Original author: Vitalik Buterin

Original translation: Huohuo, Vernacular Blockchain

Today, WorldCoin, a Web3 encryption project co-founded by OpenAI founder Sam Altman, officially announced its launch. It is reported that the Worldcoin team has designed a biometric identity authentication system called World ID, which uses an eye scanner Orb to verify the identity by scanning the user's iris.

On the same day, Ethereum founder Vitalik Buterin published an article "What do I think about biometric proof of personhood?", expounding on his views on biometric proof. The following is the full translation:

People in the Ethereum community have been trying to build a decentralized The Proof of Humanity solution, which has always been one of the most difficult but valuable problems. The Proof of Humanity is a limited form of real-world identity that allows a given registered account to be controlled by a real person (and a different real person than every other registered account), ideally without revealing which real person it is.

There have been many efforts to try to solve this problem before: BrightID, Idena, and Circles are representative examples. Some of these come with their own applications (usually UBI tokens), and some have found solutions in Gitcoin Passport to verify which accounts are valid for quadratic voting. Zero-knowledge technologies like Sismo add privacy to many similar solutions.

Until recently, we have seen the rise of a larger and more ambitious The Proof of Humanity project: Worldcoin.

Worldcoin was founded by Sam Altman, who was previously known as the CEO of OpenAI. The idea behind the project is simple: AI will create a lot of wealth for humanity, but it may also kill a lot of people's jobs because the system will eventually develop to the point where it is almost impossible to tell who is human and who is not a robot. So we need to fill this gap by:

(1) creating a really good human identity system so that humans can prove that they are actually human;

(2) Providing UBI for everyone. Worldcoin is unique in that it relies on highly sophisticated biometrics, using a dedicated piece of hardware called “the Orb” to scan the iris of each user’s eye.

The goal is to produce a large number of these orbs, distribute them widely around the world, and place them in public places so that anyone can easily get their own ID.

To its credit, Worldcoin is also committed to decentralized development. This means technical decentralization: using the Optimism stack to become L2 on Ethereum, and using ZK-SNARK and other cryptographic techniques to protect user privacy, as well as decentralized governance of the system itself.

Worldcoin has been criticized for privacy and security issues with the Orb, design issues with its “Token,” and ethical issues with some of the choices the company has made. In fact, the Worldcoin project itself is still a work in progress. However, others have raised more fundamental concerns about whether biometrics – not just Worldcoin’s eye-scanning biometrics, but also the simpler face-video upload and verification game used in The Proof of Humanity and Idena – will ever gain mass adoption.

There is certainly no shortage of criticism, with risks ranging from inevitable privacy breaches, further erosion of people’s ability to browse the internet anonymously, coercion from authoritarian governments, and the possibility of how to be secure while being decentralized.

This post will discuss these issues and provide some arguments to help you decide whether it is a good idea to scan your eyes in front of our new spherical tool? Should we abandon the development of The Proof of Humanity and what are the alternatives?

01 What is The Proof of Humanity and why is it important?

The Proof of Humanity is valuable because it solves the current problem of power concentration on the traditional Internet, avoids dependence on central institutions, and leaks as little personal information as possible. If The Proof of Humanity is not solved, decentralized governance (including "micro-governance" such as voting on social media posts) is a castle in the air.

Many major applications in the world today deal with this problem by using government-backed identity systems (such as ID cards and passports). This does solve the problem, but it makes a huge and unacceptable sacrifice in privacy.

The two-sided risk faced by our current human proof system

In many human proof projects - not only Worldcoin, but also "flagship applications" such as Circles, the "Token per person" code (also known as "UBI Token") is built in. Every user registered in the system receives some fixed number of tokens every day (or hourly or weekly). There are many other applications, including:

- Airdrop mechanism for token distribution;

- Token or NFT sales with more favorable conditions for less wealthy users;

- Voting in DAOs;

- Quadratic voting (payment for funds and attention);

- Protection against robot/sybil attacks in social media;

- CAPTCHA alternatives for preventing DoS attacks.

In fact, the common desire is to create open and democratic mechanisms to avoid centralized control by project operators and domination by wealthy users. The latter is especially important in decentralized governance.

In such a situation, today’s existing solutions rely on:

(1) Highly opaque AI algorithms

(2) Centralized ID, also known as “KYC”.

Therefore, an effective identity proof solution would be a better solution that can achieve the security properties required by these applications without encountering the shortcomings of existing centralized approaches.

 02 What were the early attempts at Internet identity proof?

There are two main forms of human identity proof: social graphs and biometrics.

Social graph-based human identity proof relies on some form of guarantee: if Alice, Bob, Charlie, and David are all verified humans, and they all say that Emily is a verified human, then Emily is probably also a verified human.

Vouching is often reinforced by incentives: if Alice says Emily is human, but it turns out she is not, then both Alice and Emily can be punished. Biometric proof of personhood involves verifying some physical or behavioral characteristic of Emily that distinguishes humans from robots (and individual humans from each other). Most projects use a combination of these two techniques.

The four systems I mentioned at the beginning of the post are roughly as follows:

(1) The Proof of Humanity:You upload a video of yourself and put up a deposit. To get approved, existing users need to vouch for you, and other challengers challenge you over time. If there is a challenger, the Kleros decentralized court verifies whether your video is real; if it is fake, the deposit is forfeited and the challenger is rewarded.

(2) BrightID:You join a video call "verification party" with other users, and everyone verifies each other. Bitu can be used for a higher level of verification through this system, where you can get verified if enough other Bitu verified users vouch for you.

(3) Idena:You play a captcha game at a specific point in time (to prevent people from playing multiple times); part of the captcha game involves creating and verifying captchas, which are then used to verify other people.

(4) Circle:Existing Circle users vouch for you. Circles are unique in that it does not try to create a "globally verifiable ID"; instead, it creates a trust graph where someone's trustworthiness can only be verified from the perspective of your own position in that graph.

03 How does Worldcoin work?

Each Worldcoin user installs an app on their phone that generates private and public keys, just like an Ethereum wallet. They then visit "the Orb" in person. The user stares into the Orb’s camera while showing the Orb a QR code generated by their Worldcoin app that contains their public key. The Orb scans the user’s eyes and uses sophisticated hardware scanning and machine learning classifiers to verify: (1) whether the user is a real person;

(2) The user’s iris does not match that of any other user who has used the system before.

If both scans pass, Orb will sign a message approving the dedicated hash of the user’s iris scan. The hash is uploaded to a database - currently a centralized server, which is intended to be replaced by a decentralized on-chain system once they determine that the hashing mechanism works. The system does not store the full iris scan; it only stores the hash, which is used to check for uniqueness. From that point on, the user will have a “World ID”.

World ID holders are able to prove that they are a unique human being by generating a ZK-SNARK to prove that they hold the private key that corresponds to the public key in the database, without revealing which key they hold. Therefore, even if someone rescans your iris, they will not be able to see any actions you take.

04 What are the main issues with building Worldcoin?

There are four main risks that people are concerned about:

(1) Privacy

Registries for iris scans could potentially leak information. At a minimum, if someone else scans your irises, they can check against the database to determine if you have a World ID. An iris scan could potentially reveal more information.

(2) Accessibility

Unless there are enough orbs that anyone in the world can easily obtain, a World ID will not be reliably accessible.

(3) Centralization

The Orb is a hardware device, and we cannot verify that it is constructed correctly and has no backdoors. Therefore, even if the software layer is perfect and fully decentralized, the Worldcoin Foundation still has the ability to insert backdoors into the system, allowing it to create as many fake human identities as it wants.

（4） Security

Users’ phones could be hacked, and users could be forced to scan their irises while showing public keys belonging to other people, and it is possible to 3D print “fake people” that can be iris scanned and given a World ID.

It is important to distinguish:

（1）Problems unique to the choices made by Worldcoin;

(2) Problems that are inevitable with any biometric proof of human identity;

(3) Problems that are inevitable with any general proof of human identity. For example, signing a “proof of humanity” means publishing your face on the internet.

Joining the BrightID authenticator doesn’t do this completely, but it still exposes your identity to a lot of people. Joining Circles exposes your social graph publicly. Worldcoin is much better at protecting privacy than both of these.

On the other hand, Worldcoin relies on specialized hardware, which brings up the challenge of whether the Orb manufacturer can be fully trusted to build the sphere. This challenge has no analogues in The Proof of Humanity, BrightID, or Circles. Perhaps in the future, others besides Worldcoin will create different specialized hardware solutions with different trade-offs.

05 How do biometric human identity proofs address privacy issues?

The most obvious and largest potential privacy leak of any human identity proof system is tying every action an individual takes to a real-world identity. This data leak is very large, arguably unacceptably large. But fortunately, it is easily addressed with zero-knowledge proof technology.

Rather than signing directly with a private key, whose corresponding public key is in a database, a user can make a ZK-SNARK to prove that they have a private key, whose corresponding public key is somewhere in a database, without revealing which specific key they have. This is typically done with a tool like Sismo, and Worldcoin has its own built-in implementation.It is important to give a “crypto-native” human identity proof here: this fundamental step provides anonymization that is missing from essentially all centralized identity solutions.

The existence of a public registry of biometric scans is a more subtle privacy leak. In the case of The Proof of Humanity, this centralizes a huge amount of data: you get a video of every The Proof of Humanity participant, making it crystal clear to anyone in the world who’s willing to investigate all The Proof of Humanity participants.

In the case of Worldcoin, the leak is much more limited: Orb computes locally and publishes only a “hash” of each person’s iris scan. This hash is not a regular hash like SHA256; instead, it’s a specialized algorithm based on machine-learned Gabor filters that handles the imprecision inherent in any biometric scan and ensures that consecutive hashes of the same person’s iris have similar outputs.

Blue: Percentage of bits that differ between two scans of the same person's iris

Orange: Percentage of bits that differ between two scans of two different people's irises

These iris hashes leak only a small amount of data. If an adversary can brute-force (or covertly) scan your irises, then they can compute your iris hash themselves and check it against a database of iris hashes to determine if you're participating in the system.

This ability to check if someone has registered is necessary for the system itself to prevent people from registering multiple times, but it also has the potential to be abused.Also, iris hashes have the potential to leak a certain amount of medical data (gender, race, and perhaps medical conditions), but the leakage is far less than what is captured by almost any other mass data collection system in use today (e.g. street cameras). Overall, the privacy benefits of storing iris hashes seem good enough for me.

06 What are the accessibility issues in biometric human identification systems?

Specialized hardware introduces accessibility issues because specialized hardware is not accessible. Between 51% and 64% of sub-Saharan Africans now own a smartphone, and this is expected to increase to 87% by 2030.

But while there are billions of smartphones, there are only a few hundred Orbs. Even with more massive distributed manufacturing, it would be hard to reach a world where everyone has an Orb within five kilometers of them.

But Worldcoin, to its credit, is working on it!

It’s also worth noting that many other forms of human identification have even worse accessibility issues. It’s very hard to join a social graph-based human identification system unless you already know someone in the social graph. This makes it easy for such systems to be limited to a single community in a single country.

Even centralized identity systems have learned this lesson: India’s Aadhaar ID system is based on biometrics because it was the only way to quickly onboard its huge population while avoiding massive fraud caused by duplicates and fake accounts (thus saving huge costs), though of course the Aadhaar system as a whole is much weaker in terms of privacy than anything that has been proposed at scale within the crypto community.

From an accessibility perspective, the best performing system is actually one like Proof of Work, where you can enroll using just your smartphone. However, as we’ve seen and as we’ll see, such systems come with all sorts of other trade-offs.

07 What are the centralization issues in biometric human identity systems?

There are three main issues:

(1) Centralization risk in the top-level governance of the system;

(2) Centralization risk unique to systems that use specialized hardware;

(3) Centralization risk exists if proprietary algorithms are used to determine who the real participants are.

Any human identity system must contend with (1). If the system uses incentives denominated in external assets (e.g. ETH, USDC, DAI), then it cannot be completely subjective, so governance risk is inevitable.

For Worldcoin, the risk is much greater than for The Proof of Humanity (or BrightID) because Worldcoin relies on specialized hardware, while other systems do not.

Especially in a "logically centralized" system where only one system is doing the validation, this is not a risk unless all algorithms are open source and we can guarantee that they are actually running the code they claim to be. For systems that rely purely on users validating other users, this is not a risk.

08 How does Worldcoin solve the hardware centralization problem?

Currently, a Worldcoin-affiliated entity (Tools for Humanity) is the only organization making Orbs. However, the source code for Orbs is mostly public: you can see the hardware specs in this github repository, and other parts of the source code are expected to be released soon.

The license is one of those "shared source code, but technically not open source" licenses similar to Uniswap BSL, and in addition to preventing forks, it also prevents what they consider to be unethical behavior - they specifically list mass surveillance and three international civil rights declarations.

The team's stated goal is to allow and encourage other organizations to create Orbs, and over time transition away from Orbs created by Tools for Humanity to having some kind of DAO that approves and governs which organizations can make Orbs recognized by the system.

This design is leaky:

It fails to decentralize in practice. This is probably due to a common flaw in federated protocols: one manufacturer will always end up dominating in practice, causing the system to re-centralize.

It turns out that this distributed manufacturing mechanism is difficult to secure. I see two risks here:

(1) The emergence of bad Orb manufacturers: if there is a manufacturer of the Orb that is malicious or hacked, it can also generate an unlimited number of fake iris scan hashes and give them World IDs.

(2) Government restrictions on the Orb: governments that do not want their citizens to participate in the Worldcoin ecosystem can ban the Orb from entering their country. Furthermore, they can even force citizens to scan their irises, giving the government access to their accounts, and citizens will be unable to respond.

To make the system well-equipped to identify and combat bad Orb manufacturers, the Worldcoin team recommends that Orbs be audited regularly, verifying that they were built correctly, that key hardware components were built to spec, and that they have not been tampered with after the fact. This is a challenging task: it’s basically like the IAEA’s nuclear inspection bureaucracy, but for Orbs. Hopefully, even a very imperfect implementation of an auditing regime can significantly reduce the number of fake Orbs.

To limit the damage any bad Orb manufacturer can do, it makes sense to have a second mitigation. World IDs registered with different Orb manufacturers, preferably registered with different Orbs, should be distinguishable from one another. If this information is private and stored only on the World ID holder’s device, that’s fine too, but it does need to be proven on demand. This allows the ecosystem to respond to (inevitable) attacks by removing individual Orb manufacturers, or even individual Orbs, from the whitelist on demand. If we see the North Korean government going around forcing people to scan the Orb, then any accounts that result from this can be immediately and retroactively disabled.

09 Security issues in general human identity?

In addition to issues specific to Worldcoin, there are a number of issues that affect human identity design. The main ones I can think of are:

(1) 3D printed dummies: People could use AI to generate photos or even 3D prints of dummies that would be convincing enough to be accepted by the Orb software. Even if only one group did this, they could generate an unlimited number of identities.

For Worldcoin, this is much less risky than a system like The Proof of Humanity: a face scan can check many more features of a person than a mere deepfake video, and is much harder to fake. Specialized hardware is inherently harder to fool than commodity hardware, which in turn is harder to fool than the digital algorithms that verify remotely sent pictures and videos.

Could someone 3D print something that could eventually fool even specialized hardware? Possibly. I expect that at some point we’ll see a growing tension between the goals of keeping mechanisms open and keeping mechanisms secure: open source AI algorithms are inherently more susceptible to adversarial machine learning. At some point in the further future, even the best AI algorithms might be fooled by the best 3D-printed dummies. However, from my discussions with the Worldcoin and The Proof of Humanity teams, it seems that neither protocol has seen significant deepfake attacks at this point, for the simple reason that it’s incredibly cheap and easy to hire real low-wage workers to register on your behalf.

Can we prevent the sale of IDs?

In the short term, preventing this outsourcing is difficult because most people in the world don’t even know about the Human ID Proofing protocol, and if you tell them they can make $30 by holding up a QR code and scanning their eyes, they’ll do it.

Once more people know what the Human ID Proofing protocol is, a fairly simple mitigation becomes possible: Allow people with registered IDs to re-register, cancelling their previous IDs. This makes “ID sales” much less credible, because the person who sold you an ID can re-register, cancelling the ID they just sold. However, getting to this point requires the protocol to be very well known, and Orbs to be very widely accessible, to make on-demand registration practical.

This is one of the reasons why it is valuable to integrate UBI Token into a human ID system: UBI Coin provides an easy-to-understand incentive for people to learn about the protocol and sign up, as well as having their own account cancelled if they sign up on behalf of someone else.

Can we prevent coercion in biometric human ID systems?

It depends on what kind of coercion we are talking about. Possible forms of coercion include:

- A government scans people's eyes (or faces) at border controls and other routine government checkpoints and uses this to register its citizens

- A government bans the use of the Orb within the country to prevent people from independently re-registering

- A (presumably government-run) app that requires people to "log in" by signing with a public key directly, allowing them to see the corresponding biometric scan and thus the link between the user's current ID and any future ID they get from re-registering.

A common concern is that this makes it too easy to create "permanent records" that follow a person throughout their life.

Especially in the hands of unsophisticated users, it seems difficult to completely prevent these scenarios. Users can leave their country and (re)register with the Orb in a safer country, but this is a difficult process and is costly. In a truly hostile legal environment, finding an independent the Orb seemed too difficult and risky.

Proof of identity methods that require a person to say a specific phrase when registering are a good example: it is sufficient to prevent hidden scans, and for coercive measures, the registration phrase can even include a statement confirming that the respondent knows that they have the right to re-register independently and potentially receive a UBI token or other reward.

If coercion is detected, the device used to perform the coerced registration may have its access revoked. To prevent apps from linking people's current and previous IDs and trying to leave a "permanent record", default human proof of identity apps can lock the user's key in trusted hardware, preventing any app from using that key directly without an intermediary anonymous ZK-SNARK layer. If governments or app developers want to solve this problem, they need to force the use of their own custom apps.

With a combination of these techniques and active early warning, it seems possible to lock out those regimes that are truly hostile and keep those that are merely neutral (like much of the world) honest. This could be done by projects like Worldcoin or The Proof of Humanity maintaining their own bureaucracy to accomplish this task, or by revealing more information about how an ID was registered (e.g., in Worldcoin, which Orb it came from), and leaving this classification task to the community.

Can we prevent ID renting (e.g., selling votes)?

Re-registration does not prevent renting your ID. This is OK in some applications: the cost of renting your right to collect that day's share of UBI Coins would just be the value of that day's share of UBI Coins. But in applications like voting, ticket selling is a big problem.

A system like MACI could prevent you from selling your vote by allowing you to cast another vote later, invalidating your previous vote so that no one can tell if you actually cast such a vote. However, this doesn't help if the briber controls the keys you received when you registered.

I see two solutions here:

(1) Run the entire application process within the MPC. This also covers the re-registration process: when a person registers with the MPC, the MPC assigns them an ID that is separate and unlinkable from their proof-of-identity ID, and when a person re-registers, only the MPC knows which account to deactivate. This prevents users from proving their actions, because every significant step is done within the MPC using private information known only to the MPC.

(2) Decentralized registration ceremony. Basically, implement a protocol similar to the face-to-face key registration protocol, which requires four randomly selected local participants to jointly register someone. This ensures that registration is a "trusted" process and attackers cannot snoop during the process.

Social graph-based systems may actually perform better here because they can automatically create a local decentralized registration process as a byproduct of the way they work.

10 Human identity proof based on biometrics vs. social graph-based verification

In addition to biometric methods, the other main competitor for human identity proof so far is social graph-based verification. Social graph-based verification systems all operate on the same principle: if there is a large number of existing verified identities that have all proven the validity of your identity, then you can obtain a valid verified status.

If only a few real users (accidentally or maliciously) help verify fake users,

then you can use basic graph theory techniques to set an upper bound on the number of fake users that the system verifies.

Proponents of social graph-based verification often describe it as a better alternative to biometrics for the following reasons:

- It does not rely on specialized hardware, making it easier to deploy;

- It avoids a perpetual arms race between manufacturers trying to create fake people and Orbs that need to be updated to reject such fake people;

- No biometric data needs to be collected, which is more privacy-preserving;

- It may be more pseudonymous-friendly, because if someone chooses to split their internet life into multiple identities separate from each other, then both identities may be verified (but maintaining multiple real and independent identities sacrifices network effects and is costly, so it is not something an attacker can do easily).

Biometric approaches give a binary score of “is human” or “is not human”, which is singular: people who are accidentally rejected will not be able to get a UBI and may not be able to participate in online life. Social graph-based approaches can give a more nuanced numerical score, which of course may be a bit unfair to some participants, but is less likely to judge someone as completely “impersonal”.

My take on these arguments is that I basically agree with them! These are real strengths of social graph-based approaches and should be taken seriously. However, it is also worth considering the weaknesses of social graph-based approaches: regional limitations, privacy leaks, risks of unequal concentration, etc.

11 Is human identification compatible with pseudonyms in the real world?

In principle, human identification is compatible with all kinds of pseudonyms. There is no ideal form of human identification. Instead, we have at least three different paradigms of approaches, all with their own distinct strengths and weaknesses. A comparison chart might look like this:

Ideally, we should view these three technologies as complementary and combine them. Dedicated hardware biometrics have the advantage of being secure at scale, as demonstrated by India’s Aadhaar. They are very weak at decentralization, although this could be addressed by making individual spheres responsible.

Today, general purpose biometrics are easy to adopt, but their security is rapidly declining and they may only work for another 1-2 years. A social graph-based system bootstrapped by a few hundred people who are socially close to the founding team will likely face a constant tradeoff of either missing out on large parts of the world entirely or being vulnerable to attacks by communities they can’t see. However, a social graph-based system bootstrapped by tens of millions of biometric ID holders could actually work. Biometric bootstrapped may work better in the short term, while social graph-based techniques may be more robust in the long term and hold greater accountability over time as algorithms improve.

Possible Hybrid Development Paths for the Future

The problem of making an effective and reliable human identification system, especially in the hands of those far from the existing crypto community, seems quite challenging. I definitely don’t envy those who attempt this task, and it may take years to find one that works.

In principle, the concept of human proof of identity seems very valuable, and while various implementations have their risks, so does not having any human proof of identity: a world without human proof of identity seems more likely to be a world dominated by centralized identity solutions, money, small closed communities, or a combination of all three. I look forward to seeing more progress on all types of human proof of identity, and to seeing the different approaches eventually form a coherent whole.

Source link

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia