ceoln @ceoln@social.cleverlibre.org

Ah I think one protection there, to this obvious #worldcoin request-linking attack, is that I as a service provider need the user's cooperation to get the nullifier associated with a given context and user request (they, roughly, have to provide a signature on an approval of it).

So asking the user to approve a request under the "evilcabal" context might not work. :) But what if I just send one with the obvious "FooService20230725" context, and another with an empty string, or "xyRaqe"?

I guess the idea might be that we could tell everyone "never approve a request that has a context not obviously related to the action you intend to perform" and even "never approve two requests for two different contexts with one action", and if two different services were seen to be using the same context and therefore trying to track users across services, they could be named and shamed.

But once we're starting to talk about how users will have to be trained on some relatively esoteric judgments like this, I feel like we're already talking about something that is unlikely to ever be used by very many people. At least that's what my experience suggests.

Also from the #WorldCoin whitepaper:

Third parties "cannot track users across applications".

I don't believe this is true.

The mechanism that seems to be intended to prevent this is the "context". If I'm FooService and I get a request from a WorldID user to post something, I can send infrastructure the context "FooService20230725" and the message, and get back a proof that someone on the Official Human List did request to send the message, and a magic number N (called a "nullifier") which has the property that any other request by the same human (whose identity is otherwise not exposed to me) with the same context, will return the same nullifier.

So if I want to limit my things to one per day per human, I can just use a context including my service name and the date, and reject any that yield the same N value of the nullifier.

Or if I want to, I can always send just the context "FooService", and do whatever rate-limiting I want myself. This approach also lets me associate all requests that come from the same user! So I can track users across requests to my service.

But now what if me and the other members of my Cabal of Evil Services ALSO send in each request with a context of "EvilCabal"? That will yield Ns that will allow all members of the Cabal to track users across applications / services.

We still won't know who this person is in terms of real-world stuff, but we will be able to say that all of these requests to all of our services were from the same human, because they all returned the same nullifier N when sent with the same context.

(And if one member of my cabal does find out the government identity of some requestor, because we like sent them a package of Skittles via USPS, then we can all know it instantly, because we have the internet.)

I may be overloooking something here, but if I'm not, then it's not that third parties "cannot track users across applications", it's that third parties "cannot track users across applications unless they cooperate with each other".

And, um yeah... :)

(They're actually sitting at the very bottom of the last section, "Disclaimer". Some buggy pdf-to-html script or something?)

Also (a nit, but c'mon) the footnotes in the #worldcoin whitepaper don't work. The HTML says literally:

Even the most recent implementations<a id="2" href="about:blank#fn2">2</a>

Seriously?

"If every message or transaction included a "verified human" property, a lot of noise could be filtered from the digital world."

What? How? Since it's "privacy preserving", the "property" can't be traceable back to a particular person. So what prevents the spammer CEO (who is a person, and has the ability to "prove" that all their actions are done "by a human") from "proving" that each piece of spam is human-created?

This makes no technical sense.

#Worldcoin

Has anyone read this "whitepaper"? Apparently no one at Worldcoin proofread it. :)

A sample sentence (not actually a sentence): "The COVID relief fund for India, where over $400 million were raised in a short period of time by individuals around the world to support the country as a hint at what can be possible. "

So far it's basically the same vapid claims repeated over and over.

Oooh! Maybe #OpenAI quietly retracted their AI-text-detector because it would have revealed that the #Worldcoin whitepaper was written by #ChatGPT . XD