154 - Sign-in With Ethereum with Wayne Chang

Welcome to Bankless, where we explore the frontier of internet money and internet finance. This is how to get started, how to get better, how to front run the opportunity. This is Ryan Sean Adams. I'm here with David Hoffman, and we're here to help you become more bankless. David, I just realized we talk about internet money and internet finance in the intro. We should also add internet identity to the list of things we are covering in Bankless. Today's episode is about Ethereum, its ability potentially to take back our identity on the internet. We're exploring that topic with Wayne Chang, who is a researcher and a core dev behind the Sign In with Ethereum project. If you haven't heard about this project, this is the episode to pay attention to. A few things to look out for. Number one, why Google, Facebook, and Twitter are actually banks for your identity. And of course, we are bankless. So is there an alternative? Number two, we talk about why Wayne thinks Ethereum can disrupt the Silicon Valley tech companies and become the standard way you sign into every application and social media platform on the internet. Number three, we talk about how this leads to a more sovereign, decentralized, and free internet for the world. Crypto has been called, you've heard us talk about this before, a separation of money and state. This is the separation of identity and state and is perhaps even more profound. David, why is this topic so important to you? Why did we set up this conversation? I know you were very excited to bring Wayne on and talk about signing with Ethereum.

Yeah, sign in with Ethereum, it's like one of those small holes as a rabbit hole that once you go through the hole, it only gets bigger and bigger and bigger as it goes. The implications of a simple swap of sign in with Google or sign in with Facebook when it turns into a sign in with Ethereum, it seems so simple. But the downstream changes of how that completely changes the landscape of the internet and how users on the internet are able, as a result of that, to go from a commodity to the big Silicon Valley apps to an actual user, once again, a free and sovereign user of the internet, it's quite profound. And it really does go down to the depths of what does it mean to have an identity, to be a person? And Wayne is a deep thinker, both as a developer as to how do we come up with standards to implement this sign in with Ethereum Vision, but really what does it mean to authenticate? What does it mean to be a person as it goes to the internet? And these are conversations, Ryan, that we had in the debrief about human identity is a

Infinite, boundless thing, yet we know that it is captured by the current status quo of the internet because so much of what makes up users on the internet is defined by Facebook. It's defined by Google, it's defined by Twitter. So what happens to the internet when we can unlock it from the constraints of these web two apps and finally make a version of ourselves that's as limitless as the kinds of assets that we can mint on Ethereum? I think it's such a fantastic conversation. So if you want more of that conversation, you can sign up for the Debrief Podcast, which is the only podcast that exclusively comes out on the Bankless Premium feed. If you don't have the Bankless Premium feed, there is a link in the show notes to go sign up for that. And so you can get that extra podcast into your podcast feed wherever you listen to your podcast.

On the debrief this time we actually brought in Wayne for a quick five-minute explanation of Zuko's trilemma as well. So stay tuned for that.

One last thing before we get into the episode with Wayne. Bankless is getting into the world of web three tokenized content. So we are tokenizing every single Monday podcast, including this one, at collectibles.bankless.com slash mint. The mint goes live on Monday. And if you are a bankless premium member, you are on the whitelist to mint one of the 100 NFTs that goes out with this podcast. Again, you can try that out at collectibles.bankless.comslash mint. This is a pretty fun experiment. We're also going to have a Twitter space with Wayne on Monday, of course, as well. If you guys want to ask questions about the episode, there is a link in the show notes if you would like to partake and join us in this exploration of Web3 content.

Guys, we're going to get right to our conversation with Wayne. Bankless Nation, this is a topic we have been waiting a long time to talk about and are super excited about. It's in our bull case for 2023, isn't it, David? Sign in with Ethereum, and we've got the perfect guest to help us out with this topic. Wayne Chang is the co-author of the Sign In with Ethereum EIP. It's called EIP4361. That is the Ethereum improvement proposal that is proposing the properties of Sign In with Ethereum. And he's also the co founder and CEO of Spruce, which is a company that's working to grow this very important standard. And what Sign In with Ethereum is doing is trying to make the internet more user first. Wayne, welcome to Bankless.

Thanks so much for having me. This is great.

Well, I want to start with a big question in people's minds. Identity on the internet.

Yeah.

Is identity on the internet broken today?

We have to first define what identity means because that's a very overloaded word and means a lot of things to different people, right? So there's definitions from like standards organizations like NIS NISO that say identity is a set of attributes around an entity. How useful is that? You know, maybe to certain implementers. There are other groups that have other opinions about identity. I'm just talking about technical specification, what some technical organizations think. They're non-technical interpretations, of course. But some more useful and holistic definitions, for example, are identity is the way that we recognize, remember, and respond to people and things. So broader than just a really technical definition, right? So, and typically identity is only useful in a context, uh, functional identity versus so-called foundational identity, that you're a human on this earth, maybe as part of a nation, is something closer to foundational identity in semantics. But functional identity, hey, I want to show that I can drive this car, or I want to go to the bank and access my account, or I want to log in and see my cat pictures in storage somewhere, right? Those are more functional identity oriented.

A conversation that we've had on Bankless frequently, we've had this conversation with Chris Dixon. It's come up a number of times in Bankless is that the internet was not built with a native payments system. There was not money on the internet when we created it. And as a result of that, that's had some downstream effects. It's created the advertising model. Uh, it's turned internet going adventurers into commodities for these big applications like Facebook and Instagram. I'm wondering, Wayne, if it's a fair to frame this conversation that we're about to have as similar to the internet was also not built with identity primitives in it from day one either. And the downstream effects of that are kind of the paradigm that we find ourselves in today with Web2. Login with Facebook, login with Twitter, login with Instagram. Is that like a fair kind of foundation for setting the table of this conversation?

I think that's very fair. And another example of sort of the vestigial artifacts from ARPANET when you had a bunch of highly trusted universities setting up networks to talk to each other, and there was just inherent trust because you basically knew everyone as part of that network. You did not have to do that much adversarial thinking to make those systems secure because you know you had local trust. But as we scaled up, you know, those things weren't baked into the core protocol, and we're starting to run into those problems. And there are some market solutions to those things, sometimes with adverse incentives. So yeah, I think that's a pretty good description of why we are where we are now.

Uh can we talk a little bit about identity? Because I do want to get to that that question of is identity on the internet broken, but I still feel like we're in the definitional phase of what identity on the internet is. Practically, what is identity on the internet? I think I guess my identity in the real world is let me see, it's probably there's a nation state component to it. So I have a driver's license and a passport and a social security number, and I'm an American citizen. I'm also a Canadian citizen, so I have a Canadian passport as well. That's a piece of it. It's also somewhat socially defined, I suppose. Like when we say like I identify as, right? And I might identify as a particular gender or a particular like religious affiliation, or I certainly identify as uh probably a crypto native, an Etherean, somebody from the bankless nation. Yeah, these are all identities that I have, but I also personally identify as a dad, for instance. And uh, you know, someone on the internet would say I also identify as an AI that is under much dispute. But like, what do we mean when we say so that's a real world, but what do we mean when we say identity on the internet? I guess for me it would be like, okay, well, I have an email address, and that is some sort of identity. And if it's a Gmail account, then I can sign in with my Google account in places. I have an Apple ID, maybe. I have probably a Facebook ID, I have a Twitter ID, I have a password manager with all of these identifications, I suppose, to all of these various web applications. And then I also have like, you know, social media profiles that sort of tell you who I am. So maybe LinkedIn is my professional presence and Twitter is kind of like, you know, I don't know what Twitter is, it's some kind of bio combination of whatever I am on Twitter. But what is the digital identity and how does that intersect with the like what are we actually talking about today in the current state? When I even asked the question of is identity on the internet broken? What is identity on the internet?

Yeah, and I think

Part of the answer to what is identity on the internet has to do with what are you trying to do, right? And depending on that, a lot of things are relevant or not. Identity is just such a contextual thing that you really need to describe scenarios, whether it's even, you know, you have to present your password somewhere to get into another country. That is a scenario that makes that part of you relevant. And as you alluded to, having a professional presence, you have different identities for different contexts in your life. When you're with your family, it's probably a different personality even than when you're at work. Think about your work Slack versus maybe you're hanging out with people on Discord or in a WhatsApp group. It's a different dynamic and you'd bring different aspects of yourself to those places, right? So it's not necessarily the case that you can just have, you know, everything in every context and it makes sense to people. In fact, when you're, you know, your work self, you actually don't want to bring up a lot of things that might not be relevant if you're just trying to do your job and a good one at that. And likewise, you don't want to bring your work stuff necessarily to social media sites where you're just really trying to enjoy the personal side of your life. Right. So these different areas where you already have different digital presences, I think are important to consider when we talk about identity.

So that's what identity is on the internet then too. It's sort of similar. It's I guess the aggregation of all of these various logins I have, something to that effect. Is that really what we're talking about? It's my Gmail account, my Twitter account, my Facebook account, and Instagram, and all of these things? Is that what identity is? And if so, who owns these? Are they mine or are they somebody else's?

Yeah, and I would say it's some combination of those. And preferably the point of view is that you should own those and decide where and when those things show up. Kind of like having a hand in poker and deciding which cards to reveal in what situation, right? So that's how we'd really like the internet to work, instead of a lot of things being controlled outside of your purview, if it's especially about you.

I think as we're trying to get down to the basement of things, which we love doing on Bankless, getting all the way down to the core primitives of what makes the world tick, it's important to note that your identity is something infinite and unconstrained and limitless. Like who you are as a person is very different in almost any different scenario, be it on the internet or in the real world. Sometimes, to use my co-founder as an example, he plays the role of dad. Sometimes he plays the role of podcaster. Sometimes he plays the role of investor. Sometimes he combines these things. I'm sure he has musical taste. These are all different things that make up humans and that also transcends across time. And it can also be constrained by the systems, the social structures that we inhabit in this world. So we talked about a form of identity as like the nation-state. Like the nation-state bestows upon you a nation-state approved identity at birth. Here is your identity. It is this passport number A37421, or your social security number, or your phone number. And so you are given your identity by a nation-state inside of the nation-state context. And that is actually a constraint on identity because, of course, you are not just the person that the nation state believes you to be. You are not just a social security number. And so it's important to note that your identity is infinite, it's expressive, it's adaptive, it changes over time. You select it, you control it. And then also we have our social structures that we exist inside of our nation states, our web two apps that limit our ability to express who we are. And so, Wayne, I want to ask you the question: how has over the trajectory over the internet, can we do an audit of this state of identity in the internet? Perhaps we can keep this to web two because these structures that we have Google, Facebook, Twitter, these previous other like login with, you know, insert your Silicon Valley tech giant here, what is this state of identity on the internet today? Like, can you do an audit for us on this?

Yeah.

Yeah.

Is it broken?

Yeah, is it broken?

So average person has maybe a hundred passwords to manage, according to one survey in 2021 from NordPass. And because of so many UX issues, onboarding services, forgotten passwords, a lot of people have opted to give that job of, you know, attesting for their login to an entity, typically a large tech company. Popular ones include Facebook, Google, Apple, Twitter is emerging, but I don't have exact statistics right now. But a lot of these use a protocol called OAuth2 under the hood, which allows you to delegate access to resources. That was the purpose of it. So OAuth 2 was invented because of the problem where you have a photo sharing website and you have a different website that does printing. And if you want to print those photos, you can either download all those photos and retitle them in the printing site, or maybe there's a way for the printing site to talk to the photo sharing site directly, right? In the land before OAuth 2, we would basically give the password to the printing site and they would basically log in on our behalf, right? And there's a lot of horrible security things with this. So we want to move away from just giving passwords to those systems, although it's still in place in some places on the internet today. But that became OAuth 2. And then some clever people thought about, hmm, what if we could also include instead of photos, identity information as part of the payload that you could give as a resource, right? And that's how we got to OpenID Connect, which is the dominant identity protocol on the internet today governed by the OpenID Foundation. Now, the really interesting thing about OpenID Connect is if you talk to a lot of the developers and architects of it, they always wanted a decentralized internet where you'd have a bunch of identity providers that you could have an account with and you could sign in with this service. That was, I think, the intended effect of a lot of those architects. But what happened was a few intermediaries that played these roles started to grow and grow, and they had these network effects that caused them to be pretty dominant. And that's where we're left with today, with a lot of people using those services. And what's interesting about it is I think that people are giving up a lot more control than they realize. So if you have a Gmail account they use for everything and you sign in with Google in places,

If at any point you lose that Gmail account, it's not just Google services that you lose access to. It's basically potentially anything you use that Gmail account to sign up with, right? Because the forgot password button will be broken for you, because you can't access your email anymore. And it's maybe could be preempted to reset across all your accounts, right? So that's a big level of trust. I don't know if everyone is comfortable with that they're taking. Maybe some people are, and that's fine, but we think it should be a choice. So we think that moving towards more direct authentication systems like signing with Ethereum without an intermediary is a very exciting proposal, and we've gotten a lot of alignment with the ecosystem on this.

When you say lose access to something like Gmail,

in that category of lose access, what are we talking about? I mean you could also be like censored by something like Google. Like you are

It doesn't have to be you forgetting your Gmail password. Right. It could be someone just uh a system administrator or someone who has access. And for all the great controls that we hear about, uh, we constantly hear about stories in these large tech companies where some employee had unauthorized access to a certain spot, or some kind of system failure caused this thing to happen, right? Or even there was a request by this other entity and they had to do this, and all of a sudden your access is gone. There's a long trail of this happening in news articles, et cetera.

And that's the point. You don't own that identity, that authentication Google does.

That's right.

And if we would look at Silicon Valley as like a topology of size of tech companies, you kind of have the big ones, right? Facebook, Google, Apple's probably in there, Twitter's up there. And then there's like a bunch of smaller like Silicon Valley apps that probably use these bigger companies to log in with, right? So Canva, Pinterest might be having like a login with Facebook or a login with Google button. And then so all of these like smaller web 2 apps use the bigger web 2 apps for identity, right? They've outsourced the need for identity to these bigger web 2 apps. Putting on like a finance brain, it kind of feels like the banking system where we have these commercial banks, look Wells Fargo, JP Morgan, Chase, and they are signed up with the Federal Reserve. And the Federal Reserve kind of dictates everything. Like they give or take away accounts, right? And so does your commercial bank gives or take away accounts from you. And so what you're saying with like because of this convenience, a lot of like our identity systems, if you choose to like log in with Gmail or Facebook, whichever provider you choose, whichever central banks of identity that you choose, everything downstream breaks if you get deplatformed there. And so you've given like these central authorities custodianship over your internet identity. And that's just like a bank. Is it fair to consider these like web two apps banks for our identity?

I think it's fair with two caveats that I can think of now. One, there's no oversight body for it like there is for banks. And even if you have one, it's, you know, how effective can it be? And it's not FDI insured either. So if you lose it, you know, what recourse do you have?

Okay, so that are some of the risks and drawbacks. Bankless listeners understand the perils of centralization. What about just like user data and other just risks and drawbacks of web tube-based login that we haven't touched on? Is there anything that we should really touch on before we move on?

Yeah, one thing that I really think about, and we'll get to this probably later in the conversation too, is just how much innovation are we stifling? It's always really easy to see the stuff that's there and then you lose it. But what about the stuff that could be there and now it can't be there because we have the current Rails that are in place, right? And how I'm thinking about this is once you sign in, sometimes you get the dialogue that says, do you want to share this part of your account? Right. And it is convenient for a lot of people to do that. But if you are a large tech company and you provide, let's say, a storage service or a photo service, do you really want to let the user share from a different photo storage that they like and not the one that's part of your closed ecosystem? I think there are a lot of interesting incentives that have to happen when one company controls the end-to-end login experience for billions of people, pretty literally. And there are some commercial interests at play too. So this kind of differing of incentives and principal agent problems, I think, is at the very core of it. And when you move to these decentralized direct authentication methods and you have the right protocols to let the user build up their entire login experience and what data gets imported or not, then I think a lot more is possible.

And Wayne, are you also saying, if I kind of talk about second-order effects there, is like, are these big tech companies also incented to keep you in their walled garden, incented to like promote their identity platforms as the single identity? I would imagine that would help them establish a moat around their core business and kind of block out competitors, block out innovation. Are you saying that there's a negative incentive at play here too?

I think there's a positive incentive for a company to build up with their internal network effects, right? More stickiness through that, more ability to have people use the systems every day. And also it works so nicely with all the other pieces of the ecosystem right away. And it's more difficult for other services. So yes, I think there's a natural Walt Garden effect here.

Just one last bit of housekeeping while we're on kind of definitions and the existing problem before we talk about signing with Ethereum is can you tell us the difference between this term identity, which we've talked about so much, and this other term authentication?

Yeah.

So what's the difference between identity and authentication?

Yep. And I will add two more just so we have a complete set of stuff to talk about, right? So let's talk about identity versus identifier, right? So Wayne at spruceid.com, that's an identifier for me, right? That's something that I can type into a computer, an Ethereum address, you could argue, is an identifier, right? But an identity is so much more complex than that, as David said, it's just pretty boundless and very contextual for us to even talk about it, right? So that's one difference.

And other examples of identifier would be ENS name, a domain name, something like that.

That's correct. Yeah. Any kind of thing that you can use is a digital handle, and you can use that to, you know, maybe one identity is associated with many identifiers.

Is my phone number an identifier?

Yeah, it can be considered an identifier. It's kind of used in relation to the context in the system. So you know, sometimes you might log into a reservation service for a restaurant and that's your main identifier.

And then we have the pair of authentication and authorization. And I'll tell you how that's related to identity and identifiers. So, what's authentication? Authentication is basically being able to determine if someone is who they are claiming to be, right? And there are three ways to do that that we know of. If you discover a new category as a listener, please get in touch because you will win many prizes and things. Because what we've determined in the identity ecosystem so far has been something you know, like a password or uh you know secret phrase.

Something you have, maybe a YubiKey that you carry,

or something that you are. And that starts to get into biometrics and you know, things that you can't change about yourself so easily, like how you walk your retina, etc. All the modes of authentication seem to fall into these three broad categories. Sometimes, you know, you squint which one it's in. But uh, using a bunch of these factors in real life or on the internet, we're able to identify that someone is uh who they say they are, who they're claiming to be, or who we think they are, and that's authentication.

So the practical authentication for a lot of people is a username, it would be the identifier maybe, or it could be authentication and then password. That would be the something you know category, which is the vast majority of ways we log in. And then if you add a two-factor authentication on top of that, so if you guys are familiar with something like Google Authenticator or using your phone number as a second factor of authentication, is that tied to device? And would that be authentication for something you have? It's sort of like my device, I have this, I have my mobile phone, so I can type in this code that generates every 60 seconds. And then that's the second factor when we talk about two factor authentication, right?

That's completely correct. Yeah.

Cool. Identifier, authentication, authorization. What's next?

Yeah. So we may use identifiers in the process of authentication to see that, oh yeah, that's the identity, right? Confirm the identity. And after we have an idea about who we're dealing with, we're able to understand what they might be able to do in the system. Maybe they log into a website as the administrator or a basic user, right? Those two different roles have different privileges within the system. So basically that's what authorization is. Now that we've identified who signed into the system, we can figure out what they have discretion over.

So it's basically what you can do. It's kind of your role, right? Do you have the ability to on Reddit post a comment, or do you have the ability as a Reddit mod to delete comments? That would be an example of authorization. After you've authenticated, then you're authorized to do a particular set of things within this ecosystem. Is that correct?

Yep, that's right. And drawing back to the example we're talking about before, when you're signing in with a service, they are basically the proof point. So let's say you sign in with your login service, you go to a resource, and the resource says

Hey, prove to me that you're actually logged in and you are who you say you are. And then the login service will attest or not that you signed in correctly. And that's how these sign in with whatever services work.

Got it. Okay. Now you said there were four. Is the fourth just identity?

Oh, yeah, just identity. Yep.

Okay, which is everything else we were talking about earlier.

Yeah, it's a notoriously difficult term to define, even for people working in identity.

So now moving the conversation to sign in with Ethereum, I guess, based on those definitions, what is the scope of sign in with Ethereum? We'll talk about what it does and what it is, but since we just talked about the definitions, does that give us the identifier? Is that authentication? Is that authorization? Is it identity? Is it the full package? Is it all four of these pieces or just a part of it?

How I would put it is that all these pieces are part of the identity puzzle, right? And nothing will just head on tackle identity in its entirety. I think it's piecewise is the best approach as well. So sign in with Ethereum.