Early this morning I participated in a WeChat AMA that was organized by our friends at Unitimes. Over 800 people participated and I was impressed by the thoughtful questions and quality of the ensuing discussion. The conversation was largely focused on user adoption and scaling, but then Vitalik Buterin, the creator of Ethereum, dropped in and asked a few questions. It’s hard to give thoughtful responses in a chat format, so I wanted to expound a bit on my answers and share how we’re thinking about these topics with our broader community.

Can you explain more about how your identity layer works? Who will be making the claims verifying identities initially?

— Vitalik Buterin

We’ve written extensively about our support of the ERC-725 standard and how identity is central to everything we’re building at Origin.

ERC-725 allows you to make claims about yourself that are published to the blockchain and associated with your Ethereum wallet. Trusted third parties can then verify parts of your identity and publish attestations on your behalf.

For example, Origin will verify your email address or phone number by sending you a special code to confirm that you have access to those accounts. We will verify your social media accounts by asking you to prove control by signing in using OAuth. You can even link your Airbnb account by publishing a unique set of words to your Airbnb profile as a publicly auditable proof that you control that account. This means an experienced Airbnb user can benefit from their existing reputation as a trustworthy host or guest instead of starting over from scratch.

Particuarly, how do you provide the security and trust benefits of identity, while preserving privacy (which is especially important if you think initial use cases will involve restricted goods and services!)

— Vitalik Buterin

You should think of your identity on Origin as your public profile and only share information that you’re willing to be publicly associated with your Ethereum address.

This is an important distinction from Civic and uPort where all of your data is stored on your personal device. This is great except it means you need to explicitly grant permission each time you share information about yourself. For marketplaces, it makes sense for some information to be public from the start so buyers and sellers can know who is on the other side of the transaction without having to ask every time. Confidential data should always be kept off-chain and the only information that should be stored on-chain is the evidence that a trusted third-party verified that data.

There are essentially 3 ways information about your identity can be stored on the blockchain:

• Publish the raw data. Our DApp currently allows users to store their name, description, and photograph in plain text. We make sure to warn users about the potential consequences of what they’re doing. We think it would be irresponsible for us to encourage users to publish personally identifiable information like their phone numbers or email addresses to an immutable ledger that will likely outlive all of us.
• Publish a hash. A better option than storing raw data on-chain is to store a hash of that data, or better yet, the root of a merkle tree which allows you to prove that some data exists in the set using a zero-knowledge proof. For example, a trusted third-party could mail a postcard to my home address to verify I live there and then publish a hash to the blockchain. Other parties could then use that hash to verify that the address I shared with them was indeed my verified address, without my personal information being publicly available.
• Publish a checkmark. Centralized services like Airbnb will show a checkmark on your profile showing that they have verified your email address, phone number, and government-issued ID. This is only useful because I trust that Airbnb has your information if anything goes wrong. This is the approach we’re currently using on our DApp, but it’s not a good long-term solution. We have a strong preference against storing any personally identifiable information but recognize that it may be important for us to see the raw data to prevent abuse if we’re issuing rewards based on completing attestations.

We’ve been investigating the idea of offering token rewards for signing up or referring friends to the platform, much like most sharing economy platforms offer new user & referral incentives today. Growth is one of the most important things for any network, and something we’d like to incentivize across the Origin platform. Unless we come up with a good answer for how to prevent Sybil attacks, these rewards will likely have to be granted from a centralized system instead of programmatically from a smart contract. The problem is if all we can see is the root of a merkle tree, there will be no way to spot even obvious abuse like creating signups for [email protected], [email protected], etc.

Long term, we view storing personally-identifiable information as more of a liability than an asset and we intend to explore using zero-knowledge proofs to store hashes on-chain instead.

Are there any specific trusted third parties initially lined up?

— Vitalik Buterin

We’re still in the early days with ERC-725 but there is growing support for this open standard with 18 other companies participating in the ERC-725 Alliance. We know of several other companies that are looking into offering attestations including some of the top exchanges. We’re currently offering attestations on things that are digitally verifiable like your email address, phone number, and social media accounts on the profile section of our DApp. It’s easy to envision how other trusted third parties could offer attestations after verifying your government issued documents for example. We think this would be incredibly valuable instead of investors having to do the same KYC and AML checks over and over again.

Thanks for great questions, Vitalik! And thanks again to Unitimes for hosting such an engaging AMA session.

Continue reading part II where I answer Vitalik’s questions on how we are thinking about early adoption and initial markets.

Learn more about Origin: