DIDs: An Ongoing Conversation

Transcript

hey everyone welcome to our panel um which is on dids an ongoing conversation uh my name is lauren feld i'm the head of growth at three box labs which is the team behind ceramic network which is a network for sovereign data before we kick off today i just wanted to get a sense of the audience and who we have so if you guys in the audience if you've heard of dids can you just give like a little round of applause if you've heard of it okay right all right uh and now give a little round of applause if you've heard of dids and you know what they are okay slightly less um so awesome that's uh that's what

we're here for does anyone want to shout out what a did is what does that stand for all right so did is a decentralized identifier and that's what we're going to be talking about for the next 30 minutes not only what they are how they're being used today in the industry but also how they came about and how we see them evolving so to start i'll just do some quick intros of our awesome panelists so first we have wayne chang who's the co-founder and ceo of spruce systems which is an open source y combinator back startup focusing on decentralized identity and decentralized data storage uh and then we have pele at the end who's the ceo of noda bene which is another identity project helping centralized exchanges uh deal with regulations using dids and

verifiable credentials which we'll talk about a little bit later and lastly we have oliver turbo in the middle who is a architect and standards lead at consensus identity and both oliver and pele were part of the yupor team which was one of the first decentralized identity projects in the ethereum space and all three of our panelists have spent time working with the w3c the openid foundation the decentralized identity foundation on creating these open standards so i think we're in very good hands today so to kick it off i'd love to just hear from you guys everyone talks about identity it's a super nebulous term what does it mean and why is it so important well identity is definitely not easy to

define and identity is not a just a specific thing and then it is something about us and how we present ourselves so there's a lot of philosophical ways of defining identity and it's often difficult because as engineers we tend to want identity being a technical protocol or a ens name or a email address or something like that but that's not an identity identity these are identifiers and we all have many different identifiers a lot part of our identity is not related to an identifier but it's related to how we present ourselves in daily life online etc yeah i agree with palace so i also think

that there won't be one single identifier that will define ourselves i think we will have multiple different identifiers in different contexts for instance i want to present a different identifier or identity in my professional work and i also want to separate this from other contexts that you i mean basically situations like uh you know my family banking gambling whatever it is i think it's very important to separate those and an identifier is really just it's not identity i identify as really something that can accrue reputation in a certain context

and maybe win before you go if we can just talk about how do you guys see identity being different in web 2 versus web 3. yeah so um to address the first question what is identity um the iso definition would have you believe that it's a set of attributes associated with an entity i think that's too narrow and just like what pele was saying you know too engineering focused i like the definition that identity is the way that we recognize remember and react to people and things it's extremely contextual just like oliver said you have a different identity you want to present different circumstances and you don't necessarily want to present all your data at once all the time like perhaps on a public blockchain but in web 3 we have the opportunity to start from identifiers that are

completely detached from any other information and gradually build up your information with your consent for a specific interaction right and that is an awesome awesome privacy model that is possible when we have uh cryptographically based identifiers uh and we don't start with an email that you're already highly correlated with and i'm really excited for that potential cool i think everyone here has kind of started to hit on dids but maybe we can just break it down and talk specifically about what is a decentralized identifier where did it come from like how did it come about and why was it so novel so so decentralized identifiers as a way of

or it's a proposal to to create a set of standards allowing people to start iterating of on essentially user issued identity and a decentralized identifier is just a very simple technical spec actually it's an extremely simple technical spec where you can go in and just have an identifier and that identifier could be a blockchain address it could be an ethereum address so it could be an ens name something else but it's just an identifier and the this but it's a way of look you can look up information about this identif identifier so you can look up public keys so an ident decentralized identifier it can

it can actually sign things so you can you can see things that are signed by an identifier you can also receive information so it's something that represents a part of you and this simply a blockchain address can very easily be used as a decentralized identifier yeah so it's a so did a decentralized identifier is a um yeah it's a w3c standard i mean it's about to become a official global standard i mean currently we're about to reach the recommendation stage and yeah so i did is really nothing else than a data model for any kind of decentralized identifiers so

ens could be also seen as a form of a decentralized identifier i a couple of weeks ago i wrote a spec that actually tries to reformat or like put enos names in the format of a decentralized identifiers you can use it um with did like bit based systems and i think that's very important if we agree that this will be like the unified format for things like that then we would all benefit from it because it would increase interoperability we would especially between systems that have been built the last couple of years in a decentralized empty space and the emerging stuff that happens in

the east serum space really quick wayne before you go i know you mentioned w3c i mentioned in the beginning but we're throwing around a lot of acronyms does someone just want to break down what is that so for the audience yeah so w3c is the world wide web consortium standardized html css the next data formats that have been standardized verifiable credentials was standardized in 2019 how do we sign a digital attestation about something it's not just restricted to the web 3 world but verifiable credentials is likely the global data standard that your digital diplomas are going to be represented in professional certificates vaccine credentials how do we do this in a privacy preserving way you know that's

kind of what we're all trying to think about and to decentralize identifiers i think to contextualize it it's very helpful to think about what's the problem that decentralized identifiers uh try to solve right and that problem is what if google rugs you what if you lose your at gmail account and uh how much access do you lose it's not just google sites right it's anything you ever use that identifier to log into it's kind of gone if a centralized identity provider decides not to serve your account anymore right so um what are user-controlled alternatives so we can transition not your keys not your coins over to not your keys not your identifier how do we build one that you control decentralized identifiers give

us a potential pathway there and that's why it's exciting awesome maybe wayne while you have the mic do you want to talk a little bit about some of the use cases for dids i know you guys are doing a lot of work around them just share a little bit about what we're seeing out there yeah so especially relevant to people here is cross chain identity how can we refer to blockchain accounts on different blockchains make references to other blockchains if you're on ethereum saying on this other evm chain you know that's the same account as my previous one if there's even a non-evm chain how can you make claims statements about that other account maybe you're a very successful farmer on

ethereum and you want to show people that you know you're successful farmer so you should give me better apy on another chain right decentralized identifiers can be a way that you have handles across these different chains to be able to assert yourself even in the metaverse with gaming use cases how do you you know take your experience items from one game to another game so that it travels with you not locked into a service that's really the ethos of web3 and decentralized identifiers are very aligned to that yeah so in the pure technical sense the use cases of dlds are i think discovery of public key information and service endpoints so you can give someone your

dide and then that person can resolve information that allows you allows the person to verify signatures generated from the did controller or even encrypt data to the dld controller you would also be able to discover certain services of the user and so ultimately the ids gives you the ability to prove control over that identifier which can then be used together with verifiable credentials which are more important to you know reputation use cases so verifiable credentials is actually more important for encoding that kind of data so for instance if you if you attended event like this you

would get a credential issue to your identifier and then in later on you can actually prove that you control that credentials you can show someone you really attended the event yeah i think i think one of the real important use cases as we're moving everything onto public blockchains is that verifiable credentials and the ids allows us to start building a way of talking about of associating off-chain information such as who we are what we do of in an off-chain way in a privacy preserving way and we can associate this to our blockchain

data and whether it's across blockchains or not and that's a really important part of it particularly because you know in the ethereum world we we often everything we do lives within this you know beautiful giant shared evm but we also need to get the benefit of the evm outside we need to tie things to the outside world and this is really where the verifiable credentials and the ids come in and it's really really important part of what the technology allows us to do if i just respond to that yeah totally agreed so one of my favorite use case examples is you know the the holy grail of a lot of web 3 networks decentralized uber

what if instead of uber taking a 25 vig on every transaction right you just pay the cost of computation to the protocol you're matched up and you're good to go there are problems with this model right namely you don't want to get into a stranger's car just because they pulled up after you send a transaction to a smart contract address for the next 20 minutes of your life or so you want to know that you're gonna be okay right and maybe you don't trust claims exclusively from other ethereum addresses to tell you you're going to be okay you actually want the department of motor vehicles or an insurance company to be like yeah that person's like you know they have a clean driving record they paid their insurance and they're they're good and they have reputation on the network those systems are based on like

cryptographic systems invented in the 80s like x509 and other like older systems and if you hope to associate some of that data to a blockchain address you're going to need interoperability you're going to need dids you're going to need vcs just like pele was saying awesome so yeah we're dropping a lot of different terms dids vcs maybe we can just break down verifiable credentials a little further and kind of compare contrast with dids and talk about the trade-offs yeah i'll start it off and keep it short but a verifiable credential is just signed json that has structure there are some other nuances and required fields to it like who's making this statement but you can think of a verifiable credential as a digital

statement about reality right and it's kind of up to your so-called trust framework or shared belief on how people interpret that the right data schemas to use and things like that decentralized identifiers and verifiable credentials don't need each other but they work well together verifiable credentials can completely work with an https web 2-based system that's fine but if you have a decentralized identifier you can use verifiable credentials to show that to make statements with your did so um and i'll hand it over to oliver who might be able to talk about how you might issue a verifiable credential out of meta mask yeah so they develop our credentials specification under nws3c so it's already a global final standard so it's

adopted by dybalas we see and a lot of people are billing on top of it and so the data model specification is super super flexible it allows you to attach any form of proof to secure the the json blob or the json deep blob to be more specific and because this proof you know is so flexible um you can even use your metamask or your eap 712 signature to um issue verifiable credentials through metamask so we can't be so we have um we have been working on a specification actually recently that would have allowed to do that yeah it's it's really important to

understand that in most cases verifiable credential is not designed to be able to be used on chain but there are these use cases where you can do it so what what what oliver is just talking about so there's some interesting use cases there that i think are particularly in good form for uh for ethereum where you could essentially issue a certificate of some real world aspect to your metamask wallet and then you could use that when you're calling a a smart contract and then essentially then the smart contract instead of checking a white list for example it can get real-time information from the real world

and you just tag that along as a token along with a smart contract call and it's a really really flexible way of of tying the real world to the to the two smart contracts but but it is really important and i think a very important thing for us in the ethereum world to when we're talking about identities and identifiers if we all if we're talking about a single global identifier which is what a lot of people use on ethereum you know you need to start being very careful about what you put on the blockchain itself but it allows us to do that put essentially very data minimized claims that you can put on a blockchain

yeah so we're talking about a lot of the benefits around dids i want to maybe go into some of the limitations so for example some people will argue that dids are actually re-centralizing user data um so what are your thoughts on that and maybe some other limitations around dids yeah so i think that it's important to remember that dids are just a data format specification it's just an identifier right like and it doesn't really try to centralize data or decentralize it for that matter it opens up a lot of possibility though so the the risk that a lot of people are pointing out is correlation risk which is a very important risk for us to understand right and correlation risk is

people being able to behind your back or you know maybe in front of you look at all your information figure out what interactions might also be you and get a fuller picture of who you are and maybe violate your privacy my favorite definition of privacy just to start with there is from helen nissenbaum it's privacy is being able to maintain appropriate flows of information right so you might want to be very public about it you might not want to be but that's the point it's up to the user privacy is not the same as confidentiality right so in order so a lot of the design goals should and this is probably a value that we all share should enshrine user privacy and uh figure out for the demographic what's

appropriate flows information for them and get them there and i think that if you're not careful about making this consideration you might end up building a system that correlates everyone's data and reveals more information about them than they anticipated and that's a horrible outcome and oliver maybe before you go um you know another limitation that people are talking about is around all the different did methods that are out there and that that's kind of leading to again a fragmentation rather than a unification around standards um i know you've co-authored a bunch of did methods so maybe you could talk a little bit about why that is like the need for having these different methods and maybe give some examples of some of the ones that you've co-authored uh yeah so the as wayne um already mentioned

earlier um so the drd specification is really just a data model specification and it's designed the way that you can come up with your own specific so-called dod method the id messer defines the crude operations for stuff that is in the did document so in the data model how to modify the data mount how to update the keys who are authoritative um to the dld and the controller and owner and stuff at service endpoints and so they're like how many 100 plus the id methods already registered um some people might argue that's bad but it's actually good because it shows the flexibility of the dids back so you

can really literally write a d id method specification for all kind of use cases so we there's even the id methods for that wrap ethereum accounts that wrap nfts assets and also ens names and certainly there are the id methods that do work unchained and off chain layer 2 is also possible so there actually not so many limitations maybe pele i know that you are dying to talk about ens um so maybe we can open the floor for that now i i know yesterday makoto was presenting and talking about um sign in with ens that

they're launching and ens is also emerging as kind of this other identity kind of standard out there what what are your thoughts on that where does that fit into this conversation yeah so i'm a big fan of ens but there is a very big problem with the way that the ethereum community is using ens at the moment it's become a cool thing for you to have any nest name as on your twitter profile and ens is not designed it's not a good thing to encourage people to use it as an identifier for people and the reason for this being is that you are essentially creating in web 3 something same as similarly dangerous as what we got through web 2. you're

creating a public source of data that everyone out there can go in and and analyze and do graph analysis on that's tied to individuals so i i'm a big fan of again a vns for business as services smart contracts all of those kinds of things but when you use it and when you're encouraging particularly new crypto users new blockchain users who don't understand how blockchains work to use ens it is a really irresponsible thing for us to do as a community and ens is great and there are enos dead methods and everything and ens has absolutely has its place but as a community as an ethereum community we need to take some

responsibility here and not create the next facebook just in a decentralized way because that's what we're literally doing at the moment and we have to stop this now do you want to respond maybe yeah so i'm gonna also add to that uh discussion so um at spruce we're working on sign in with ethereum with ens and the theorem foundation how do we have uh one way to sign in with your ethereum address uh you can go to login.xyz if you want to learn more or see notes but basically the gist is you know we want to be able to let the user sign in with ethereum as opposed to signing with google signing with

facebook and what pele is mentioning is a very important problem in that your ens domain and other data about your account can instantly be resolved once you do this that's that correlation risk we're talking about and i think the demographic he brings up is basically the most vulnerable demographic new users who don't understand the implications of their actions it's all about use case it's all about user expectations and if those expectations of how their data are used are met or not right so if a new user you know buys a nft and puts it as their twitter profile picture and doxes themselves links their twitter account to their address right they might have had the expectation that oh no one can do that i'm just showing

my pfp but uh hey their expectations were violated right so i think what pele is saying we have to do a better job as an ecosystem to educate the different trade-offs we're already starting to see some of this take root where a lot of people are having a public presence account that you're okay you know sharing to everyone else everything in that account is public and associated to a real identity you might have other accounts that you use more privately that you don't expect people to know about and you have to take extra precautions to achieve that privacy so the ux for that isn't great right now and there's a lot of work we're going to do to improve on that but i think it's critical if we want to protect new users especially as mainstream adoption happens to prevent a privacy catastrophe so i agree largely

maybe just a quick aside because you're talking about nfts and bringing web 2 users along so a lot of people are talking about using nfts to add reputation and semantic context to dids what do you guys think of that is that kind of just building off of the nft hype is it solving a real problem yeah so i think that you should always consider uh maybe not doing an nft for data around a user right i think that's the safe assumption think about if you have the information in hand where are the places that you would want to present that information that the user would want to present it because as soon as you put it as an nft it's kind of out there forever and always if you believe in the longevity

of blockchains right so that's a very important consideration to take your your first reaction should not be let's grab an ft for that to represent data about a user uh definitely not personally identifiable information that that is just don't do that yeah i think for many use cases um so currently there are a lot of po-ops i also received a pull-up today for attacking this conference i think a lot of those reputational use cases i think it's really not important to always show that you own that on chain i think in many cases it's just okay to present those uh that reputation completely off chain and for those use cases very far potential

make total sense um i mean i am you know i do like nfts for certain things but is it really the best choice for you know um representing your identity i don't know i mean there are a lot of privacy issues that i can think of i think i mean it's totally possible today to create an nft where the owner of the nft is like a specific ens name like a sticky evil malicious nft and then you would have that it's basically like bad reputation that you would have forever i mean problems like that appeared on facebook a long time ago where people got mobbed by other users

and when if with nfts you would have something like that forever on chain and then i think that's a risk people would need to consider so again i'm not against nfts i do like them but um we need to take care that there's some privacy implications maybe pele just to switch the topic i'm looking at time one thing that i think is important that we'll cover is just your thoughts on whether ethereum wallets will in the future support dids and verifiable credentials and just talking about you know does that open up any new use cases what does that look like if they were to do that yeah i mean i think it's really important for the ethereum community to start adopting this technology because it really allows us to to

build for example build tokens d5 protocols whatever kind of things that we want to build on ethereum but actually tie it to the real world and it's not always an easy straightforward way of thinking about it but we're building this new technology just like it's you know when people are starting building d5 protocols there's a lot of learning a lot of mistakes to be made right and that's the same also now we're trying to tie these to the real world and there's a lot of really incredible opportunities out there um like we we're using the ids at my company every day for for enabling crypto transactions for between regulated entities and it's a great way for entities to be able to communicate

between each other and and make sense of a particular transaction so that's a real world use case that we're using it for today and there are lots of other interesting things happening like the european union is rolling out uh this guy's involved with it uh rolling out um the ids and verifiable credentials as new identity methods within the european union maybe i'm just looking 30 seconds left if each of you guys just want to give a 10 second what will we be saying about dids a year from now my hope is actually that the dods will eventually be adopted by crypto wallets ethereum wallets and would um actually be used for cross

chain identification um that's my hope it will also require wallet providers to add support for them yeah um our perspective is that we should just try harder to meet the community where they're at and you know if you already have an ethereum address well check under your seat you have it did you know and go from there and work out signature suites that work with the signing that we're familiar with in ethereum so i think that will demonstrate uh some really great utility to the ecosystem right away and we'll be able to adopt even more sophisticated forms of identity with better features we need lots of debts everyone should

have hundreds of thousands of debts out there and i think that's what we're going to see in the future awesome thank you guys for joining me up here thanks you guys for listening in the audience sorry we don't have time for questions come find any of the panelists if you want to chat after