foreign
[Music]
good afternoon
um
I'm here to talk about Spruce its
Mission sign in with ethereum and how
the concept came about its being and
especially where we go from here
this is my third time in this country
and I'm really excited to be in Bogota
and looking forward to exploring more of
Bogota
um before we jump into the all the fun
stuff about Spruce and sign in with
ethereum I'd like to give a quick
introduction about myself
I am anukriti Kumar uh I'm a product
manager with Spruce
um
before joining Spruce I was working as a
data program manager
um with an airline in New York City I'm
a computer science engineer so I
understand technology a little bit and
code a little bit as well
um I started my web free Journey
probably 11 months back and two months
back I took the plunge and started
working 100 in the space and there
hasn't been any looking back and I'm
enjoying every bit of it
so
and outside of work I love dogs and I'm
really passionate about them and my
husband and I we try to Foster one dog
probably every two months because we are
not yet ready for the commitment
so let's jump on to the fun part now
oh yes so Spruce um I'll talk more about
Spruce but it's a two-year-old company
and we are working a bunch of use cases
of data and identity
and that's the team there
um we are 17 to 18 people company and I
love working with these folks
okay so this is we are all this we are
going to cover today probably next 20 to
25 minutes so
jumping into the decentralized identity
where Spruce functions in so just giving
a quick background of what is
decentralized identity
so decentralized identity is an open
identity framework where you own the
data and it's all open and
self-controlled
um think of decentralized identity as
statements about reality and these
statements about reality could be on
chain as well as off chain and they can
range from anything such as where do I
live which university did I go to how
much ethereum transaction I made in last
one hour what doubt do I work for so all
they all those statements are
statements about reality in some way or
the other
and
I said that it could be on chain as well
as off chain and on-chain example could
be that an ethereum transaction happened
a signature was involved and if
something happens the ethereum
blockchain can attest to the state of
itself and of course it's fully
verifiable
and
the off-chain example could be
the second line is
it could refer to as a Json signature
and an ethereum address associated with
a Twitter account or a Google account so
but there's a difference between the
on-chain and the off chain as said off
chain is fully verifiable and there will
be cryptographic evidence for you to
prove that this is true whereas for off
chain if someone says my Twitter account
is associated with my ethereum account
it may or may not be true so
it all depends on who is making the
claim what evidence is being provided in
that statement and what how are you
interpreting that evidence of
um statement so for example if I give
you a driving license and you get caught
by a police officer and you show that
driving license it has no value so it
has to be given to you by a transport
Authority in the U.S we use DMV so DMV
has to give you the driving license and
only then it would be a verify
verifiable credential
so how does this happen off chain so
let's try and decode this diagram a
little bit so
what I I explained previously that it's
a trusted framework who's issuing the
statement and who is verifying it this
is what happens here so this
um this model is known as verify
credential model it is a global data
standard issued by w3c and if you were
to work in the decentralized identity
world you hear about this a lot so and
we like to call it at Spruce issuer
holder and verifier so issuer for
example could be a university and where
the holder completed their masters from
and the verifier could be an employer
who wants to know that whether the
holder actually completed their masters
from the issuer so in this case the
issuer will issue the credentials to the
holder which will live in holder's
wallet and once the verifier wants to
see okay I want to verify whether the
holder completed the masters from
particular University the holder will
send the credential to the verifier so
we want to move to a space of user and
wallet centricity where the user decides
what data to to share to be shared and
with whom so a small example of this is
you have these social media websites and
let's say you have a page there you have
100 people who follow you and 50 posts
and you have several likes on them so
that's one part of the data and then the
analytics are associated that few people
like every of your post uh one of the
reels got maximum engagement where does
this data live now
this lives on the intermediary or the
social media's website we want to move
to a world where you own all this data
the information and the data analytics
associated with it and hold it in your
data world
so
so this is this is what is happening
here
so today is you are the user the
application and the database sits with
them but we want to move Spruce mission
is to let users control the data across
the web and we like to think that
if platform instead of user going to the
platform and
resting all the control of the data with
the platform we want the platform to
come to the day come to the user and
access the user's Data Vault and that's
what's happening over there the database
is with the user
so Spruce
um we like to think of ourselves as user
control maximalist we want to provide
maximum user control to all the holders
of their data and we believe in
self-sovereign identity and that's where
we want to move to
okay so cue cue is signed in with
ethereum that solves a big problem and
I'd like for us to understand the
problem first the problem
not really a problem but what is
happening today the big login
so when you want to sign into a popular
service you will ideally a user idly
will use a identity provider which is
mostly centralized and has control of
all the users identifier
while they might come with a problem but
I think they also have solved for a
great user experience case in point a
forgot password I use forgot password on
a regular basis and I'm sure a lot of
people here but what if there are few
users sitting here and out there who
want to have the option where they want
to have the responsibility or full
control over their own data set and that
is what not happens with big logins as
of today
so we want to move from
not your keys not your crypto to not
your keys not your identifier or this
could be not your keys not your data as
well
so I like to do a quick thought
experiment really to the big login
um I have a Gmail account let's say
tomorrow I lose all the access to my
Gmail account what all will I use the
access to it's not just my emails it
will be everything that I use my Gmail
identifier with for me personally it
could be Amazon
Etsy uh Uber
Airbnb so I am giving a lot of power to
this another identity I'm at the behest
of this another identity which is
controlling a lot of my data and who may
or may not be incentive and aligned with
me all the time
but if it was Key Management I would
easily probably learn about key
management or deploy a key management
system and then I'll be able to control
all my data
okay so these are few factual points um
metamask has done a great job
um last it was seen that we have 21
million users that's monthly active
users on metamask but as of today we
just use the transaction the connect
wallet to do the transaction the
financial transactions and that's that's
about it
so how can we better do the connect
wallet part
and that is where sign in with ethereum
comes and if you've logged into your
passport site on Defcon you have the
option of logging in with your email and
with sign in with ethereum that is what
Spruce uh sign in with ethereum
compliant is
so a quick history of how Simon with
ethereum came into being
um I think summer of 2021 ethereum
foundation and ens Dao released RFP and
called for proposals on
and requesting for spec which included
reference implementation of JavaScript
and backwards compati compatibility mode
with open ID connect and oauth so that
people or users on the webto world can
also use sign in with ethereum
and this was right after the vitalik
stock at ECC where he talked about the
importance of identity and that is when
people realized there could be a bunch
of use cases with sign in with ethereum
there was a call of a lot of RFP
proposals and a bunch of proposals was
submitted and Spruce was lucky enough to
be picked up
so we developed sign in with ethereum in
the open on in public there were ton of
community calls it took seven to eight
months to develop these specifications
and the whole core libraries and we
worked with a lot of dabs with a lot of
wallets and you can go and check it out
it's called eip4361
um that's ethereum Improvement program
4361
and it's very close to be getting
approved
okay so how do you interact with the web
3 world today
um you go to metamask connect click on
connect wallet and you are there
exploring the web 3 ecosystem that's
about it nothing happens there you are
proving that you own the public key but
not verifying your identity
so connect wallet you are just proving
to be the account holder without any
proof
and that is where sign in with ethereum
comes so sign in with ethereum is a
specification that includes both
elements of identity and signing to
enable users to take full control over
their data using their ethereum profile
and ens profile and of course this is
all open source and that can be checked
out
so Siri has been going on for a while
um I think people have been trying to
work with authentication flows on
blockchain accounts since 2016 2017
and what we've done is we've
standardized the message when you sign
in with ethereum it's a standardized
message I can show you how it looks like
in a second and
sign in with ethereum was developed
heavily with Json web tokens which is of
course live in production and used by
billions of users
so these are the examples of what
happens as of today you see a random
nonce
um when you sign in or probably a random
hash which has no meaning to a webto
user or sign into my my website or
there's a there's a small message but
what we've done is we've given a
standardized message and a rigid grammar
which where there will be no malicious
statements can be injected into this and
we've purposefully made it that way
so
so basically we've standardized the
message to give the user a great ux
experience user experience but we've
also added few security features and one
of the most important security features
is domain binding so by domain binding I
mean when you're trying to collect to a
wallet and it says your wallet says that
domain for example example.org is trying
to connect your wallet the wallet will
now actually be able to see or the
wallet has the opportunity to check
whether example.org is an actual website
and the request is coming from
example.org this happens over a TLS
connection so the wallet can say with
pretty con with pretty much confidence
that this is not a phishing site an
example.org is an actual site
so
and this is this is the example of that
and the wallet will keep on popping up
messages give will give you messages
probably three or four times to warn you
that this is a phishing site in case
example.org is not what it claims to be
so that's how it will look like the sign
in with ethereum and if you were signing
on the Defcon app using sign in with
ethereum that is what it will look like
as of today
so as as mentioned before we've
developed Coe out in the open with all
the community uh with a lot of wallets
and devs and these are our initial
partners and we will be working very
closely with them in coming months and
weeks
so what Where Do We Go From Here Siri is
a basic library that will enable great
user experience and will provide
security features but we are trying to
work with on a bunch of products
um where
the data are can be brought in by the
user so you have Twitter account
associated with your ethereum account
and you can bring that wherever you want
to it doesn't necessarily have to be on
one side you want to go on uni swap you
can you can take your Twitter account or
Facebook account with you so that's your
bring your own data workflow and we are
also working on core libraries and some
products where Coe functionality will be
enhanced and um and being able to work
with wallets and apps very closely
so if I were to leave you with few
thoughts um sign in with in with
ethereum provides with you with a great
user experience so if you are a wallet
or dab you definitely want to use it
because it will help the user especially
a web to user get onboarded onto your
wallet or your dab pretty easily and it
provides security for the user as well
so you can definitely avoid the phishing
aspect and we are trying to build cue
and its components more so if you want
to work with us we build in the open
please reach out to us
um that's my Twitter handle or feel free
to reach out to anyone in the team we
are pretty responsive and we'd love to
work with you guys so yeah thank you
everyone