Sam Curren (TelegramSam): Good morning Good morning, you know someone who isn't here yet now's a good time to send them a text or or a message.
Sam Curren (TelegramSam): Welcome folks if you know someone that should be here that isn't as a good time to text them the agenda link with the zoom meeting link in it remind them.
Sam Curren (TelegramSam): should be a non conflicting zoom room that I got fresh from the folks that hyper ledger.
James Ebert: Next.
James Ebert: yeah.
Sam Curren (TelegramSam): I felt bad about stomping on someone else's meeting.
So.
Sam Curren (TelegramSam): I had attempted to do so, the first time and clearly didn't do a good enough job.
James Ebert: is empty DC the Keith posted in comments on kind of wiki goes to a different room.
Sam Curren (TelegramSam): Link on the wiki this one.
Stephen Curran: that's the one I used and it worked.
Sam Curren (TelegramSam): Oh, is there a different one on the previous page.
Stephen Curran: Oh it's probably on on the previous week.
Sam Curren (TelegramSam): The previous week one is bad.
Stephen Curran: We should probably edit and remove it.
Sam Curren (TelegramSam): But it might be bad also on this one.
Stephen Curran: Oh, and if they're using the one on the.
Sam Curren (TelegramSam): This one this one doesn't have a mobile link but it's the one on on last week's one is incorrect.
Sam Curren (TelegramSam): And the hyper ledger meeting calendar got created linking to the to last week's agenda.
Stephen Curran: A great I didn't create that.
Sam Curren (TelegramSam): No, you didn't it was it was one of the hyper ledger folks.
Sam Curren (TelegramSam): But I may not have been very clear about it.
Sam Curren (TelegramSam): So.
Stephen Curran: Let me edit that page and remove it or put the new one in is this going to be the one going forward.
Sam Curren (TelegramSam): This is going to be the one this is the link going forward okay.
Stephen Curran: So i'm going to replace wherever I see a link.
Sam Curren (TelegramSam): It should just be on on this November 16 one.
Stephen Curran: So Keith i'm editing that page and removing the old.
Stephen Curran: And switching it to the new one.
Sam Curren (TelegramSam): This is areas mobile summit that's not accurate at all.
Sam Curren (TelegramSam): What someone wiped out the hang on.
Stephen Curran: Oh geez.
Sam Curren (TelegramSam): This is not accurate, the whole How did this.
Stephen Curran: Work that.
Sam Curren (TelegramSam): Oh no.
Akiff Manji: it's it's under the meetings so it's like I didn't look at the working group links I just clicked on that one.
Sam Curren (TelegramSam): Oh, so this one is under there.
Sam Curren (TelegramSam): But where's the other page.
Sam Curren (TelegramSam): there's an area's mobile summit and an Aries.
Sam Curren (TelegramSam): Mobile summit page.
Sam Curren (TelegramSam): Okay fortunate.
Stephen Curran: 2021 mobile summit page.
Sam Curren (TelegramSam): How did that happen, what do we do.
Stephen Curran: I did nothing.
Akiff Manji: Okay, I think yeah if you open a sidebar you'll see it under.
Stephen Curran: Okay i'm editing that page as well i'm it i've got it edited in all places.
Sam Curren (TelegramSam): Okay, thank you.
Okay.
Sam Curren (TelegramSam): That was a fumble, thank you for.
Stephen Curran: Oh, created by Robert mcluckie last modified originally.
Stephen Curran: Okay, so.
Stephen Curran: I might as well change that it's it's Tuesday every week right.
Yes.
Sam Curren (TelegramSam): Thank you for bringing that to our attention, I was not aware that we had.
Sam Curren (TelegramSam): done this poorly.
Sam Curren (TelegramSam): don't need to add to any confusion and I apologize Stephen a wiki editor is on it.
Sam Curren (TelegramSam): Okay.
Stephen Curran: And it is 4pm CET right now right.
Stephen Curran: Though hank.
Stephen Curran: The puppies here so that's good.
Sam Curren (TelegramSam): The puppy is here the is good mines asleep.
Sam Curren (TelegramSam): He doesn't do morning.
Sam Curren (TelegramSam): Okay.
Sam Curren (TelegramSam): We should get started, I apologize for the lateness and the confusion of making that all happen, thank you for being here and thank you for picking others to invite them.
Sam Curren (TelegramSam): We have a cool set of topics today that I have long wanted to talk about I have more questions and answers, but together, I think we can figure out some awesomeness this is so, officially, welcome to the we're already recording welcome to the Aries.
Sam Curren (TelegramSam): summit session on mobile infrastructure so on the list is mobile verifiers device recovery secure element usage and SDK and embedding Apps into existing agents into existing mobile Apps call is recorded and will be posted.
Sam Curren (TelegramSam): The, it is a hyper ledger calls, so the Code of Conduct applies in our ancestors policy notice.
Sam Curren (TelegramSam): Those are both present and, and please surface any issues if you become aware of them and you are, I would invite you to add yourself to the attendees list, particularly for these these mobile.
Sam Curren (TelegramSam): Summits, so that we can be aware of who is here, who is involved in the conversation and help get in contact with one another as we work things out.
Sam Curren (TelegramSam): So that would be helpful, I will add to the link to get them, this is the one that might just posted, but that is the that's the link for the agenda today.
Sam Curren (TelegramSam): i'd also invite you to get you with any notes or thoughts or links or anything else that actually comes up the wiki support simultaneous editing so.
Sam Curren (TelegramSam): Anything that you type will actually just show up on my screen and you don't have to worry about having a about anything being overwritten or other annoying stuff like that.
Sam Curren (TelegramSam): So, yes.
Sam Curren (TelegramSam): Is there any adjustments to the agenda that we want to make or do we want to reorder the discussion topics as they're present for order of usefulness or efficiency.
Sam Curren (TelegramSam): I have a relatively you know, these were the things suggested as we group them together and so.
Sam Curren (TelegramSam): That, I am here to host but I certainly don't have all the answers and only some of the questions so your feedback here in these working groups these these summit sessions is very useful and an often if you have an opinion, please speak up someone else probably agrees with you.
Sam Curren (TelegramSam): Okay, so what I will attempt to do is is sort of organize the discussion, and we can talk about stuff I do not have lots of details on many of these topics, so if you.
Sam Curren (TelegramSam): If these will be very short conversations without the contributions, or at least questions of others, you don't have to have solutions you can just have questions.
Sam Curren (TelegramSam): And that will that will help move this along so i'm going to attempt to sort of guide the discussion, according to our agenda, but this is but but we'll need lots of input from folks we had great discussions last.
Sam Curren (TelegramSam): Last week, and so i'm hoping to continue the that or more level of involvement in discussion this week, as we, as we dive into these topics and figure them out so first on the list is mobile verifiers.
Sam Curren (TelegramSam): would like to start.
Stephen Curran: We need them.
Sam Curren (TelegramSam): Was that was that a statement or question.
So.
Stephen Curran: um for us, the one scenario is certainly that.
Stephen Curran: The model.
Stephen Curran: Excuse me, the model for.
Stephen Curran: vaccine proof of vaccination credentials in British Columbia, at least, has been the holder displays a qr code.
Stephen Curran: And the verify or scans that qr code, with a mobile APP.
Stephen Curran: And gets a result on it.
Stephen Curran: And that.
Stephen Curran: That model is.
Stephen Curran: seen as as common and, in fact, many people new to this scenario assume that is how things will work that you will.
Stephen Curran: Have a qr code on your phone and you will walk up to an airline gate and it will scan your qr code and then say yeah you're good.
Stephen Curran: So.
Stephen Curran: it's a model that will have use cases that are viable, you know, a policeman comes up to your car.
Stephen Curran: You display your cell phone with your with your link, for your license and and and the police scan that and get information from from your credential about it.
Stephen Curran: right or wrong now whether that's correct or not is a different question whether it's appropriate.
Stephen Curran: that's a different question but that's a model that we see as popular and and, in some cases will be assumed, and therefore we should consider supporting it.
Stephen Curran: So that that's part of it now, obviously it can always work, the other way around, and in fact the qr code.
Stephen Curran: may not be that you display may not be for your credential but rather may be a qr code that is just an invitation to ask me a question.
Stephen Curran: And that question is the proof requests that that verify or once that's probably the right thing to do, as opposed to having the user having to search through their wallet find a particular credential and then generate a qr code.
Stephen Curran: Which is associated with that credential that they want to display.
Stephen Curran: So.
Stephen Curran: Those are the sort of different discussions we've had around it so i'll use that as opening and I see other cancer.
Mike Ebert: So Stephen, I just wanted to pipe in and say that the opposite model where the the verify or displays the qr code and then asks a question is exactly what we did in our Aruba trial last April and.
Mike Ebert: Since then we've had some situations where it's one way in somewhere it's the other and we've had requests also for enterprise verifiers, but I think we're going to see a mix and there are certain situations where it's more appropriate to do one way and then sometimes the.
Mike Ebert: Other so.
James you're up.
James Ebert: yeah, I just wanted to jump on Stevens thoughts, one of the things that I see as a.
James Ebert: benefit to the user experience that Steven mentioned is this idea of the qr Code as best as as an invitation.
James Ebert: So, establishing a connection first because, and then you can follow up with additional questions and or protocols so, for instance, one of the things that we've done in one of our projects is.
James Ebert: The first thing that you get is not a presentation request, but.
James Ebert: A basic message so you're actually able to have some kind of.
James Ebert: Additional context be related to the to then user prior to.
James Ebert: Getting this request for a presentation for a credential.
James Ebert: So what I think that'd be.
James Ebert: Something that I would highlight something else I would add also that mobile verifiers have a large value to them is being able to do offline verification.
James Ebert: In contexts where you don't have Internet connections.
Stephen Curran: Have you.
Stephen Curran: Well, have you done consideration of offline verification via qr code versus bluetooth slash whatever.
James Ebert: yeah we we've done.
James Ebert: we've we've done some work with.
James Ebert: Some individuals for offline verification with.
James Ebert: qr codes.
James Ebert: and
James Ebert: While it is effective and it does work I would.
James Ebert: From my point of view, I think the doing a ble connection is likely to be a better user experience.
James Ebert: And flow, so we ran into issues based off of our timelines we didn't get too much further into the big portion of our implementation but that's something that I would.
James Ebert: Like to do.
Stephen Curran: Have you talked to anyone else it's done ble.
James Ebert: Talk some with Timo because they did the.
James Ebert: upon the specification around that, but we were doing it before too much noise was.
James Ebert: around this so we weren't actually able to talk to other employers around it or biggest issue was actually just the.
James Ebert: apple to android that integration of those two different platforms, be able to talk to each other.
Sam Curren (TelegramSam): So ble I think it's definitely useful, I mentioned that you can't use shortened qr codes in an offline sense you're not gonna be able to resolve the qr code that's So if you have a qr an invitation in a qr code that isn't shortened, then that will work.
Sam Curren (TelegramSam): So so very cool that way so so offline verifications is one of those unique features, it strikes me that one of the other sort of things, this may not be a unique feature exactly but.
Sam Curren (TelegramSam): When you are talking with a verify and they recognize that they don't need specialized equipment that's often a really useful sales feature.
um.
Sam Curren (TelegramSam): And so I think that.
Sam Curren (TelegramSam): I think that piece of it is is useful in the sense that you know, particularly for maybe small things are small projects.
Sam Curren (TelegramSam): have in common hardware.
Sam Curren (TelegramSam): being used as it is a useful bit there and may not be the person, you know, a personal cell phone necessarily but, but something else.
Sam Curren (TelegramSam): So what other unique features, do we need of.
Sam Curren (TelegramSam): For off mobile verifiers, what are the, what are the pieces, that we need to have.
Stephen Curran: One thing you need is support for.
Stephen Curran: verify verify our support basically so.
Stephen Curran: Where we've really focused on holder support within.
Stephen Curran: Mobile agents.
Stephen Curran: leads to this point, of course, we don't know exactly what's in existing ones, but, but this idea that you have to have.
Stephen Curran: A verified or make sure that the framework sports verified and that your user interface has it.
Stephen Curran: Those are the big things.
Sam Curren (TelegramSam): I Clichy I think you've been unmuted.
Clecio Varjao: i'm struggling with my microphone, but I think it working now has anybody done any work on, and I think the thing version of the very fire.
Clecio Varjao: Of the holder presented the Code, the Code as opposed to verify it comes to the sense of speed of the transaction, the problem of a large scale event.
Clecio Varjao: or somewhere where it's time sensitive if you're waiting in line for something.
Clecio Varjao: Either can be a restaurant or it can be a sports event or I don't know and waiting to board airplay so so does the situations where usually.
Clecio Varjao: At this myself I tend to prepare myself for that transaction to be as easy as possible, so I have my my passport at hand, my idea had ready to complete the transaction as quick as possible.
Clecio Varjao: Has anybody done any work.
Clecio Varjao: Any research on that large scale of the Protocol.
Sam Curren (TelegramSam): We have not well, we have talked about it briefly, but not in any protocol adjustments senses, but just that the we when you.
Sam Curren (TelegramSam): it's possible for user, for example, to sort of pre selected pre authorized certain types of transactions.
Sam Curren (TelegramSam): That way, when the request comes in, if it's when they've pre authorized, then it happens if a if a different request comes in, it could actually pop up and ask you right if you've managed to prepare the wrong thing if you will.
Clecio Varjao: yeah, so I think that's that's kind of the user interaction where where that motto it's it's important and, especially, right now, the proven facts nation, I don't know how much of.
Clecio Varjao: The physical add to important so right now to live with both the show kind of a pro vaccination and a physical identity, hopefully, maybe in the vc world only the verified person ID and the vaccination would suffice.
Clecio Varjao: But there is the interaction where your check two pieces of ID one of them being physical.
Sam Curren (TelegramSam): Well, one of the advantages that I think you're probably chasing with the physical is that if it actually routes, the trust back into a physical credential.
Sam Curren (TelegramSam): And it's a little bit of a blend of between all the new and, ideally, yes, we can, maybe do it all but but, but the model of actually presenting it alongside a normal sort of photo ID or government ID I think it's actually a pretty good one that we don't explain often enough.
Sam Curren (TelegramSam): We already do verifications i'm quoting that have physical ids all the time and so being able to present something along with your phone that is maybe more either dynamic or you know, have a different format alongside of physical credential I think is a reasonable flow actually.
Clecio Varjao: yeah I think I think initially at least the hybrid model or will probably be used at least at the beginning and and again the.
Clecio Varjao: When you're waiting in line there is that that point where I need to check a specific person credential before I let in through all that through so just asking you ahead of time may not be suffice it does a similar thing to consider.
Sam Curren (TelegramSam): You quite possible, yes Mike your hands up.
Mike Ebert: So.
Mike Ebert: As i'm being asked and pushed to develop governance, both in the.
Mike Ebert: In the verification and the.
Mike Ebert: holder side both agents should be able to access the governance file and cash a governance file, or perhaps the verify or should be able to pass the governance.
Mike Ebert: that's kind of silly because you have to trust if you're establishing trust.
Mike Ebert: Then you'd have to have established that before your offline interaction, but maybe to pass a governance file for to establish a workflow or something like that, so a couple couple of wishlist items around governance related to verification and offline verification.
Sam Curren (TelegramSam): Right.
James Ebert: That was that was exactly what I was going to jump on and say Mike is that there's.
James Ebert: As part of the offline verification, you have to be able to cash those.
James Ebert: Those things, and then the second thing that i'd say that seems obvious but also there needs to be the.
James Ebert: Transport support in the framework.
James Ebert: And that's not always necessarily.
James Ebert: been feasible, since our focus has been on http and web sockets.
James Ebert: And also sometimes the frameworks are assume Internet connection.
James Ebert: So.
James Ebert: there's certain levels of framework needs to adapt for.
James Ebert: additions need to be added.
James Ebert: And then the other thing I was going to mention was that Stephen had asked is so I know at least with FDA it supports mobile verification because that's what we utilized in the party, a project was.
James Ebert: A fj for the verification portion on the mobile in a mobile context.
Sam Curren (TelegramSam): So one of the things that strikes me for verification as it relates to.
Sam Curren (TelegramSam): machine readable governance is that.
Sam Curren (TelegramSam): let's say I run like a i'm running like a film festival or something and I want to use credentials to do that, and so I have you know people with phones that are verifying you know tickets to their maybe i'm not using the movie theaters normal ticketing system.
Sam Curren (TelegramSam): I might have a heard a verifiers that i'll represent the organization and not just one, which means that, from a machine readable governance perspective.
Sam Curren (TelegramSam): We may need more advanced verify our authorization than than we do in a more simpler case.
Sam Curren (TelegramSam): It meaning.
Sam Curren (TelegramSam): there's the existing way that we have exercised from machine readable governance has has a list of allowed verifiers.
Sam Curren (TelegramSam): And, and if you're in the list here in the list that that could work here.
Sam Curren (TelegramSam): One of the the second or the sort of the second order ways of doing it is that you say anyone that has credential X from this particular issuer is an authorized verified.
Sam Curren (TelegramSam): And so that that might be useful, because you can state that in the machine readable governance file and then you can issue that credential to people that are.
Sam Curren (TelegramSam): That ought to be authorized to be verifiers in an easier way, meaning a new volunteer shows up and you say, well, can use your personal phone and they say yes, so you issue them a credential it says you're an authorized verified to represent.
Sam Curren (TelegramSam): The film festival and and that way you're not necessarily updating the governance file, for you know, every time you add someone, but you can still check to see if it's if it's an authorized person, and so the.
Darrell O'Donnell: Guy jumped in for a second.
yeah.
Darrell O'Donnell: Are we here to agenda mobile stuff we're talking about machine readable governance mean I get did you can get your list of issues, your list to verify from governance, but is the issue here.
Darrell O'Donnell: Working on the machine readable governance filing caching and mobile, or are we shooting through the mobile bigger picture issues.
Sam Curren (TelegramSam): Well they're related here, in the sense that.
Sam Curren (TelegramSam): If we want to do offline verifications and need.
Sam Curren (TelegramSam): stuff to be cached then there's there's you know we need.
Darrell O'Donnell: But there's any number of strategies like we're on the on the one of my clients government is going to be building that into the APP itself, because to very slow moving list of issues initially.
Darrell O'Donnell: They will likely move on to trust registries or a machine readable governments format, but that's kind of a given you need to cash and stuff if you want to work offline and or peak performance.
Sam Curren (TelegramSam): So if if you're frustrated that you feel like we've pigeon holed on something like please suggest an alternative but there's been no declaration of have only one approved strategy here it's just the only thing that's been suggesting.
Darrell O'Donnell: See if there's a pigeonhole me right here it's it's under a concept called machine readable government, as opposed to.
Darrell O'Donnell: you're going to need to cash for performance and for offline use what do we need to cash hey here's a possible solution we call it.
Darrell O'Donnell: In machine readable governance, you have your other option if you want, whether the bigger picture to me is the mobile need for caching for performance and offline years, so it makes sense, just trying to put in the right pocket.
Sam Curren (TelegramSam): Totally yes, and I appreciate you calling out something that you see as being not represented, either in the notes or verbally very well.
Mike Ebert: i'm i'm by no means a mobile expert, I just have a need there, so I throughout the entire concept of machine readable governance and I do appreciate the help to figure out which pieces go where we definitely need caching.
Mike Ebert: I don't know what else, so I will mention caching and then we'll figure out which other pieces later, and we can focus on the mobile stuff for certain.
Darrell O'Donnell: awesome.
Sam Curren (TelegramSam): machine readable governance has been talked about is being able to use for caching information, so you can know things in advance what.
Sam Curren (TelegramSam): What other mechanisms do we.
Sam Curren (TelegramSam): want to enumerate about caching specifically.
Darrell O'Donnell: Trust registry protocol.
Sam Curren (TelegramSam): And that's something that can work offline.
Totally.
Sam Curren (TelegramSam): Okay, so a centralized thing like address registry is but as possible.
Darrell O'Donnell: me to send flowers to.
Her.
Mike Ebert: I have guidelines around when to refresh sometimes you could say catch me for a long time or.
Darrell O'Donnell: The time time to live.
Mike Ebert: to live.
yeah.
Darrell O'Donnell: what's nice about these ones is, these are well known patterns our job here to me, the important part for us is what's unique about the.
Darrell O'Donnell: SSI approach the did calm and or verifiable credential portions of those that we need to consider the caching either for performance and or offline use the, how do you do it well known, where do I get the data from again that's another option there's different options there.
Horacio Nunez: Shall we also talk about like having a the ability to report properly to a client where.
Horacio Nunez: When when they don't need the happy path like.
Horacio Nunez: I think, like a, especially in the case of like going into like an entertainment place right, it was like something wrong with your ticket you don't want to get like a technical issue right like I think like part of this task is also.
Horacio Nunez: making sure that the ux is meant to be as good as if you were online.
Sam Curren (TelegramSam): So the ux of the verify or the ux of the of the holder or both.
Horacio Nunez: Both yeah I think I mean I I think like when we talk about like connections and the and the exchange of data right which will have like a.
Horacio Nunez: layer that is like a reflective that is easy for anyone building a wallet to guarantee that they will be able to provide all of the details to the person holding the creation.
Horacio Nunez: I mean like if we're talking about like a machine readable a government system right, I think that this should be a concern.
Sam Curren (TelegramSam): So so clear user experience for both the holder in the verify or so that.
Sam Curren (TelegramSam): For the non happy path right.
Horacio Nunez: Yes, yeah, and this should be something that is easy to.
Horacio Nunez: To translate I mean, like, for example, if I, if I have like a dictionary of like Portuguese, I can make it a work without having to do like like new work with like something that was build your store and just for English.
Sam Curren (TelegramSam): So internationalization and localization are key to expanding a broad user base if your use cases one where that's going to be useful.
Horacio Nunez: yeah I mean I keep in mind that most of the phones and, like the phone system they already have support for it's like like nobody is going to take an excuse if.
Horacio Nunez: I mean like if you're more of a hassle a a global appeal appeal the Rover on the House a one language right that's not something that people are used to now.
Right.
Sam Curren (TelegramSam): Other aspects of mobile verifiers.
Horacio Nunez: yeah I like the ability to convey to the user, in which portion of the flow, they are.
Horacio Nunez: Important I think like when we talk about is where we are always using the technical terms right like we're like establishing a connection with like exchanging a credential but.
Horacio Nunez: We don't have like a universal progress bar that can tell the user, where they are when something doesn't work right like the ability for someone to ask for help right this I mean it's like a non existent right now.
Horacio Nunez: Like I don't know like a if if people have us here type form a lot, they have like a universal way to tell you, like how deep into the process, you are, I think, like that will make up stuff super clear.
Horacio Nunez: For people, especially when they deal with like have like a government system and.
Sam Curren (TelegramSam): I love the idea of universal progress bar Stephen your hands up.
Stephen Curran: yeah um.
Stephen Curran: yeah certainly that that is more a ux and something we should be thinking about and building I like that on on the mobile side.
Stephen Curran: The performance is a big deal here so.
Stephen Curran: You know the amount of back and forth, I was thinking about.
Stephen Curran: close to his comment and and this idea of the.
Stephen Curran: holder initiated.
Stephen Curran: Presentation exchange and how quickly you know it's one thing to say, oh select a credential and my wallet producing qr code.
Stephen Curran: And then have the.
Stephen Curran: Have have have that initiator proof request.
Stephen Curran: Excuse me, but about how quickly that.
Stephen Curran: falls apart as soon as you need some some combination of credentials boy that you know you're proving your proof of vaccination but you don't have.
Stephen Curran: A driver's license you have to use some other or you're from out of state.
Stephen Curran: And you need to use some other driver's license not issued by the current jurisdiction and so on, like it really falls apart quickly as soon as you want to combine multiple things in the same one, so it really does push me into this idea that you.
Stephen Curran: You you far more wanting to just not have to find what credential you want to present but really just say Okay, this is me so present a qr code that says, you know let's establish a connection, so you can send me, whatever it is you want, and I can respond to it.
Stephen Curran: So sort of wandered off the you know the path, but back to that.
Stephen Curran: combination of things of.
Stephen Curran: That it's much better for the verifiers to ask.
Stephen Curran: Rather than the holder to to to do much more than propose they shouldn't just present a credential or a proof.
Sam Curren (TelegramSam): For full on agree one of the things that I think this can be assisted to have common targets by like governance or trust registry, so that.
Sam Curren (TelegramSam): For example, if I if I know if I, if I have some some guidance ahead what i'm going to be asked, then I can pre authorize something that's likely to be a thing.
Sam Curren (TelegramSam): The cool part about this is that, even if you pre authorize a set of things and I say i'm i'm willing to present you know.
Sam Curren (TelegramSam): schema a and you show up with schema be we can still handle that meaning you prompt the user and say hey you authorize day but they're asking for because that's still okay.
Sam Curren (TelegramSam): And it's still handles that we can still make sure the user is never sort of blindsided or unexpectedly share something that they didn't anticipate.
Sam Curren (TelegramSam): So, having common targets like this, I think could be useful, I think there's also some sort of Meta level where you can say i'm willing to present my ID given any of the.
Sam Curren (TelegramSam): Governance frameworks or trust registries that i've that i've agreed to abide already.
Sam Curren (TelegramSam): And so I can sort of Meta approve of a variety of those as a smoother user experience and then, if any of those you know falls into any of those separate things on my system, then it will work if it doesn't then, then I can be prompted.
Darrell O'Donnell: and your wallet can say this is normal or hey this is weird or this is weird would you like me to report them.
Sam Curren (TelegramSam): sure.
Sam Curren (TelegramSam): yeah like I advise this I don't I I advise not to do this, you know I mean browsers, for example, have have been more opinionated about things.
Sam Curren (TelegramSam): You know, with first when you went to an invalid site with an invalid CERT they would change the little icon and the little lock icon.
Sam Curren (TelegramSam): Then they got to the point where they would warn you, but you had to click a bypass button you sometimes now you gotta you gotta click a bypass button and type something in to get it to let you access that.
Sam Curren (TelegramSam): And so they're still not totally preventing you from doing it, but they're trying to make it obviously harder for things that they think are a bad idea, and I think agent software can have a similar opinion and advise users in similar ways.
Sam Curren (TelegramSam): James your hands up.
James Ebert: yeah I was just gonna add in another one of the things that we do have a third with the Aruba trial and then, subsequently idea was that the.
James Ebert: upon the first presentation of of a trusted traveler potential, we would be able to have to approve that and.
James Ebert: review that presentation that at the end of that presentation we would.
James Ebert: Give them the option to automatically present that in the future, not requiring.
James Ebert: Re approval.
James Ebert: assuming it was specifically that credential so.
James Ebert: That gave a chance for the user to.
James Ebert: Look at the nitty gritty details, the first time, but then they know what's happening so that could be improved in the future.
Sam Curren (TelegramSam): So I could save my authorization allow this to be done in the future i'm not obviously not using good ux terms, but from a technical perspective once they've gone through it, they can say if they asked again i'm willing to give the same information.
yeah.
Sam Curren (TelegramSam): But for like a frequent traveler I think that could be.
Sam Curren (TelegramSam): Frequent right, I mean that could that could that could smooth the whole process over.
Sam Curren (TelegramSam): yeah yes.
Sam Curren (TelegramSam): good idea.
Sam Curren (TelegramSam): So some some trends i'm sort of pulling out just by seeing this there is.
Sam Curren (TelegramSam): A level of framework support needed for various things transports other sorts of formats that need to make happen.
Sam Curren (TelegramSam): standards around you know, we have more published, not a ton but more published about machine readable governance than I think i've really seen about trust registry protocols so some more information about that may be helpful.
Sam Curren (TelegramSam): and continually ux work as we figure this out, I think could be could be useful.
Sam Curren (TelegramSam): And I would love to see ble support.
Sam Curren (TelegramSam): developed, I think that this would be incredibly powerful.
Sam Curren (TelegramSam): For those offline use cases in the sense that.
Sam Curren (TelegramSam): You know, you can you can pass information back and forth in a relatively rapid manner, without any infrastructure needs at all, really.
Sam Curren (TelegramSam): And I think that that would be pretty great Oh, thank you there apparently type is where the trust register registry protocols are being developed so there's a link there Thank you Darrell for that.
Darrell O'Donnell: I might know the guy.
Darrell O'Donnell: Are you the guy that's excellent guy.
Sam Curren (TelegramSam): Nice James your hand is your hand up again, or was it up for before.
James Ebert: it's up again, I wanted to call out and have a have a question if.
James Ebert: There may just want to use the standard practices from other industries and such but to mike's point of having auditing requirements for mobile verifications so, for instance.
James Ebert: If i'm going into a restaurant and they need to verify coven.
James Ebert: reporting that is potentially not.
James Ebert: life or death kind of thing, however, in a different context, like your board at boarding a airplane they likely, want to have some kind of audit log on that, is there a mechanism that that should be, or could end or should be done in a mobile verify or context.
Darrell O'Donnell: I think there certainly is the question is, is it our problem to solve, we had a sheet on that exact trust registry protocol.
Darrell O'Donnell: We started getting pushed into areas, you know you must make sure you secure your API and stuff it's like you need to follow your own industry best best practices.
Darrell O'Donnell: If you have a legal obligation to do that good do that but it's on the verifiers side of the fence unless there's something that clearly needs to be done.
Darrell O'Donnell: In the mobile itself me they just need to cash and when they get back to connect connectivity it spits out and synchronize, which is also a well known thing now.
Darrell O'Donnell: Let make sense.
Mike Ebert: thumbs up.
Darrell O'Donnell: As if we're trying to do too much.
Darrell O'Donnell: we're gonna end up.
Darrell O'Donnell: there's what we did I can't tell you how much time we spend on the freaking.
Darrell O'Donnell: Securing the API i'm like oh my God, this is a somebody else's problem and it's a well known industry thing.
Darrell O'Donnell: Our province figuring out, what are the key piece of information that needs to flow here, and if there is something on the mobile fair fire that's unique to the SSI room.
Darrell O'Donnell: We should definitely raised that here, I just not sure I can't think of anything but as many would know i'm sure saml support me on this, I might have deep thinker on some things.
Darrell O'Donnell: I sent.
Sam Curren (TelegramSam): me this tea that went up Darrell.
Darrell O'Donnell: Now isn't doing give me rights too easy.
Sam Curren (TelegramSam): too easy there's no.
Sam Curren (TelegramSam): there's no there's no accomplishment in an easy victory no So what are the things that I was thinking about this was that.
Sam Curren (TelegramSam): I to go back to my example of a film festival, and it would be nice.
Sam Curren (TelegramSam): This isn't something that necessarily has to be standardized but i'm thinking about it from the perspective of the film festival running my own mobile.
Sam Curren (TelegramSam): verifiers it would be kind of Nice to report back the things that I verified as a mobile device, you know either now or maybe I I sort of catch that because the network's down because 5000 people showed up in a small town, and I can.
Sam Curren (TelegramSam): Catch that and then report back using some protocol to the main organization to say hey here's the ones that actually verified.
Sam Curren (TelegramSam): In that way, that you know, the main work might do that they did that I don't think that's critical to making the whole thing work but it might be an important thing to sort of think about from the aspect of mobile verifiers and having people.
Sam Curren (TelegramSam): Like the pattern, if you will, of using a mobile verify that represents some organization.
Darrell O'Donnell: Or perhaps them if there's a way, we can do this, that is, you know minimal surveillance minimal privacy correlation etc that there's a best practice that is SSI centric and is unique.
Darrell O'Donnell: and needs to be considered, maybe that's something we also need to raise.
Sam Curren (TelegramSam): So, like how to do auditing in a in the most minimally disclosure way possible yeah.
Sam Curren (TelegramSam): I think I think that can be really useful and there may be a time to do that, I also think that a film festivals well within the rights to sort of keep track of how many people actually showed up to.
Darrell O'Donnell: Each individual film right.
Sam Curren (TelegramSam): And that isn't necessarily a.
Sam Curren (TelegramSam): memory, it may be that it doesn't have pii in the credential but they have like oh here's the ticket ID that actually showed up or something like that it that is correlating but.
Sam Curren (TelegramSam): How do you then is being persistent.
Clecio Varjao: I have yes Min Max has to be working.
Clecio Varjao: Right now.
Clecio Varjao: On the physical world there's a difference of thing I show my ID I have confidence that that information I can't see how my ideas being used if it's just being used for verification, yes, somebody look at it, or somebody is taking a copy of it.
Right.
Sam Curren (TelegramSam): yeah and I think that there's some right answer there in in sort of policies flows governance.
Sam Curren (TelegramSam): rules.
Sam Curren (TelegramSam): That are expected on on multiple parties.
Sam Curren (TelegramSam): You know, for that, for example, if I if i'm presenting my you know citizenship credential at the border i'm kind of assuming that governance like logging that somewhere right.
Sam Curren (TelegramSam): But having that up front to say hey they they're persistent is or this is someone who's agreed not to persist, the information you're presented.
Sam Curren (TelegramSam): You know, would be would be nice to know, and I think that there's a there's a variety of things that I think could help there as we.
Sam Curren (TelegramSam): know this is a level of sophistication that I aspire to in our industry in the sense that I hope this becomes our biggest problem.
Sam Curren (TelegramSam): Because it means we have solved some other ones, and so, but, but I think that there's a handful of things, it would be nice to know in advance, in which case you know things like a credential manifest.
Sam Curren (TelegramSam): could be useful there or certainly something like a machine readable governance, which may lead to a manifest or some.
Sam Curren (TelegramSam): Some sort of trust registry feature that allows you to sort of know in advance what you're agreeing to I think is really useful there's also the opportunity to.
Sam Curren (TelegramSam): get more clear with the credential exchange protocols that we have not only of what I want, but some sort of indication of what I plan to use it for.
Sam Curren (TelegramSam): there's a data sharing agreement protocol that that i've been reading through and considering that that does similar sorts of things where where you might they can disclose and you have to actually agree to some sort of policy.
Sam Curren (TelegramSam): For that day to use in advance, and I think that there's good opportunities there.
Clecio Varjao: yeah and since we're talking about this mobile verify, I think that.
Clecio Varjao: That base will require some level of governance dad that identified trust that the verifiers falling some starts falling governance funding policy and.
Clecio Varjao: dad wouldn't necessarily be a technical point of view, be more of a yes ma'am verify i'm a good i'm following the good thing if i'm asked if I sent that i'm not starting and i'm not starting right.
Right.
Sam Curren (TelegramSam): Totally Stephen.
Sam Curren (TelegramSam): you're muted.
Stephen Curran: I am.
Stephen Curran: Sam somebody a couple of people are trying to join and they're getting a message they have to join zoom to be able to participate, can you see security setting right now that you can adjust.
Sam Curren (TelegramSam): I will look.
Stephen Curran: Okay, I mean it's other than you know just adjusting as a security section there's nothing we can do this week, but we'll have to look for that for next week so.
Sam Curren (TelegramSam): So the meeting is not locked there's no enabled waiting room.
Stephen Curran: looks there's have a.
Stephen Curran: confirmed email address or something like that they're saying so, a couple of people have posted on the Aries working growing list.
Sam Curren (TelegramSam): Thank you for keeping an eye on that number one number two.
Stephen Curran: Okay yeah casino had to register, I have a zoom account.
Stephen Curran: So anyway, if you could look at that.
Sam Curren (TelegramSam): I will I don't think that's solvable.
Sam Curren (TelegramSam): During this meeting, unfortunately yeah.
Okay.
Stephen Curran: Second issue that I wondered is.
Stephen Curran: Are we, at a point we could start to say Okay, what are the action items we can take with.
Stephen Curran: With offline verification.
Stephen Curran: there's a few things here we can we can start to say okay can people pick up some things.
Stephen Curran: Obvious ones for me or things like what is the user experience flow if you're doing you know what is it verify or look like is a verify or a separate APP or is it part of, say, areas by fold.
Stephen Curran: or Aires Max is that the type of thing we can get to in this topic.
Sam Curren (TelegramSam): I would like to.
Sam Curren (TelegramSam): So I, this is the so what we've talked about a lot of different aspects of mobile verifiers I think the discussion itself has been useful, but is there something more concrete about it, we can pull, I think, is what you're saying saying Steve yeah yeah.
Sam Curren (TelegramSam): So.
Stephen Curran: I didn't cut off conversation by doing that i've got.
Sam Curren (TelegramSam): No, I was, I was hoping to get there soon.
Stephen Curran: yeah okay good.
James Ebert: The two of the biggest things that I would see that our needs are the.
James Ebert: The transport level so ble.
James Ebert: And then the caching mechanisms.
James Ebert: Both of those are going to be definitely very framework specific.
Stephen Curran: yeah one thing I wondered is if someone the answer i've always given about whenever people ask me a ble is go talk to.
Stephen Curran: Timo so one of the things i'd like to see captured and nfc same thing, I think, would fit in the same category.
Stephen Curran: would be Could someone take the action to write up.
Stephen Curran: The state of.
Stephen Curran: ble nfc offline interactions and and produce a document that we can publish somewhere.
Stephen Curran: Maybe it's a concept rfc there is rfc that sort of talks about where we are with that.
Sam Curren (TelegramSam): This that could be really useful.
Sam Curren (TelegramSam): So we summary of existing state of ble would be useful, like where are we, you know, like we've got some work that Timo at all, have done.
Sam Curren (TelegramSam): But are there any actual code implementations etc and sort of knowing like where we actually are on these on these.
Sam Curren (TelegramSam): Various timelines would be useful.
Stephen Curran: Even if there's no code implement you know implementations how far did.
Stephen Curran: I think it was global crypto I believe and and tivo ANIMO did some work, so you know how far did they get.
Stephen Curran: What what did that you know, even if they don't have an implementation what is what knowledge, did they gain that that's the big thing.
Right.
James Ebert: i'm Sam I know that you had communicated implementation that was done.
James Ebert: With ble I don't recall, who had done that, but I remember you reporting on that.
James Ebert: In one of the Bible calls.
Sam Curren (TelegramSam): The only thing that i'm aware of is the work that team of is done I don't know anyone that's actually produced working code based off of that.
James Ebert: um and partially to the question i'm not sure if there's been too much beyond that one more important that you mentioned was this is the the spec that was put together for.com bluetooth that.
Sam Curren (TelegramSam): Yes.
James Ebert: He must win him yet so i'm not sure if there's too much beyond this that has been done, but.
Stephen Curran: that's excellent that's a good at least you know, having a reference to that.
Stephen Curran: Next word.
Stephen Curran: is all about that.
Sam Curren (TelegramSam): So this has been defined in and appears to be like I know just enough about bluetooth to be dangerous.
Sam Curren (TelegramSam): But, for example, having like identifiers for the service you ids etc are something that I know is necessary, and those are in here, so this appears to be and here's some at some example of like message sizes, etc.
Sam Curren (TelegramSam): And so you know there's some discussion of kind of how to do it here.
Sam Curren (TelegramSam): I this appears to be a pretty good investigation of what's actually required.
Sam Curren (TelegramSam): For the in the case of nfc I don't know that anyone's actually produced a document like that what is it actually capable of what What did the mode mobile os is support.
Sam Curren (TelegramSam): Since we're talking about mobile verifying.
Sam Curren (TelegramSam): What what what sort of possibilities exist there there's what the protocol supports and then there's what you can do easily with what the tools that we have, which in this case is the mobile so.
Sam Curren (TelegramSam): Mobile OSS and what they actually support.
Sam Curren (TelegramSam): I know that from from an nfc thing that that ios has been slightly late to adopt some of the things that android had for a while, but I don't know if they've gone beyond and added some other things, or.
Sam Curren (TelegramSam): Or can you do more than just sort of read something quickly nfc could be used as a way to bootstrap and into ble.
Sam Curren (TelegramSam): But could it be used to actually go further to actually pass information back and forth across nfc I know that's theoretically possible because of how you know.
Sam Curren (TelegramSam): contactless credit cards work, but I had I know nothing about what the limitations are or anything else, and so so information about how nfc might work I think could be incredibly valuable to that discussion.
Sam Curren (TelegramSam): um I think that I think that the the summary of existing state another one could be an MC is sort of previously committed to doing this at some point but.
Sam Curren (TelegramSam): But it talks about how machine readable.
Sam Curren (TelegramSam): Governance.
Sam Curren (TelegramSam): is currently being used.
Sam Curren (TelegramSam): There is some rfc that one big one, written by Daniel hartman that describes like the possibilities for something like this, but it's it's very much a let's paint a big sky thing.
Sam Curren (TelegramSam): and not necessarily like a brass tacks like here's what's actually being used and so that that could, I think, be useful.
Mike Ebert: yeah need a few weeks we'll we'll work on that, though.
Sam Curren (TelegramSam): um any other volunteers for some of the the investigation or reporting back to the Community on the status of these sorts of things.
Stephen Curran: i'm a quick question is.
Stephen Curran: ble nfc in.
Stephen Curran: Are those.
Stephen Curran: Realistic to do, or is it just too fiddly and documents for humans to.
Stephen Curran: enable a connection using those two technologies either of those two technologies like is it practical to tell a person oh you're going to like I don't even know what.
Stephen Curran: What the process would be i've never done it and and don't know what it was, I remember there used to be that APP that you tap two phones together, and it would.
Stephen Curran: transmit information that was pretty easy.
Stephen Curran: Is that.
Stephen Curran: Is that a.
Stephen Curran: level of level of capability we're talking about.
Sam Curren (TelegramSam): Sebastian your hands up.
Sebastian Bickerle [lissi@Main Incubator GmbH]: yeah so I mentioned nfc actually because I used it in a hackathon or last week.
Sebastian Bickerle [lissi@Main Incubator GmbH]: To kind of initiate connections presentation request and I just liked the user experience somehow it's actually I was using android.
Sebastian Bickerle [lissi@Main Incubator GmbH]: And the ratio how the state is an ios, but it was like yeah only tapping the mobile device on.
Sebastian Bickerle [lissi@Main Incubator GmbH]: tech and it just read the connections presentation requests and with another click on the APP I was able to make my presentation, and this was just from a user experience view was really something that I liked and so yeah.
Sam Curren (TelegramSam): yeah Sebastian or would you be willing to to publish or share some of that information about nfc stuff.
Sebastian Bickerle [lissi@Main Incubator GmbH]: I can.
Sebastian Bickerle [lissi@Main Incubator GmbH]: I will, I will, so the meetings on a weekly basis right I missed the last one so.
Sebastian Bickerle [lissi@Main Incubator GmbH]: Yes, the next meeting.
Sam Curren (TelegramSam): Well, these are every week but we're sort of moving through topics what i'm hoping that we can do is report back to the Community is.
Sam Curren (TelegramSam): We can either report back in the main areas call, but I, but even before that I think the sharing within the Aries either the mailing list or, even better, the.
Sam Curren (TelegramSam): The rocket chat channel I think is a good way to sort of share and surface that information and that way we can get to it as much as possible, I don't.
Sam Curren (TelegramSam): it's possible that you know after we go through a couple more weeks and sort of bringing up topics that we'll have time for people to.
Sam Curren (TelegramSam): circle back and report on previous things that they reported on that could be really useful but I hate to wait to that so if there's something that you can share.
Sam Curren (TelegramSam): Online either a video or a link or something that kind of walks through this, I think that that might be a faster way of getting the information out there.
Sebastian Bickerle [lissi@Main Incubator GmbH]: No yeah so actually one of my colleagues, made a video from last week.
Sebastian Bickerle [lissi@Main Incubator GmbH]: But I don't have it right now and there's also there was one drawback so actually use the static on other static presentation request, but the.
Sebastian Bickerle [lissi@Main Incubator GmbH]: Most of the transaction or communication was still over the Internet and well, it was mostly because we didn't understand the iot device or the nfc writer.
Sebastian Bickerle [lissi@Main Incubator GmbH]: Completely at the hackathon didn't have enough time to investigate, but I saw examples of this, for android.
Sebastian Bickerle [lissi@Main Incubator GmbH]: Based on android team I think it's the technology, well, it kind of submit or transmit arbitrary data which kind of feel led me to the idea that should be possible to actually have to hold that conversation or communication through nfc at least one foot.
Sam Curren (TelegramSam): Right, I know that some of the android stuff.
Sam Curren (TelegramSam): starts with nfc and moves to bluetooth it uses nfc to to transfer bluetooth information to start there I don't know if all of it is done that way.
Sam Curren (TelegramSam): But in, and I want to clarify that, when we asked for like.
Sam Curren (TelegramSam): Help or someone that can report we're not looking for like a magical solution we can all instantly implement just knowing where we are is incredibly useful, so if there's things that you've learned that work and things that you learn that don't work.
Sam Curren (TelegramSam): Those would be wonderful things to know about just not just to you Sebastian but all of us as we're trying to report back to the Community.
Sam Curren (TelegramSam): So thank you.
James.
James Ebert: yeah i'm just to your question, Stephen on Is it actually viable.
James Ebert: One of the things with ble because we did do a little bit of.
James Ebert: work into it.
James Ebert: Is that, in theory, you should be able to do.
James Ebert: you're just providing a different.
James Ebert: Additional service and your invitation, which means that and that's what allows you to earn a lot of hook allows the phone to identify which ble services to actually talk to.
James Ebert: which, in theory, should make the user experience pretty seamless in terms of oh i'm offline I hit the offline.
James Ebert: checkbox or toggle or whatever, and then I just scan the qr code it flows, as it did previously.
James Ebert: I think there's a couple of nuances in there that we don't necessarily know, but I think it would be viable.
Sam Curren (TelegramSam): I agree with James and that i'm.
Sam Curren (TelegramSam): Like 96% sure that the user experience of bluetooth could be amazing, even in cases where you don't have to.
Sam Curren (TelegramSam): Because you can advertise and you can sort of.
Sam Curren (TelegramSam): detect bluetooth services and the types of services they offer prior to connecting with ble I think you could.
Sam Curren (TelegramSam): end up with scenarios, where you are prompted or something is made easier, because you happen to be physically close in order to make that happen, and obviously there's some ux stuff that we need to gain experience with with the technology but.
Sam Curren (TelegramSam): For example, I know that you don't have to like go deep into the settings of your phone and click something in order to make it happen like it is you know with default phone configurations, it can just happen and makes sense.
Sam Curren (TelegramSam): which I think is very cool and so.
Sam Curren (TelegramSam): Yes, you would, for example, be able to detect that there is a ble device nearby that offers a did calm service that's that this is ble terms.
Sam Curren (TelegramSam): Like the service descriptor and over and then you could you could prompt that you could either automatically if the user has configured so are your APP does it sort of discover and receiving and retrieve a credential from the other party.
Sam Curren (TelegramSam): In advance of even prompting the user to say hey here's the connection that's authorized to interact behalf of you know, on the music festival or with whatever and you could, and then you can you know.
Sam Curren (TelegramSam): Begin that interaction, having already exchanged credential with the other party and knowing who they are so there's there's some some cool aspects there that I think would be useful.
Sam Curren (TelegramSam): Again, like from person to person perspective, you we may or may not want to do that, but from a service perspective there generally isn't a privacy problem with with sort of revealing or sharing those types of credentials, with more or less anyone who wants them.
Sam Curren (TelegramSam): You know if you're walking up to a border patrol checkpoint or you're trying to enter a film festival or something like that lots of those interactions I think we made very good.
Sam Curren (TelegramSam): Okay, so Sebastian is going to teach us a little bit about about that we have a link here for ble if there's anyone with more experience that would be awesome and then i've leaned on Mike for the.
Sam Curren (TelegramSam): For the machine readable governance thing and a few weeks we already have a link for trust registry protocols are there other things that folks would would like to suggest or volunteer to as an action item before we move on to the next topic.
Darrell O'Donnell: i've got two quick ones one we did a presentation on trust heard industries were covers a lot of these issues it dovetails nicely with the machine readable governance, so I shared that on rocket chat another item.
Darrell O'Donnell: Let me just connect it is going to send you a link, one of the things we're having this discussion right now it's kind of.
Darrell O'Donnell: got a guy gets it's only Tuesday get to use the word orthogonal it's orthogonal to our discussion, but.
Darrell O'Donnell: One of things we're doing a trust over IP is going through the technical technology architecture and it really dovetails nicely with the exact discussion we're having i'm going to share you a link right now, if you could just got to find the.
Darrell O'Donnell: Page wait, I need to present it properly.
Darrell O'Donnell: interview.
Darrell O'Donnell: Because I think it enters this exact discussion going back fun zoom I got.
Darrell O'Donnell: Everyone.
Darrell O'Donnell: This is the new kind of the one of the diagrams we're working towards.
Darrell O'Donnell: Go to go to sorry it didn't go exactly where I wanted you to.
Sam Curren (TelegramSam): Oh, it just jumped to 62.
Darrell O'Donnell: Okay perfect perfect.
Darrell O'Donnell: So the idea here is is is that you know we're doing did calm we're having this discussion, if we look on the transport block in layer one.
Darrell O'Donnell: we've been doing web sockets https someone at some point is going to do raw tcp IP.
Darrell O'Donnell: And someone is also going to be doing bluetooth nfc and stuff and it would be amazing to understand you know, one of the fundamental differences there you know, like to the point, what are those limits of nfc where the box, what can we not do.
Darrell O'Donnell: To the point that you know didn't come over smoke signal will never work, so we should never even tried or something but.
Darrell O'Donnell: it's also just to make you folks aware that we're having these meetings that happen on Thursdays and some of the architects on this call would, I think, be extremely valuable to have their that's it done selling the trust over IP.
Darrell O'Donnell: stack diagrams.
Jason Leach: i'm going to link it here Darrell.
Jason Leach: Jason Oh, can you just describe what you mean.
Jason Leach: By machine readable governance with the objectives.
Sam Curren (TelegramSam): Yes, I will attempt the I know Mike is trying to multitask at the moment, so let me take a stab at he can correct me if if necessary.
Sam Curren (TelegramSam): The idea that Daniel wrote about with machine readable governance is that.
Sam Curren (TelegramSam): it's a mechanism that can be used to solve the root of trust problem, the root trust problem, basically, is a great you give me a credential but how do I know that you're a good person to give me the credential and so a machine readable governance file can be published by an organization.
Sam Curren (TelegramSam): Really by anybody, but the idea is that if you if it's trusted if it's published by an organization that you trust, then the machine readable governance file can be used to either advise or make automatic decisions based on.
Sam Curren (TelegramSam): Based on the contents of the file, for example, who is an approved issuer within this governance framework or which schemas.
Sam Curren (TelegramSam): are common for either issuing credentials or for presenting credentials and and it's a file that can be used by the all the participants Internet interaction to sort of help set expectations and make that work and the Daniels.
Sam Curren (TelegramSam): machine readable governance rfc it's a it's deeper read and it's a conceptual rfc has been linked by Stephen in the chat and Mike your hand is up, thank you for helping to clarify whatever i've said that's poorly done.
Mike Ebert: Now you're you're really close, I just wanted to emphasize that it's not just about roots of trusting agents, but that we're.
Mike Ebert: we're also attempting to gather things like you said, the schemas the presentation definitions, some of the actions or workflows the steps that are taken.
Mike Ebert: ways to you know, say, not only as a someone who can be trusted but are they acting in a way that is that they're meant to that's you know that they agreed to ahead of time that people can rely on us, you know, following the rules.
Just a little extra they're.
Sam Curren (TelegramSam): Raised up.
Jason Leach: A couple of us from the provinces like BC Ontario for sure going to take just take a look at overlaid capture architecture to see if it's helps improve the annotations of.
Jason Leach: A non credits from using the term correctly I don't know if this dovetails into any of this work, or if we should talk more but i'm just throwing it out there because.
Jason Leach: What we I think what we want to see is like when it credentials issued right now it's a little tough to figure out who actually issued it without like maybe doing some obscure look up on the blockchain to see if some.
Jason Leach: suggested fields are filled in and similarly like what kind of credential are you are you a driver's license are you a something so when you're presenting a credential to the user you don't have to rely on like parsing schema.
Jason Leach: schema stuff to actually figure out what it is and so we're looking into it for that reason, if it dovetails maybe we should get it on the combo if not we'll just do our own thing for now and report back when we have some more information to share.
Sam Curren (TelegramSam): I think it would dovetail nicely I think they're they cover to some degree, different aspects of the of the problem, but I think that there's likely to be some very, very useful overlap that you discover.
Sam Curren (TelegramSam): Also, thank you, Stephen for adding to the notes when i'm not that's presented.
Sam Curren (TelegramSam): So So yes, I would love to report back your success there i've always liked the idea behind the overlay captures architecture and always been entirely overwhelmed by the scope of everything that involves one of the things that I personally would love to see is maybe like.
Sam Curren (TelegramSam): hey here's a slice that we're able to use and here's the value that it provided and we're able to do this without like boiling the ocean, and that would be wonderful.
Sam Curren (TelegramSam): Stephen your heads up.
Stephen Curran: A couple more things on the.
Stephen Curran: Existing state or sorry action items.
Stephen Curran: One would be somebody to think about and sort of perhaps raise an issue and say fj or something like that on.
Stephen Curran: How to basically inject.
Stephen Curran: Presentation requests.
Stephen Curran: into a into a a deployment.
Stephen Curran: In other words, nobody is going to construct a presentation request using an API using a mobile interface or anything like that they've got to be there.
Stephen Curran: so that they can choose to use them right something like that, and so how is it that presentation requests get managed inside a framework so that might be a framework thing.
Stephen Curran: And then the second part of that is then.
Stephen Curran: Then, then you're getting into the user experience, which is assuming you have some presentation requests.
Stephen Curran: specified what is the user experience for mobile verify or to say Oh, I want to get this.
Stephen Curran: I want a proof of this from whoever i'm verifying So what is the user experience look like.
Stephen Curran: Is that does that combination of things, make sense, so how does.
Stephen Curran: yeah technically do we inject.
Stephen Curran: templates for proof requests and then, how does a verify our request that and and perhaps you know, a use case like a you know, a lineup like cossio said, your job is to collect.
Stephen Curran: proofs from a lineup of people as quickly as you can, how do you do that.
Sam Curren (TelegramSam): I think that you make a good point is that no one's going to craft their own right.
Sam Curren (TelegramSam): So um or that would be you know sort of very confusing, but it would be really, really common for a mobile verifying to say hey like which ones are sort of pre written that I can select exactly.
Sam Curren (TelegramSam): So, for example, if I walk up to volunteer to the film festival, and they could say yep and they give me a credential to authorize me to do so.
Sam Curren (TelegramSam): And then, I have a quick link that I either tell me about or I reverse somehow I discovered.
Sam Curren (TelegramSam): That says hey here's a here's the types of verifications and now, because I have that credential I can now play in that role, and my mobile APP can you basically sort of pre select that that that template or the the the defined verify or.
Sam Curren (TelegramSam): You know the the presentation request from the verifiers perspective to then engage with other people to make that happen.
Sam Curren (TelegramSam): So that's that's an excellent question and I think I want to sort of pump this to both the trust registry protocol stuff and the machine readable governance to see how those mechanisms as those are the ones that we've discussed might be might help solve this problem.
Sam Curren (TelegramSam): Okay, whether we just read it ourselves and try and figure it out, or whether they can you know whether these solutions you know there's some explanation of how these solutions can help us, I think that that would be useful, so.
Sam Curren (TelegramSam): So darryl and Mike I think that's, this is a super relevant exact question.
Sam Curren (TelegramSam): That that I think that we should explore and more information about That would be good.
Sam Curren (TelegramSam): Oh Mike shared a hack and D link.
Stephen Curran: yeah that's what i've got in here is presentation.
Sam Curren (TelegramSam): Oh okay perfect.
Sam Curren (TelegramSam): I thought that already.
Darrell O'Donnell: yeah excellent that that exact question is in the.
Darrell O'Donnell: Trust ridges webinar that I posted on the year by fold i'll copy it into this discussion here, you know exactly those questions you know what credentials are there what's normal for a verified to ask.
Sam Curren (TelegramSam): mm hmm.
Darrell O'Donnell: now use the driver's licenses that you know obligatory example.
Sam Curren (TelegramSam): yeah if you could post that link in here, that would be amazing.
Darrell O'Donnell: on its way.
Sam Curren (TelegramSam): Okay, so I think we've had some good conversation there's action items we've got a few folks volunteering.
let's see.
Sam Curren (TelegramSam): I am going to post this.
Sam Curren (TelegramSam): i'm going to do that in even with protest of the word webinar because somehow It makes me cringe.
Darrell O'Donnell: i've got a hard stop in the bottom of the hour i'm wonder if I could just add one small thing that we're doing on the Canadian province project on secure element and generally and security.
Sam Curren (TelegramSam): yeah so let's have you do that real quick, I also want to talk a little bit about device recovery at least today but.
Sam Curren (TelegramSam): I would love to have two devices to scare element here.
Darrell O'Donnell: This will be real quick because i'm going to be posting and rocket chat on areas by fold, as well as some other places just more that's more of a decayed Ian internal thing that one my client is the is the government of Ontario Stevens discovered a vc.
Darrell O'Donnell: we're working together, though, what we've done is created a couple of just markdown files, with a plant you ml diagram and a PNG of that diagram.
Darrell O'Donnell: To start to provide at least guidance on decisions, you should be making when you're making a wallet.
Darrell O'Donnell: As well as providing a little bit of background information for the folks that come in external who are the security analyst for a government for a bank, etc.
Darrell O'Donnell: So that they have a starting point, that is more normal for them, as opposed to normal for a cryptographer or normal for a developer, to start with i'm just wondering just want to float does that sound valuable to folks it'll be more detailed flowing in Iraq, a chat later today, tomorrow.
Sam Curren (TelegramSam): yeah just I personally raise my hand, I think that would be, it would be sort of wonderful to read about what your thoughts are there, or what that is, and if that can grow into something that.
Sam Curren (TelegramSam): You know, is either a starting point, or better yet like a sort of a.
Sam Curren (TelegramSam): Community thing that we can wave about like hey yeah here's here's the starting points right.
Darrell O'Donnell: yeah because we want the big organizations that have heavy heavy processing fast enough stuff to not look at us as like oh that shiny thing that we don't understand.
Darrell O'Donnell: that's the whole goal of this is portrayed in a different way gathering all in one spot, as opposed to hey you have a choice as a developer here three things you could do.
Darrell O'Donnell: down here are three things you did well that's Nice, what did you do, how does it fit into my security framework that's the questions we're trying to answer.
Right.
Darrell O'Donnell: Well, so you just the starting points will get that in push that socialize that through areas by fold on the on rocket chat as well as in the.
Darrell O'Donnell: Government, the regular areas.
Sam Curren (TelegramSam): If you would mind yeah.
Darrell O'Donnell: In the regular show cool.
Sam Curren (TelegramSam): yeah that's.
Darrell O'Donnell: awesome.
Darrell O'Donnell: cool for me, and I would love to hear about this device recovery, because I think it's the biggest security problem we have and adoption from.
Sam Curren (TelegramSam): it's a huge problem um.
Sam Curren (TelegramSam): Can we move into that there are some secure element things there Stephen.
Sam Curren (TelegramSam): Your your hands up.
Sam Curren (TelegramSam): And muted they go.
Stephen Curran: it's not supposed to be.
Sam Curren (TelegramSam): Oh there's not supposed to it, no worries okay um I would love to there are some aspects of secure element as it comes to device recovery is can we can we shift the topic to device recovery is that does that acceptable.
Sam Curren (TelegramSam): Okay.
Sam Curren (TelegramSam): um.
Sam Curren (TelegramSam): Let me try and get the.
Sam Curren (TelegramSam): conversation started here a little bit, and I should have prepared this link and I don't have it, the universal wallet.
Sam Curren (TelegramSam): I think, is the thing.
Sam Curren (TelegramSam): So this is some existing work that I partially love and partially don't like it all, from a personal perspective.
Sam Curren (TelegramSam): This is not me wearing any particular hats.
Sam Curren (TelegramSam): But this this spec here addresses two things and one is a data model, and so it talks about collections of things and sort of having to the data model to represent stuff.
Sam Curren (TelegramSam): For example, like did documents there's a currency example in here here's a credential example and then so so I like this there's also then an interface, this is the part where I start to not like this.
Sam Curren (TelegramSam): This is basically sort of defining like Oh well, here's all of the here's here's how you would do this if you didn't want to use dead calm.
Sam Curren (TelegramSam): And, and this is maybe more controversial what i'm saying here, and if you disagree with me please speak up so that my voice is not the only one heard.
Sam Curren (TelegramSam): But this is the talks about the interfaces and how he'd actually interact with the wallet and we have did come protocols for that and that's that's my preferred.
Sam Curren (TelegramSam): method of actually integrating there, but I really like the data model stuff I, I think that there's some things that we could do to improve the use of this, in particular, one of the things that I don't like about this data model.
Sam Curren (TelegramSam): Is that I believe it is.
Sam Curren (TelegramSam): it's it's maybe useful for portability between wallets but not necessarily useful for backing up an individual wallet itself.
Sam Curren (TelegramSam): And so the.
Sam Curren (TelegramSam): i'll get to the protocol section in a in a minute Troy.
Sam Curren (TelegramSam): that's a good suggestion of the one of the the initial ideas that i've had is that if we are doing backup and restore it would be great if backup and restore could also be sort of a portable mechanism, but all of our Apps have way more information.
Sam Curren (TelegramSam): In them.
Sam Curren (TelegramSam): Then, then, are defined here in the in the data format for example here's a here's like a profile, or maybe someone else that you're aware of right here's their did here's the information you have about them.
Sam Curren (TelegramSam): And, but this doesn't, for example, necessarily contain all the information about like maybe a most recently used thing or other sorts of.
Sam Curren (TelegramSam): of information that isn't necessarily doesn't necessarily need to be portable.
Sam Curren (TelegramSam): But might be really relevant to your APP so if you're doing the backup and restore have your own APP Those are all the details you actually want to save because it helps people return to a familiar experience after they perform a restore.
Sam Curren (TelegramSam): And so the the crazy idea that I have is to define a format which uses the data model defined in universal while 2020 but also allows for the the the sort of the existence of a application specific format that could be whatever you want it to be.
Sam Curren (TelegramSam): and
Sam Curren (TelegramSam): And then combine that into a zip file the same way that open office tends to so you have a json file and you have some other binary file you create one zip file that that is that is both of those together that could be a great backup and restore format.
Sam Curren (TelegramSam): So that.
Sam Curren (TelegramSam): so that you can either use it to backup and restore to the same application.
Sam Curren (TelegramSam): In receive rich data if you backed it up and restored it to a different application, you would have a more minimal set of data, but still have all the really useful.
Sam Curren (TelegramSam): stuff that's actually going on, and so that I think is a really useful thing there to sort of make that happen anyway that's an idea that I have we i'm unaware of any.
Sam Curren (TelegramSam): Cross framework specific efforts, I know that the I know that the the.net framework has a backup and restore which which works within that framework.
Sam Curren (TelegramSam): But I think that having sort of a cross project thing would be would be super useful.
Sam Curren (TelegramSam): In in moving this forward and solving sort of the portability problem and in the.
Sam Curren (TelegramSam): You know if we're if we're really telling a story about how important his credentials are but we don't really have a sort of a universal way to make this happen, I think that that would be useful, so that's all of my ideas on this topic, and now I want to be quiet and listen to.
Sam Curren (TelegramSam): What other folks have done or ideas that they have about making this.
happen.
Sam Curren (TelegramSam): Stephen.
Stephen Curran: So I really would want to separate out the backup and restore from portability so you've you mentioned that but i'd really like to underline that that those should be two separate things and.
Stephen Curran: What state you get.
Stephen Curran: My tendency is to think they that.
Stephen Curran: They should be separate, in other words.
Stephen Curran: backup and restore should be sort of continuous wellman you know, maybe not an export a one time event, I guess, if you.
Stephen Curran: If you can't if you don't really have portability, if your backup restore a separate so as i'm talking i'm sort of thinking, maybe they're not the same thing.
Stephen Curran: Or maybe they aren't separate.
Stephen Curran: Because if you if you can't restore to if you can't have portability, then you don't have true.
Stephen Curran: Sir, if you can't do a straight backup and restore to a new program you don't really have pure portability so okay i'm backing off that.
Stephen Curran: There, there are a lot of things, and so I think that that idea of the universal wallet interrupt you.
Stephen Curran: I don't know how it gets into extensions, but things like vc data format like i'm sure it doesn't mention cl signatures and and and the data around that, but that would absolutely be required.
Sam Curren (TelegramSam): Yes, so one of the thoughts that I had is that, rather than sticking all of the universal wallet stuff into the same file, as you can have different files, with different things in it.
Sam Curren (TelegramSam): And, for example, not all walls do all things, for example, some wallets do cryptocurrency and some don't right.
Sam Curren (TelegramSam): So if I took a thing that had cryptocurrency and I import it into a wallet that didn't obviously we ought to inform the user in a hopefully understandable way about what's going on, but I still would like to be able to important stuff that that while it can actually do.
Sam Curren (TelegramSam): It to that, and so there I think there's an opportunity to take that that data model but sort of defined the actual file format that that data model falls into such that you can.
Sam Curren (TelegramSam): That you can sort of know how to unpack that format and work with this stuff that is that is useful.
hmm.
Sam Curren (TelegramSam): Darrell.
Sam Curren (TelegramSam): your hands up.
Sam Curren (TelegramSam): Your quiet, but you're unmuted.
Stephen Curran: i'd say we lost him what.
Sam Curren (TelegramSam): Okay well darryl if that works out later it would love to hear what you got to say.
Sam Curren (TelegramSam): So darryl highlights that familiarity between wacky pack scenarios is quite similar yeah that I was involved with that and there's sort of a reason.
Sam Curren (TelegramSam): Oh Jerry you back.
Darrell O'Donnell: i'm back yeah sorry I was saying, first off I forgot I disconnect my computer.
Darrell O'Donnell: The.
Darrell O'Donnell: I really do like you, Sam there's some love and hate for the not hate, but really good nuggets in that that spec I like the data structures, other than I am absolutely not a json ld at context guy.
Darrell O'Donnell: backup and restore couple things to think about in the security document I mentioned we're going to raise the point that there are some things you are not allowed to restore.
Darrell O'Donnell: And or in theory backup because they're tied to the device, so if I have a high assurance credential that I had a physical onboarding process with you.
Darrell O'Donnell: If you've got a new phone we're doing it again so there's this kind of interplay that we have to I think consider for those things that are more.
Darrell O'Donnell: You know, high assurance but there's a whole bunch of this this backup restore to me I gotta run, unfortunately, but the number one thing for me is, we need to make sure that it is not the easiest attack vector to take over my life.
Darrell O'Donnell: which the easier make restore the easier it is to take over my life.
Sam Curren (TelegramSam): yeah oh.
Darrell O'Donnell: By the way, to credit unions down the States when they hurt.
Darrell O'Donnell: It was backup your data they're like no.
Darrell O'Donnell: Absolutely no because one of their, this is a sad part of the world, one of their number one attack vectors his family, fraud, where someone clones their own their their family members phone and steals your user and password.
um.
Darrell O'Donnell: But so whole bunch of different use cases are i've really loved that we're discussing them.
Sam Curren (TelegramSam): Yes, so the credential that has been marked as.
Sam Curren (TelegramSam): Not available there's some interesting discussion and nuance there, am I okay back here, restoring it to the same phone, or is it should only fail if it is research.
Sam Curren (TelegramSam): there's also things that you actually can't backup and restore.
Sam Curren (TelegramSam): Like like a secure element keys, if you have keys that are in the secure element of the phone to the high design you can't actually extract them.
Darrell O'Donnell: or put new ones in there, exactly.
Sam Curren (TelegramSam): you'll see that in the.
Darrell O'Donnell: In the in the document.
Sam Curren (TelegramSam): So one of the things that I added here to the initial note was rotation to new keys.
Sam Curren (TelegramSam): If we can't wait, we have to recognize the fact that we may not be able to use the same keys that were there before.
Sam Curren (TelegramSam): But can we prepare a mechanism, such that when I restore it to a new phone I can go through a process or do something to sort of recover my identities, even though i'm using new keys to do so.
Sam Curren (TelegramSam): And that is a that's an important bit there too right where.
Sam Curren (TelegramSam): We have to recognize that some of the implementations are not going to use formats that are in portable or exportable, and having a strategy for that is useful, we might have some that are capable of that.
Sam Curren (TelegramSam): But but that's certainly a piece of it right.
Sam Curren (TelegramSam): In my so there's there's also synchronization, which is a little bit different in the sense that.
Sam Curren (TelegramSam): We need to the venn diagrams circles come really close, if not overlap, a little bit on device recovery in the sense that.
Sam Curren (TelegramSam): The synchronization can solve some of the same issues, but the mechanisms are often very different the use case for a backup and restore is is is often a lot different than synchronizing data around.
Sam Curren (TelegramSam): Between things so if I have like a phone and a tablet and a laptop.
Sam Curren (TelegramSam): And they all sort of talk to each other to sort of synchronize my information than the process of doing a restore might be reintroducing that device to the other things and sort of having a recent the information.
Sam Curren (TelegramSam): That that can so Those were some over there's some overlap, but we have to also support the use case where the only thing that someone has to be involved in something SSI is a phone and they need a reliable way of just having a sort of a single device that enables that to occur.
Sam Curren (TelegramSam): there's also, if I backup from one phone and restore to another one.
Sam Curren (TelegramSam): Does the does it invalidate the previous phone or now can they sort of both be involved, these are some of the open questions that we need to talk about as we figured out right.
Sam Curren (TelegramSam): And and it's possible, I think, to design mechanisms, such that when you're in the process of restoring into a new phone you D authorized the old phone from all the relationships that you had.
Sam Curren (TelegramSam): And so there's there's things that can be done there, I think that could be you really useful from a security perspective, you know, let alone.
Sam Curren (TelegramSam): You know and ease of user experience perspective.
Sam Curren (TelegramSam): um.
Stephen Curran: yeah the idea i've always had is that that you sort of have a place to put backups in a place to put the the the restoration key and those are separated.
Stephen Curran: This family member restores backup to a new device makes me wonder if that's efficient, is there any other way to do it other than that, like like how else would you do it and and are there other ideas out there on how that that separation of the encrypted blob that is your backup.
Stephen Curran: and your or or sequence of blobs that is your backup and then your restoration key that that allows the restoration.
Sam Curren (TelegramSam): Right um so I like the idea of.
Sam Curren (TelegramSam): of encrypted backups go somewhere and then the key for that encrypted backup.
Sam Curren (TelegramSam): go somewhere else.
Sam Curren (TelegramSam): And that i've seen various user experience type things like this, where someone you know, in the process of creating a wallet.
Sam Curren (TelegramSam): sets of recovery mechanism and part of it involves like printing out a huge qr code that you know that has device recovery information and then you're supposed to go stick that.
Sam Curren (TelegramSam): Ideally in someplace better than your bottom drawer of your of your dresser and it perhaps in a fire box or in a safe deposit box or something else, such that you can then recover that.
Sam Curren (TelegramSam): I think there's also an interesting difference between extracting a file myself that I then I actually have the actual file versus having automatic backups that go to a service.
Sam Curren (TelegramSam): And, and maybe I pay a service or maybe I have access to the service for some other reason, like my company provides it or my university provides that or something.
Sam Curren (TelegramSam): And that is an interesting piece of that too, because there's a I think there's an opportunity there for for some some some ease of use going on, but I also.
Sam Curren (TelegramSam): love the idea that I could just extract the bits myself and and and then and then make it happen right so here's here's an example yesterday or the media provides that that could be a service that immediate or service provides as backup to so here's a real life example my mom's computer.
Sam Curren (TelegramSam): Has issues she uses it primarily for running personal finance using quicken she gets the computer fixed but required to know us re install.
Sam Curren (TelegramSam): But the the guy that the repair guy that did the fixing restored a bunch of backup stuff to the to the Toronto computer.
Sam Curren (TelegramSam): And she needed to get quick and back on there, she needed a computer back, but when she really needed access was was back to quicken so she can manage your personal finance stuff right so.
Sam Curren (TelegramSam): by looking around I was able to locate the quicken file in her stuff.
Sam Curren (TelegramSam): That was that was her most recent copy and when we reinstalled quick and I was able to reconnect it.
Sam Curren (TelegramSam): To the previous data file that was her most current stuff so that, when it all came back up on a brand new fresh install on technically on the same hardware, I was able to like reconnect that.
Sam Curren (TelegramSam): And I worry that if we're not careful we're going to make that sort of thing impossible, I get the attack vector problem there right is that is that someone who gained access to that data, you know could use it maliciously.
Sam Curren (TelegramSam): Or you know it cause all sorts of havoc, but the the the fact that I was able to sort of restore the state of that was important to her, and I can see the same thing being absolutely true, and in an identity type solution where.
Sam Curren (TelegramSam): something happens, you know you drop your phone in the ocean.
Sam Curren (TelegramSam): You get a new one that you need to be able to get back the stuff you had even if there's a process involved in doing so it needs to be straightforward enough.
Sam Curren (TelegramSam): That it doesn't take a rocket scientist to like put that together i'm no quick and expert I just happen to know a little bit about computers and I would love there to be some sort of similar thing, where you know you can help someone out and make that happen.
Sam Curren (TelegramSam): So the other thing that I didn't write in here yet and I didn't talk about was that there's an interesting opportunity for social recovery with backups.
Sam Curren (TelegramSam): One of the issues with the backup is where do you put it right, I can I could pay for a service and trust them there are strategies for you know, like shimmy or shouting stuff where I can set up an.
Sam Curren (TelegramSam): n n n m of n recovery strategy with contacts or friends that I have that could be a one of the ways that i'm able to recover all of my data.
Sam Curren (TelegramSam): I bring this up, not to say that, like this is the way we have to do it, but then I actually think that there's a variety of solutions to device recovery and backup and.
Sam Curren (TelegramSam): And that this is actually a really interesting opportunity for for some differentiation if necessary.
Sam Curren (TelegramSam): To make that happen, but that I have been promoting some of these in an open source manner, such that you could have mechanisms that are that are used across platforms, etc, would be really useful.
Sam Curren (TelegramSam): I think the lowest common denominator of that sort of cross thing is some sort of backup and restore and recovery.
Sam Curren (TelegramSam): That helps that happen, and so, if we can align even on the little as bit of that I think it would be incredibly useful.
Sam Curren (TelegramSam): Right now, for example, we have contacts many years did that I have from other people.
Sam Curren (TelegramSam): And we have credentials here are credentials that I have received and that's kind of right now the lowest common denominator that we're looking at other Apps have other features, but if we could even start with something that is.
Sam Curren (TelegramSam): Even in a super limited way portable, then we can begin building on our experience there to like make something happen.
Sam Curren (TelegramSam): So I imagine if we pursue the work on this, that in the future we'll end up with something like a backup and restore a thong.
Sam Curren (TelegramSam): Where we practice and demonstrate the process of creating a new wallet on one platform making some connections receiving your credential going to the other platform and going through whatever necessary process, there is, and then, and then you know experiencing what that's actually like.
Sam Curren (TelegramSam): And so I think that there's a wide variety of ways to do this, and I think we can pursue a lot of them i'm hoping that with some lowest common denominator stuff we can have an effort.
Sam Curren (TelegramSam): That that is capable of of doing some sort of basic thing, while still doing advanced things, one of the reasons why I like the idea of combining some sort of universal data format redundantly with some sort of application specific backup is that.
Sam Curren (TelegramSam): The the application specific backup becomes immediately useful to the application, if you want to restore directly back to the same application, but we gradually build up the the.
Sam Curren (TelegramSam): The compatibility of the of the application or the generic backup format, like the data model oriented stuff so that we can.
Sam Curren (TelegramSam): We can sort of make something immediately useful and then grow the the the Cross APP compatibility aspect of its utility.
Sam Curren (TelegramSam): In that way we we don't have to put in a crazy amount of hard work going forward to make something relatively universal to do that, I hope that made sense I said a lot of words.
Sam Curren (TelegramSam): thoughts comments rebuttals corrections.
Sam Curren (TelegramSam): Relevant X KC D comics.
Stephen Curran: that's.
Stephen Curran: Thank you, pretty much now, but I think.
Stephen Curran: Those are the things we all have, I think we have good high level ideas but getting down to.
Stephen Curran: What I put in here, which is okay, how do we get an rfc that defines such a protocol.
Stephen Curran: It doesn't really matter what the target is could be immediate or service, but we need a a.
Stephen Curran: A protocol that says this is how it gets done.
Sam Curren (TelegramSam): It doesn't have to be a protocol if it's file format oriented.
Sam Curren (TelegramSam): For example, if I can execute a backup no.
Stephen Curran: I don't I think it does because it's got to be continuous.
Sam Curren (TelegramSam): And I think it's useful, even if it's not continuous.
Sam Curren (TelegramSam): So what i'm trying to do is see if we can get to something that is is easier because it's not necessarily a continuous thing.
Sam Curren (TelegramSam): But we can still make that happen yeah move that's a bad idea I don't know James.
Sam Curren (TelegramSam): json smarter than me.
James Ebert: Well that's question was um I was just going to somewhat agree with Stephen that I feel like a protocol would be really helpful here for for that, because if I look at a end user, I don't think a good portion of them are going to be using.
James Ebert: file format.
James Ebert: I had another question, but I figured i'd wait for thoughts on that first so.
Sam Curren (TelegramSam): So what if the file format transfers the same transferred in the protocol as one that you could technically just export and get a file out.
Sam Curren (TelegramSam): Absolutely that weird.
James Ebert: No, I feel like that those should be very at least very similar, if not the same.
Stephen Curran: To me.
Stephen Curran: um.
Stephen Curran: And yeah now that I think about it i've gone through this thought process before have a file format allows you to put it somewhere, you still have to put it somewhere.
Stephen Curran: And for regular humans to do that, they have to put it somewhere it's not sufficient to just save it to the device because it's the device you're backing up basically so that's that's not sufficient, it has to go to some sort of service, I suppose.
Stephen Curran: It is actually valuable to go the device So if you lose the file, it becomes corrupt, you can just recover it from your own device, but that doesn't doesn't cover that use case of losing the device, it could go to the.
Stephen Curran: You know ios cloud or whatever it's called and and and the backup service on the device and that get that has a restore path to it, so that might be sufficient in some cases, so so that you can restore.
Stephen Curran: The APP and get back, but I think for.
Stephen Curran: portability it almost has to go to another one another service but I guess Okay, then you've got a third use case i'm doing a lot of thinking on the fly here you've got a third case which is.
Stephen Curran: I want to move devices so i'm specifically going to make a backup and then restore it on my new device so that.
Stephen Curran: it's less of a recovery and more of a a a.
Stephen Curran: transition from one device to another.
James Ebert: And then to sams point, though, is that if you make it the same data format file format between all those these cases, then, even if we start with just synchronizing and or start with just file format, then it would be easier to translate transition to another one.
Stephen Curran: yeah it says.
Stephen Curran: I don't I don't dispute that all i'm saying is that it it can't be a tell the user has to trigger, it has to be more or less continuous, otherwise you have this gap where oh I haven't made it back up in three weeks.
Stephen Curran: Totally yeah so and that to me implies.
Stephen Curran: It can't be a full backup every time I guess it's just classic backup strategies, well, it is, it is shades of grey is not a you're right i'm wrong either way because you know, a file format might be sufficient, but it also might be.
Stephen Curran: impractical so who knows that that's what I think.
Clecio Varjao: I, I have a question since we're talking about services and the protocol side of it.
Clecio Varjao: Again i'm kind of new to this whole thing but that's something we talked about the mediator as a backup service.
Clecio Varjao: couldn't that be all be part of the protocol that we leverage those connections to implement the Protocol that I could shard my keys through some connection points or I pick on one of my connections that says i'm going to make this my backup point.
Clecio Varjao: Is every talking about.
Stephen Curran: That that's.
Stephen Curran: Where I was going with the Protocol, but that a protocol might define.
Stephen Curran: Okay here is the here is the message I send when I do a backup and here is the message I sent when I set up a backup and.
Stephen Curran: And here's The message I sent to set up the location where i'm going to put him put the backup and here's where I send the recovery keys.
Stephen Curran: As a different way, so that's how I was thinking about it.
Stephen Curran: Okay, but.
James Ebert: I think.
Sam Curren (TelegramSam): The combination, is important.
Sam Curren (TelegramSam): I think there's combinations of protocols here, I want to really quickly separate the concept of a mediator, providing backup if we have a backup protocol.
Sam Curren (TelegramSam): Then a mediator can also support the backup protocol, but that's not necessarily something that has to be done so, if you have I will backup for you.
Sam Curren (TelegramSam): relationship and protocol that could also be done by someone who does a mediator and could be a combined service which actually simplifies a lot right.
Sam Curren (TelegramSam): you're already kind of trusting them for a little bit so trusting them with more is good, I think they'd like something more like a peer to peer backup or a peer recovery would be a separate protocol that could also be used.
Clecio Varjao: Well yeah I agree with you, the backup feature it's not necessarily tied up to mediator that's why i've asked if that is actually tied up to a connection, where a mediator, is just one other connection.
Clecio Varjao: and any other connection.
Clecio Varjao: can be leveraged should be a backup service if I trust my you know, Google beta plus or a government to to do that, then that'll be represented as a connection so anything that has a connection to my wallet can be leveraged for those some of those features.
Clecio Varjao: And mediator, be one of them.
Sam Curren (TelegramSam): Yes, totally and so you could do like feature discovery to discover like oh like they actually support the whatever protocol that's cool so now i'm going to ask you, you know that the user hey that they'll go back up for you do you want to do that, or whatever right.
Sam Curren (TelegramSam): yeah so so I totally agree there, so we have a couple of pieces of work that i'm identifying one is a file format.
Sam Curren (TelegramSam): And Stephen I think we could start with full backups and then figure out how to optimize for delta's.
Stephen Curran: yeah I agree, I think, as I talked about it, I realized it's really just an optimization start with your backups and then you figure out how to do an optimization if we have to.
Sam Curren (TelegramSam): Well, so, then we have a backup protocol.
Sam Curren (TelegramSam): which will receive and store backups.
Sam Curren (TelegramSam): And then be able to get them back right, we also have a.
Sam Curren (TelegramSam): Recovery key piece of work that needs to be done exactly and.
Sam Curren (TelegramSam): And this is complicated because I think that we're unlikely to get this right, like the first time, so it may be that we have to allow and are designed for a variety of recovery key scenarios.
Sam Curren (TelegramSam): And one of them, that has been successful in other cases is is a is a past, it is the recovery key represented as a pass phrase.
Sam Curren (TelegramSam): Because this is literally something that someone could write down on a piece of paper and stick somewhere and and be useful as their recovery pass phrase.
Sam Curren (TelegramSam): When they actually make that happen, so this would be something the key would be known to the device doing the backup and you can and then.
Sam Curren (TelegramSam): You can make that happen so biometrics Antonio suggests we could i'm trying to find the simplest possible thing that would work.
Sam Curren (TelegramSam): In recognize that we're going to come up with better stuff later, but that way we're not trying to solve all of the complicated problems all at once, for example, biometrics is a pass phrase is really problematic in some scenarios.
Sam Curren (TelegramSam): So anyway, try to figure out something that would work as even just a baseline.
Sam Curren (TelegramSam): It is possible.
Sam Curren (TelegramSam): That you know that, as part of the process, you know we have different types of key formats, maybe I shared my keys and send it to friends, maybe I.
Sam Curren (TelegramSam): It spits out as a pass phrase that I write down on a piece of paper and put it in my firebox that I have in my house, maybe.
Sam Curren (TelegramSam): You know there's there's a variety of ways, we could do this but, but if we come up with sort of the the basic way of making it happen, at least in the beginning, then that would be a useful thing.
Sam Curren (TelegramSam): um I totally love the idea of a protocol and here's it for continuous backup and here's why.
Sam Curren (TelegramSam): A lot of folks are going to be on boarded because their company supports this, or they have a credit union or something and so.
Sam Curren (TelegramSam): they're going to need a handful of things and and mediator, is likely to be bundled into that process, because they don't want users to have to figure out mediators and in the same service could also provide backup.
Sam Curren (TelegramSam): For them, and it's totally reasonable that like an employer would provide you know the SSI wall and backup services for their employees.
Sam Curren (TelegramSam): And so that's a that's a really useful thing and there's actually some level of protection there that the protocol is designed.
Sam Curren (TelegramSam): To only accept encrypted information without the decryption key, which means that the service actually providing the backup feature that is already fairly protected, because they simply don't possess the key to be able to to unwrap and recover that.
Sam Curren (TelegramSam): And so that's a useful thing, so we have a file format, we have a key strategy recovery key strategy.
Sam Curren (TelegramSam): We have a protocol.
Sam Curren (TelegramSam): definition.
Sam Curren (TelegramSam): For backup and restore and we also have.
Sam Curren (TelegramSam): Related to this.
Sam Curren (TelegramSam): Is, and this may be a phase two thing, but how you handle recovering from situations where you don't have the key the key right you can't actually back up the device key.
Sam Curren (TelegramSam): In the in the sense that what you might need to do is place in your documents that key that can be used to rotate to a new device key and that way that's the key that you backup.
Sam Curren (TelegramSam): The rotation key and I know carrie has some opinions about the sort of a thing, and like so you know pre setting up a rotation key or the next key, but if you designate a rotation key that's part of your backup.
Sam Curren (TelegramSam): Then, when you restore to a new phone you use that key to to to to authorize the use of a new device specific key in order to to make that happen.
Sam Curren (TelegramSam): And in that way we can we can sort of make that happen, and I think if we do that strategy, then, if we if we accomplished those things, even at some basic level and work on getting them implemented, then we can make that happen oh so file formats, I think the.
Sam Curren (TelegramSam): I think the two things we should focus on now is connection data.
Sam Curren (TelegramSam): Like the deeds of other people right and and and credentials.
Sam Curren (TelegramSam): And we may have to in order for simplicity, to pick some things that are important, but a little bit harder to solve and place them sort of in a position for around to development, like we recognize that some.
Sam Curren (TelegramSam): That some issuers don't want their credentials to be restored to the same device or another device so.
Sam Curren (TelegramSam): So, but we can't handle that yet perhaps right, so we haven't even discussed how to indicate such a thing.
Sam Curren (TelegramSam): And I recognized it not solving all of those problems will restrict some of the folks that can implement this because they have requirements that preclude this.
Sam Curren (TelegramSam): But I think it's a place, we can start and then, as we add the necessary features, to the various protocols to indicate which credentials, you know they they don't want to make that happen, then this becomes a little bit more broadly applicable.
Sam Curren (TelegramSam): And then of course there's other things like pure backup and recovery or.
Sam Curren (TelegramSam): Or you know deltas, for example.
Sam Curren (TelegramSam): That that we can sort of figure out as we go James your hands up that goodness, I need to talk less.
James Ebert: I feel like making the distinction between backup restore and recovery is a wise distinction, even though they are definitely related I think there's a having that distinction is good.
James Ebert: I wanted to ask if we've talked a lot about those three things i'm not sure if we've talked too much about synchronization and or is that a we can't do much about that, until we.
James Ebert: go through these first steps, or is there things there, we can progress in that areas well what.
Stephen Curran: What do you mean by synchronization synchronization of the.
Stephen Curran: Storage plus and synced with the backup or do you mean synchronization across devices or.
James Ebert: devices, so I have, I have.
James Ebert: My mobile phone and I have my laptop and I, my browser and I want to use my identity and all three of those places.
Stephen Curran: I think.
Stephen Curran: different topic, I think.
Sam Curren (TelegramSam): I I think I committed an error by including sink in here, let me do this because they're a little bit orthogonal, which is why I included them.
Sam Curren (TelegramSam): But, but that synchronization within a domain to use the the domain language, Daniel hardman is is fond of using.
Sam Curren (TelegramSam): Is it is a really important issue that is actually fairly orthogonal to this most of us seem to be pursuing the case where it's a domain of a single device, and we have to solve, at least that problem before we can sort of move along and allow for multiple agents to exist in your domain.
Sam Curren (TelegramSam): and vendors, maybe, maybe solving this in the sense that you have a cloud agent Anna in a mobile wallet and they have figured out internally how to make that happen, and I think that's Okay, so long as the external protocols are there, then full compatibility exists.
Sam Curren (TelegramSam): But I think that synchronization within a domain is a separate and also large problem.
Stephen Curran: Why do you have rotation their.
Sam Curren (TelegramSam): station.
Sam Curren (TelegramSam): There was a part of part part of the recovery process.
Sam Curren (TelegramSam): meaning if I have to rotate to a new key when i'm restoring to a phone.
Sam Curren (TelegramSam): That, for which I was not able to backup or restore the device keys.
Sam Curren (TelegramSam): Oh you're gonna then rotation has to be part of that that's why I included petition.
Sam Curren (TelegramSam): Okay, so I don't mean to include rotation generally spam.
Stephen Curran: Okay that's what I wanted to be sure.
Sam Curren (TelegramSam): there's a again there's a little bit of venn diagram overlap there but yeah yeah.
Stephen Curran: yeah yeah sorry.
Sam Curren (TelegramSam): Okay, so we have file format, we have key recovery strategy for the encrypted file so maybe maybe maybe backup encryption is part of that thing.
Sam Curren (TelegramSam): And then we have a protocol for at least the movement of the of the.
Sam Curren (TelegramSam): Of the backed up encrypted encrypted backup file to another party.
Sam Curren (TelegramSam): Do you have any volunteers for for stuff James your hands up that mean you're volunteering for all of it.
James Ebert: I had a had a question.
Sam Curren (TelegramSam): Yes.
So.
James Ebert: On the areas thread, there was a conversation that I was just speaking with Stephen and Ian on an indie SDK is there issues here with backup and restore if we can actually transfer the link secret.
James Ebert: and actually utilizing the credentials that we backup if that makes sense.
Sam Curren (TelegramSam): If you came back and delete secret that none of the credentials, you have are useful.
Stephen Curran: yeah I think indie does include.
Stephen Curran: i'm exporting the link secret I believe that's part of the export.
James Ebert: I haven't looked too much at this portion of any SDK.
James Ebert: So is there.
James Ebert: Something there that you can import the link secret, on the other end yes.
Ian Costanzo: yeah when you do when you do a backup.
Ian Costanzo: and restore with India, does the whole wallet, including the link secret yeah I think the discussion that we were having on rocket chat was around using credentials from two different wallets and you know whether you could have two different wallets with the same link secret.
James Ebert: That makes a lot of sense.
Stephen Curran: or or as well, could you combine two wallets with to link secrets such that the link secret is.
Stephen Curran: is stored with each credential and I don't think it is but.
Stephen Curran: I mean, in theory, that's possible now whether you could present those in proof again depends on the end on credits implementation.
Stephen Curran: don't think from a from what can be done today i'm pretty sure Ian was absolutely right that you know.
Stephen Curran: They have a presentation of multiple credentials have to use the same link secret.
Sam Curren (TelegramSam): I think that's the current thing Okay, so we have a minute left has been hugely productive There we have file format, we have file encryption and we have protocol definition, is there any of those items that someone is just really excited about diving into.
Stephen Curran: It i'm willing to help on both I can't do both but i'm willing to help on both.
Sam Curren (TelegramSam): I.
Stephen Curran: Have others helping out.
Sam Curren (TelegramSam): I think I have thoughts about file format and I have thoughts about the protocol definition, I could at least throw a sketch together about those things that would be the start of that conversation.
Stephen Curran: If you could do a sketch, that would be awesome i'd be glad to help us.
Sam Curren (TelegramSam): OK, I will I will do that and share it, I will do it as a half empty file that I would encourage commenting and additions, etc, as we sort of develop that out.
Sam Curren (TelegramSam): and hopefully we can turn that into something useful my goal is to hopefully make this something that could be implementable pretty vast by most projects.
Sam Curren (TelegramSam): Because of the combined nature of the APP specific backup plus the generic data file format backup, which means that it should be very easy to do the APP specific backup and then you would just be responsible for creating the the data format.
Sam Curren (TelegramSam): You know the common data format pieces as part of that, so I will put some sketches together on that.
Sam Curren (TelegramSam): And that way we can advance the backup and restore work, which is something we've long needed.
Sam Curren (TelegramSam): I love the idea of having protocol support this as well, so very cool Thank you everyone for coming I this ended up getting recorded to the cloud, so I am going to have to chase down the recording but I will get it posted.
Sam Curren (TelegramSam): i'm grateful for all of your involvement, we will see you next week, where the topic is wait seconds.
Sam Curren (TelegramSam): The topics for next week and I will get this published in advance.
Sam Curren (TelegramSam): include.
Sam Curren (TelegramSam): wait for it.
Sam Curren (TelegramSam): The credential user experience is on tap for next week.
Sam Curren (TelegramSam): And so those that's what the topics will be around, including svg credential display credential seeming revocation implications.
Sam Curren (TelegramSam): Mobile governance on ux in auto approval of presentation requests that those are all the credential ux will be the main topics for next week thanks you all hope your week is a great one and we'll see you later.
James Ebert: yeah Thank you.