SkyePass application

[RoyTimes]

Grant Application Checklist

• The application-template.md has been copied, renamed ( "project_name.md") and updated.
• A BTC or Ethereum address for the payment of the milestones is provided inside the application.
• The software of the project will be released under the Apache license version 2.0 as specified in the terms and conditions.
• The total funding amount of the project is below USD $30k for initial grant applications and $100k for follow-up grants at the time of submission.
• The initial PR contains only one commit (squash if needed before submitting your PR).
• The grant will only be announced once we successfully delivered the first milestone.

[CLAassistant]

All committers have signed the CLA.

[Noc2]

Thanks for the application and all the effort you put into it. Looks like an interesting project. But the current application is above the 30 k limit for initial grants. Also our grants program focuses on funding software development and research efforts related to Polkadot, Kusama and Substrate. Your current deliveries contain very little that is actually related to our tech stack. Therefore I suggest to reapply with a new grant application that potentially also contains some of your future plans. In the meantime, maybe the Filecoin Dev Grants might be interesting for you. I’m closing this PR for now. Let me know if I should reopen it.

[RoyTimes]

Hi. Thanks for the feedback. I guess I misunderstood initial grant as the grant before deliveries of milestones. I have updated our requested amount to stay within the limit. There's a bit funding gap for us beyond $30k tho. We will take a look at the Filecoin grant. Thanks for the info.

As for the question on the revelation to the Polkadot and Substrate tech stack, I apologize for not specifying it enough in my proposal. If you could reopen this pull request, our update commit should show up.

A gist of what we have updated:

1. Each password-username-(OTP) combination is a digital identity and we want to tokenize that.
2. Each digital identity represents a public identity and a private identity, while most of the time the public identities is not important.
3. Each vault is a collection of the private identity part of these tokenized digital identity.
4. To enable easy sharing, we are integrating an ENS-like user handle system. i.e. @adam for Adam Smith etc. These handles will be linked to all public identities related to Adam.
5. The idea of extensions mentioned in the application are simply services/small application injected with a user's private identity.
6. Therefore, beyond the vault management smart contract, we are also deploying a series of identity management smart contracts and open to future option to develop an identity focused parachain. The Substrate eco-system is a good fit compared to other smart contract platforms for its flexibility.
   • When more customizations are needed, we won't be limited by the platform.
   • Because these identity management smart contract is designed to be more generalized, we have the option to deploy them on different chain than where we want to host our vault metadata contract.

After all, consumer-grade password manager is not a large market. Identity solution will be our end game and Substrate sounds like the best choice of platform for us.

I hope these changes make the case for relevancy to Polkadot/Kusama/Substrate and you can reopen this PR. Let me know if I can help answering more questions.

[RoyTimes]

@Noc2 Please review and let me know how you think.

[Noc2]

Sorry for the late reply. Let me know once you updated the application and you think it’s ready for review.

[RoyTimes]

Changes have been made. Please review.

• Resolved: $30k grant limit. For any amount beyond the $30k limit, we will fill in the gap other ways.
• Updated: added in more specifications the tech stack related to Substrate to demonstrate the necessity to develop SkyePass on top of Substrate.

[RoyTimes]

@Noc2 Please review and let us know at your convenience. Thank you!

[Noc2]

Sorry for the late response and thanks for the additional information. I have a few follow-up questions:

• Regarding: “Account & Vault Metadata: Stored On Blockchain”, you are aware that this also increases the attack vector of the system (potentially publicly identifiable)? And just to double check, you are not storing private data on-chain, correct?
• Also encrypted data on ipfs is a big security issue. What kind of encryption are you planning to use? Do you have previous experience regarding security related software development?
• Regarding identity, you could take a look at Substrate Name Service Pallet paritytech/substrate#7197 and potentially also reuse the on-chain identity on kusama/polkadot.
• How are you planning to charge users $2/year if the software is fully open source? Or are certain parts not open source. For example the ipfs part seems to be currently missing as part of your deliveries.
• Could you add the open source license to the deliveries? See https://github.com/w3f/Open-Grants-Program/blob/master/applications/application-template.md

[RoyTimes]

@Noc2 Thanks for the comment. We have done some minor changes to the application.

And:

• Regarding: “Account & Vault Metadata: Stored On Blockchain”, you are aware that this also increases the attack vector of the system (potentially publicly identifiable)? And just to double check, you are not storing private data on-chain, correct?

Of course not, private data should never leave a user's computer without encryption. The data on chain is the vault's metadata that contains the public address of the owner/members and the CID to the encrypted IPFS file.

• Also encrypted data on ipfs is a big security issue. What kind of encryption are you planning to use? Do you have previous experience regarding security related software development?

We use Shamir's secret sharing schema (the actual library we are gonna use is secrets.js, the security audit of the lib is included in the repo), with an asymmetric crypto algo, either ecdsa or ed25519, provided by polkadot.js/util-crypto or eccrypto. Yes, we have experience working on security related software but we are not researchers on cryptographic. So we leverage on these trusted cryptographic libraries for the core encryption functionalities.

• Regarding identity, you could take a look at paritytech/substrate#7197 and potentially also reuse the on-chain identity on kusama/polkadot.

Absolutely. This looks great. We have updated the deliverables on the "smart contract" sections to enable us to make reasonable changes but maintain the same or very similar functionalities. Like using the native on-chain identity.

• How are you planning to charge users $2/year if the software is fully open source? Or are certain parts not open source. For example the ipfs part seems to be currently missing as part of your deliveries.

It's the same idea as that all public blockchains are open source but not free to use. Users need to keep a few dollars in their wallet to make changes to their vault and the $2/year will mostly go to blockchain nodes. Before we complete these two milestones, the software will be advised to be used for alpha testing only, and we will deploy on a testnet. After this phase and with the feedbacks from testers, we will have a more definite plan for how payment works.

A rough idea is something like Ramp Network that does the fiat-crypto KYC/AML and a xDAI-like chain for fast and cheap micropayment. That's why we have included partnership building on our phase 2 deliverables. The Substrate community is a pretty big crowd and we are optimistic of getting an ideal chain provider partner.

• Could you add the open source license to the deliveries? See https://github.com/w3f/Open-Grants-Program/blob/master/applications/application-template.md

Done.

[Noc2]

Thanks for the update. I have a few follow-up questions/comments:

[Noc2]

Thanks for the update and sorry for the late reply. I’m happy to go ahead with it and share the application with the rest of the team. Maybe you can still update the “Total Costs” to actually say 30k instead of see below.

[Noc2]

@RoyTimes Also I just wanted to make sure that you are aware of the following, in case the grant gets approved: The grant should only be announced once you successfully delivered your first milestone.

[RoyTimes]

@Noc2 Thanks for the approval.

Thanks for the update and sorry for the late reply. I’m happy to go ahead with it and share the application with the rest of the team. Maybe you can still update the “Total Costs” to actually say 30k instead of see below.

Done. Updated. My change might have accidentally dismissed your previous approval of the changes though. Haha.

Also I just wanted to make sure that you are aware of the following, in case the grant gets approved: The grant should only be announced once you successfully delivered your first milestone.

Yes. I understand. Our team have been making progress since we started this application 4 weeks ago. We should be able to deliver the first milestone sooner than 10 weeks from here.

[RoyTimes]

@semuelle @Noc2 @mmagician @Lederstrumpf Please review.

Could you split the first milestone in two, so that the first milestone is a basic proof of concept? A CLI or library for encrypting and decrypting a vault with a quorum of 2 would suffice. Or move some deliverables to M2? Ignore the 1 milestone = 1 month suggestion. You put so much functionality in the first one (especially the app) that I am worried you might not accomplish all of it in a reasonable time and then delivery and evaluation can get messy. But overall I'd be okay approving your application and look forward to your delivery.

Great that you mentioned that. I was actually hesitating if I should bring it up myself. I have updated the deliverables. We have most of the stuff (~ 80%) written on the updated Milestone 0 done. But I do need to send my laptop to Apple for repair tomorrow. (butterfly keyboards are the worst) Also, while using the community toolchain, we are aiding the community on development as well (see my Github history). Ideally, I will be able to invite you all to review milestone 0 later next week.

[semuelle]

Great, thanks for the changes.

[github-actions]

Congratulations! As part of the Open Grants Program, we want to help winning teams acknowledge their grants publicly. To that end, we’ve created a badge for projects that successfully delivered their first milestone. Please observe the foundation’s guidelines when making any announcements; in particular, don’t announce the grant publicly before you've completed at least the first milestone of the project.

At that point, we will be happy to collaborate on an announcement about the work you’re doing. Please get in touch with us at [email protected] in case you're interested (at least two weeks notice is preferred).

[mmagician]

@RoyTimes I've amended the original contract here, as per the discussion in the Grants Delivery Repo. Please let me know whether this is fine with you

[RoyTimes]

@mmagician fine by me. Feel free to merge.

[jimmychu0807]

Thanks @mmagician and @RoyTimes for hackathon participation.

[alxs]

@RoyTimes care to share a quick status update on the second milestone, along with an ETA if possible? It looks like the SkyePass repositories have been inactive since the last delivery.

[RoyTimes]

@alxs Hi, we are extracting the core technology of SkyePass to https://github.com/skyekiwi/skyekiwi-protocol so that it's more general applicable beyond just a password manager. It's almost in a stable state. After that, we will come back to SkyePass. ETA another 2-3 months. We are still getting onto this.

[alxs]

@RoyTimes sounds good, good luck with your new approach then. Could you submit an amendment and add estimated delivery dates to the remaining milestones, or extend their duration accordingly?

[RoyTimes]

@alxs Yes. Will submit a PR by the end of this week.

[semuelle]

@alxs Yes. Will submit a PR by the end of this week.

Did you submit an amendment, @RoyTimes?

[semuelle]

Hey @RoyTimes, now that the SkyeKiwi Protocol grant is completed, are you working on the second milestone of SkyePass currently? Can you share an estimate on when you think you might finish it?

[alxs]

@RoyTimes please note if we don't hear from you within the next 2 weeks, we'll assume you're no longer interested and go ahead and terminate the grant.

[RoyTimes]

@alxs Sorry for the delay. You can go ahead and terminate this grant as we have completely shift the focus from a password manager to build a full fledge privacy enabled blockchain on Polkadot. Thank you!

[alxs]

Awesome, good luck with it and thanks for the reply! Also feel free to apply again in the future.