CredPass - One Stop for Logins

Inspiration

Identity theft and stolen or lost credentials has been a raging concern. With the increase in the number of digital services in the web we see upto almost 1.2 million credentials that are lurking in pure sight, and almost 89% are stolen.

With CredPass we want to be able to prevent common credential cyber threats from occurring like credential stuffing, man in the middle attacks, Password Hash Attacks and more.

What it does

CredPass is a simple service that generates a new Credential (Jason Web Token) based on information shared by the users. It also generates a TOTP (Time Based OTP) based on a shared secret which is embedded inside this credential. Embedding of the shared secret inside the credential allows the verifying service to parse the JWT and then authenticate the OTP which has been presented by the user.

The JWT’s or credentials are shared with the verifying services using DWN’s allowing programmatic access only to certain DID’s which need access for verification, thus preventing attacks mentioned above.

How we built it

We built CredPass using three layers

1. SSI Service
2. Middleware (credpass-backend)
3. Web5 DApp (credpass-frontend)

The credential generation service is the ssi service which is hosted locally on a docker container

The Web5 DApp is built using the Next.js framework and uses the web5 api to generate DID’s and allow access to DWN’s.

We also have a middleware in-between the DApp and the ssi service which is a simple node.js server that serves request between the ssi service and the Web5 DApp..

Challenges we ran into

Not having the SSI service API easily accessible on the web to make schema changes or generate credentials urged us to deploy the docker container locally.

So every time Docker shuts down the identification service DID and schema id have to be regenerated :(

Update speed of records on DWN’s are quite slow, especially if we use the query command.

Accomplishments that we're proud of

We are really proud to have integrated some of the core services provided by TBD to create a identity authentication application for the future Web.

What we learned

We learnt quite a few things while creating this applications:

1. T/HOTP’s can’t be generated using base64 encoding :(
2. DID’s and DWN’s using Web5 on Next.js
3. Containerization

What's next for CredPass - One Stop for Logins

We would like to be able to integrate with other Web Services to use JWT’s from CredPass for web authentication and logon in the future.

Built With

• api
• css
• did
• docker
• dwn
• javascript
• next.js
• node.js
• ssi
• web5