uh Social Network accounts um people some people spend a lot of time on that kind of thing even if you're not into social social networks big time we still have digital identity in the in the non-web 3 world we have things like government IDs and driver's licenses and all that kind of stuff so um yeah it's our our real world human identity is reflected in those digital sources so that's what we try and build on but we need to recognize that those digital sources also are vulnerable to civil attacks so we need to yeah filter out the Bots and kick them out um so they're the kinds of things we're trying to do with interrep now um let's take a look at what the interrep Lego block looks like in an application we have we have uh everything rooted in the blockchain interrep is the Lego block on top of that that provides the identity the identity module um and the Lego block on top of that is semaphore and your application hooks into semaphore uh and with all of that we get the um the identity layer in interrep we get the Privacy layer in semaphore and we get the blockchain so providing all the all the guarantees um interrep will integrate with those identity sources like our social social media accounts and those kinds of things now semaphore relies on the idea of groups um you form form pre-existing groups and the semaphore application will use those identities in those groups to verify the kinds of things that your application is doing so semaphore is is a privacy layer so those groups the group membership is guaranteed but never revealed it's never revealed what the underlying ethereum account is so um yeah so we'll talk a bit more about the the details of that a bit later but that's an idea of what your application stack is um it's yeah it's really just a bunch of Lego bricks all plugged together uh the kinds of identity providers we've been linking with so far uh these examples Twitter and Reddit and GitHub so what we'll do is a an oauth uh verification on your Twitter account for instance and using that we'll link it with an ethereum account and never reveal that link but we we maintain that that link that Twitter handle is always reflected in that in that ethereum account uh and it's easy to for us to add new new providers is really just it's an oauth verification and some rules about um you know what's a qualified account or what does it look like a bot does it not does it look like a human um we can also integrate with other providers we could use email as a as a an identity source and this is useful in some cases not in others maybe it's not so useful for Gmail accounts but even Gmail has some barriers to entry so but if you've got like a DOT edu account email account then that's a fairly good guarantee that there's a human behind that account and and a reasonably good guarantee of uniqueness so we can use those kinds of sources and integrate with those government authorities are good in that um you know the government make sure you only have one driver's license for instance uh and there's there's a strong guarantee there's a human behind that driver's license so if we can we can integrate with those kinds of sources and it also includes the people who don't use social media so that's another approach we have um we can do things like curating groups of of um users so that might rely on personal knowledge of of uh of the individuals involved so that's that's also a strong way to guarantee Humanity other ID projects we can integrate with those and we can integrate with Unchained sources like use things like nft ownership that kind of thing now a bit about semaphore so with those identity sources we create a group we put someone into a group now semaphore relies on these groups semaphore groups uh membership sets so um there are guarantees of once you're in that set you're you're expected to be you know anyone can expect that that identity to be to have a human behind it um so and with semaphore it's a generic framework um in which members in that membership set can signal on a topic and that apply that can be applied in multiple ways but an easy to grasp example would be a dow that has votes on proposals in that situation a signal is a vote and the topic is a proposal and semaphore will guarantee that that anyone who votes is a member of that group and they can only vote once and all of that is is done with privacy so you don't know who is voting on a particular voting in a particular direction so it can support secret votes but it still maintains strong guarantees of um membership in that set uh so this yeah the semaphore framework gets used in lots of ways but uh the group membership part of semaphore semaphore playing vanilla semaphore has its own group management but what we do with interrep is semaphore outsources the group management to interrupt and then that's that's um interf itself is is basing its identity groups on for instance on Twitter membership and GitHub membership and so on so um the way that works is users will prove their membership on that in that social network identity source um h so that will form a Twitter group but we subdivide that into tears which basically represent a level of confidence that there is a human behind that behind that ID and as we know uh Twitter is riddled with Bots so we will just apply rules to filter out the spots as best we can we won't we're not going to say it's perfect but we'll get pretty close good enough for most applications the way we do that for instance with Twitter is we'll have a we have some criteria that we apply ourselves with Twitter it's a a fairly High bar to getting gold status you'd need 7 000 followers with 2 000 followers you'd be silver with less than that you'd be uh bronze but we also linked to botometer and that will do an assessment of your Twitter account and for most people that's gonna that's that's going to give us a score on how much botometer uh how confident they are that you are not a bot so most people with a bit of history in their Twitter account and a few followers will be able to get in silver or gold just using that bottoma to school you can you can try um you can join a group in and on our website and um assess your own status there and see if you can get into one of those groups I'll the link will be in the in a later slide um but yeah so uh the way we do it is um is we'll we'll do that evaluation uh give someone a score and then assign them to that to that that level that tier bronze silver or gold um and uh that yeah so uh applications will be able to choose what level of confidence uh they they require some applications will insist on a strong guarantee of humanity but they're going to be working with a smaller pool of of people who can qualify for that so some people some applications will want a large group of people to draw on and they're not so not so concerned that we um strongly guarantee Humanity as long as we do some filtering to kick out the Bots um so that would be a bronze level um with interact groups because interrep is managing those groups if you join a group that group can be used across multiple applications um so you can join once and use it in many applications and effectively we've got to sign in that will be workable across multiple applications and the advantage of doing that in a privacy setting is that we have a large privacy pool so the nitty-gritty process of of joining a group the user will come to a sign on screen sometimes it'll be a step just before they go in to use the application sometimes it will it can be done well beforehand someone can join a group and then they'll keep their identity and use that to kind of log in to work with the application so whichever way that's done first step is to prove the identity with the provider that might be like Twitter oauth or GitHub oauth having done that the our application will do that assessment assign the user to a tier called Silver bronze and then invite them to join that group so the user will uh do their Twitter sign on say okay you're in Twitter gold would you like to join this group they click click that button and then the next step is they link that with an ethereum account so the user will sign a message with their ethereum account which guarantees that they own that ethereum account it also prevents that account from being used again so they can only join once and the Twitter account likewise can only join once so having made that link we we have we return a semaphore ID the semaphore ID provides that guarantee that that Twitter handle is represented in that semaphore ID and that can be used from there on in the application without revealing that link of who the actual Twitter user is behind that account and neither is the ethereum account revealed in the actual application because we're using semaphore IDs and it conceals that we can also work with on-chain sources of uh proof of humanity if you like some of those are pretty pretty strong guarantees of humanity and I'm thinking there of like Sol burn tokens or poapps like the pop-up you get from your Devcon 6 with your Devcon 6 ticket that can only be owned by a human right because they're only giving out tickets for humans so that's a that's a pretty good indication that that account has a human behind it uh it's certainly very hard to um very resistant to civil attacks so yeah so we we take a slightly different approach with on-chain groups behind the scenes but um but they end up as a semaphore ID and work the same way in your application so the kind of applications we work with that we have in mind for interrep uh private voting I talked a bit about this before um yeah membership of uh Dow for instance and we can guarantee membership guarantee that there's a human behind that um uh a human in that in that group but never reveal who that human is social networking we think is a promising way to apply this and some of our sister projects in privacy and scaling group are um we're working on this you'll hear some talks in Devcon about that um but yeah that's uh another place where privacy is important but also Humanity proof of humanity is very important um we have anti-spam applications like the rate limiting nullifier another one of our sister projects we can do things like Fair air drops and civil resistant faucets so if you want to um yeah put some anti-civil properties into a an airdrop or a faucet interrupt can do that kind of thing so to close we think a pragmatic approach to Identity building on our history that we we all work on you know in our existing digital lives taking a pragmatic approach to to use that bring it across to ethereum um we can build up we have a existing source of identity that we can build on we don't need to build it from the ground up uh we don't need to discard those relationships we have in our social networks um but we don't want to bring along the surveillance opportunities the opportunities for misuse and abuse and we can build applications that respect personal privacy so our theorem accounts can be used for more than just Financial transactions we can start to extend it into the social realm bring along our social relationships give them a human context and make our accounts more credibly human and our applications in the web3 world so the links that QR code is to our Discord you're welcome to come there and ask questions and find out more you're also welcome to come and hit me up I'll be hanging around a lot at the temporary autonomous Zone down on the ground floor um which is the pse's um uh little uh hub um you're welcome to visit the application interrep.link and you can sign on there get just get yourself signed up with a server ID see what your Twitter status is maybe you have to work on that we've got documentation links we've got our code open source you'll find all that on the um on those links but yeah please come to the Discord and ask questions if you or come and ask me in person uh so thanks for all that um the QR code on this slide is the Discord for privacy and scaling we do lots of cool applications in the xero knowledge space so uh you can join that Discord and ask questions check out our job openings if you like building cool applications for privacy and scaling and check that out um and on that note thank you [Applause]