Decentralized User Account Management

Transcript

so this is supposed to be kind of an interactive workshop at least that's what I was told to prepare for but it might turn into a live demo since we don't have desks with where people can just open their laptops and do some stuff and so on but maybe we can so the project that I'm going to present it's called get login which is a user account management slash login system for primarily for web 3 depth but it is actually done in such a way that it closes it it matches the web to

experience and standards as closely as possible so you can actually use your own chain identity even for web 2 applications so it is made compatible with with the wealth version 2 and also with web login so this is the github repository and you find two rebels there so one is the the module itself login and the other is an example DAP which we're going to actually see in action so this guy here so it's open ID connect and OAuth 2 compatible and eventually

you will be able to use all sorts of of key management devices so you could use your your meta mask account you could use your hardware key or you can also use a simple user name and password based authentication and the whole idea is to make it so transparent to end-users that they don't even need to know that there's some ethereal magic going on behind the scenes and under the hood and I believe that we have successfully solved the zero ether onboarding problem

so this is an invitation based system but the actual rules and conditions of you know handing out invites is up to the application developer so you can build this into your DAP and then you know set up your own rules I'm not the author of this project so I participated in architecting it and I funded it but the principle author is Igor so it's mostly his work and if you are interested in like very deep technical details then he's the right person to ask and I'm just going to give a high-level overview of of what it does

and probably given the format that we ended up having it's better best to start with a live demo although I encourage everybody who has a laptop online to kind of try to get your hands dirty and I will actually show QR codes so that you can follow URLs of your own and we can maybe try you know getting an invitation signing up and things like that so this thing is deployed on swarm so this is not like critically dependent on swarm you don't have to use it with

swarm but it was designed very much with swarm in mind so it's a swarm friendly application and the particular instance on the web gateway is here so can you use this your code just try you should see something like this okay so I'm going to hide the QR code shortly so you should see something like this so

this is a login window as you can see so you can if you already have a username and the password you can just login which you probably don't so what you can do is you can sign up where the sign up means that you have some invitation code which you can use to actually register a username and the password but it can also arrive as a URL on which you can click so let's try let's try a example so I'm going to show a QR code together with an invitation or and maybe well let's see if anybody can actually

accept it so that's kind of an experiment here so let's try this way first so this is an invitation code this doesn't have the whole URL in it it just the invite which you need to copy and paste into the invite window let's just drive I'm wondering if somebody manages

to to do that and once we go through all these mechanics I'm going to show you what actually happens on the blockchain under the hood because all this is actually blockchain based so what you're seeing here this code here and codes among other things the private key of a pre-funded key which only has a little bit of gas money on it which means that you can send it over reasonably protected channels like chat or email or things like that and you don't really need to be afraid of somebody exerting too much effort to steal it because it's

not a lot of money like it's a few cents worth of ether well this is rinkeby tas theater actually but the idea is that you get this invitation you click on it and your DAP is going to be able to send a transaction to the blockchain from this pre-funded key and the person who invited you is the person who needs to fund your invitation and hopefully when you're using any system like that you you you always have a little bit of ether lying around in these temporary accounts and when you log out you're actually defunding these temporary accounts so that's like the underlying

mechanics of it so did anybody manage to accept the invitation okay so somebody managed Oh congratulations so what you should see okay so this in which I have further invites so we can like after I'm done with the public thing we can play with it in a private

manner but so basically what you need to get is that you you log in and and so you're going to so you can see that you have some balance up there you can log out if you want to and after that you can actually use depth or even web to applications which authorize this thing to be your user management so there's a exampled app for which I'm also going to show a QR code it's I believe this guy

so here's a swarm hosted app and it will only work for the person who was lucky enough to get invitation and meanwhile again the policy the mechanics of how you're handing out invitation can be coded up in a smart contract and solidity or Viper or whatever smart contract language you want and you know you can sell them you can monetize them you can restrict them so you can play all sorts of games with the invitation it's up to you how you're going to grow your network yes well I'm just asking

because you said it was going to be interactive and me if you were going to explain it later but is the so what are you doing if the private key is a private key derived from the username and password or are you generating a private key and storing it locally neither so what you do is you're generating the private so you your your key and your identity are separate if you lose your key there can still be a social recovery mechanism and we can talk about that too but in this particular instance what's gonna happen is that you're you generate a key locally but in addition to storing it in

your browser's local storage you also submit it in an encrypted form to the network that it can be retrieved with your username and the password so if you go to another computer which doesn't have your private key in your local storage and you enter your username and your password the necessary encrypted data will be loaded off the blockchain decrypted in your browser and placed in your browser's local storage so you don't have to use it that way so this is not dependent on this mechanism you can use a hardware key okay but then that does me that your security is based on the security of your password because

someone could try to brute-force your password yes so it has the usual cryptographic protection mechanism like salted and iterated hashing and those things but yes you should choose a reasonably strong password and also we have this idea that one thing that can mimic the so if that happens for example with your Facebook account you will email Facebook support now in a decentralized application there's no Facebook support so whom you are going to turn to and we have this idea that your initial point of contact is the person who invited you because they

apparently know something about the system more than you do and they can have some sort of control over your account which you can cut it's up to you again so you as the invited person can decide that ok now I have some better social recovery mechanism or I trust my hard working more than anybody else so you can cut that only become cord if you want to but initially as a naive user you can turn you can email to your - - ever invited you that hey let me call you over the phone somebody has brute force Mikey could you please reset my password so that I can pick a better one so if you so now if you get to this if

you scan this QR code then where you're going to get is something like this and then you just need to authorize get login to to be your user management oops sorry I click too early so so maybe you have already done that so where's my where's my video as so us yes okay so this is a very primitive type

example that you can you can try we've screwed a little bit up because that's not the contract URL that we want it to be there but I think now we can get this one so the actual URL of the contract this guy here another QR code so here's the ring to be a contract of the user management system and if you look at

this contract then you can actually watch what happened when you registered when you accept the invitation when you logged in when you authorized your when you authorized your client so all these things they happened in the blockchain but as you can see I didn't I didn't have to send him any you know rinkeby test Eater so the onboarding process is actually very very closely mimicking the web - onboarding process that in the email you just get an invitation with the link on which you can click so basically that's the demo that I wanted to show and if you want to play with it

there are more invites available and I think it's time to open for the Q&A anybody else maybe well you said that like the identity and the keys are different tell me about what is the identity is it a smart contract is there a smart contract motherhood for every idea was to use a proxy contract but I was talked out of it I think you were one of the people who talked me out of it so instead of that there's this smart contract which has a database of of

identities so identity is basically a record in a smart contracts database so there's no separate proxy contract for every identity but there's one one smart contract per like social network and you have reasonably cryptographically protected records from which those who have the appropriate credentials can kind of prove everything they need to prove but for example you cannot like scan the state of that smart contract and got to get all the usernames that's not that's not possible okay so who invited me yes you can find that out

yeah we can take that offline and we can certainly play with it and see how it works on the blockchain thank you for your attention [Applause] like I want a fan