Is it owned by a government or an organisation? Is it the same in the digitalism and physical?
How do you experience it? I don't know anybody who has had their identity stolen or you
know anyone who has had that identity stolen. What does that actually mean to have your identity
stolen? And is it possible do you have multiple identities?
I think we're probably I think all of us in this room agreement that something anyway is currently going wrong with identity
But we're seeing the identity and the way we use identities in the digital domain are a key sort of source and resource for
errors, fault, fraud, but also confusion. So if we see you know the amount of passwords is massively rising to all of the different services that we log into
But also the amount of emails and spam emails and how these are used to actually gain access to identity so fishing attempts
I like to go through all these but one of the things is also important for us to think about is is it just people individuals of identities
but what about things and the things that we're interacting with in the physical domain and what is that bridge between the physical and the digital?
With all of these things that are increasingly going wrong and increasingly causing an impact on different groups
particularly vulnerable groups we talked about people who don't have maybe digital literacy but also elderly targets
We also see children a lot of children having their identity stolen as well
So we're part of a group of community, disposal identities community at the end I'll put up the links so you can join this open community and join the discussion
But we believe there's a need for a fundamental change in the way that we think about identities
So quick diagram here so current identity models very centralized so federated identity it means that there are organizations who are
Managing
Possibly owning controlling our identity across multiple services, but also gives an ability as we know to track
And trace and surveil what we're doing across multiple services
Self-soven identity takes this from the centralized perspective and architecture to a decentralized
but also giving the agency in the end users control
But the challenge here, and maybe a disclaimer here, I'm not a developer, I'm a UX trained product owner
So I'm kind of the advocate for the end user
What we're looking here is asking people to completely change their paradigm of how they interact with identity
From this rather easy, possibly lazy centralized to a decentralized where they are responsible
But we'd like to move it to a disposable perspective, disposal identities, where by depending on the context
Depending also on the timing, I actually have a completely different identity
If you think about this, it's something we also do very much in fiscal domain
And in the social domain, why are we not able to do this effectively? Why is it not facilitated in the digital domain?
How many people have more than one email?
How many people have an express? I call it like a junk email or spam email that uses organizations you don't trust
Okay, so we're already kind of doing it anyway, so we believe that actually in the development of the digital identities
We need to facilitate this ability to change our identities and only share the information, data minimization
That is needed for that interaction that transaction
And it's based on a theory, Rob
Which is formed the base of our community
Well, thanks, yes, it's not so much, I would say theories are big word
You see the spider in the middle and basically what I've always noticed is that all the threads
They sort of move to the spider, so basically in the world that we live in now
We have all these entities and services that basically label to look at us
And the idea is to turn that round so that the spider basically determines which type of information goes to all the other entities
So from self-suffering identity, we'll be able to generate disposable identities
And I think that mainly for about 80% of transactions
We simply have to send a token payability
So for example, if I rent a house and if I need to pay an energy provider
All the energy provider needs to know that I can pay
There's just very little else that he or she or the entity should know
They're just one of my money, sort of
So I can send them a token payability that I can pay
That's all, that's all they need to know
And this goes for all the other services and entities as well
And so I can basically go through life
Having good relationships with all these entities
Which they basically don't have to know who I am, what I am, where I'm from
They're just one of my money that just needs to know that I can pay
So I send them this payability token
And in the token of course there's something that can be unlocked if I do not pay
If I breach the contract, they can find me which is kind of logical
Which is very enough, but basically that's all that they would sort of have to know
So that's basically this idea of disposable or ephemeral identities
In a more positive sense we can say ephemeral identities
In a more urgent sense in which we are now in which we are so much sort of under the looking glass
It's good to speak of disposable identities, so that's what we do
So with this, it's not really a theory, we can make it and make it a theory with this idea
I hand over back to you in Lorna
Right
Yeah
So one of the things that we see is that with identities
There are multiple different perspectives on how we look at identity
And also these are driving the way that we're developing the solutions
And we see it in a moment predominantly
It's being driven by the EUDI of
We have to be compliant if we want to be sort of interoperable and working across all of the different countries in Europe
We're seeing also the development of technology
But I'd like to sort of also discuss here about the need for a social cultural perspective
As well to sort of help drive back towards the more legal and economic perspective
This seems to be driving development at the moment
So use experience perspective
A community, maybe a little bit of history
So our community kicked off very dynamically in the pandemic
Where we had this realization very early on in March of the pandemic
That it would be really good to have a much more privacy security
To support with the services for example with the tracking and tracing and vaccinations
The group got together, we had different groups, UX team, tech team, dev team
In the UX team we started doing scenarios
How is this going to be implied?
But we actually came to this realization when you put it in the real context
There was a danger that although we would provide this autonomous private solution
That actually we would also be creating the opportunity for another institution to block people's access
So for example if you don't have the QR code to show that you're not infected or that you're not vaccinated
Then your access to services and locations could be blocked
And we decided this is not what we wanted to contribute to
So we stopped development and as we all know that kind of started happening
So we could see by using the user perspective what would actually happen
So although we have the intentions of giving control to users and decentralized way
You have to look at the context at how it might be developed
So but we didn't stop there, we decided to continue to develop this into use cases
We actually set up a foundation, it's a non-profit organization twins
And we're developing an app called twins connect
We've developed the first solution
And we're now in the process of further developing it for open source publishing
And also to ensure that it's actually compliant with EUDI off
And the idea is that we have this app or this agent, this manager in between us and our services
You could call it a wallet
But we have, we want to call it something else
And actually the focus is not about managing my identities
But it's actually about managing my relationships
Which are to do with identity and data
So at the moment there's a lot of focus on identity
But we see that actually the purpose is to identify myself
So that I can transact with you with different data
And I can actually then trust that you are who you say you are
I can trust that you are going to use my data in the way that we've actually agreed
I can have contracts under my control that I can actually revoke
So there's a lot of different needs
And we have to test it with users and when we sort of ask them
These are the kind of things that we're building
It seemed to make a lot of sense and resonate
Much more than the story about having verified credentials
And the self-sovereign identity
So at the course of these are the properties that we are building
So basically there's disposability
And this could be set on a time-based
So when I take my pet to the vet
Only in that time is that information available
But once that point is over
The vet doesn't need to store or have my information
Verifyability
So there needs some in many cases where the risk level is increased
How can that be verified
Also the privacy and particularly the transparency
So we're talking about the GDPR consent controls
Why is that not in my control
And I can actually see who has access to what data and when
Number of use cases I'm not going to go into that too much now
But so we've got a lot of these QR codes
These are credentials
If I have my phone in the physical domain
But this credential saying that I am above a certain age
Or I have the payability
Or I have the credential to drive a car
How do you know that's me?
So when we start looking at in the real world
How am I actually going to verify that this QR code
This phone is mine
So there's a lot of these things that when we start putting it into the physical domain
How does this actually bridge between the physical and digital
So who can you trust and how do you trust them?
What can you trust when it comes to credentials and data?
But also how do we actually build that trust?
That's one of the things that we're working on
And also really is this trust worthy from a user perspective
And I'm going to sort of finish here on my perspective
I want to throw into the room
Can we stop talking about wallets and can we stop
Actually walletizing and commoditizing identity
From a social cultural perspective
I think this is really actually quite dangerous
And we shouldn't be going that way
Because it's a mental model
And what it is is actually it's driving us towards a very transactual
And very commercial perspective on identity
And I don't think that that's what identity is
We don't think that's what identity is
But at a social cultural perspective
Should actually drive us towards designing
Actually mental models and actually in solutions
There are much more sort of fair and social and sustainable
Our approach is towards relationships and connections
Where we build up trust and in that trust
We actually are able and enabled to share our data
References and psychology references in computer science
Which I think back up this perspective
That we as humans I think is a human right
We should be able to operate in the physical and the digital
And the legal domain with multiple identities
So I put a skip past this and so we've built the solution
I say that's not yet published but this year it will be
So join our community later the link is going to be on the screen
But it actually has dyeing technology inside so I'm going to hand over to Andrea
Thank you for now
Well I believe this is for the walletizing song
Only because I speak loud nothing happens
Alright Andrea
I wear two hats
One of the non-profit foundation dyeing org
And one of the
For-profit BV call forpome
We come from long history of innovation
In 2000
One of my co-founders
It did the first Linux that booted from CD
Called Dinabolic back then
Which funny enough grabbed the attention of dark pop
Because it was used by US military deployed in rock
In 2011
The same guy presented the beat coin to the cow's computer club in Berlin
And it did the first fork
And then in 2014 there were disagreements about a certain component inside
The Linux that ended up in forking they'd be out into that one
And that's when I showed up basically in the organization
So we have a background as cryptographers
We started working on a cryptographic version machine back in 2017
Then we built components on top and we ended up building solutions on top
The purpose of the cryptographic machine was primarily
To allow non-programmers to understand a new cryptography
So the motto was cryptography for the messes
And that's when Xenruh, which was born
Xenruh is so everything we do is entirely up in source
Xenruh is written C, it builds on any platform
On any architecture, even on cortex and chips
And it's programmed in a dialect of cucumber-girking
Which can be read at least by non-programmers
Fast forward 2022
We decided we heard about the ODRF specification
We decided to start working on it
We got a first grant from an NGO program
Then we got a second grant recently
In the middle we got a third grant to implement a compliance slash
Interrogacy resolution that we're going to be very happy to show to Sean
Well, it was not here
And we are now at the stage, how much time we have?
Yeah, plenty of time
We are now at the stage
Where we have a...
Okay, the term wallet, I find it extremely unfortunate
Because the wallet can mean a million different things
All of people associate wallets with cryptocurrency
When we talk about ODRF wallet
It's not clear what it is
So I love to use the term identity solution
So what we have is a fully open source solution
Where the main, the two main pillars of how the solution would work
Would be first of all
We do not want to store private keys of anybody anywhere
Second, we want
Organizations running
Issues and very fires
Or if we talk in the open entity for VCI language
Authorization service, credential issues and running parties
We want them to run them in their own infrastructure
So we do not run any of the Microsoft ourselves
We have a dashboard that with a low code, no code approach
It allows you to set up a credential issue
Then you press a button and you deploy the credential issues somewhere else
And we can do a very quick demo here
Let me skip to this
So for those who are interested here, you don't load the wallet
Which has been in the store for about the month
For the stores
And I enjoy the nice for about a month
So please don't be too
Don't expect too much from that
And once you have installed the wallet
And you have gone through the setup
You can try and get a credential here
The credential is actually one of the first integrations we have done
You will be asked to respond to a questionnaire
Which integrates with another open source tool
Cobotoolbox and basically once you respond to the questionnaire
The answers go into that tool
And you get an SDJot
LDARF compatible ish credential
And we have plenty of time
So again, this is a completely open source
Our connection between foundation
We have a long-standing friendship
They look at the problem from the UX
And humans are perspective
We have been looking at the exact same problem
From a cryptographic slash technical perspective
As I said, we come from the week we have a background cryptography
Our wallet right now, our identity solution
Can do in the version you see online
Can do only SDJot
But we can also do BBS or BBS plus
As some people know it which is
The journalish proof flow that is getting more traction
We can do post quantum cryptography
We can do other journalish proof flows
We have, we have, we're looking at the upcoming cryptography
And we're very, very active in privacy
Enhancing technologies
Especially when it comes to the knowledge proofs
We did implement this from scratch
Meaning that we implement the open ID for VCI protocol
Only with tools built in house
While we did this
We realize our painful it is
And how broad this specification is
So we felt the need
To start working on tool
That would help people
Testing their compliance and interrability
So we have another product we're working on
Which is, yeah, we don't have time to talk about it now
We may have time to talk about it tonight
Because we have a site gig
And, okay, I think that those who wanted to try this
They had done it already
There is probably a
Yes, so we are running an event tonight at 7
And those who want to join are very welcome to
And I think that we have five minutes
Yeah, let's do some Q&A
We've got five minutes
Did you have a question for this team?
Please raise your hand
And if I can ask the presenters
And some nasty questions if you could repeat it for this
The mic that we asked
Can you question right here in the corner?
Like, yeah, just here
I think that was my question to you, can your ID be stolen?
Yes
Yeah, the question is, do you have something about
Is that the recovery of my ID that's stolen or lost?
Yeah, that's actually a question I was hoping to ask
Because one of the challenges we've had in trying to bridge
The sort of the user's world
With the self-suffering identity world
Is, of course, the recovery
So that's one of the modules that we're developing
From a user's perspective
What approaches work best
So do we have completely sort of self-suffering
Where by, yeah, if you lose your access, you lose everything
Or do you, would people want to have sort of brokers
In between which kind of takes away the full on privacy
But actually a range
Or do you have shared secrets that you can then socially
So we're actually looking into what makes sense
Because again, it's a mental model paradigms
Like, yeah, but I just like send for a password reset
No, that doesn't work
So that's actually one of the sort of the social sort of
Use experience things, areas that is not solved
And I'm not sure it's actually solved yet with UDI
Either
So any thoughts or suggestions, please join our community
And feed into this, this is a developing area
Next question, right here in front
There are a lot of things that you have to do
The idea of the activity
So different things
And how you find it in force
And then you're like, well, you can't answer
And then you can't answer
Yeah, so one of the sort of solutions that we're developing
Again, it's still, you know, in the actual real world
It's still a question mark as to how
It's still a problem
But the idea is that the data that you're sharing
You're not literally sharing
You're giving access to
And so what we do is you build channels
With whoever you're having this identity in data sharing
With and the moment you or your contract says
This is no longer being shared
Or access is being revoked
Then that's sort of automatic
Forgetability
But it's not perfect
And again, this is the question
So once someone has that data
How do you track and how do you follow what's happening with it
One of the solutions we've actually developed a solution
As an innovation project with a Belgian retailer
And one of the solutions there was to separate the personal data
From the content data
Which actually from a commercial perspective is most interesting
They don't need to know who you are
But they really want to know sort of
Amalgamated consolidated data of uses and interest
So that's also another option
So it doesn't matter the data goes out there
Again, questions because as we know
We can say there's no personal identity
But it can still be tracked back and traced back
So again, it's early days
We don't have the, I think the right solutions
But I think we have the ideas to try and get us there
If we keep bringing it back into the real world
We're going on a minute what happens if
What are the unintended consequences?
So no answers, but definitely thoughts and ideas
Next question right there
You're asking me
If it's still yet another blockchain ontology
Technology
No, no, no
Our components can do blockchain to probability
But if you try the wall from the QR code
There is no blockchain there
There could be
We talked with a couple of people that would like to do KYC
And mix blockchain KYC with the ADRF
But that doesn't mean not yet
It's a new question one is about
If you invent one
Let's go back to
You know, I don't mean any of these great
Particularly over the other town
It's on one
At some point you know
I don't know
I don't know what I'm promoting
In fact, it's the first kind of something
It's called market
And someone knows I was there
And this is called market
It's called market
Yeah, so the idea
Indeed is that every time you scan
And it's an identity data relationships
The identity is I am a customer
That's it
Or I am a customer who is vegetarian
That's all the identity data you're sharing
When you actually do the data transaction
So this is why we're trying to shift this thinking
It's not identity and data relationships
So in the one location
I have one identity
And the other one I have
I'm a completely different identity profile
I'm still a customer
And I'm still a vegetarian
But there's no connection between the two