GALXE passport storm: digital identity does not require a KYC passport

Original author: UVZeee.eth@AEON Labs

GALXE (formerly Project Galaxy) recently released its passport digital identity passport service. Users need to upload ID and other identity documents and complete the KYC procedure before they can get the "passport" issued by them. The processing fee is $5 per authentication, and the first 100,000 users are free. Mandatory KYC processes, the collection of private user information, and certification fees raise debate about whether the process is necessary. GALXE declares this passport as a kind of SBT (soul binding token), which has caused some discussions on whether SBT should appear in the form of KYC passport.

This article attempts to demonstrate: (1) data on the chain provides many ways of identity verification, and KYC is not the only helpless decision; and (2) why web3 Digital identity does not require the form of identity document "passport", as well as the inherent defects and hidden risks of this kind of document.

Why do we need to be forced to provide private information when using public domain data on the chain can identify identities?   

In various web3 projects in recent years, it can be seen that many sources of information can participate in the process of identifying individuals and constructing identities. As follows:  

Public chain transaction information.

Wallet data analysis platforms such as Nansen have shown us that on-chain transaction information can be used to identify wallets and identities. Through information such as transaction items, transaction frequency, and transaction objects, Nansen assigns various labels to different wallets, such as "public figure", "rarible user", and "depositor". These wallet tags are really a reputation, a shallow form of identification. We can see which traders have a closer trading relationship, who are rich people who hold a lot of cryptocurrency, and who are collectors who specialize in collecting NFTs. Therefore, transparent transaction information on the chain can directly participate in identification and identity establishment.

NFT and the community.

The NFT community project represented by BAYC explains that holding some kind of NFT can be used as an identity certificate to verify whether it is eligible to join the community. After joining the community, proof of participation activities (which can be understood as non-transferable POAP), community contribution tokens, etc. can be used as identification marks. However, the NFT community still has bright prospects for identity recognition: for example, BAYC members continue to release derivative artworks based on monkey images. Once the creative behavior is connected with community contributions, the creative behavior can become the basis for the creator's identity endorsement.

Zero knowledge proof.

Polygon released Polygon ID at the beginning of this year. This service aims to respect web3 user privacy and anonymity requirements while verifying user identities, thereby optimizing KYC, KYB and other service experiences. Zero-knowledge proof (ZKP) allows users to prove that they have legal identity documents during the identity verification process, without allowing third parties to read the content of the documents themselves, thereby disclosing private information to third parties or regulatory agencies. This shows that even if a KYC link is required to avoid risks, companies can still choose to complete the verification without touching private content.

We can see from the above list that there are still many ways to authenticate without forcing users to submit private information to any company. KYC was originally a compromise method born of regulatory pressure outside the Web3 community, but now in the GALXE passport project, we see this pressure-resistant compromise being actively used by web3 native companies. Moreover, GALXE is only a certificate platform rather than a financial transaction platform, and is currently not under any external pressure from government regulation. This kind of "forward-looking" compromise is unacceptable.

One of the advantages of blockchain attracting users and rapidly developing a huge web3 community is to protect anonymity and Respect for privacy information, but GALXE's active KYC to obtain sovereign identity endorsement has cast a shadow on the prospect of establishing a truly decentralized web3 society and establishing a native digital identity.

Why do you not need a passport? Talking about how a piece of paper transfers risks to individuals  

The invention of passports is only a hundred years old. We might as well disenchant this form of document and analyze whether we really need a form of identity document called “passport” in the Web3 community.

A piece of history: The birth of the modern passport is related to the increasing border controls of countries during World War I. Border controls restrict people and goods from entering and leaving a country at only a few points along the long border, and require passports to prove their identity. On the one hand, it prevents the influx of immigrants from the third world, and at the same time, it can control the brain drain from the country. After the end of World War I, this temporary policy is still controversial and continues to this day, and has become a routine method of sovereign countries around the world. In the 1980s, passport information standards were formulated, and around 2000, a new generation of passports with built-in biometric chips appeared, and the format of identity documents such as passports became increasingly mature.

Returning to the present, I think this form of identity documents for the purpose of border control will be harmful if reused in the decentralized web3 world. The reasons are as follows:

The presumption of guilt of identity.

The underlying logic of the passport is the presumption of guilt for identity: it assumes that a person cannot prove his legal identity unless the person has a passport issued by a sovereign country to clear his name. But before the First World War, were people born legally? Therefore, identity risk is an artificially created or artificially enlarged risk.

Promoting identity theft to become a profitable business, the identity risk is actually passed on to the bottom users.

Continuing from the first point, identity risk, as a risk of artificial expansion, makes identity theft and risk management two popular businesses. Assuming that Alice cannot prove "I am me" by herself, instead of relying on a piece of paper to prove that I am Alice, then anyone who holds an identity document named Alice can use Alice's identity to obtain potential Huge profits (such as immigrant entry or borrowing under false names). Identity theft is thus perpetuated, whether in the web2 or web3 world, on-chain or off-chain.

In order to eliminate the above crimes of identity theft, the risk management of centralized thinking tends to superimpose identity documents, face authentication, fingerprint recognition, personalization issues, assistance More and more information such as recorded words proves "I am me". After the top layer expands the risk of identity, the increased verification cost needs to be borne by every user at the bottom layer, which is actually a downward transfer of risk.

If GALXE still wants to use an isolated and authoritative document like "a passport" to prove the identity behind the wallet, it will also face identity theft and risks management issues. And because the wallet is actually directly controlled by the private key, if Li Gui obtains Li Kui's private key offline, he can not only steal wealth, but also use his identity. Because the GALXE passport does not know that Li Gui in the offline world has replaced him Li Kui's identity endorsement allowed Li Gui to be unimpeded on the chain.

Contradicts the liquidity value of Web3.

As shown in the example of passports, international travel and nationality changes are hindered by the need for the endorsement of a sovereign state. Mandatory KYC verification forces the user's private information to be obtained by the company, and the identity certificate is bound to GALXE, thus losing the mobility of migrating identity authentication services. In addition, if as a web3 creator, he rejects the second YouTube or Tencent because he does not want to be deeply bound, then why should he accept a service like GALXE whose privacy and identity certificates are still bound to the company?

Digital parasitism is not a digital twin.

Under the condition that the identity certificate can only be obtained after going through KYC, is the identity established here the original identity of Web3, or a secondary identity that must be attached to the credit endorsement of the sovereign state? The SBT article mentioned that soul-bound tokens can be "self-certified", so that the digital identity described by SBT is an independent and self-certified individual, that is, a digital twin of an individual in the real world. However, KYC relies on the certification of national identity documents rather than "self-certification", making it more appropriate to describe the identity it establishes as digital parasite.

The above are the possible defects of the KYC passport. Even though the KYC link enables GALXE to quickly surpass its opponents in terms of security and compliance, its limitations to Web3 digital identities Construction, in the long run, is unfavorable.

End  

Since the concept of SBT was proposed, there have been many The imagination and experimentation of what form SBT exists in. The author believes that using SBT to authenticate identity and build an identity credit system is essentially to screen the huge and complicated sea of data on the chain, and to screen out the key information or information intersection that can describe the identity, so as to gradually approach an increasingly accurate identity portrait. The open and transparent data sea on the public chain ensures that information resources are not monopolized, and the information screening services provided by various companies that meet the needs of various scenarios also ensure profitability and ecological vitality, thus enabling a diverse and decentralized social vision There is a possibility of realization.   

GALXE passport shows us the possible shadow side in the construction and proof of digital identity. If the value of decentralization of web3 is not recognized, it may appear that while using the high encryption of the blockchain as an excuse to persuade users to hand over private information and absorb it as company assets, combined with the increasing regulatory pressure facing blockchain finance, Take advantage of the trend to launch a "regulatory friendly" identity certificate, monopolize identity authentication power to form a new centralized platform, and become a skin-changing web2. This is a far cry from the vision of SBT as the cornerstone of a self-certifying, decentralized social credit network as conceived in the article "Centralless Society".   

Of course, on the digital identity track, imagination is still on the way. We look forward to seeing more ideas and attempts to gradually promote digital identities to have a greater and more profound impact in the metaverse and even in the real world.   

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia