Up to this point, we've been claiming our DANG tokens into the current logged-in user of the frontend,
which happens in my case to have this Principal ID,
now the problem with this is this is actually just an anonymous user. It's actually not a real user at all.
And the reason is because we're not logged in.
So this user that's operating the website has no Principal ID to give our backend to use.
Now, you'll notice that when you've logged in to, say, the Network Nervous System, or when you initially
signed up to get your free cycles from ICP, you had to go through a login process, and the login process
asked you to create an Internet Identity.
And when you create an Internet Identity, you able to assign a device to that Internet Identity anchor
and it would ask you to verify your identity using either a USB security key or this current laptop
device, which in my case can let me log in using touch ID.
Now what exactly is this internet Identity and how can we implement it in our website to allow authentication
of our users through the Internet Identity?
That's what we're going to explore in this lesson.
Now, one of the things we were missing is this authentication ability on our website, and we're going
to do it using something that's called the Internet Identity.
And the idea with the Internet Identity is it's an anonymous blockchain authentication framework that
is supported by the Internet Computer.
It's going to fill a similar role to say, log in with Facebook or log in with Google.
And the idea is that authentication and keeping your users' passwords secure is actually quite a difficult
task technologically.
And this is why you've heard of so many security breaches and data leaks, everything from Ashley Madison,
to Equifax.
Even big companies aren't very good at keeping login information secure.
A better solution would be to offload this challenging task to a company that's good at technology,
so in this case, Facebook and Google, because they have the infrastructure and they have the investment
that's already made into authentication and keeping things secure using Oauth.
But if letting big tech companies know every aspect of your online life
doesn't sound like a good idea to you,
then this is where the internet Identity comes in, because it allows us to be anonymous. Using the Internet
Identity,
we can create as many of these anchors as we want.
And these anchors give us a pseudo-identity which we can be used to log in to decentralized apps.
But you can create as many of these anchors as you want or need,
and the Internet Identity at this stage knows absolutely nothing about you.
There's no username, there's no password,
you don't need to provide an email to sign up,
there's no seed phrases, One-Time passwords, authenticator apps, or email confirmations, which means
that companies won't be able to track you across services or even know who you are.
The Internet Identity builds on this thing called the Web Authentication API, which is a specification
written by W3C and FIDO with the participation of big companies like Google, Mozilla, Microsoft and
others.
This means that the technology that is behind it will be compatible with all modern browsers and operating
systems.
When you create an Internet Identity, it's secured using chain-key cryptography, the same framework
that powers the Internet Computer. And it uses compatible cryptographically enabled devices such as the
fingerprint sensor on a laptop or the face id system on a phone to authenticate you, which from a
user's point of view makes the sign up and login super easy because you don't have to remember any passwords
or usernames.
All you have to do is just sign in using your biometric data like your face or your fingerprint, which
makes it super convenient
and it also eliminates the weakest point of online security, which, to be honest, is you.
It's the ability for you to generate secure enough usernames and passwords and to remember them.
So how does that actually work?
Well, when you add a device to an anchor and you generate a new Internet Identity, a pair of cryptographic
keys, a private and public key, are generated.
The public key is stored on the Internet Computer blockchain, while your private key remains locked
inside the authentication device,
so together with any sort of biometric data that secures the access to it, for example, touch ID. When
you log on to a decentralized app, both keys are
required to authorize the session and the authorization from the Internet Identity then grants you access
as an application specific anonymous identity, which basically allows you to be pseudonymous across
many applications,
and it also lets you create as many of these pseudo-identities as you need.
And if you want to learn more, you can take a look at this demo from the Dfinity team, where the founder
of Dfinity talks about how it works in more detail.