Digital identities and the blockchain

Digital identities and the blockchain

BitID Identities KYC Passcard Synero

In the recent years there have been a few attempts at creating digital identities using cryptography and the blockchain. We had BitID using the cryptography behind Bitcoin for secure website login, Synero creating a decentralized social network where everyone owned their own identity, and Passcard allowing you to put your information into a blockchain. All of these are attempting to solve similar problems - creating a decentralized system of identities. An interesting goal for sure, but the approaches they take might not be enough to be a game-changer.

Related post - "Governments - do your job. Give us unique digital signatures!"

Value of disposable identities

When talking about online identities, we generally can put them into two categories - disposable and non-disposable. The first kind are cheap or free to create and don't carry a lot of value in themselves, such as email addresses, throwaway accounts and handles. We create them at a whim and throw them away once we're done. The second kind either cost a substantial enough amount of money to create, or they take a lot of time to grow, such as SSL certificates, personal social media accounts and similar accounts we tend to keep and grow for years.

All of BitID, Synero and Passcard accounts start as disposable identities, with the Synero network aiming for their users to keep their accounts long enough for them to become non-disposable. Even though the identities are essentially free to create, they can still be useful not verifying real-world identities, but for keeping a consistent online identity ("I am 1PiachuEVn6sh52Ez7o6Fymvw54qvQ4RBm and I log in with the same identity as last week").

Problems with crypto-based identities

While identities based on cryptography are certainly an interesting approach, there are some problems they have that traditional ways of logging into online accounts don't have.

First of all, there is the problem of keeping the private keys used for identity verification safe while at the same time being able to use them whenever one needs to log in. It's all well and good if you have your smart device handy, provided it doesn't get compromised, lost, stolen or otherwise becomes unavailable. You can keep your private keys in an online wallet like Blockchain.info, or perhaps some password-storing solution like LastPass, but then your security is usually dictated by the strength of your password.

Another problem with crypto-based identities is that they lack provisions for what happens if you forget your password or your account gets compromised. If your Gmail gets hacked, there are ways you can get it back. If you forget your Facebook password, you can reset it. With crypto-based identities, the problem gets harder. You could store your password mnemonic in a secure location and the protocol could allow for setting of some fail-safe recovery methods, but it is very unlikely casual users would be able to use these methods effectively.

Identities on the blockchain - no silver bullet

When I heard about Passcard, I was sceptical about the usefulness of their approach to put your identity on the blockchain. Since the information is publicly available for anyone to see and there is no cost associated in copying the information verbatim, at best this serves as a name tag anyone can write on:

As discussed before, such identities aren't too useful without some central authority to verify them. At that point, the system stops being completely distributed.

One could also ponder a similar approach with the data encoded into the blockchain being encrypted first. This way copying the data wouldn't be too useful since you would still need some key to decrypt it. If you combined this method with identity verification you could achieve some pseudo-anonymous identity verification, but it wouldn't prevent your identity from being leaked after the first time you decrypt it.

Conclusions

Identity verification and online identities appear to be following the bandwagon of "lets put everything on the blockchain and see if it sticks". While some of the approaches might be useful for some use cases, it is very unlikely we will see mass consumer adoption of such technologies in the near future. There are too many use cases that still need to be resolved.

Governments - do your job. Give us unique digital signatures!

Governments - do your job. Give us unique digital signatures!

government Identities IDs KYC

This week at Decentral Vancouver we had an interesting discussion with Gene Vayngrib, Greg Meredith and Katryna Dow (the full video of the hangout can be viewed here). We talked about the concept of decentralized identities - how people can build up online identities and trust to be able to conduct online transactions with unknown parties with minimized risk of scams. This later turned into a discussion of sybil attacks and how governments might actually be useful for something. So, lets start from the beginning...

Online identities - the current model

At the moment, online identities can be viewed as a collection of pseudonyms - it's rather hard to tell if say, ThePiachu on Twitter is the same person as ThePiachu on Reddit, etc. Similarly, it's hard to tell who this person is in real life. If we use OAuth and say, sign into multiple websites with Facebook / Google Plus / whatever, at least we can know that one entity is behind all of the accounts.

Now, why is any of this important? Well, a lot of online interactions depend on user's reputation. Everyone wants to know that the person they are talking to is the same person they talked to last time on a different website, etc. Moreover, this persistent reputation can be useful to determine how likely a person is to scam you. Building up years of online presence takes a lot of effort, so the person would only try to scam and lose the reputation if they could earn more than it would cost to build up another pseudonym. In contrast, an hour old account with no history is cheap to burn to scam, defame or troll someone online.

Decentralized identities

One could describe decentralized identities as a decentralized extension of the OAuth model. With projects like BitID or Meeco, we would be in control of our sign-in identities, just like we control our Bitcoin addresses. We can create an identity on our computer, use it to sign into some websites with our Bitcoin address and thus start building our reputation, similar to the current model. The only problem is, such identities would be vulnerable to theft. For example, if I go by the address of 1PiachuEVn6sh52Ez7o6Fymvw54qvQ4RBm and someone gets my private key, I can no longer prove that I am the original owner of this address, nor that I authorize a new address to be my identity from now on.

Moreover, there are some important use cases that this model doesn't solve. If anyone can create any number of identities, you cannot use those identities to do democratic voting, use them to distribute universal basic income to each person in a fair manner, etc. For this, we need to resort to what a lot of crypto-anarchists hate - the government.

Governments and unique identities

Like it or not, the governments (or at least some of them in the western world) do a few things efficiently. One of such things, is verifying that a given person is the person they are claiming to be. The first thing any company does when they need to verify your identity is to ask for your government ID. While they aren't 100% fraud-proof, it's pretty reasonable to assume a government can ensure:

• that each person has a unique number assigned to them
• the number is not shared between multiple people
• no person has more than one such number
• if the number ever gets stolen, it will be tracked
• whether the person is still alive or has already died is tracked with reasonable accuracy

Now, if we took these capabilities and stick them on some hardware device say like this one:

We can solve a lot of problems quite efficiently.

Digital ID - KYC for the digital age

How a Digital ID might look:

1. A government identifies a person and issues them an ID with a chip
1. The ID holds a private key, performs signature on request and dispenses the public key as needed
2. The ID is not wirelessly accessible (to avoid problems like this)
3. They will probably need to issue them the hardware interface to use this ID online - probably some USB dongle
2. The government keeps a record of the ID and the status of the person (alive, deceased) and the ID itself (active, stolen, replaced)
3. The government opens up a public API for anyone to request only the most basic data:
1. "Is ID X stolen?" - yes/no
2. "Does ID X belong to anyone?" - yes/no
3. "Is ID X valid?" - yes/no
4. "List invalidated ID numbers from last year"
4. The API responds in a cryptographically verifiable way
1. The response is signed by the government's private key - no other party can forge the signature
2. The response includes the request in question, validating that the inquiry was made (so the requesting party can prove they did their due diligence)
3. The responses are aggregated into some factom-like database on the blockchain, meaning that all requests are auditable
5. If a person ever loses their ID, the government will replace the ID with a new ID and record that the person's ID was changed and to what ("ID #245 got replaced by ID #9472")

Now, what good does this do? Quite a lot actually.

First of all, KYC becomes fully digital. No more ID scanning, photo taking, etc. A service like Kraken can just ask - "Please input your ID number here, and please verify your identity by digitally signing this verification text...". The service quickly learns that the person owns that particular ID (through challenge-response), and can take that ID to the government and ask: "A person with this ID requests KYC. Is this person in your database? Is the ID valid? Everything OK?". After a prompt positive response, the service is sure they have fulfilled their KYC requirements. If a government ever asks - "who is this person?", the service can give them their ID and the government will already know who they are looking for.

Secondly, identity theft is diminished. In order for someone to steal your identity, they would need to have access to your ID card. If your ID card gets stolen, you report it to the government and they will:

• give you a new ID card with a new keypair
• invalidate the old one
• keep a record of the change for everyone to poll

This means that any digital service can periodically get the list of invalidated IDs and cross-check it against their own database. If they match, the account can be frozen, or updated (in case the ID gets replaced).

Thirdly, any service that relies on globally unique real-world identities (such as democratic voting) can utilize this system to solve the problem of sybil attacks. Similarly, if you want to build communities of real people, not just online aliases (say, LinkedIn), this also addresses your needs.

Lastly, this also solves the problem of scams. If you are unsure who you are dealing with, get their public key, verify their identity through challenge-response, and if worse comes to worse, you can pinpoint to the police who was it that did you wrong.

Conclusions

While a lot of people might oppose the governments interfering too much with the Internet through the actions of NSA and the like, there are still good for some things. If leveraged correctly, the governments can help solve one of the hard problems in cryptocurrency - unique user verification. If implemented correctly, this can make the burden of following KYC requirements cost next to nothing.