the introduction to decentralized online
identities and how to implement
implement it wrong
um
hello hello hi everyone uh my name is
alien and today I'm going to talk about
the ayata travel pass and the
interesting system that uh that goes
behind it that's called the the
self-sovereign identity and this session
uh I do not allow a recording uh either
video or audio or taking photos of
anywhere and the the slides will be
released after the talk uh
okay
um a little bit of self-introduction uh
my name is alien I'm a researcher at the
at assist the the citizen lab University
of Toronto
um my research focuses on fighting
security and privacy problems in popular
mobile applications uh in the past my
most probably most famous
research was conducted on Tech talk and
doin that attracted a lot of media
coverage
um
so when when covet started
um
a lot of apps were introduced either to
do contact tracing or
uh vaccine passwords uh yeah where you
you know the the Taiwanese uh contact
tracing app something like those and so
the the app I'm going to talk about
today the Iota travel pass is is one of
them
um
so
um but it's not just a covet related app
it is it has a very interesting system
behind it so uh that is uh like one of
the major topic of my talk today
and
um yeah and and
uh in my after work time I also uh
volunteer as digital security trainer
for civil society organizations and I'm
also a Linux desktop user and a fast
contributor
okay a little bit on the the citizen lab
um
citizen lab is a interdisciplinary
research laboratory uh in the University
of Toronto and we combine practices from
political science and law and computer
science and area studies uh combine them
to to do our research and so other than
mine research there are also other very
cool and interesting research Topics by
my colleagues so uh I highly encourage
you to take a look and probably our main
most famous research is about the the
Pegasus malware developed by the NSO
group in Israel
those are this this is also one of our
research topics not by me but my by my
colleague is that focusing on the the
digital Espionage uh targeting the Civil
Society organizations and we also look
at what I think our Taiwanese audience
would find interesting is the freedom of
online expression
um such as my colleague studied the the
censorship mechanism of the the Chinese
uh in some messaging app WeChat
so I think these are very interesting
research and I encourage you to take a
look
um so uh to the topic uh first I'm going
to introduce you to the Iota travel pass
the Iota travel pass so so since covet
started uh many countries have began
imposing travel restrictions for example
you must test negative on a PCR test in
order to travel to the country
um so ayata travel pass is a mobile
application that is available on IOS and
Android that allows you to to receive
digital test results and share those
digital test results
um with the airport authorities
so to use the Iota travel pass
at the ITP first the user would have to
register on in the app by launching the
app and then completing the uh the the
registration process which involves
scanning their passports and completing
a liveness test because the app wants to
make sure that the user I mean the the
the the the the thing standing in front
of the of the phone camera is not a
photo uh they they will ask you to for
example tilt your head uh move your head
so that to prove that or blink your eyes
to prove that you are a real live person
and then they will allow you to continue
to register and
um after completing the registration the
user can now proceed to go to a covid-19
uh testing Laboratory uh and at the
laboratory they will the the user will
register with the laboratory essentially
signing up for a test and uh and the the
lab will use the identity created
in the ITP app
and after the the lab uh the the
covid-19 test results has been processed
uh the when the lab wants to issue a
um
uh digital covid-19 test result it will
send the digital test results via ITP
into the user's ITP app and then once
the user receives the digital test
result they can store it on their phone
and they can carry it along with them on
their phone and then when they go to the
airport when I check in at the airline
desk they can they can show uh they can
show to the to the to the staff that I
have been tested negative
okay
um the the interesting thing about ITP
is that
um it's not it usually it uses a very
novel
um technology called
self-sovereign identity
uh which is which I'm going to talk
about next
and so before we talk about the the uh
self-sworn identity we can first look at
conventional online identity systems
um the the most common one would
probably be oauth so in oauth
users would entrust their uh private
information to the identity provider
commonly Facebook and Google and apple
you know all these Giants and whenever a
application needs some user user data
they will
um ask you the use of open permission
and then the user will will tell the
identity provider that whether some
application is allowed to um
to receive which identity which data
items and once the permission is given
the the application can contact the
identity provider and retrieve the user
data from from the identity provider so
this is how conventionally it works and
the SSI is designed to replace this
system
sorry
okay so before we look into SSI let's
first look at how identities in real
world Works in this example I'm going to
take the the driver's license as an
example
the
um
so the governments they issue driver's
licenses and car plates which are called
credentials in SSI and they issue those
credentials to to either a holder which
is the driver and also the car that
holds the car plate so here
um
uh uh yeah so so here essentially the
the the car and the driver holds the
credential and uh because the the car is
not it's not alive as a person so we we
call that it's kind of like a robot so
it only holds the the carplay but
there's nothing else but it does hold
some kind of credentials so we call that
an agent in SSI and at last the the the
police which is the verifier can verify
those credentials carried by the holder
the driver uh or on the agents which is
the car so imagine you're driving your
car and and and and driving along the
highway and the police pulls you over so
essentially this is this this is what
happens in in real life right and the
police can look at your car's plate and
number plate and they they can verify
that whether these plate is valid still
valid and and you you fight all your
taxes for example and uh and they can
also verify uh your your driver's
license to to make sure that you have
the uh
you are licensed to drive this vehicle
so the SSI the Self Storage identity
systems look very similar to the to the
real world identity systems uh that is
the the driver's license so
um as I mentioned the the driver's
license is essentially a credential and
you can also call it a certificate those
certificates those credentials contain
certain statements and those statements
can be about anything about anyone so
for example it can say that you are
tested covet negative and you can also
say that you are a member of this for
example Airline
mileage program it can be a lot of
things and it can also be for example
that your your college diploma from some
University
yeah so uh the the issue are essentially
the issuer can issue any credential to
any user and
um the the agents are robots or programs
that can act on behalf of the user uh
which is also like authorized by the
user to perform these actions such as
cars and mailboxes so mailboxes receive
uh messages on behalf of the user and
then relay the messages to the user
afterwards so and also the the verifier
will can request credentials from the
user or request credentials from the
agent and also verify those credentials
yeah and and At Last I want to point out
that the the SSI is a it only refers to
a category of Technologies and standards
rather than a spec a specific one so
there are many many implementations of
SSI and also a a key observation is that
SSI is built upon the exchange of
credentials that is the the the the the
major
bit difference from uh the conventional
online identities
okay so uh to implement SSI we only need
we also need a data registry and it is
often but not necessarily A blockchain
and the blockchain the data registry uh
serves to facilitate peer communication
and it also serves as a revocation
registry to to to to to
um to allow the verifier to verify
whether certain credentials are revoked
or not and the the data registry also
does not hold any private data so for
example the the when when a driver is
issued a a driving license uh the the
driving license is never uploaded to the
to the data registry
and the the next component of SSI is
verifiable credentials
so the as I mentioned the credentials in
SSI we have the the knowledge of we have
the concept of credentials but uh they
are not just like normal credentials
they are verifiable so
um the verifiable credential is a double
3C standard uh it contains uh mostly
three parts
um the the most important part is the is
the yellow part the claims which are the
the statements that I mentioned the the
statements of the of the credential that
says something uh about the subject for
example the say some saying that you
graduated from a college and there are
also credential metadata uh like issuer
dates and schema and there are also uh
attached proofs to prove that these
claims are true and these proofs are
usually cryptographic yeah
uh but I'm not going to go into the
detail of the cryptographic area that
yeah I don't have the time
um and let's go back again to look at
what goes on the on the blockchain so
uh so once we understand the verifiable
credentials um uh these are the
information that goes on the data
registry uh which includes names and
public key resolution and there are also
credential schemas for example there
might be a schema for that goes under
their registry that says for example
College dipole Master contain field a b
c and d things like this and there's
also a revocation registry which is kind
of special uh as it is you I think it is
uh to my knowledge is implemented with
zero knowledge proofs and it is
essentially you can imagine as a
compound compound hashing function and
um the the verifier can can download the
hash value and using some cryptographic
magic they can know that whether this
credential has been revoked by the
issuer and this is all done so the the
verifier uh can download the the value
but the data necessary that blockchain
notes will not be able to know that
which credential and which issuer that
you are actually trying to verify so
this is kind of cool
and there are also public credentials
that goes on the data registry for
example the like public what really
pretty public ones like a company
registration
yeah
and so back to iata travel pass how does
iota travel pass use SSI to implement
their their functions so here
um again we see a a show you a
um the the Samo graph that has the other
other actors in The SSI so the the as I
mentioned the the Laboratories issue
covetash results and so the the labs are
essentially the issuer of the credential
and the credential is the cover test
result and the ITP app also issues a
credential to itself which is the
digital password that is issued during
the creation of your account in ITP and
there's also the mailbox that because
you you can imagine uh when the user
uses ITP the the phone will not always
be online right but the the laboratory
might need my my complete processing of
the of the covet test result at any time
right so there needs to be a mailbox so
that the lab can send the test result to
um without
um
uh uh uh so without loss when the user
is offline so that is the the the task
of the of the mailbox the agent and uh
when during verification the ITP also
sends the the test results and the
digital password for to the airline
which is the verifier to to to complete
the the verification and the there's the
the
specific system using the specific SSI
system using ITP is called Sovereign and
it is
um also a blockchain system so the
debuggling serves as a the the data
registry
okay so again uh let's compare the the
the the the the the flow the user flow
and the technical flow of the of the
itps operation so when the user
registers on the ITP by scanning their
passports and completing the liveness
test is essentially itpc is essentially
creating a self-asserted verifiable
credential to itself and when the user
goes to the laboratory to to to to to
um uh to register for a covert test uh
it essentially ITB establishes a
connection with the laboratory and third
when the lab sends a completed covid-19
test result to the user it is
essentially sending a verifiable
credential to the user
and also at last when the airport staff
is trying to verify the digital test
result uh the the airport staff and ITV
has to First establish a connection
which is a facilitated as I mentioned
facilitated by the data registry to to
build the connection and and once the
connection has been established the the
airport staff the verifier will request
uh uh verifiable credential of a
particular schema and the ITP will
prompt the user to to to whether you
would like to share this uh credential
to to the verifier and if the user says
yes and then the the VC is sent over to
the verifier
okay so what what does the the the lab
registration look like so this is from
one of the the iota's
um uh demonstration videos so
essentially you scan a QR code the QR
code contains something like this to the
right this is a invitation to build a
connection and the connection in SSI in
Sovereign is special is it's built using
a protocol called Aries
and when the user scans the QR code the
uh the app will prompt this screen
asking the user to share data to allow
sharing of the data or do not shoot data
and now I'm going to talk more on
Sovereign so Sovereign is is one of the
SSI systems and it is composed of a few
parts uh but I so so therefore the the
verifiable credential part essentially
defines the the the the file format and
the yeah in the fields that go into that
to for for a few for a credential to be
verifiable and secondly it also
comprises of the areas protocol which uh
which is designed to uh to transport the
exchange of uh verifiable credentials
and third there is the decentralized
identifier standard
um
which is there sort of like in the place
of DNS to to resolve uh
special decentralized names into real
https endpoints and there's at last
there's The Sovereign blockchain that
serves the facilitating communication
and as revocation registries
Okay so
um because this is too too much detail
so I'm going to skip most of it
um so Aries is a as I said it's it's a
it's a protocol that is designed to uh
uh facilitate the exchange of verifiable
credentials and uh it is on a similar
level it is on a similar level to oauth
uh so it operates uh based on https and
it defines a set of actions that could
be taken by actors
and and the processes of for example
authorization
and uh so to the top left this is what
the the what a decentralized identifier
looks like
and the Sovereign blockchain's job is to
resolve the name into a really
contactable uh endpoint sometimes https
mostly https sometimes something else
and on the second part of my talk I'm
going to talk about how ITP implements
it wrong
so basically all the issue comes all the
issue is caused by the implementer which
is a company called evernam
uh
so you know blockchain is very complex
and when you want to integrate
application that works with a blockchain
there are often trouble for example the
nodes might not always be online because
drop in in blockchain nodes are allowed
to go offline
yeah so so the the no you're you're
trying to contact with might go offline
and you don't know whether it is online
or offline or not and it might also
takes a long time because you don't know
which node is located where so you
cannot contact the closest node
and this makes
this makes it problematic for use in
client applications uh because the user
might need to wait a long time and fail
and retry so this is very not very ideal
for for fun from a product uh stand of
you and so so what usually happens is
that the the implementer implements a
wrapper uh or in blockchain World
sometimes people say that it is a API
Gateway the Gateway speaks very simple
https or https based uh protocol that uh
that is always online and so the contact
can conduct the Gateway and then perform
the Gateway will perform actions on the
blockchain uh on behalf of the client
so this is the first problem that every
name creates and the second problem is
that in blockchain users always lose
your private keys and
so the solution comes a very popular
solution for the vendors that let's
manage the user's private key for them
and that defeats all the purpose of the
blockchain actually you probably have
guessed so this is the wrapper the the
the the green box that is used
um by the the Laboratories so evernam
creates a lab app which uh is a
web-based web-based application designed
for laboratory staff to send an issue
and cover test results and it also
manages the the lab's private key on the
blockchain for them
um yeah
and this is what the lab app looks like
to the right so you can see that on the
interface there is a place for the for
the for the lab staff to uh search for a
task sample ID and to issue a digital
test result and it can also they can
also upload a CAC file for batch
entrance
and and for verification the the
situation is more complex because
uh even though I haven't improviser
Airline app Iota stated that stated to
us that it's not actually used by any
airlines so and and we don't we don't
have the detail on on how the airlines
are how the verifiers are actually what
programs the verifiers are using to to
verify those digital uh covid-19 test
results
so the actual architecture looks more
like this all the green boxes are
implemented by every name you see
um the user uses ITP which is mostly
implemented by Eminem and the lab also
uses the lab app which is cloud-based
web-based and manage the lab's private
key and also implemented by Eminem and
to the right the agency service which
hosts the mailbox also implemented by
Eminem to the to the to the bottom right
the the verify app we know from the
statement it also implemented by the by
Evernote so uh and those different
wrappers the the green boxes they talk
to each other on behalf of the user
and they also supposedly will talk to
the blockchain to verify but we don't
really know because we don't have the
implementation
uh I'm not sure if everyone has noticed
the problem here so uh this is a a a a
line from the popular movie Hong Kong
movie uh Charlene soccer uh where you
see on the field in a game when you
control all the players or the judges or
the hosts or the co-hosts
there is no way that anyone can beat the
host yeah the game is essentially weaked
so the actual architecture of ITP looks
more more like this
so there's in the central there in in a
in a central there's the the evidence
all in one service that tells everyone
what to do and whether some uh
uh uh covet test results are valid or
invalid so basically they decide
everything they can they can uh the
urban M can issue uh false but looking
real negative test results to any user
and they can also allow passage of inner
authentic covid-19 test results
and the blockchain is also not really
needed here because everyone relies on
every name to talk to the blockchain so
we don't really need it we don't really
need it and if we remove the blockchain
there wouldn't be any any loss of
security of the system because it
already sucks and so let's compare ITP
with the old system
which is paper and in paper uh in in a
paper vaccination verification scheme
you have the lab that issue a
covenanting test results on paper and
you have the verifiers looking at the
paper to either on visual inspection or
sometimes there are pki based digital
signature algorithms to to verify but at
least there is the separation of power
that is the verifier and the issuer are
not the same entity
but now we still have the problem that
the results might be forged but worse
because every name controls the issuer
and both the issuer and the verifier so
this is so the essentially what I'm
saying is
the ITP is even less trustworthy than
traditional paper-based uh
vaccine sorry not vaccine covid-19 test
result systems
so there are also other issues with Iota
travel pass for example the live Nets
test is completed entirely client-side
so it can be bypassed
uh as demonstrated in my full project is
bypassed and the digital password
scanning can also be bypassed I can fill
in arbitrary information and ITP will
create a
um digital password for me
and the impact of all those problems
combined is that uh first theoretically
Eminem can create can Forge covid-19
test results secondly the ITP system is
even less trustworthy than traditional
paper-based systems and at last
arbitrary digital passwords can be
created so if people really think that
digital password is a
replacement for physical passports they
will run into big trouble because
digital passwords can be forged
form fortunately too man to to based on
the answers of ayata the digital
password is never really used for
identity verification
so alas why should we care about SSI or
ITP
because
both Canada and the European Union
are currently discussing ways to to
interoperate their existing national ID
system with
the SSI systems not necessarily
Sovereign but might be other SSI systems
but still I think SSI is very important
because it on a technological level it
is it has some added features compared
to traditional pqi but the all the
problems I laid out was mostly because
of a problematic implementation but not
with the the design of the protocol
itself so so I think so so both the EU
and and Canada are looking to integrate
SSI into their national identity system
so I think this is what makes SSI
important uh yeah for us to look at
and the theoretical advantages of SSI I
think number one would be that users can
finally keep their own data instead of
entrusting them to a identity provider
like Google or Facebook and secondly
there is the peer-to-peer data sharing
so the data sets on the user's control
until the user decides to share them
yeah and the user can also decide to
selectively disclose information which
is not possible with traditional
TOS or pki based certificates for
example if I get a driver's license uh
that says I'm allowed to drive Auto
vehicles and I have I'm born something
date and I'm a gender or something and
I can use this and construct a zero
knowledge proof that to for example to
someone at a bar to a bartender at a bar
to prove that I'm over 18 and able to
drink I can only I can I can decide to
selectively
only prove that my age is above 18.
without actually reviewing the the
actual age and also not
revealing any other information such as
my gender yeah and it also allows for
the SSI also allows for decentralized
and private revocation checks because
doing revocation checks the the the the
digital footprint of the check is often
is often also considered a a a kind of
can be inferred uh can can be used to
infer client Behavior but in SSI uh
using zero knowledge proofs we are we
can construct uh decentralized and
private revocation checks
the disadvantages of SSI I think is
mostly on a ecosystem level because
mostly SSI systems are very new now and
most of the SI systems are new so there
is also mostly only just one vendor
behind every SSI system which creates
trust issues because if you decide to
use a system decide to use the SSI
system then you only got one vendor to
choose from and that you will end up the
same as the ITP problem that you have
the same entity that controls the issuer
and the verifier yeah so this often
creates trust issues and the the second
problem is that users always lose their
private keys and I think there are some
uh innovative ways that have been
developed to allow like retrieval of
lost private keys or or or or at least
construct a new trustable one but those
are even more complex which I won't go
into the detail and a last SSI is also
highly highly complex I'm I'm not sure
whether all these complexities are
necessary but because this complexity
will prompt the need to seek vendors
because you cannot implement it yourself
it's too complex
and when you seek vendor you you go back
to the num question number one
um there is only one vendor
so conclusion so Lessons Learned is that
first don't trust the system because
it says is used in blockchain
and secondly don't let the players be
the judge in the system in any system so
we should separate the credential or
certificate issuer and the verifier
entities
so these are the two Lessons Learned and
my opinion is that exercise highly
complex and it is currently in early
adoption phase and So currently there is
not enough scrutiny on SSI and
implementations so therefore the and
also the a highly complex system also uh
puts a high bar to to implementation and
integration which which prompts me as I
said to seek vendors and uh it also
makes it difficult for competing vendors
to to enter the market and which again
might lead to monopolies and this is
Monopoly is definitely not we want to
see in in national ID systems right and
therefore at current stage I would say
that citizens citizens should not trust
SSI for any sort of public use yet maybe
in the future but definitely not now
until more scrutiny and more security
research is done against SSI
and uh but despite all this I think SSI
technology is still promising because it
has it incorporates a lot of the new uh
developments in in mathematics and
cryptographics and so it provides like
all those cute cool new features like
selective disclosure and private
revocation checks so I think these are
very useful and very cool and could help
protect user privacy
and but however uh the we we must
continue to make sure that SSI the SSI
Market remains competitive otherwise
with monopolies we will end up with
worse Solutions than traditional
paper-based systems
and I think so so this is the the second
last slide I will go through very
quickly so first uh you are not really
required to use ITP uh you can still
decide to to have a paper uh
covid-19 test result and also ITP is not
available on every flight it is only
available on select flight so you
probably have not used it that's the
problem that's probably the reason and
can I pass border control with forged
ITP digital Pi squares likely no because
we don't actually know what the border
control is using but I don't think it is
likely that they will use the the ITP
for for that verification so the on the
border control you you probably still
have to show your physical password
and
and third exercise does not require
blockchain you can you can also use pki
blockchain is not required but everyone
uses blockchain
and
so at last
um I did not find any vulnerability on
the political level but rather on a
ecosystem and implementation-wise level
yeah so I.E this is a implementation
issue of SSI
and so that's the end of my talk uh uh
you can you can look at the the full
report on on this link and you can also
find other cool research from my
colleagues at the
citizenlab.ca and I will be available at
the The Village uh the the cscs booth
you can mostly find me there and there's
my email
uh any questions
true
so anyone who wants to ask questions
um
t
hi
um thanks for the talk
um I guess I have sort of two questions
my first question is how does SSI differ
from just attribute based credentials
generally because so like uh in uh
Anonymous credentials or attribute based
credentials it's just like a pretty well
studied pretty well studied problem in
you know privacy cryptography so for
example the edamix protocol is something
I'm a big fan of that implements uh
attribute based credentials showing that
I have a driver's license for example
that's valid without revealing other
things about me or that I've tested
negative for covid and I'm just
wondering is there a difference between
SSI and this kind of system
um sorry I don't think I've studied
attributed credentials before oh okay I
mean it sounds really similar to what
how you described it maybe it's the same
thing it sounds like very similar but
I'm not really sure
um sorry um by um attribute um
credentials you mean like kind of like
metadata kind of stuff no no it's like
what you were saying so you have a
credential like
um let's say uh I have a my credential
is my University degree so it's issued
to me by some issuer uh like the
university and I have the the degree on
my app for example that has all these
fields and every field in the in the
credential is an attribute so I can for
example say I have a degree in uh
biology and uh and I can verify this
cryptographically kind of like What's
Happening Here
who is the signer
the the university would be issuing me
the the credentials on the signer so it
sounds very similar but I have not
studied the term attributed credentials
so I'm not really sure but also one
thing to clarify is that SSI referred to
a to a category of systems and for
example as a sovereign
that can be called SSI and
uh Sovereign is also composed of
different components that that serves
this different purposes in the system
such as the the the attribution
credential that you just mentioned will
probably be you very similar to the the
verifiable credential thing but but not
necessarily with the Aries protocol or
the decentralized identifier component
okay yeah maybe uh we can chat after
because
um there's uh yeah yes it's happy to
chat yeah thanks and do you have a
second question I think uh the second
question was kind of based on the first
okay we can chat about it later okay yes
yeah I guess probably it really depends
on like uh what's the definition for
attribute um credential I think it's
kind of similar to an SSI um aspects um
from what was previously mentioned yeah
um so
um any more questions
um
um if not maybe I'll I'll ask a question
so
um like right now you're mentioning that
uh the SSI is not
um kind of mature enough for uh General
applications so let's say there are
developers here um who works on uh
various apps that
um needs to verify the user's identity
so you will still propose that we go the
traditional route of
um
uh directly like verifying oh that's a
that's a good
and difficult to answer question and so
I I I think it is good for
I think that depends on the scale of the
system right so if we're talking about
for example a national ID system like
the Taiwanese Eid system I think we
should definitely not use this exact
technology for that for now but we
should definitely trial SSI because it
is very promising technology and it
offers many advantages over a
traditional pki-based systems so which
is the one that the Taiwanese ID system
is currently using though we we don't
have Eid yet but yeah this is
implemented with pki right so it's very
interesting and for small scale systems
for example let's say I'm a
um for example I'm I'm a company that I
want to manage my company identity using
SSI I think that that that that that
could be that could be used if you if
SSI could be used in this case because
the it is not public the the company can
rely on a single vendor to to if they
trust the vendor is if you trust the
vendor having all those like cyber
security certifications and and you
trust them I think it should be fine
having the the issue and the verifier
being the same person though it will
still be best if you seek out a
additional vendor uh too so that you you
have two vendors
um scrutinizing over each other yeah
this kind of like democracy you you
shouldn't put the exact excitative
Branch with the of the legislative
branch with the same uh people so that's
going to be problematic uh yeah so
that's basically my answer um so in one
way I mean my understanding of the issue
is like um if you are in a scenario
whereby um the benefits of being like
the leader in um
verifying identities and um
um managing the Privacy issue of that
outweighs the possible
um downtime or issues that can come from
using an SSI system then that would be
kind of the opportunity to to use the
system to kind of be the leader in in
that change right
uh yeah I I guess you could say that yes
I think I think it companies could could
could trial that because uh uh I think
the the this this or because I mean
traditionally companies already use
single sign-on systems and that's
already very centralized so if you
replace that with with SSI that is also
essentially centrally controlled that
wouldn't be so bad compared to the to
the to the to the old a single silence
system but it also wouldn't be so good
if you if you can if all everything is
implemented by the same vendor so yeah
there's okay at one point I'd like to
add is that
um SSI brings tons of complexity it's
too complex so
um is is the complexity worth the extra
advantages that you have not necessarily
I don't think it is currently true for
most of the case
okay so the takeaway would be um you
know if we have single Scion then
there's something that you can at least
continue to use until we see you know
SSI being um Yeah by some of the leaders
yes yes okay um great um so I think
that's about the time so uh let's thank
um uh paleon with a round of approx for
the uh fantastic speech thank you
I also have a bounty house uh session uh
which will be in Chinese