“The elusive dream application that could be based on blockchain technology is a universal and privacy retaining identity system.” – SecurityWeek on Immutability (August 8, 2024)

That dream of a decentralized privacy-retaining identity system able to combat AI-driven bots and deepfakes may not be as elusive as feared – courtesy of Tools for Humanity (TfH) and Worldcoin.

The Worldcoin/TfH identity solution is not a traditional identity system. It contains no personal information – instead it simply and irrefutably confirms that this person is a living person and not a bot.

TfH is a non-profit organization founded by OpenAI’s Sam Altman and Alex Blania in 2010. Its CISO is Adrian Ludwig, who was Atlassian’s CISO for five years and director of Android Security at Google for six years. The firm has raised a total of $115 million through venture capital funding.

Worldcoin is technically under the stewardship of the Worldcoin Foundation, an exempted limited guarantee foundation company incorporated in the Cayman Islands. For all practical purposes it would be fair to think of Worldcoin as a project being developed by TfH but with potential future business flexibility.

It is easy to consider malware as the scourge of the online world. But if you apply the concept of reductionism, you find a deeper and more fundamental problem below: the bots and fake accounts that distribute the threats. The real problem for security defenders is not who you are, but what you are: are you human or not? SecurityWeek talked to Adrian Ludwig for a better understanding.

“There’s a small number of bad actors that develop pieces of malware, but they’re able to make tons and tons of accounts,” explains Ludwig. “So, they’re able to hide behind having all of these fake identities and use them to deliver their malware.”

That basic pattern plays out everywhere across the internet. “You see it in social media where people produce bot accounts and try to sway public opinion. You see it in dating sites, where people create dozens of different dating profiles, and try to use them to manipulate the results in ways that can often be abusive.”

It’s this widespread problem of astroturfing that plays out wherever there’s a market – manipulating the truth for less than truthful purposes, whether that’s political perception, social perception, product volumes or values, or sales achieved. 

“For almost any company or platform that reaches a certain size on the internet,” continued Ludwig, “tons of money is spent trying to solve this problem.” But in essence, the problem is simple: does this identity belong to a human or not? It is a problem that will escalate with increasing criminal adoption of automation, bots, and AI.

All other aspects of identity are built upon this first distinction – and that is the first solution that must be provided: a global, privacy enhanced, secure and durable proof of unique humanity. This is the issue that Worldcoin currently addresses with its World ID.

It is a global problem that ideally requires a global solution. It requires universal trust. It must be decentralized, controlled by neither company, organization, nor government. It must effectively be infinitely scalable. And it must be secure, privacy-enhancing, and immutable. There is only one current technology that offers this possibility: the permissionless blockchain similar to that developed by Satoshi Nakamoto for Bitcoin.

In brief, a World ID is generated locally by the World App and confirmed to belong to a living human by a double iris scan from a specialized custom camera (the ORB). The unique iris scan is stored in the Worldchain blockchain, preventing the same biometric being abused to generate multiple World IDs. The iris code is believed to be irreversible but is, or will be, further hashed to ensure irreversibility. The initial iris scan and the code is deleted from the Orb.

Worldchain

The unique proof of humanity (the iris scan code) is stored as encrypted biometric data within Worldchain; technically an Ethereum Layer 2 blockchain. This provides visible confirmation that the entity concerned is a real person without including any PII. But Worldchain will do more in the future.

“We’ve been doing a lot of work related to making Worldchain able to support other applications that are specifically targeted at humans,” said Ludwig. “We think it’s important that there be space that favors humans over automation, because so much of the internet basically favors automation over humans. So, we’ve produced Worldchain, which is a blockchain connected to Ethereum, to advance those applications that favor humans.”

Right now, Worldchain just provides the fundamental proof that this entity is human.

World ID and Worldchain

The concept for a World ID is a single global unique human identifier. That would require several billion different unique identifiers that could be tied one to one for every human and stored securely. “We needed to find a way to differentiate each individual across all of humanity,” said Ludwig. 

The only technology that comes close to offering this possibility is biometrics; but it’s still difficult. Not all biometrics provide sufficient entropy, and not all provide long term stability. Faces change over time, fingerprints get worn down and scarred. Ludwig turned to the iris – it is unique to each person, provides sufficient entropy to distinguish everyone, is stable, and is difficult to fake. More specifically, he turned to both irises, and TfH designed and built a custom camera called Orb. 

“It’s a camera built for the specific purpose of looking at a person’s face and making a decision about whether this person is real and alive or not; that is, whether the subject is a live human,” he continued. “It then collects only the information that’s necessary to determine if they have previously registered for the system – checking against the existing entries already registered on the Worldchain blockchain.”

No personal information is required beyond the iris scan, and no data is retained by the Orb. The scanned data is encrypted, and a zero-knowledge proof is generated and used to confirm with Worldchain that this is a new entry rather than a repeat entry. New entries are added to the blockchain, and the subject’s World ID is confirmed and safely stored on the subject’s mobile phone. Each World ID is unique and can be neither shared nor transferred.

World App, developed by TfH, is the first application for the Worldcoin project. It must be downloaded and used (it runs on both iOS and Android) before the World ID subject uses the Orb. The app generates a cryptographic keypair that effectively becomes – once verified as belonging to a unique living human by the Orb iris scanning – the person’s World ID. 

The public key of the keypair is passed to the Orb via a QR code (that is, air-gapped and containing no personal information). The Orb scans both irises and generates an iris code. The public key and the iris code are sent to the backend (the Orb deletes all data it has held). If the iris code is unique (using the Hamming distance calculation), it is stored on Worldchain, preventing any future use of the same code (that is, the same person) for a separate identity and providing both visibility and decentralization. When the process is successfully completed, the user has a unique proof of humanity – the World ID – stored in the World App wallet and tied to the proof of humanity iris code via the cryptographic key pair. Throughout the process, zero-knowledge proofs are used to confirm ownership of data without disclosing the data. No PII is generated or stored by Worldcoin.

Once the World ID is established within World App, it can already be used to sign into participating platforms just as platforms offer ‘sign in with Google’. The precise method will depend on how the participation is implemented, but one method could be the presentation of a QR code generated by World App. The point, however, is that World App confirms to the platform that the person is a single, unique and genuine human being with a World ID. The platform is protected from bots and fake IDs, while the user gains access without having to give up any personal information to the platform.

This has, of necessity, been a very brief and basic overview of a new approach to an old problem: proving the basis of identity by proving humanity to the exclusion of fake, bot driven identities. The project is still in its early days, but the potential is clear. Participating platforms already include Discord, Minecraft, Reddit, Shopify and Telegram.

World ID is in its infancy, even though it is already used by some 12 million people around the world and can be used for sign-in to several major platforms. But the future potential is immense. This potential could be unleashed by third-party apps developed to work with World ID. 

“To make World ID and the Worldcoin Protocol easy to use, an open source Software Development Kit (SDK) is available to simplify interactions for both Web3 and Web2 applications,” explains a Worldcoin whitepaper. “The World ID software development kit (SDK) is the set of tools, libraries, APIs, and documentation that accompanies the Protocol. Developers can use the SDK to leverage World ID in their applications. The SDK makes web, mobile, and on-chain integrations fast and simple; it includes tools like a web widget (JS), developer portal, development simulator, examples, and guides.”

Potential example use cases could include social media and networking (preventing the generation of multiple bot accounts used for magnifying false narratives): healthcare (for secure storage and only authorized sharing of patient medical records); supply chain management (enhancing the traceability and accountability of goods as they move through the supply chain); and – dare we say it in an era of election credibility concerns – secure and fraud-proof online voting (at both the governmental and organizational levels).

More to the initial point of this article, however, World ID can help with the isolation of deepfakes. It is an open question whether technology will ever be better at detecting a deepfake than at creating one. SecurityWeek asked Ludwig for a response to whether World ID can help solve the future and growing threat from deepfakes. “The short answer is yes,” he replied. “Worldcoin is building tools to help humans prepare for the age of AI and distinguish which online content is produced by humans versus bots.”

We may not be able to detect a deepfake, but World ID will detect a fake source and imply dubious content.

Related: Deepfake of Principal’s Voice Is the Latest Case of AI Being Used for Harm

Related: LastPass Employee Targeted With Deepfake Calls

Related: UK Cybersecurity Center Says ‘Deepfakes’ and Other AI Tools Pose a Threat to the Next Election

Related: US Agencies Publish Cybersecurity Report on Deepfake Threats