| HN Mirror

[1] https://www.coindesk.com/policy/2023/05/24/black-market-for-...

> his actual concern here is humans stealing identities and running bots in order to farm any sort of UBI mechanism that gets set up

So exactly what's happening with Worldcoin right now [1].

People will soon be able to use their iriscodes to reclaim credentials that they sold, and once people start doing that, the market for re-sold credentials will drop to approximately zero.

> People will soon be able to use their iriscodes to reclaim credentials that they sold, and once people start doing that, the market for re-sold credentials will drop to approximately zero.

Is the obvious related problem this solution brings forth supposed to go unsaid? (Criminals don't buy something they can steal.)

Okay, so what's the attack scenario here?

Imagine we live in a future where Worldcoin is ubiquitous, all the hardware/software is open source. Several orb operators exist in every city in the world, and operators have a non-trivial amount of WLD tokens staked to ensure good behavior. Misbehaving orbs have their keys and subkeys revoked at the first sign of illicit usage.

Maybe a criminal kidnaps 10 people, then steals an orb, and uses those 10 iriscodes to register 10 new credentials on the network. How much profit would you expect to come to the criminal before their credentials are revoked?

Is there another attack you're thinking of?

> a criminal kidnaps 10 people, then steals an orb, and uses those 10 iriscodes to register 10 new credentials on the network

This is a lot of work. Just steal the iriscodes. If they're used for re-issuance, they're being stored and transferred. If they are not directly used, there is a hash-like reduction that can be exploited.

For sake of argument, though, let's assume perfect security. Infallible security. All the way through. Congratulations, you've turned every pair of eyeballs into an oil spigot. When the Taliban or ISIS carves through a town, instead of beheading the leaders and taking their treasures, they take everyones' irises. Every authoritarian state would require scans of its citizens so payment could be routed through (read: stolen by) it, a requirement they would back up with violence.

kemotep 1052 days ago

So if we start with your premise, the attack I can see being a concern is being able to deny people access to Worldcoin and burning their accounts/tokens by maliciously attacking an orb. If keys can be revoked because of illicit usage, someone could generate a key at the orb they wish to attack and act maliciously. Sybil attack, or attempt fraudulent transactions, or whatever behavior triggers burning all the keys tied to an orb. Do this before an election (if worldcoin is used for voting) or before the UBI is dispersed for the month and you could disrupt a lot.

How does Worldcoin provably know that an attacker is not using a dead person’s keys?

pessimizer 1052 days ago

That sounds like a automation problem. If you have an office dealing with UBI and unemployment in your neighborhood, the government can literally know their customer. The more people unemployed, the easier it will be to staff them.

These people are pretending they're fighting fraud, when instead they're trying to reinvent government responsibilities/campaigns as passive income sources for 3rd party rent-seekers. Uber for welfare.

That sounds neat. I like the ultra-local approach.

The important thing that I think your argument is missing is that everything here is additive. I'm sure the whole Worldcoin team would love it if governance organizations of all sizes, from tiny villages to billion+ population nation states would run UBI programs to take care of their people. The thing is, today, that's not really happening, so there are a number of people working to make it happen from different angles. Maybe all of them fail, maybe one succeeds, maybe a bunch succeed and any given citizen of the world might be entitled to payments from a handful of UBI sources.

Do you think there are better global scale UBI projects and ideas out there, or do you think we should just stop trying to solve this problem?

> Do you think there are better global scale UBI projects and ideas out there, or do you think we should just stop trying to solve this problem?

To the degree Worldcoin is doing anything to UBI, it's in tarnishing its brand. (Identity verification is not what's holding it back.)

If they were serious about this as anything but another crypto pump-and-dump, they'd focus on direct foreign aid.

Sybil resistance is important in any sort of UBI system that preserves privacy, which may or may not be important. I like the idea of a privacy preserving UBI, and feel like it's definitely a lot more equitable than having it based on existing passports, or bank account numbers, or something like that.

> I like the idea of a privacy preserving UBI

This is valid. But even if we reduce scope to a privacy-preserving UBI, nothing Worldcoin solves the core hurdles thereto. It's solving a side problem tangentially related to those involved with a privacy-preserving UBI, but entirely germane to an a16z-style crypto pump-and-dump.

Adjunct: how is Worldcoin privacy preserving? At least with Bitcoin you can plausibly deny ownership of a wallet. In a world on Worldcoin, every traffic stop lets the cops inspect your bank account.