Privacy in Cosmos Live: Fraser Edwards (Cheqd) - Zero Personal Knowledge Ledger

Transcript

good afternoon um we hope you enjoyed your lunch and we are about to start the next round of talks uh the first one is uh from fraser edwards from checked so that's coming in hi um so yeah i'm fraser from checked um and we created the trusted data economy um and title of this is zero personal knowledge ledgers so did a bit of a riff on kind of the title of like today um but with a focus on how not everything needs to be on ledger um you can do things off and actually to i think it was anna anoma's like point earlier there's a lot of benefits from a privacy

angle um so this is us uh so probably key people to call out from here like myself and anchor used to work together at accenture um i actually led a project here with the dutch government doing digital passports using ssi and then alex also has uh studied here and did loads of ssi with with kind of um with the dutch government so uh what we'll be covering really really quickly um so ssi or decentralized id they're kind of used interchangeably some people hate one term some people hate another um they're fine um but kind of focusing on like what does it look like and then kind of how is it different to other privacy projects which may have been talked about today and then get

into kind of maybe what we're building and then hopefully a q a if we've got time um originally this was scheduled for like 30 minutes so we'll see if i can rattle for a bit quicker um so easiest way of saying ssid is just yeah not your keys not your data sorry not your keys not your coins for data um like when we kind of came into like the web 3 crypto space we kind of assumed that everyone would know what ssi decentralized ideas and we pretty much just found tumbleweed like no one knew at all um despite everyone having like this really big focus on anonymity or pseudonym pseudonymity and generally on like having ownership of whatever you're dealing with um

and this is kind of like shifting kind of how data is used at the moment to how it we argue it should be used and really the the big difference is instead of centralizing around organizations or companies you're centralizing around the individual so even though you've got the term decentralized id really it's centralized around the user um so following that whole like design principle of like user-centric design that's basically what this is um but the best way of really describing it is to go through like some use cases of how this could potentially work and what we'll be building and cool so um everyone probably in this room has been like hit by a scammer at some point or like been contacted like maybe by a fake exchange

maybe by like a fake bd rep um or maybe even someone pretend to be a team member just to try and like get keys off you um and one of the things that like we'll be into working with partners in the coming kind of weeks and months is actually like skipping past this whole like nfts for identity thing and issuing credentials out so they can prove it who like people can prove who they are but very much like not building this around like one central entity and not necessarily doing kyc so this doesn't need like you to register with a passport it doesn't need you to um kind of go through the like an onboarding process all it needs is someone with a reputation whoever that is to basically attest to who you are

so for us as a company the fact that we've been through outlier ventures base camp is like a good tick in our box the fact that we invested in by ignite is another thing we can point to and we can like prove and we can build up kind of reputation for both the company and the individuals who work for it without needing a centralized kind of orchestrator of all of this like a linkedin and the upshot of this is basically anyone can start proving who they are to each other without a central authority but also as we kind of get onto later on without having to write anything on chain like all of this stuff takes like uh takes place like above the top of the ledger um with really like only the core capabilities on the bottom probably a cooler example though is like

actually making gaming um kind of portable so like this is the ability to like purchase avatar shift them shift experience shift reputation and basically bring those between games or ecosystems or metaverses um so this could be like we we've kind of blogged about this a while ago but this could be something as daft as like the charizard that you grew up with and created across like pokemon red all the way through to the latest games and raised suddenly you can take into like super smash bros and it has like a unique character set but it's also something you've created and had a relationship with for years it also extends like being able to prove avatars match the real life kind of

person if necessary um like obviously a lot of people online want anonymity but we're also starting to see people where they are a public name um like they're well known they have a profile and they're gonna start presenting in the metaverse and they need to prove it's them who is doing it um so a great example is like some ceos or like bands blah blah are starting to do addresses in like metaverses and they need to prove that it's them and it's not a deep fake and not someone faking their voice and so there's kind of wrapping all this up again and providing like proof that an individual is who they say they are and have that ability and this is kind of um we published this before the eu kind

of position paper came out recently um but this is looking at like if you were to start adding on privacy preserving um kind of reputation or kind of kyc on to d5 and we know that there's people like t grade and others are kind of looking at this as well but what this effectively effectively allows for is like you can register get kyc'd and we've basically got this idea where um someone can spin up a pool they can set kind of entry criteria for that pool and they don't need to record really anything about the individual all they need to know is that they have passed certain criteria so in this kind of scenario you'd be able to have someone create a pool that excludes the us entirely so

they know that they would never need to worry about kind of the sec coming after them they may be able to set a policy where you have to prove you're over 18 you don't need to give your date your date of birth like your address your name anything but all they need to know is that you are over the age of 18 which you can kind of prove with a mix of like ssi which we'll be building out and also zero knowledge proofs which have been spoken about as well oh so if i go kind of just wrap these up like these were just a few examples of the kind of stuff that we'll be building but the kind of the bigger impact of this is like ssi across just everything so one of the best impacts that this is probably going to have is it should just

get rid of possible sorry passwords um like if you can authenticate to a strong level using data that you hold and do in a privacy preserving manner you can effectively eliminate passwords out um and we're starting to see like some of the bigger companies so um a vast antivirus bought like an ssi company recently um they're one the company they bought every name of one of our investors um and they're looking at like how they might build that into their wallet um and kind of that's very much like off in the future but like they've got such a scale that if they go after this they could just eliminate like passwords entirely and that also makes it like single sign-on

so um i imagine again most of people in this room have how to create like a huge number of accounts for various stuff recently i'm finding that whenever i go to buy anything even if it's once i'm having to create a full account now which is pissing me off no end um and it'll kind of basically get rid of that as well like if you can immediately register transact without having to enter all of your personal details like the user experience is going to be so transformative and i think one of the current frustrations i had was i had the ktdi demo on my phone um obviously don't anymore having left the project but like i've seen what this can look like and it's so slick like you it's very hard to kind of go back to the current world where like things are clunky you're entering your details all

the time where you've not had to before um so this is where we get kind of getting to the meat of it and like how this is different to some of the other like privacy and kind of portability projects that you'll see so this is where we're kind of contrasting against like that maybe the likes of secret network um and and kind of uh when i i can't remember who it was he was speaking about like um like tumblers that kind of stuff um and how this is a bit different so uh yeah this is the main kind of thing so personal data does not hit the ledger so um there are various different ways of implementing implementing ssi um but one of the kind of primary rule like aims that we go for is personal data just

shouldn't be on the ledger and it really doesn't need to be either so the whole point of this basically is if you're putting data on the ledger as someone spoke about earlier it's correlatable like you can start unpicking like who's writing when even if you can't necessarily read the data you can start tracking people across the network and if you can start kind of breaking the encryption if if that does happen you suddenly just expose a load of personal data that really didn't need to be there in the first place so that's where we get onto like what's called in ssi the trust triangle um and basically what this is doing is using decentralized pki which i won't go into too much detail on but like basically keys on ledger so that when data's issued and data is received like you can actually verify that data without any

any of it needing to be written to the ledger at all so literally across this you've got like someone issuing data to an individual that individual shares that data on the data was originally signed by someone and then the kind of person who receives that can go back and check that the signature on that data is matches who issued it they can check kind of the reputation of who issued it but they can also check that all of that data was kind of encapsulated encrypted and hasn't been tampered with as well and again all of this without hitting the ledger at all um and this is just in case anyone wondered what kind of a did on the left-hand side sorry yeah left-hand side of this was basically a decentralized identifier and kind of there's a really technical

kind of jargony thing on the left-hand side but a much easier way of thinking about it is like a car registration plate all it does is uniquely identifies the car and tells you who owns it if you eventually trace it up um but the key thing is like these are typically on the ones on ledger are typically companies or organizations they don't need to be kind of individuals and they shouldn't be individuals like there's no kind of need for that at all and there's some pretty major benefits to this approach um so one of the biggest things is much higher system throughput um so i think someone spoke earlier about like you can like horizontally and vertically scale um scale networks and the beauty of this is because we're

putting less on ledger actually when we do scale vertically and horizontally we get much more out of it because there's so much less less on there in the first place um the other part when we're kind of looking at stuff like ibc is um we get a lot easier interrupt with other networks even outside the cosmos ecosystem and that's because kind of the primitives on the ledger are so kind of much more simple than other networks say that you can actually replicate them across ledgers and because all the data is also moving across ledger as long as each one is contactable you can start routing stuff kind of across ledges that's one of the kind of core aims of ssi is across the entire stack having interoperability so

you're not locked into one provider we're not just creating like a different data silo to a facebook or google and probably the final bit is like the really key bit which is um extremely privacy preserving so like with no personal data on on the ledger like there are so like fewer attack factors for this like you can't watch like signing events on the ledger because there aren't any with regards to personal data you can't look at the two parties involved because that's not there like suddenly you're really restricted into like um you you've got to literally be either one of the companies or the individual involved in that transaction or speaking to them directly to get

anything out of them and that's one of the really really big focuses of like the ssi ecosystem as a whole like is eliminating privacy leakage like it's very much come from a like privacy focus like we want to get as far away from the facebooks the googles of the world and very much back into like giving people back that control and giving people back their data um and to focus on not on that kind of that last point again so drilling even drilling in even further like even though the data is going off ledger like you can still combine this tech with stuff like zkb so zero knowledge proves um so even when the data's off ledger you can still restrict the data even further

and make it kind of much more privacy preserving so um like a really good example for this and there are many where there's like this tech i kind of gave one in the defy side like makes sense um but for example like loads of people will have bought booze or cigarettes at some point and use their driving license or passport to kind of justify their age um especially when people are going into nightclubs like obviously you used to just flash an id card they barely pay attention to it and you'd walk in but now there's a much more focus on like people scanning them they're checking them against databases and all that kind of stuff and if you think about that all they really need to know is are you over over the age of 18. like that's it that you literally need to know that the id

matches your face and you're over 18. um and that's where this can get to like not only can you have the data rooting off ledger and no privacy blah blah you can also restrict what's being shared so you can really drive it down to just two pieces of data and not even kind of your date of birth so the creepy guy who's like or the bouncer on the door of the club doesn't need to know anything about you all he needs to know is that you're allowed in um so then in the final cut a bit i'll just move on to like what we're building and how it fits with kind of everything we've gone before so um basically like myself anchor and the rest of the team have been involved in various projects in ssi across like last four years

um like we built some pretty cool stuff with like a couple of governments like national health service a few others say um but the same thing kept on happening like everyone loves the paradigm like everyone loves the like privacy preserving side of stuff but the thing that was really holding it back was like making money like if you're gonna take data out of like a centralized silo that people monetize you have to replace it with something like you have to give some revenue that kind of chorus like covers it off um so what we repeatedly hear is like oh this is really cool the user experience is amazing how does this commercially work like how does this replace advertising revenue how does this replace like the service fees that i get

so we're focused on like building a a clear incentive model for the entire ssi ecosystem so the example here is kyc um but what we're effectively doing is like when that data is issued and whenever it's used there's going to be like a monetary value that's transferred and all of that is like pit it's blinded like no one involved like outside of the ecosystem can see no one outside of the transaction can see um but what it does mean is that whenever that credential is reused the person who issued it in the first place gets paid or the individual gets paid so an example might be if you use your passport um you can kind of get paid back for this um but the key thing here is really it

just incentivizes the entire ecosystems and our theory is basically that by kind of incentivizing these ecosystems you can start pulling all this together and start interconnecting them so data moves across um and really for us the the massive upshot for this is there are hundreds of thousands of these ecosystems um and yeah so it was the right slide so and this is maybe where we're slightly different to other projects as well so rather than trying to build like a vertical stack like we are focused purely on the network layer um and what that means is instead of trying to build like up into wallets up into like specific use cases what we're actually doing is working with like 30 or 40 of the ssi partners around the world to build on top of the network they already

have clients they already have use cases built out so we just need to make them more successful at what they're doing and then help them branch out into new markets so i think originally it was time for more questions but i just got the like we're running shot on time from agneska so i think we start and then at the point where i get tackled off stage is the point where we stop i've got one minute so yeah if there are any questions more than happy to answer if not that gets us back on time i think it doesn't work oh no it works okay so um

did you also look at you could also like monetize your own data with this is that also uh uh something you're looking at yeah yeah so um if i go back really quickly um you'll notice like there's a flow back to the issue a bit there's also flows to the holder so like we know that there are lots of companies focusing on like monetizing individuals data there's been loads of experiments with this and typically you don't make that much money like it's 50 quid for literally everything about you it's not a lot at the same time like there are definitely benefits to it one of the best examples we could see is like in um in e-commerce like there's loads of fraud tons of it and it's all basically

credit card fraud um and one of the things here is that like there are loads of um cashback sites where you get click-through revenue for going through ads like top cashback and and similar ones and you could basically do the same thing where if you do like you can use ssi to do like a one-click kind of checkout experience and at that point it's probably worth rewarding someone for one dropping your fraud rates as well as like simplifying and having less fallout in the checkout process so like it's probably marginal but it's still definitely worth doing um i think we're kind of not like going headlong into it so it's something we'll enable and probably the thing that i should

have said is like we're not dictating the way we're going to build this all out is effectively provide tooling across like across the ecosystem so we'll just build the tooling and then let the ecosystems in the industries and the clients figure it out so we're not going to specify but what you've described really could quite easily come around by someone just deciding to go and build it on top of the rails great question by the way thank you very much thank you fraser