Sign In with Ethereum

foreign [Music] good afternoon um I'm here to talk about Spruce its Mission sign in with ethereum and how the concept came about its being and especially where we go from here this is my third time in this country and I'm really excited to be in Bogota and looking forward to exploring more of Bogota um before we jump into the all the fun stuff about Spruce and sign in with ethereum I'd like to give a quick introduction about myself I am anukriti Kumar uh I'm a product manager with Spruce um before joining Spruce I was working as a data program manager um with an airline in New York City I'm a computer science engineer so I understand technology a little bit and code a little bit as well um I started my web free Journey probably 11 months back and two months back I took the plunge and started working 100 in the space and there hasn't been any looking back and I'm enjoying every bit of it so and outside of work I love dogs and I'm really passionate about them and my husband and I we try to Foster one dog probably every two months because we are not yet ready for the commitment so let's jump on to the fun part now oh yes so Spruce um I'll talk more about Spruce but it's a two-year-old company and we are working a bunch of use cases of data and identity and that's the team there um we are 17 to 18 people company and I love working with these folks okay so this is we are all this we are going to cover today probably next 20 to 25 minutes so jumping into the decentralized identity where Spruce functions in so just giving a quick background of what is decentralized identity so decentralized identity is an open identity framework where you own the data and it's all open and self-controlled um think of decentralized identity as statements about reality and these statements about reality could be on chain as well as off chain and they can range from anything such as where do I live which university did I go to how much ethereum transaction I made in last one hour what doubt do I work for so all they all those statements are statements about reality in some way or the other and I said that it could be on chain as well as off chain and on-chain example could be that an ethereum transaction happened a signature was involved and if something happens the ethereum blockchain can attest to the state of itself and of course it's fully verifiable and the off-chain example could be the second line is it could refer to as a Json signature and an ethereum address associated with a Twitter account or a Google account so but there's a difference between the on-chain and the off chain as said off chain is fully verifiable and there will be cryptographic evidence for you to prove that this is true whereas for off chain if someone says my Twitter account is associated with my ethereum account it may or may not be true so it all depends on who is making the claim what evidence is being provided in that statement and what how are you interpreting that evidence of um statement so for example if I give you a driving license and you get caught by a police officer and you show that driving license it has no value so it has to be given to you by a transport Authority in the U.S we use DMV so DMV has to give you the driving license and only then it would be a verify verifiable credential so how does this happen off chain so let's try and decode this diagram a little bit so what I I explained previously that it's a trusted framework who's issuing the statement and who is verifying it this is what happens here so this um this model is known as verify credential model it is a global data standard issued by w3c and if you were to work in the decentralized identity world you hear about this a lot so and we like to call it at Spruce issuer holder and verifier so issuer for example could be a university and where the holder completed their masters from and the verifier could be an employer who wants to know that whether the holder actually completed their masters from the issuer so in this case the issuer will issue the credentials to the holder which will live in holder's wallet and once the verifier wants to see okay I want to verify whether the holder completed the masters from particular University the holder will send the credential to the verifier so we want to move to a space of user and wallet centricity where the user decides what data to to share to be shared and with whom so a small example of this is you have these social media websites and let's say you have a page there you have 100 people who follow you and 50 posts and you have several likes on them so that's one part of the data and then the analytics are associated that few people like every of your post uh one of the reels got maximum engagement where does this data live now this lives on the intermediary or the social media's website we want to move to a world where you own all this data the information and the data analytics associated with it and hold it in your data world so so this is this is what is happening here so today is you are the user the application and the database sits with them but we want to move Spruce mission is to let users control the data across the web and we like to think that if platform instead of user going to the platform and resting all the control of the data with the platform we want the platform to come to the day come to the user and access the user's Data Vault and that's what's happening over there the database is with the user so Spruce um we like to think of ourselves as user control maximalist we want to provide maximum user control to all the holders of their data and we believe in self-sovereign identity and that's where we want to move to okay so cue cue is signed in with ethereum that solves a big problem and I'd like for us to understand the problem first the problem not really a problem but what is happening today the big login so when you want to sign into a popular service you will ideally a user idly will use a identity provider which is mostly centralized and has control of all the users identifier while they might come with a problem but I think they also have solved for a great user experience case in point a forgot password I use forgot password on a regular basis and I'm sure a lot of people here but what if there are few users sitting here and out there who want to have the option where they want to have the responsibility or full control over their own data set and that is what not happens with big logins as of today so we want to move from not your keys not your crypto to not your keys not your identifier or this could be not your keys not your data as well so I like to do a quick thought experiment really to the big login um I have a Gmail account let's say tomorrow I lose all the access to my Gmail account what all will I use the access to it's not just my emails it will be everything that I use my Gmail identifier with for me personally it could be Amazon Etsy uh Uber Airbnb so I am giving a lot of power to this another identity I'm at the behest of this another identity which is controlling a lot of my data and who may or may not be incentive and aligned with me all the time but if it was Key Management I would easily probably learn about key management or deploy a key management system and then I'll be able to control all my data okay so these are few factual points um metamask has done a great job um last it was seen that we have 21 million users that's monthly active users on metamask but as of today we just use the transaction the connect wallet to do the transaction the financial transactions and that's that's about it so how can we better do the connect wallet part and that is where sign in with ethereum comes and if you've logged into your passport site on Defcon you have the option of logging in with your email and with sign in with ethereum that is what Spruce uh sign in with ethereum compliant is so a quick history of how Simon with ethereum came into being um I think summer of 2021 ethereum foundation and ens Dao released RFP and called for proposals on and requesting for spec which included reference implementation of JavaScript and backwards compati compatibility mode with open ID connect and oauth so that people or users on the webto world can also use sign in with ethereum and this was right after the vitalik stock at ECC where he talked about the importance of identity and that is when people realized there could be a bunch of use cases with sign in with ethereum there was a call of a lot of RFP proposals and a bunch of proposals was submitted and Spruce was lucky enough to be picked up so we developed sign in with ethereum in the open on in public there were ton of community calls it took seven to eight months to develop these specifications and the whole core libraries and we worked with a lot of dabs with a lot of wallets and you can go and check it out it's called eip4361 um that's ethereum Improvement program 4361 and it's very close to be getting approved okay so how do you interact with the web 3 world today um you go to metamask connect click on connect wallet and you are there exploring the web 3 ecosystem that's about it nothing happens there you are proving that you own the public key but not verifying your identity so connect wallet you are just proving to be the account holder without any proof and that is where sign in with ethereum comes so sign in with ethereum is a specification that includes both elements of identity and signing to enable users to take full control over their data using their ethereum profile and ens profile and of course this is all open source and that can be checked out so Siri has been going on for a while um I think people have been trying to work with authentication flows on blockchain accounts since 2016 2017 and what we've done is we've standardized the message when you sign in with ethereum it's a standardized message I can show you how it looks like in a second and sign in with ethereum was developed heavily with Json web tokens which is of course live in production and used by billions of users so these are the examples of what happens as of today you see a random nonce um when you sign in or probably a random hash which has no meaning to a webto user or sign into my my website or there's a there's a small message but what we've done is we've given a standardized message and a rigid grammar which where there will be no malicious statements can be injected into this and we've purposefully made it that way so so basically we've standardized the message to give the user a great ux experience user experience but we've also added few security features and one of the most important security features is domain binding so by domain binding I mean when you're trying to collect to a wallet and it says your wallet says that domain for example example.org is trying to connect your wallet the wallet will now actually be able to see or the wallet has the opportunity to check whether example.org is an actual website and the request is coming from example.org this happens over a TLS connection so the wallet can say with pretty con with pretty much confidence that this is not a phishing site an example.

org is an actual site so and this is this is the example of that and the wallet will keep on popping up messages give will give you messages probably three or four times to warn you that this is a phishing site in case example.org is not what it claims to be so that's how it will look like the sign in with ethereum and if you were signing on the Defcon app using sign in with ethereum that is what it will look like as of today so as as mentioned before we've developed Coe out in the open with all the community uh with a lot of wallets and devs and these are our initial partners and we will be working very closely with them in coming months and weeks so what Where Do We Go From Here Siri is a basic library that will enable great user experience and will provide security features but we are trying to work with on a bunch of products um where the data are can be brought in by the user so you have Twitter account associated with your ethereum account and you can bring that wherever you want to it doesn't necessarily have to be on one side you want to go on uni swap you can you can take your Twitter account or Facebook account with you so that's your bring your own data workflow and we are also working on core libraries and some products where Coe functionality will be enhanced and um and being able to work with wallets and apps very closely so if I were to leave you with few thoughts um sign in with in with ethereum provides with you with a great user experience so if you are a wallet or dab you definitely want to use it because it will help the user especially a web to user get onboarded onto your wallet or your dab pretty easily and it provides security for the user as well so you can definitely avoid the phishing aspect and we are trying to build cue and its components more so if you want to work with us we build in the open please reach out to us um that's my Twitter handle or feel free to reach out to anyone in the team we are pretty responsive and we'd love to work with you guys so yeah thank you everyone