#DappCon22 : Day 1 - Identity For Web3: Privacy- Preserving Transaction Authorization, Julio Santos

Transcript

all right there we go um so hi everyone my name is uh Julio I'm a co-founder at fractal where I lead product and engineering and um I'm very excited to be here and I I'm really looking forward to telling you about um what we do um but before I get started there is something that I need to share um and uh both for context and awareness but also like you know to to contextualize the perspective to which I come to this and to which fractal comes to its Suite of products that it offers right now and that is um the state of identity in web 3 is appalling right now and we need to stop [ __ ] around with identity we need thank you [Applause]

um we need to tune out the identity maximalists and we need to stop waiting for Perfect Solutions because we're not going to get anywhere like that how much longer are we going to be sitting around polishing standards how much longer are we going to like Pretend We're a web 3 and tell our users to go and feed their data to walled Gardens to strip naked in front of some corporate that gives no shits about them that's us today and um it's not like we don't have the technology uh the I mean the internet identity Workshop God bless them they've got they've been at this for 15 years since 2005 well my math is off but you get it the w3c for almost a decade and

that is amazing work and what have we all done with that well we've raised hundreds of millions as an industry we built a bunch of decentralized identity protocols who are now extremely expensive deserts with no function because there are no users so we've got all this amazing infrastructure for marketplaces to develop an identity to be self-sovereign and it's all perfect but they're empty and why why are they deserts and they're deserts because identity is messy identity verification is messy compliance is messy supporting users is messy so nobody wants to take responsibility but fractal does we

Embrace this mess we take this responsibility and for those of us those of you that that don't know us like um well I suppose this is what we look like now and um uh we've been verifying identities for crypto companies for five years that's that's all we do that's all we've been doing since the beginning and uh we learned a lot in this process um and first of all we learned not to be identity maximalists we we learned that identity is not like something fun or something you know extremely pure and very very easy to systematize in code no identity is messy identity is about building bridges to meet space to real humans and that's the messiest thing

that there is so like you know instead of waiting and masturbating over like how exactly you're supposed to implement the ID standards we built and we built and now we've got a million users we are not a desert we're the only non-desert in fact and we did this because we have a pragmatic approach um like is are we completely decentralized no are our products perfect also no but we're live our products run the Spectrum depending on your Tech stack your ethos where are you in the decentralization process and because we did this we now built the community that we did and my point that I want to the point that I want to make

and I promise like I'll stop ranting in a second is that is this um crypto needs to grow up and it needs to grow period uh we need adoption and we need it is our responsibility to make it grow well and so for me identity brings much needed legitimacy identity making it simple and secure is how we onboard the next billion people into crypto and don't don't get me wrong I am not talking about identity as opposed to anonymity those are not in Conflict identity is a feature we have so much work in blockchain it's targeted towards anonymity thankfully who is thinking at the other side who is

thinking of what identity enables who is thinking of identity as human uniqueness for proper Democratic governance with one token one vote sorry with one human one vote instead of having the plutocracy of one token on one vote who's thinking about Fair air drops who's thinking about authentic nfts identity is literally civil resistance and um I'm really sorry about it like if you if you don't get it or if you won't get it you're not going to make it it is a very very powerful feature that will help us bring the next building folks and I know you know why we keep using the tools that we do because you know we're all working very hard in our car products we're all focusing on what we're trying to bring to Market and

identities often an afterthoughts and your users hate you for that because what you're telling me to do telling them to do absolutely sucks and we can do better today we're going to be in a much better position in 10 years but we're in a much better position today and we're not leveraging that and that is a bit of a shame and I want to show you what I mean um but I'm also kind of like calling on you to revisit how you're thinking about this and what you're waiting for before helping us push towards a world of more decentralized identity more self-sovereign identity where folks actually are in control the right side of the spectrum I showed you before so let me show you what I mean um I just felt like I really need to give you some context

now who are we we're the market leader for idv in crypto that's all we've been doing we are not a technology company I guess we are but like that is not how we think of ourselves we think of ourselves as like identity verification is important it is critical often folks have no choice to do it and well we also think that it sucks so we wanted to make it better since the beginning and that's what we've been working on and in the process we also discovered that you know what was the very beginning just really about kycaml because it was it was what we were doing is actually a much bigger problem and has much bigger utility in crypto because in crypto we're just addresses but humanity is how we coordinate what

makes us different is that we started from the identity verification part and we found a way to bring that to web3 Applications we essentially after putting together a bunch of very very pretty proofs of concept implementing the w3c standards working with the rc75 and 735 and nobody giving a [ __ ] we instead found a way that folks can progress in that direction without having to completely change the way that they're doing their business because identity in crypto is a lot more than just kycaml I was telling you before it's about Fair governance it's about Fair air drops it's about enable under collateralizing and enabling under collateralized loans it's about actually bringing the people to crypto that need to be in crypto and

whose identity is necessary to unlock what they want to unlock so the way that we approach this is we're it's a very pragmatic perspective on on the left side that's how we started we started we were a Federated identity provider I think log in with Facebook but then on the other side instead of having I don't know from some random information about a person you've got verified information people just log in then you can do a simple Standard oauth Process which every web developer knows and this has worked for a very very long time and this is all that people wanted and we wanted to push them towards well using a data wallet it's on the very right side of the spectrum we've got one built our users that use the data wallet get their credentials in their wallets they can they can create

um proofs from that information with Selective disclosure to only share really really what they need and whomever is verifying still knows that it was us you know how many people use that 50 000 it's ridiculous we're not there yet we're not ready for that yet apparently we have the product we'll maintain it'll make it work we'll keep trying to push people but what they want to end up when infrequently is the stuff in the middle and that is because as more and more people build infrastructure in web 3 and more and more of your backends migrate to web3 then it starts becoming extremely clunky to try and make a web 2 protocol like oauth work with that so how does your smart contract do oauth well it doesn't so instead of trying to like jump from the very left to the very

right we have a pragmatic Continuum a probiotic spectrum of decentralization and we try to push people as far to the right as they are comfortable going as their processes allow them to go and as their Tech stack allows them to go and this is a very straightforward illustration of how our of API Works everybody knows Federated identity you're like oh log in with fractal get verified with fractal or something talks about qic that's all we did in the beginning and so user comes back to the website and you're like great okay so your website now knows that this person you're selling a token for example you can do business with them how does your smart contract know that and like the collection of weird clutches and hacks that like folks that are Partners or

clients put together to make this work is insane um and um I mean I I've done that before I've ran a token sale and I had to pay six grand to like white list the people that could buy it inside of my smart contract this is absurd this doesn't make any sense but it's straightforward people understand it people use it everybody that has used the web knows what this is but this is incomplete and so we want to bridge the gap and make this more available for web3 and we put together something called the credential API these are not w3c verifiable credentials not because I have a problem with them but the opposite I think that they're amazing this is getting stuff to production quickly and getting stuff that works

today quickly so any user will connect your wallet or connect their wallet to your platform to your adap and you can immediately talk to us and say hey so you ask the user to sign a message giving you consent to ask if they're with fractal if we verify them already if we verify them to the criteria that you need a certain level of kyc or simply being a unique person and you get back a proof that you can send in their transactions to the smart contract so that your smart contract can always know should I accept this transaction or not your front end can immediately respond by looking at the status that this person has in fractal and because we have built it as a community and not a transactional service of identity verification your

chances are going to be pretty high because we've got a million users and about half of them are fully verified and the way that it works is super simple like you a user connects the wallet you ask them to send to to sign a message so that we know that they're okay uh sharing information with you and it's very limited information you essentially just know that they passed a certain kyc level or that they're a unique person or they're an accredited investor and they don't live in a country that you can't do business with for some reason all of this happens with the user's consents none of this is on chain now we have a different approach that some folks have been preferring lately uh and you know it's all full the trade-offs but it's the idea registry

are these w3cd IDs no why do I have a problem with them no but this is in production and the way that this works is instead of you having to ask the user to sign a message send it to us we simply white list their address on chain once for everybody so fees are on boards to adapt like the connector my mask you can immediately look up the registry and then if a user on ports to adapt then they're there ready for every other dap if your dog wants to do one person one vote they look the user up in the registry or somebody already put in there great awesome I can do business with this person or if your application is selling securities and it needs the user to be an accredited investor and

the application requiring that before the user is now in the registry this becomes a public good for any that building on this ecosystem because it keeps growing and growing and growing with more and more addresses that you're going to have to deal with without really telling you the name of this person or anything about this person if you're compliance if your use case is compliance there's a few asterisks here in which you've got other rails that you're able to use to pull any information for audits that you need but this is not going to be unchanged it's just not going to be available the point is the facts that you can do business with this user is available on chain and everybody can launch and read it today it's there and I don't want to go too deep into this but this is something that we want

to replicate all over we want to make sure that this is available on every chain so that wherever you're building your dap doesn't matter what a user used first if they have they're there ready for you ready for your token a click away and the fractal wallet is a simple credential wallet I'm sure a lot of you will be familiar with this um it is a essentially assigned piece of Json that you can then use to create sub proofs from the data so telling somebody you're over 18 rather than telling them your actual age and this this I love this I think is where we're all going to get to at some point but until we do I really believe in having intermediary solutions that we can use

today and the way that this works is exactly is you'd expect a wallet to work like you know you've got a website saying hey we need this information from you do you want to share it do you not we don't know about it we're not intermediating this we verify this user once like we don't know they're sharing this information with anybody else we shouldn't it's none of our business and they should be carrying with them should not be living in a hot server somewhere so I think that um my whole point is primarily we're all dreaming about how identity could be done in this new world of web3 and we're all building for a future that

is going to be here in 10 years and if our plan is until then to keep using the same shitty solutions that we use today we should really not be doing that and we should iterate towards it and we can help you with rates to iterate towards it because we have functioning Solutions in production that are much better than anything that you can use if the privacy of your users is important and if they use usability if your users is important and if you don't want them to do the same thing over and over and over again this is open you don't need to call sales you can just go to fractal.id set yourself up it will work try it out complain about what you don't like let me know

and I'll we'll figure it out for you but please try it out because you can and you don't need to pay that's it thank you folks let's make this a bit better [Applause] hi thank you uh the the one thing I can't figure out with ideas at some point there's somebody that has a copy of my Identity or video of the agent I verified with or whatever it's in some database right which is off chain and doesn't that become a massive Honeypot like in that case Are You The Entity where my real name and my real ID

is in some centralized database on AWS or whatever and yeah it's Turtles all the way down right like how how can we ever make that work that it's that everyone feels safe using it so um I lead technology at fractal and I need to be able to sleep at night and uh having hundreds of thousands of passports in a database connected to the web as we do you know I sleep well at night because I know the team that I have and I know what we built but like no that should not be a thing that is a gigantic Honeypot that is why we want to move to the right if you use the fractal wallet your data is no longer on mine it doesn't have to if you are not doing a compliance use case your date doesn't your data does not need to be stored even because the

only circumstance in which we need to store your data if you're using your fractal wallet is because AML regulation mandates that you as a relying party need to have access to this information and we tell our clients please this is not your core business this is not what we do let us host that don't pull it don't pull it don't ask us for it we'll put that offline and then if you have an issue we will bring that back online for you it's not like it instead of growing a Honeypot because it's connected to the internet and can be attackable we move data offline so that it can be properly protected and to serve the credentials API we can't do that these credentials API that we do I mean they last for 24

hours there's a bunch of reasons for that I could go into that we need to have that data online but we only need to have the minimum set that allows us to tell you Yep this address that you're asking about indeed matches the requirements that you have we don't need to have this person's name online we don't need to be contributing to a Honeypot and the further right we go the zero ER that Honeypot becomes I don't know if this answers your question but it's kind of how I see it it does the question then becomes if you no longer have the identities will the government still trust your mechanism yes because we will have the identities are just not online then I'm as well where they're going to be well they're going to be encrypted at

rest they are encrypted at rest and sure you always have the five dollar range attack but um they are not in a database that you can just throw your automated scripts and your other teams to try and take it down to try and get access to it it is not something that can be that can suffer a massive breach unless you know yeah the five dollar range attack on all of the people that would need the keys from to open this unlock this data thank you it's much harder nice shirts yes hello so thanks for the presentation lovely to hear more people

you know care about this I think we all need to do this so um just one short thing I would like to understand a bit more about you know what the actual proof is of you know like the verify the user and you know how where this lives and what is it I mean um what what kind of data is that so you mean the process that the user follows for us to be able to verify their identity yeah it depends on requirements so to tell human uniqueness uh we do something called liveness detection so you look at a camera for two seconds uh we we don't have that video we have like um a signature produced from that video that then allows us to know if you do it again are you the same person or not so

that's what we store and that allows us to duplicate you and for uniqueness use cases for say one person one vote use case that's all you need to do for fair air drops to happen that's all you need to do if your compliance case or if you have a compliance use case and you actually need to provide a lot more information than that well you provide a lot more information than that we take your identity document and we analyze it we take your proof of address and we analyze it if we're talking about investor accreditation we take for example your source of wealth documents and we analyze it but we don't capture this from everyone we capture this from the people that actually need to provide the information to unlock a service I am not a fan of kycaml I understand the reason it's there I think it's a very

very bad tool for what we're trying to achieve and it's throwing sand in our eyes but it's how we have to do things we don't really have a choice so I'm not doing this because I think well this is amazing and everybody should require a compliance for you to upvote and down vote no but people do require compliance and they should be able to do this in the way that affects the people the least nobody comes to us because they're like oh man it'd be great to share your passport my passport with you no it's something they have to do so how can we make this happen in a way that annoys the user's the least that protects their privacy the most and so we ask only what we need to ask based on the compliance requirements and whomever is looking for this user yes

so that's done using uh selected disclosure on the fractal wallet it's I can't tell you the mechanics of how that works exactly but you essentially take some basic information that is signed itself so your date of birth is signed and you can use your knowledge predicates to derive a very basic you know greater than function that you can also prove that it is signed by fractal or it's based on data that we were signed by fractal before thanks does that answer your question yes all right final question here as well yes with the fractal wallet that's how it works yeah thank you so much uh Julio this is a

great presentation uh I'm just curious I'm asking this for a friend who are from Australia who's uh not unable to attend the meeting but he asked me to ask this anyway out of the one million users I mean uh what kind of use cases are they really using your wallet to do because it's pretty processing fractal four yeah because you have pretty impressive 500 000 verifiable uh credentials and then maybe the second question full of that is how can you scale up from this one million to the next 10 billion whatever so well I mean thank you 10 billion would mean we're doing a poor job because there's not 10 billion Unique Individuals but I get your question um and the the user base that we grew

came primarily from a kyc AML compliance use case that's what we started by doing that's the whole reason we created the company was to make that process better so that user base grew for that use case a client wants to run a token sale somebody wants to sell Securities or somebody wants to have a system in which like you have a collection of unique accredited investors this is always what we've served and then in pushing towards web 3 we inevitably came to contact with new pain points in web3 so I think that growth is not really going to come from there going forward I think growth is going to come from people understanding that they can now make use of human

uniqueness as a way to build Fair communities and to properly reward your community for the Grassroots evangelism that you get for the effort that you get for product for contributions of any kind in your Tao and for that you will not necessarily need to know the country that a user is based on but you certainly don't want to drop the same airdrop to 10 addresses if they're the same person so this use case of uniqueness is also the simplest one the most private one the one that requires the least information I think is how things are going to grow and as regulation comes closer and closer to crypto and it will and it is already happening and you've heard that the travel Rule and like more and more folks well are going to have to bump up that human uniqueness say verification that

they did in order to now have access to something that clamped down by the law and so I think that uniqueness is the Gateway because crypto is about coordination and we're missing that layer we're missing the real way how we coordinate which is human beings and I think that that's what unlocks the gates um I think inevitably sadly or not depends on I mean I think it is um it is going to have to be denser than that and in five years we're going to be seeing a lot of more platforms having to require a certain amount of due diligence which doesn't identify one chain but it means that you needed to identify with someone thank you Julia thank you folks