EB44 – Mehdi Medjaoui & Elie Chevignard of Oauth.io: Digital Identity in the Blockchain

Transcript

hello and welcome to epicenter Bitcoin the show which talks about the Technologies projects and startups driving decentralization and the global cryptocurrency Revolution my name is Sebastian cuccio and I'm Brian probably in crane so today we have with us um and um Maggie now you have to sit yeah yes pronunciation is perfect like for German it's uh it's easy to to say so it's a algorithm yeah so Ellie is the chief marketing officer of oh after Dayo he lives in Brussels and he's lots lots

of background in online marketing and maybe majority is he also works for oauth so the two of them are kind of in charge of that company and he's the executive director of oauth to Dio so Olaf and we're gonna go in much more detail what that is and and they will do a much better job talking about it but basically the fundamental problem is online identity and of course that's something that's you know everyone is dealing with every day you know whether it is uh through their email using their passwords login or Whatever It Is by using Facebook or other services there have been other attempts with open ID Etc and of course the promise now that a lot of people are sort of working on and especially the

two guests we have today is that we could use a blockchain to create a decentralized version of that and so we will go in detail into that today so it's good to have you guys on hey thank you so first Precision maybe it's always good to precise it's just like um the the company is called off.io and this is the name of the API that we provide uh it's a it's it provides a way to integrate uh off in minutes but we are not from oauth which is also a protocol in uh so nobody owns a protocol it's really like the service that we own is uh oauth.io and so in MIDI is a Founder yes and just for information we are also the founder of Epi days

conference which is conferenced on apis uh uh worldwide where we make Edition in Paris San Francisco Berlin Barcelona we go in Sydney next year and we will have a specific track on identity digital identity delegated identity and we will talk about all these topics next second and third of December in Paris so and yeah apis are very related to uh Bitcoin as Bitcoin can be seen as a way to make money programmable uh actually actually I had to talk about this last year and I guess that this year there will be even more uh crypto things related at API days because it's it's really about this so great yeah

you're right guys well thanks uh very much for coming on and uh you know we were talking about this earlier uh this is a topic that uh often gets uh doesn't get talked about very much in the in the Bitcoin Community uh there's so many other things that are happening with Bitcoin 2.0 but you know digital identity is uh I guess a a quite a wide a wide-ranging issue with a lot of people you know in and out of the of the Bitcoin ecosystem and uh and uh so you guys are doing things uh with digital identity and applying the blockchain uh we we don't do this yet like that it's just that we have this position of uh you know providing this off API maybe we would uh tell him more about about it what what it deals with like its

authorizations to access to resources and so we have this yeah this position where we question ourselves about the identity so when we saw Bitcoin uh coming out uh of course we got interested in Bitcoin and uh um the the more you look into it the more you see the different fields in which uh you know the Bitcoin uh model or the the the idea of a blockchain can uh can have an impact and so we just started to think about it and uh and you know read some things and just brainstorm um but we we didn't put out any products yet uh related to you know uh online identity decentralized or something like this but we have a plan when you love to think about an idea

it's true that the it must have some practical uh things happening maybe down the road but it's uh right now we are thinking about it and there is no I mean if you go off that I O it's really an API to simplify the integration of oauth with 120 providers or so it's it's not enough nothing about decentralized identity uh yet so let's take a step back and perhaps kind of phrase the the topic we're talking about here can you briefly tell us what actually is online identity and why is this important so so yes first before defining online identity I think we should Define identity which is the the main topic of the discussion um so a lot of people think identity is

about who you are and when you study a little about it on philosophy when you try sociology identity is not about who you are but what people knows about you what makes you recognizable and at the end is about what you share with people so identity is not what you are but what you share just an example uh just imagine you go buy some shoes in a Shoemaker shop for example and and you you come into the shop and the seller will just ask you okay hello what is your size and what the color you like and this is the data that you will share oh my SAS is 11. I like brown color and I want a casual side so he doesn't need

to know your name he doesn't need to know your address he doesn't need to know so many information and but so for him your identity will be exactly the information you share with him so he will just see you as a buyer that loves brown color that size 11 and probably that has a payment uh that is able to pay and probably Bitcoin in uh soon but just so identity is about what you share if you are friends you will share more than that you will share your first name I hope your channel your last name some stories some Secrets sometimes so time produce data right so you will share all these experience all these stories that will make this relationship with your friend if you are in a love relationship you will share more than

that more intimacy with your family we will share specific secrets that only the family knows for example so really what you share Define the relationship that you have with people so I your identity your relationship with people is with what you share not who you are or what you are so it's the first thing which is really important to to understand and that will explain in why since 20 years we don't make well a digital identity so is it clear about that so I identity is what you share that makes the relationship with the people you are talking about and not who you are you can this is why we can be really different people right and maybe you can see this trend in uh when you

look at Facebook that allows you to have different lists and you you share different things with different people because you don't have the same identity with these different people is it is it kind of illustrating the the trend yeah absolutely I think that's a really interesting way you think about it and to be honest I've never heard that definition of identity before that it's like what you share but I like that a lot and of course yeah right anyway you're pointing out this and of course you can share different things there's different people and you know right in Bitcoin we often talk about or like it's the founders Satoshi the guy came up with it he of course has an online identity but then he has a very different identity uh presumably with his family and his

neighbors Etc so yeah so so we are the same interesting teleperson but we are different with the people we're talking about and if we want to stay stronger we will with another people for example in the subway you we will not share data right we will just share maybe a hello or something uh but but yes and the more deeper relationship we want to have the more data we share and this is really important and it comes from digital identity right now because on digital identity you have really different layers you can be anonymous so you just browse the web actually are you really anonymous because we know your IP we know or some some information but you cannot even give your name you can be pseudonymous so pseudonymous so you just

give a name that this that doesn't represent you uh we cannot recognize you with this name but every time you will use this name we know it's the same people like a Bitcoin address is a good example yeah example like a Bitcoin address you can be self-asserted so you say I am this person so and people and we you will browse the web and registered websites with an identity you say you you have then if you go deeper you can be socially verified so for example your Facebook identity today is socially verified because we ask 200 800 friends to say okay this is the right person uh I know him this is a real name and and thing this is socially verified

and and all this delicated identity that we have today uh uh um always disconnects and social again is about that and then you have the verified identity so you decide to trust uh organization that will be the the thing that will verify but let's say for example a government with a passport with an ID a driver license this is a verified identity which is owned by someone that everybody trusts let's say for example a government but it can be you can play the role of a central Authority I would say just like a bank that you trust in a transaction you would have the this kind of central authority to provide the what we would

call a verified identity and so this is the old layer of identity you have uh on on the web uh from Anonymous pseudonymous self-asserted uh social socially verified and at the end completely verified and we and today application developers website have to manage all this layer of identity with their users and globally on the web so you were saying before that um it has not been possible or has been very difficult to create the online identity a digital online at any last 20 years I think you mentioned why is that so so today um we all the all the web has been based

on so the most important thing about identity is what you share that what people know about you for online identity you we don't see people face to face right so we need to have um uh something that makes you recognizable at every time what makes you recognizable is something you can you can be you some only you something only you uh own for example an object or something something only you can own um something only uh you can do if you have a specific skills we say okay it's only you or or something only you can know uh and and from the form from these all four things the most simple was about only you can know and we decided

to use passwords because you have one wonderful technology which is a brain which is the most advanced technology worldwide and and you have it everywhere with you but probably you have it anywhere you go so with something only you can know let's say uh which is stored in your brain you would be able to be recognizable anywhere on the web this is why we decided to use passwords but passwords can't scale with the number of service that we have just an example we today an average user web user is registered on more than 400 websites and applications

so 400 it makes 400 login and passwords to you have to remember so if for security you have a different password every time it's impossible to remember 400 passwords of course it's LastPass and things like that no yeah I was going to say this we have services that you know and companies are trying to develop services like that you know like you have apple keychain you'll get to it but um I guess but they don't seem organic you know they seem like they're trying to put a Band-Aid on a problem yeah I think that's well put and and another way to see it is that uh that there is a good um like the lead developer from Mozilla who was taking care of a Persona which was a project that maybe we'll get back to it he takes this example he takes a screenshot from a computer 25

years ago and you you still have this login password thing and when you think about all the the things that have changed in the last 25 years uh I mean you look at gmail today it's still this login password thing so how come that nothing happened something must happen and so yeah LastPass Etc you have Dashlane a kind of a solution but it's it's still very cumbersome I get I guess that we'll get back to it but uh yeah some sort of a reform of online identity because this is one of those things like you said you know 25 years ago we had exactly the same uh login system you know that may have evolved in a way that is now a bit more streamlined and such but I think for most people using a

service like LastPass or one password or or what have you it's it's not something that they'll do uh by themselves or you know that most people don't even know about it right and as meji mentioned it's the number of services that you use maybe in the 90s it was uh two free then five uh today it's maybe a hundred I don't know because each time you go on the website each time you look to an application you need a new password or a new uh login so one of the solutions that was proposed is the social login I guess but this causes other problems because you need to have identity providers so these are Facebook

Google and they just build a kind of Monopoly in centralized identity and and it can be very dangerous because you don't own it anymore um not being concreted in general when you think about Facebook uh it's okay how they distribute your identity they make some nice moves like you know when I was talking about the friends you can share certain things not everything with applications you choose what you want to share is the application allowed to post on your wall things like this but at the end even when they and we'll get back to it probably even when they introduce the anonymous login Facebook still has all the data behind and Facebook still knows

everything about you and and they are not even able to tell you everything that they know about you and your not able to have this information and this can be very dangerous of course because they take all the value from this data and you are just you know they are just harnessing your data and you don't get thing get anything about uh from it and you don't know where yeah you don't own your identity anymore and you don't really have this control I mean the control that you have is just a kind of a illusion I guess so let's not forget some of the dangers Associated to centralized online identity uh you know as you said the you don't own that because if you use a centralized ID service an open ID

service such as uh Google login or Facebook login or what have you you don't own that email address you don't own that Facebook account you don't own that Hotmail address uh if if Gmail shuts down they probably won't but you know you lose that ability to to have uh that identity with whatever services are using and on top of that I would like to say that's particularly vulnerable for identity theft because if anybody gets a hold of one email address or one Facebook account or whatever they now have access to all of your all the services that you're using that's why they work a lot on the on the security and and the other side uh of the coin I I would say is also imagine that you are an application and that you want to log in some users okay so you would you're

gonna use Facebook login because otherwise people just you know dump the thing and abundant so you use this and let's say you are a Facebook competitor somehow or anything like this they can shut down at any point uh the Facebook login for your app and decide that you do not respect that you don't respect the terms of use so it's it's it doesn't impact only the users it also impacts the whole ecosystem of applications so two small examples that every day's example so for example is data is identities about what you share just an example with friends right so you have someone who is your friend you share a lot of data but just imagine okay you're not you don't want to be friend anymore

with this person so what so you uh you don't he doesn't own the data that you shared with you everybody owns a copy of it he owns a copy he owns a copy as long as the relationship was alive then when the relationship is over he just doesn't have any updates from you but he keep a copy of the past data you keep a copy of the past data of the relationship but you keep your updates about the data today with a delegate identity like Facebook or Google they own the data only themselves the other user you don't own a copy of the data and actually you should you should it's the relationship right if it's a fair relationship everybody owns a copy of it like every

like every relationship in life and we should have the same the same thing but you can't no I mean you can make a request yes in case nobody does but it's possible nobody does I mean it's not built in I guess the the different things I guess that it I already tried I I did all the the things and I never received anything so you can like download some basic information your wall things like this and they send you a package but like all the information that they logged about you and this goes like even if you start to comment you start to type a comment uh with your keyboard and you erase it they just a lot of this also metadata right yeah everything like you cannot there is no way to have all the data

that they have so and even they give you this in a kind of raw format but what you should be able to export this data in a developer friendly application friendly format to go in another social network to learn another service with this data just an example with you know because with the Internet of Things it will be really really pushed uh in a in a really tense way just an example you know like Fitbit you know like a data tracker you know for example of course uh yeah I am so you have it if you have it for one two years and then you want to change the object so you want to change the thing right it doesn't want to change the value you don't want to change the the application the user the

the value proposition you just want to change the the hardware that makes it and if you change the Fitbit to a job on today you are not able to export your two two years history of data with Fitbit to a job on because Fitbit will not allow you to export it to to jobon directly jobon will not be able to make a Fitbit connect for politic reasons they will not allow you that so with the Internet of Things it will be harder it will be completely pushed uh uh forward because of that so relationship with objects will be will be more than relationship with uh with the social networks or will be uh with websites so users should be able to have a copy of the data and should be able to have a copy which is developer friendly

application friendly to be able to export it to another service or Hardware or application so this is why we begin to thought about Bitcoin let's say a fridge knows my identity okay so that I have a connected fridge that shops for me and at the end he knows my identity and what I like and I would never be able to change the brand of the fridge because if I change and take a new brand he would have to learn all over again and know what I like Etc that would be another example and I guess that you can multiply by the number of connected objects uh in the near future so on the identity layer I can understand you don't want to leave a relationship because you have passed with this person but in a business relationship I don't care about the path of relationship I

just want the best fridge the best uh wristband the best service you know so I can stay with my girlfriend even if we have done this some issue right now but from for the relationship that we had together but with a fridge I really don't care I just want the best and I just want to export my data to the right one that's I think that's pointing at a great uh really huge and great problem and I think it I totally agree with your assessment I'm curious though do you see any way you have any way around that because it seems like it is against the the business objectives of the companies to change that right as a fridge manufacturer you don't want you want to

have that data lock in because it makes it much but you want to grab everything you want to grab everything you want to centralize and you want to be a kind of identity right and the thing is like when you look at the web and the history of Internet uh all the protocols were built to avoid these kind of situations uh so um today of course it's a big Trend it's a big question but this is really the idea that we we have when when we think about uh you know using the blockchain uh for IDT identity management it's a way to really decentralize this and put back the owner the user uh in charge of his identity and um in a situation where he can choose what he shares and what he

says to someone and have the whole history and be able to manage this at in time so this is why this is why to to success for the long term we need and we need to keep the value we need to keep the value proposition the business value of the protocols the next protocol that we need to build for application for website everybody wants to be a platform everybody wants to be an identity platform because the the money is here so we need to help them to keep business value but we need to also to to give to the users to re-empower them to give them the ability to to choose exactly the provider the website they need or the application uh they want to use just an example you know open ID open ID the

first version of open ID users could be able to choose any provider to look to a website so I could look to let's say a game let's say let's take an example of Candy Crush if Candy Crush would use open ID I could choose Google or Yahoo or Facebook or anyone to to login but the the the game would not be able to oblige me to use only one identity so you you open ID enable that so the user had the choice it was kind of multi-centralized not decentralized but you have you you have the choice of our identity the net the last generation of open ID completely failed uh yeah uh because the lack of value because the

application didn't know what to ask you for data uh they didn't know from Google or for Facebook what data they could ask you to make a complete a better user experience then we add oauth so open authorization the protocol that came in 2007 say okay no you will be able to choose the identity of our users and ask the exact permissions you want from them and this is why oauth is the most used protocol today on the web for delegated identity because it keeps the value proposition when I'm Candy Crush and I ask you a Facebook connect and I ask you your friends list to publish on your wall to uh to publish uh to publish things uh uh for example on their on

your friends wall I have assets it's really business assets that I can have I have a lot of users I can reach a lot of people and this is why it has value it has business value so in just a second um but before we do that uh we want to talk about our uh our sponsor fairly so this is a new sponsor that we're working with a young startup that we're very excited to work with um Fairleigh is a Bitcoin prediction market and a Bitcoin prediction Market is a place where you can make bets on the likelihood of uh sporting events uh the Bitcoin price or other things like current affairs and if you bet correctly

well you may you make money right so you might ask what is a Bitcoin prediction Market yeah so the main difference between a traditional betting site and a prediction Market is that you don't bet against the house as it's called in the sort of gambling terminology or in this case you don't bet against failure.com but you bet against other people so you better match up your predictions are matched up uh with depictions of other people and it's it's like a peer-to-peer Marketplace in that way um and fairly unlike other sites they only take a small cut like a transaction fee essentially so let's start over to fairlay.com and

uh have a look at what betzer currently going on on just switch the screen here all right so so when we get to fairly.com you see the homepage where you can receive an overview of the predictions that we have currently going on so here there are features predictions you have new predictions and predictions closing soon and if you look at the top you'll see different categories you've got Bitcoin sports news miscellaneous we've got an interesting one in there we'll get back to in a second so if you go to a Bitcoin you'll see different tags and the tags are essentially just categorizing different types of Bitcoin events so we've got events relating to altcoins bitcoin news

um butterfly Labs you know some current events stuff like butterfly Labs or Mount Cox and so for example if you look at uh if you look at this one we've got ones with where the Bitcoin this bet is where the Bitcoin price will be over 400 on October 15th and if we look at that we've got 24 of people saying yes 78 of people saying no there's 40 predictions total with uh 323 millibits bet and a week to go so do Brian do you think that the Bitcoin price will be over 400 on October 15th well as someone who uh on I wrote a blog post in January and with my predictions for 2014 and one of them was that the Bitcoin price was

going to be at five thousand dollars by the end of the year obviously I would have to say yes it will be and um how much would you bet how much would you bet that the Bitcoin price will be over 400 on October 15s today right yeah a good question I mean um so it kind of depends on the odds of course that the site gives you so what are the current also thinks about four so essentially that means that if I bid a one MLB conon that it happens then you get four more so it of course depends on what I think is the probability of that event happening so if I think it's uh it's higher than 25 25

um then I should bet that um and you know I think there's perhaps a reasonable chance to do that so I wouldn't bet the house on it but I think it's uh it's it isn't bad to make where do you guys what do you guys think midi last to play I think in Casino so uh maybe yeah I think I think any will become the the new uh favorite client of pharaoh.com is that you're saying um maybe on my side I just I don't gamble that much uh you know I played it's during the crisis I made a bit of money and then lost and then made money and it takes so much time that uh I prefer to just have some Bitcoins and

forget about them and that's it so um I'm more Gambler that's it I'm a poker player uh some more Gambler and so I I would say I would say yes when people will know what we want to do about Bitcoin and identity the value will raise and now it's that's very interesting perhaps we can come back later it's an Insider market right um yeah then we could have some problems you know with the SEC Etc it could be no The Insider information is a is a can be a problem you know the law sure

so if we go back to uh if we go back to fairlay uh so if you look at that prediction you can place your prediction you can set the odds now if you're doing this for the first time and by the way you don't need an account to to to bet you can you can do it without an account you can do it as a guest but what if you're doing this for the first time I definitely recommend that you use the advanced form so if you click down here advanced form uh there's a help me button and that'll walk you through step by step uh placing this bet so How likely is this event you've got a nice little slider there where you can actually set the odds and uh how many Bitcoins you'd like to bet on that and then whether or not you bet yes or no

and so it's a bit more user friendly I guess using the advanced form it seems very uh intuitive like uh yeah my grandmother could uh stop playing with Bitcoin yeah definitely so just just for fun uh we uh we place the bet uh so if you go in miscellaneous and you'll see there oh it's still there no it's all over it's over so we had to place the bet on whether or not I'm sorry I don't understand why the yes plus the no is not 100 so yeah that's a good question

I'm not sure anyway we had placed to bet on whether or not we would have 500 followers by today I think that's probably why it uh it's not showing up anymore and uh yeah so uh they don't show bets that uh are fulfilled which is uh that are over yeah so I think I think uh you had bet three millibit coins uh Brian that we wouldn't have 500 followers by today and I I think I bet ten so I'll have to see whether or not I think you made some money but um yeah anyway so uh yeah if you want to check it out head over to australia.com so that's it's just basically the domain again f-a-i-r-l-a-y.com and you know sign up

you're going to give it a try maybe like it and uh we do want to thank them for their support of our show um so let's let's use this as a transition to get into the topic you guys are uh expert in and you guys are working on it which is oauth so can you explain how overall fits into that whole picture of online identity and the problems with online identity just because we evoked uh open ID in the oauth and uh so there were different versions of open ID but I guess one of the important things to understand is that open ID is about authentication so

this is what um with uh midi was talking about like uh yeah you would with open ID you are able to say okay this is blah blah blah this is him but you're not able to deal with authorizations and this is what oauth is about oauth is able to give access give authorizations and access to other resources and so open ID launched a new version of the protocol uh earlier this year which is called open ID connect but and that manages this kind of authorizations and is built a bit on oauth but it arrived too late I don't know if medieu you want to uh complete what I'm saying but it's just like to really explain the

separation like the open ID and or off and one is about authentication authentication and the other about authorizations yes so authentication is about verifying who you are so it's identification plus something secret like a password uh so this do you have authentication but then you have authorization which is authentication plus the the authorization the the permissions you want you want to allow to to someone so authorization is deeper is a deeper relationship and that makes more value for applications and more user experience for the users so by giving the permission I want the application can build on top of my permissions and make me a complete user experience that is better for me so and

this is what all of which now Powers Facebook Google search for a very good example I mean for people who maybe don't know about our office there are no more into Bitcoin or whatever it's it's really like the Facebook application that pops up and say uh can I access to your list of friends can I post on your wall and uh by posting on your on the wall it will provide a feature a functionality that is fun through a game or something like this all these authorizations are managed by the oauth standard but Gmail for example can ask your uh your contacts for example a Salesforce can have your business uh business leads and business contact for example so it's all about sharing and this is where the value you know if you share only your name just concrete

example but your name not everybody need your name uh your Shoemaker doesn't need your name so having the name only add authorization as authentication is not enough for uh for providing value for everybody and if we want to keep a protocol adopted we need to provide value for every everybody people that will implement it applications and people that will use it as the users so yeah so oauth bring permissions so a deeper relationship for digital identity and this is what it used today but oauth enables as Elise identity hubs on a technical level oauth is kind of broken a lot of people made their own implementation and nobody followed the standard so this is what our product is

solving on the technical thing but even on a business level it it makes these identity platforms and which is bad for the open web and for the long term so the web is decentralized and we need to have a decentralized identity and this is why Bitcoin is is here to because with oauth it is Facebook it is Google it is Salesforce which is the identity provider the the the the the the entity where everybody will delegate the identity to and you will have to depend on on them like if you are a developer you have to depend more and more on Google and on Facebook um I mean it's it's maybe maybe just to illustrate like um this is this story to show that The Evolution how Facebook

became an identity provider and how it's going to get even worse in the future is that imagine remember like when they uh were born uh at the beginning you needed an address at uh famous uh us or University or only if you had a an email address at harvard.edu you could get a Facebook account because it was reserved to the top universities so so so they were Facebook was like kind of verifying your identity uh to allow you to connect to Facebook today it's the other way around Facebook is becoming more and more the the service that you need to connect to some services and you start to see a lot

of applications that force you to have a Facebook and maybe if you click on the little link you'll be able to open an account with your email address and password but more and more they are forcing you to use Facebook and this is very bad for the reasons that we evoked just a few minutes ago um you know and even for the app developers because depending on the competitor can be very dangerous and uh I mean yeah so it's kind of illustrating like you can see Facebook becoming more and more an identity provider and at some point it could be even you know uh the government uh to provide the verified identities that midi was talking about Also earlier they could turn the government could

turn to Facebook and Google and say oh you have everything so now maybe you would be the ones providing uh official identities and verified items it is and you can see where the danger is because of all this information that they have so with the then what would be confidential what would be not uh Etc and the whole reason behind this is that the user doesn't own the the the the the data that he produced in the in his identity so we've defined we've defined broadly what identity is and and and how uh oauth attempts to kind of bring digital identity uh to everyone so how can we implement

what essentially you you say sort of broken because it is centralized and for many different reasons how can we apply the blockchain to that and to try to fix those problems so that you can take back your identity so yeah so so we we wish we we should replace Facebook on the identity level Facebook Google Salesforce and everybody else uh by the by the blockchain to decentralize it and be able to for the users to reown it so how we can do that so the the thing is uh now the discussion we have in team is do we need an altcoin do we need to create an altcoin specific to that like an asset-backed cryptocurrency where where the your identity and the value of your data will be the the the asset that

will back to the value of the of the of the coin or do we use existing the blockchain and existed coin existing coin like for example namecoin uh to be able to build on top of that the the the the problem uh for example with nemcoin is it was made for decentralizing DNS not for identity but for names and what we've seen is that identity is not about your name it's about the data you want to share with uh with the applications so we think we should make an altcoin uh we should we think we should make another coin so the the we have a a name about it which is a Elias like uh aliasana to for other names uh and we should make a null coin that will be

back this uh this identity so just how to do it on um on on the oauth protocol you have the user you have the application and on top you have the identity provider so now the identities provider will be the blockchain and every node every node every uh kind of wallet or every every client will be able to uh to check the transaction and to write into the blockchain every time you you uh you authorize a new application uh to uh to access to to some to to some data and every time you update uh data on a website it will be stored uh in the the in the blockchain so this does that mean that there was a trace of all that information over time

or can you uh Delete or remove some of that information say you give some sort of information to a website or whatever and down like you want to you want to get rid of it or not have that information shown anymore how do you how do you deal with that so we we will use we will use the the main feature of the the the the main feature of the blockchain we will use is the Unicity of the name because we need a name so we will uh keep it from from memcoin but we need to have encrypted data we cannot be it cannot be public like public transactions uh we will just use the blockchain as the authorization server so in oauth you need an authorization server that will emit tokens and this

token uh as inside the application and the permissions you have on the application so the blockchain will be actually just the hosts and this centralized host of the all the tokens and all the permissions that you have at the website because of the size of the of the data produced it cannot be in a blockchain as long as we have these techniques today because it will be so much data so the blockchain will just host all the permissions all the tokens and then you will be able to export all the data into a decentralized storage so it can be Dropbox it can be a Google drive it can be company store or it can be other blockchain like filecon Falcon for example or data coin that that wants

to decentralize the data so this is the the architecture that that we are thinking and building right now so in this case would a person have one Identity or would you have a different identities on the platform so always identities about what you share is just about what you share so you always so yeah so you will have kind of all the the all your data into a decentralized storage all your permissions all the the path to this data into the blockchain which will be uh uh uh encrypted and then when you will try to log into an application the

application will ask all the data they need okay all the permissions uh they want and then uh you will be um the blockchain will uh the the the client the the wallet of the of the blockchain will issue a token for you to access the data in your decentralized storage right so you will be able to ask in one time Facebook friends and Linkedin contacts and Twitter followers it will be not constrained into one provider each time you will not have to make three four clicks to export all your data you will be able to just in Only One login access to all the data you you have from your web services so so would you be able to

say for one website I want to give them these and these permissions but for another website it will be different set of permissions yeah the web the the each like oauth protocol each application this side the permission they want from the user depending of the relationship they want to build with them and the user of course has to prove that um what they want right yes exactly you have a like the auth protocol you have a pop-up that comes and say okay this application wants this this this and this and and be able to do this on your different services and then you will raise him or not and within two different websites so let's say you use

this to log into website a and also to website D would those two websites know that you're the same person so the if you if you sorry is the are the two websites from the same company or not let's say they are from the same company sure so if they're from the same company they know that on the first website they know the token right they know they issue the token with a certain type of permissions yeah if they or make a new website uh and they ask you a new token so they will be able to ask you permissions but they will be able to to know that if they ask at least one same level of permission that you are the

same users then you understand you will have a single sign-on experience because if they recognized because because let's say also they will be able to ask from what you give them back that this is the same the same identity uh I mean it makes sense to me let's say they ask for permission to see your Facebook friends and then you know two different on two different websites people friends like obviously it's the same identity right maybe an example would be like for example a service to store some like say some pictures you store photos on a service and so this company just stores pictures and at some point they launch a new service with maybe a new website or

set domain or whatever where they also launch a printing photo service and so uh what midi is saying I think is that uh even because they have the first token to access to your photos that are maybe hosted on either I don't know Facebook or Flickr or whatever they have this token to access these pictures so they could use it to just for the second service that they have they could use the same token because it's the same authorization and because it's the same company behind that's it yeah yeah that's it but but just to you what we call single Signum single sign-on is because at the end what we want to do that we want to keep value for application for them to keep

continuous zinc protocols but we want user experience right so as long as as a user you will have all your login uh which you which we which will be signed by your private key so you will have a better user experience because you will be kind of a single sign-on on the web on all the website that they've implemented protocol you will not have to type passwords it you will be directly logged depending of uh depending on the website so this is uh I'd like to stop on on user experience for for a second so this is an issue I think that with a lot of these Technologies we try to build a an interesting user experience for the final users how would this materialize in terms of uh an interface for for

users how would they uh use this to log into services so so the idea uh the idea is to uh with this is even to replace passwords so as you will just have one name and you will you will need to have your private key locally to sign the name to be able to be recognized by the website right so if you have an app or a program installed on your computer an app on your mobile phone uh which would sign with the private key yeah yeah so this is we have the same uh the same Challenge on that as Bitcoin is how to manage because from Jung or computer programmers or techies we know maybe we know how to manage we

understand how to manage private keys and things but for the mass for the mass because login and identities for the mass we need to to reinvent the the user experience on this it's also like because this private key is a single point of failure so right yeah very uh dangerous on the security side because it it actually gives access to everything and that's why even at when I'm like my Facebook example because Facebook is more and more like your online identity uh and it it rules everything and you can see that Facebook is more and more cautious when they when you log in from a place that they are not used to they would ask you some questions and ask you some pictures where you have to recognize so that's because there is a big

um a big stake behind and it's the same thing because if if you have all your data in this system uh that is stored in one place so by stealing one private key I would get access to everything you have to find the right mechanism to protect this private key uh you can solve this I mean you could use for instance of course you would have to have the hardware to do so and perhaps we're not there yet but you know for instance Apple uses a touch ID you know if you had some sort of a protocol where all uh handset providers were using a single biometric protocol you could use your thumbprint as a seed essentially here and it's just something to point out like this is I you know from a

security perspectives I've actually a lot more dangerous than uh Gmail for example because if somebody steals each email password you know you tend to be able to go to Google and tell them hey someone hacked my account I want to recover it or Facebook for example and then they can figure out from your friends Etc and uh right from Google for Google it could be actually if if you activated uh the two-step verification which means that you need your password and uh a kind of verification code that you get either through the app or by SMS then you don't have any problem when someone steals your password but this is the yeah that you need this kind of uh security but this type of security is in fact

recommended for absolutely everybody so I sorry yeah if I so there are two things that I briefly wanna well I guess another topic I want to come back to that you mentioned earlier but before that uh are you guys familiar with squirrel sorry um squirrel so sqrl uh yeah okay it is a extremely similar I think from the architecture it is essentially also a protocol proposed by the security Now guide is Steve Gibson on uh on how to do online identity and it works it's very very similar with having a private sort of a master public

a private seed and so so yes they're squirrel but you can also see for example one name or conveys you know one name yeah one name one name dot IO is a just want to be a a wallet for identity uh but they don't store the private key they say to you okay log into uh to Dropbox or Google Drive store private key yourself or conveys they say no we store the private key for you so we are now a bank of identity and and we are the trusted providers so I I think we should we should have different uh possibilities to to let the users okay do you know what is a private key do you know it's really important do you want to print it to store it in a really safe

place okay you can do that because you know what you are doing if you don't know you can trust us but at any time you have the right to uh to to to own it so we One Design doesn't fit all about about security and about identity uh and we we need to have this uh um uh this multi multiple possibilities for users to to know how they want to secure things right because the challenges are the same as just with Bitcoin wallets in general is that how can we secure things when we're so used to having these Central authorities that have all the security infrastructure and stuff which is closer an individual user to to to to have um what I find very interesting also uh behind this is the it's like you know a

lot of at the beginning of Bitcoin you had a lot of people saying oh Bitcoin is going to be great you because you get back in power and there won't be any intermediaries any gateways to access uh money so like you want new Banks Etc and today we see that for example you have coinbase in that if my mother wants to use Bitcoin and if we want to use Bitcoin uh every day uh to pay to buy some bread or anything in French buy some bread um we will need it we will need it we will need some kind of gateways that uh play the intermediary and and this is what coinbase does actually is that they secure your wallet and take care of this two-step verification for example they

they would force you to have this two-step verification that force you to have a receive an SMS and have your password and so it's exactly the same uh problematic when you get to the identity space I guess so um maybe having you in the beginning touched on the whole business aspect of this that you know there is a lot of money behind actually being in control of their identity there's a lot of lock-in of course it's hard to leave Facebook if you know you need Facebook to log into all those websites because you know that so do you think this actually has a chance uh or do you think that just the pressures against it and the whole economics uh speak against this yeah you have you

have many many problems I mean many problems the first problem uh business-wise is that uh you need people to store information in the blockchain so that some developers would just start using this kind of uh authentication scheme you see what I mean like if you don't if nobody stored any information nobody is gonna build an app that would say oh I'm gonna accept this uh Alias protocol or whatever because absolutely nobody is a no user will be using it that's the kind of classic chicken egg problem you need some users and you need some app developers on on the other side so there are many possibilities I mean we kind of uh thinking about it when you

look at one name which one name is doing this kind of thing um I I thought about it because for example when you look at your own newsletter like the epicenter newsletter that you send you know at the beginning there is like you can donate and there is this uh ugly string that is your address okay yeah so one name uh one name uh started like what they what they say well if you go on the website one name.io they say we would give you uh at least a bit name that people could use and and you can say like for example you would choose a epicenter as a username and this would be a Bitcoin address and they would uh create the right address behind and make

sure that the money gets uh to the Bitcoin address but you you would have a fancy uh uh address like this so so this is a kind of a smart way to start uh building a user base and it's very limited they're not gonna stay here but it's the kind of you you need to find some tricks to get some users to even if it's a very limited use uh to start to get and log some information on the blockchain right now for on on their side they are like using name coin and um but it's it's there is no magical solution and um you you can just feel the necessity to do it but there is no uh a clear path of how to get there yet so just one

thing let's let's think let's think big guys let's sing really big so just sharing just just imagine just imagine we have this I don't this uh altcoin uh Alias Bay which is which is backed by your identity so application will see value because if application are able to retrieve data for that they were not able to retrieve before because term of conditions of Facebook Google didn't allow that so they will jump into a protocol right on the user side if users re-empower themselves by by being able to re-export the data from Facebook Google into a decentralized place and to be able to be exported anywhere so there is there is an incentive with that but

let's imagine we pre-mind the coins let's say five percent to retribute the users to log in with the protocols or application to begin to to use it right so we and so we say every five percent of all the chain will be rewarded for not only the miners but the users the users of the protocol and the applications so we would be able to create an economy and and that replace let's so every time you will log you will share data you will have money because it's your data right and each time the application will will log you he will be right into the blockchain and he will be able to retrieve uh money right so is it just the whole

advertisement works today but replaced by just relationship and sharing data for a trusted relationship this is exactly how advertisements work you give them data about you so they give you advertisement and they break your user experience we would we would be able to have this consistent user experience you share that you wanted to share they log you with the data they wanted to ask you they earn enough money or incentive to do that we have an internet we found a business model for internet guys well um let's let's briefly talk about where are you guys at can we expect uh I mean you're working on this in some

stage at least right but yeah and you mentioned like you know some other projects like one name that IO that are trying to do something related name idea yeah as well uh worked on this uh ideas so so are you guys uh do you think you guys are gonna have a beta product uh at some point in the near future or is is it a project you are you looking for collaborators to work it's true now or funding we're looking for collaborators I reached the one name guys two weeks ago and and I think they they share the same the same vision of the space we need to be many people uh not only one startup can do that in my opinion uh but uh so so yes so we need the collaborators

everything is invited to work on that each API is conference we will talk about that but there is also typical challenges right uh the writing into the blockchain so now with Bitcoin it's 10 minutes every each block for identity and login you is too slow yeah it's too slow it has to be shorter maybe like Litecoin like two minutes two minutes news yeah for example so we need we need to up short a thing but it also implies security security uh issues uh uh we need to we need to solve the user experience so we thought about maybe a hardware why not making a Kickstarter with the ring a specific ring or a jewelry that that store your uh private

key for example so we need to hack on the user experience we need to hack something to make it completely Mass adopted there is also the username parking which is another issue so if I write into the blockchain your name for example Sebastian Couture for example or uh uh or a Brian Fabian crane for example uh so I would be able to store it and park on it so and then I will be I will send it to you so it's all there is other issue that we try to solve the blockchain that is used right now for all these things uh is named coin and the yeah name coin is a very fragile I mean it's not very heavy when you look at the capitalization it's just uh I don't know 40 or 50 million dollars and

the the price to register a name also is very low it's a few cents so it you would just uh you can just yeah block and squat cyber Squad so many names that it would be an issue as well so we need to find a price which is uh enough uh low enough for people to to see value and login for example say oh it will be my name for next 15 years on the web so okay I can spend some money that will give value for the uh for the the the the coin that will uh that will uh enable to to use it right so if you have a name at fifty dollars one hundred dollars okay it will give value to the coin uh behind but if the price is is not is not uh is too high they will not

register but if their price is too low people will park on it for example on name coin I think I've I took all the 15 VCS 15 20 VCS I wanted to reach and I have their name on name coin to be sure at one point I will be in contact mail them not blackmail but it's a good way to begin relationships right say oh I have your name on info and let's talk right yeah funding I have your name or name corn by the way so so yeah so we need to find a trade-off about the value that people see in it and uh and yes and not be and for people to to make them not able to park on many many names and this is what

name does so the name of name cons I think is valid only for 200 days then you have to renew it you have to renew it and it makes sense if you don't use an identity you're probably not the owner so so the more you share the more you share with identity the less you would pay the renewal so it can be an opportunity and can be an option but we need to find this value why not a Kickstarter why not to Kickstarter to say okay buy your name for for the next generation of identity on the web by your name right now and if we find if we enable them to buy the name with enough value miners application developers will find will show that people are ready to pay for that and they will invest times and and CPU and GPU on that I like this idea

that that identity is sort of has a limited time period especially online if you think if you all think about it you guys probably be using internet I mean so have I for the last 20 years and you know your the username you were using back when you were a teenager that necessarily isn't the same one you're using now and you may not use it in the future so that kind of idea that it that there's a limited time period to which you're using an online identity uh it's kind of interesting to me this is a very wide-ranging topic I mean there's so many things here in the show notes that we really didn't get to talk about and perhaps it would be it would be interesting to have you guys back on in a few months uh when you progress on oauth

yeah absolutely and um yeah thanks so thanks so much for joining us today yeah I think you need to come as well at the API days Paris Paris which is December so you are invited I mean just uh it's on December 4th 5th that's it we just uh changed the date yes it's a second and third second and third in Paris uh we able to have a bigger room and bedroom because of the the success of the the on the sponsor side and and from the the registration so we have a we will have a bigger bigger room yes if we've been Center of Paris and we will talk about apis identity and Bitcoins too

uh one thing I want to mention uh before we wrap up uh So speaking of conferences uh two things so uh as I spoke about uh earlier uh the Euro Bitcoin conference uh which was supposed to happen on October 8th uh is actually been postponed uh we weren't able to secure all the elements needed in order to have to keep the event on that date and so those of you who bought tickets you most likely received an email from me uh on Friday if you haven't uh get in touch with me but I expected everybody everybody will be reimbursed for those tickets for the next place in January for the next Edition you need to offer the possibility to buy tickets in

Bitcoin of course guys oh there is a possibility to buy tickets there wasn't when I checked I have I think we put it in place uh later on but anyways so the event will be happening in uh January rather than on October 8th and so we'll be issuing some uh uh press release uh soon to uh to give the new date and another conference so there's the btcgb conference happening on October 16th and 17th and that's in Brussels uh I'll be there I'll be on a talk with Richard catano and others on bitcoin marketing and we'll also be doing some interviews so if you're going to be at epicenter BTC and you want to talk to me to do an interview for the show definitely get in touch and we have a coupon code again that coupon code is epicenter and I think you get 15 off if I remember

correctly that's epis that's uh btc2b.org and that's on the 16th and 17th maybe I'll be around as well I don't know you're in Brussels right so why not yeah I I often move here and there but I guess I'll be around there okay well yeah again thanks so much for joining us today guys and uh yeah thank you for having us thank you for hosting us yeah so if you want to check out oauth so it's o a u t h dot IO although I don't think there's information on the sort of Bitcoin implementation no I don't know it's like but for now it's like kind of the off API that you would use

yeah but otherwise uh we will include the Twitter handles of our hosts in the show notes so um you know just uh check there and you know you can get in touch with them that way if it's a project you want to get involved in now you guys in the talk uh at the API days and you send me the presentation is that talk online somewhere can people have a look at that uh so if you go on apids.io you will be the homepage of the of the event but we're publishing the program on Tuesday okay how about we can include that in the show notes as well so it's a nice presentation and we can include a link to that so for those who are a bit more interested it's quite long and with a

lot so you're talking about the presentation that it important yeah yeah yeah is that online can people look at that uh no but I can put a slide online yes yeah okay if you put it on sideshare we'll include it in notes um and there is more technical details about implementations that uh just we could do a nearly by discussion because it's hard to show hashes and Bitcoin address uh only when discussing yeah yeah so thanks so much for listening if you want to support the show you can do so in a few different ways you can follow us on Twitter at episode BTC you can also donate some Bitcoins to us we very much appreciate that and you can do that at uh bitcoin.com tips and you can also

subscribe to news either which goes out every Friday um and that's that episode bitcoin.com newsletter and of course leaving us a review also appreciate it it helps new people find the show and you let us know what we're doing well what you would love to see on the show and where we can still improve so thanks so much for listening and we look forward to being back next week thank you thank you guys foreign