Please describe your proposed solution.
The Problem
To determine if websites, service providers, or projects of any kind can be trusted, in the Web 2.0 world we use review systems, trust badges or simply the search rank on the results page of a search engine. Often, however, these signs of trust are manipulated, paid for and fabricated by fake reviewers. Projects put fake endorsements of well-known companies or people on the website, or use company logos of trusted companies as advertisements without their consent or knowledge.
A solution
Web 3.0 offers the possibility of making statements by companies or people about one another cryptographically verifiable. Trusted entities (e.g., domain experts) can delegate their hard-earned trust to others by endorsing their work. A few examples:
- You completed a course on Plutus or PRISM, you could now show a verifiable badge of completion by embedding it into your Github profile, website or any other page.
- IOG has confidence in a Catalyst project and makes a positive statement about them: instead of a mere HTML text on a project web page, a visitor can cryptographically prove the statement and trace it back to a DID of IOG.
- A startup is sponsored (e.g., by Microsoft) and would like to embed the Microsoft logo on the website to establish trust with new customers. Instead of simply embedding a JPG, the permission issued to use their badge, which may be time-limited, can be checked. As soon as the permission expires, the logo/badge of certification also disappears from the website.
- The use cases are numerous and come to light most notably when previously unknown persons/market participants emerge on the scene, whose trustworthiness cannot be assessed by traditional means (research, sufficiently large number of reviews). The crypto space itself is the best example of this dilemma: nowhere is one more reliant on third-party testimonies about trustworthy and quality projects, and nowhere is the misuse of false credentials greater than in the crypto space. The proposal is by no means limited to web3, and instead should allow everyone to verify third-party statements on websites.
Technically, the project is based on Atala PRISM and uses DIDs to identify both the identity of the person making the statement (Issuer) and the recipient of the statement (Holder). The statement itself is called Verified Credential and could be just a short note, a lengthy review, or a picture (logo or badge representing some kind of achievement). The core of the project consists of a web service that periodically checks statements that have already been published for their validity and provides a customizable JavaScript snippet to display the given statement on a website or online-shop.
For a visitor of the website, the statement is initially a piece of JavaScript code which gets evaluated and rendered. By clicking on the statement, the visitor can cryptographically trace the statement and verify its authenticity. The revocation of statements by their respective issuers is by design possible and an essential feature. In contrast to Web 2.0, statements that are no longer valid cannot be displayed any longer, instead of sitting unchanged on a website forever.
A technical overview of the implementation can be found on the website: https://blocktrust.dev/webcredentials
The service consists of a web portal, with three sections geared towards the different use-cases:
<u>Management Area (Holder)</u>
In the management area, website owners can use a DID to register (e.g., using the blocktrust identity wallet) and provide proof of domain ownership (document upload/nameserver entries) or control over a page (e.g. GitHub). With that proof, an API token and a JavaScript snippet is generated, which can be placed on the page by the domain owner. Basic customizations (color scheme, number of statements to be displayed) can be made. In the next step, invite links can be created to be sent to the issuers who should provide the content of the credential or who should just sign the already prepared credential. Alternativly the Holder can directly send an existing Credential (Presentation Proof to be precise) to the platform itself. This happens via DIDComm and the WACI Present Proof flow. In this case, no one else is needed to issue a Credential as it already exists.
<u>Certifier Area (Issuer)</u>
Logging into the certifier area is done by receiving an invite-link and authenticating with a browser wallet. After logging in, it is possible to proceed with the authoring of one's own statement or the signing of a statement crafted beforehand by the future holder. Different templates for endorsements, reviews, or the embedding of logos are available.
With the completion of this process, the statement is cryptographically signed by the issuer and is now available as a Verified Credential on the Cardano blockchain.
We believe that the signing process must be as simple as possible. If somebody wants to get an endorsement from someone everything has to be prepared, and paid for so that the endorser just has to follow the link, quickly review it and click on a “Sign”-button in this identity wallet.
<u>Verifier API and Portal</u>
As the credential appears in the one's browser, it is automatically cryptographically verified in the background. This is necessary because statements, once made, can be revoked or become invalid. The power to withdraw statements is always completely in the hands of the issuer. Through different caching techniques and periodic verification, the statement always remains up-to-date and matches the data found on the blockchain. For performance reasons, an array of optimization techniques can be used to make the rendering of the statement on the website as fast as possible.
Clicking on a verifiable statement/logo/badge on a website takes the user to the service's verifier portal to obtain detailed cryptographic evidence of the statement's origin to ensure that the statement was actually issued by the expected entity