Please describe your proposed solution.
The Problem
To determine if websites, service providers, or projects of any kind can be trusted, in the Web 2.0 world we use review systems, trust badges or simply the search rank on the results page of a search engine. Often, however, these signs of trust are manipulated, paid for and fabricated by fake reviewers. Projects put fake endorsements of well-known companies or people on the website, or use company logos of trusted companies as advertisements without their consent or knowledge.
A solution
Web 3.0 offers the possibility of making statements by companies or people about one another cryptographically verifiable. Trusted entities (e.g., domain experts) can delegate their hard-earned trust to others by endorsing their work. A few examples:
- You completed a course on Plutus or PRISM, you could now show a verifiable badge of completion by embedding it into your Github profile, website or any other page.
- IOG has confidence in a Catalyst project and makes a positive statement about them: instead of a mere HTML text on a project web page, a visitor can cryptographically prove the statement and trace it back to a DID of IOG.
- A startup is sponsored (e.g., by Microsoft) and would like to embed the Microsoft logo on the website to establish trust with new customers. Instead of simply embedding a JPG, the permission issued to use their badge, which may be time-limited, can be checked. As soon as the permission expires, the logo/badge of certification also disappears from the website.
- The use cases are numerous and come to light most notably when previously unknown persons/market participants emerge on the scene, whose trustworthiness cannot be assessed by traditional means (research, sufficiently large number of reviews). The crypto space itself is the best example of this dilemma: nowhere is one more reliant on third-party testimonies about trustworthy and quality projects, and nowhere is the misuse of false credentials greater than in the crypto space. The proposal is by no means limited to web3, and instead should allow everyone to verify third-party statements on websites.
Technically, the project is based on Atala PRISM and uses DIDs to identify both the identity of the person making the statement (Issuer) and the recipient of the statement (Holder). The statement itself is called Verified Credential and could be just a short note, a lengthy review, or a picture (logo or badge representing some kind of achievement). The core of the project consists of a web service that periodically checks statements that have already been published for their validity and provides a customizable JavaScript snippet to display the given statement on a website or online-shop.
For a visitor of the website, the statement is initially a piece of JavaScript code which gets evaluated and rendered. By clicking on the statement, the visitor can cryptographically trace the statement and verify its authenticity. The revocation of statements by their respective issuers is by design possible and an essential feature. In contrast to Web 2.0, statements that are no longer valid cannot be displayed any longer, instead of sitting unchanged on a website forever.
A technical overview of the implementation can be found on the website: https://blocktrust.dev/webcredentials
The service consists of a web portal, with three sections geared towards the different use-cases:
<u>Management Area (Holder)</u>
In the management area, website owners can use a DID to register (e.g., using the blocktrust identity wallet) and provide proof of domain ownership (document upload/nameserver entries) or control over a page (e.g. GitHub). With that proof, an API token and a JavaScript snippet is generated, which can be placed on the page by the domain owner. Basic customizations (color scheme, number of statements to be displayed) can be made. In the next step, invite links can be created to be sent to the issuers who should provide the content of the credential or who should just sign the already prepared credential. Alternativly the Holder can directly send an existing Credential (Presentation Proof to be precise) to the platform itself. This happens via DIDComm and the WACI Present Proof flow. In this case, no one else is needed to issue a Credential as it already exists.
<u>Certifier Area (Issuer)</u>
Logging into the certifier area is done by receiving an invite-link and authenticating with a browser wallet. After logging in, it is possible to proceed with the authoring of one's own statement or the signing of a statement crafted beforehand by the future holder. Different templates for endorsements, reviews, or the embedding of logos are available.
With the completion of this process, the statement is cryptographically signed by the issuer and is now available as a Verified Credential on the Cardano blockchain.
We believe that the signing process must be as simple as possible. If somebody wants to get an endorsement from someone everything has to be prepared, and paid for so that the endorser just has to follow the link, quickly review it and click on a “Sign”-button in this identity wallet.
<u>Verifier API and Portal</u>
As the credential appears in the one's browser, it is automatically cryptographically verified in the background. This is necessary because statements, once made, can be revoked or become invalid. The power to withdraw statements is always completely in the hands of the issuer. Through different caching techniques and periodic verification, the statement always remains up-to-date and matches the data found on the blockchain. For performance reasons, an array of optimization techniques can be used to make the rendering of the statement on the website as fast as possible.
Clicking on a verifiable statement/logo/badge on a website takes the user to the service's verifier portal to obtain detailed cryptographic evidence of the statement's origin to ensure that the statement was actually issued by the expected entity
How does your proposed solution address the challenge and what benefits will this bring to the Cardano ecosystem?
As a usable product, this proposal adds immediate value for the Cardano identity ecosystem around PRISM:
- The use of DIDs are a prerequisite of these cryptographically signed statements. Thus, the proposal promotes not only the direct adoption of DIDs and the use of Atala PRISM but also the entire SSI ecosystem.
- Through the publicly visible use of the Verified Credentials on websites, the project also creates a multiplier that generates a much stronger growth effect than verified credentials that are private in nature and have no external visibility (e.g., credentials in a user's wallet that rarely need to be presented).
- Existing and newly founded projects can get trust delegated to their project based on statements made by trustworthy and known entities. The willingness to try out new scripts or projects increases significantly if it is evident that a project is verifiably supported.
- Cryptographically verifiable endorsements can also be used in online-stores to promote sales. The cryptographically verifiable way of proving the origin of a statement is superior to the often expensive and very questionable trust badges of existing providers in the Web 2.0 world.
- Other parties, like politicians, well-known personalities, magazines and journalists or product testers can use the system to support trustworthy projects o. products. This includes not only companies, but also social institutions and NGOs, which typically depend on trusted recommendations.
In short, this proposal is not only aligned with the challenge, but also helps the ecosystem as a whole to grow by focusing on what is the hallmark of Cardano: reliability and trust.
How do you intend to measure the success of your project?
Success can be simply measured by how often these badges are used and embedded. Additionally, we would gauge success by the community's interest in the project itself on GitHub. We are very much open to ideas and improvements, such as integrating additional credential types in the future.
But success is not measured by user numbers, but by the progress and success of the entire ecosystem. With this proposal, we are delivering a tool to make our ecosystem even better at what it is already good at: delivering great and trustworthy solutions.
But it is not all about projects which like to get a verifiable badge or endorsement on their webpage. It’s also about individuals, who complete courses and want to show off what they have achieved. Maybe just to build their reputation as an expert, but perhaps to finally get a new job.
Please describe your plans to share the outputs and results of your project?
During development, we will write a blog entry every two weeks at www.blocktrust.dev/blog, which will provide information about the advancement of the work. This allows the community to follow the progress during this busy time. In the blog entry we will report on the technical details of the work and at the same time state whether we are within the predicted time window of release.
Regarding the code: The project will be fully open-source under <u>Apache 2.0</u> and developed in a public accessable GitHub repository.
We are well aware of the trust put into a funded project like this by the community and are happy to be as transparent as possible. In the end, this proposal is all about trust.