Also (a nit, but c'mon) the footnotes in the #worldcoin whitepaper don't work. The HTML says literally:

Even the most recent implementations<a id="2" href="about:blank#fn2">2</a>

Seriously?

(They're actually sitting at the very bottom of the last section, "Disclaimer". Some buggy pdf-to-html script or something?)

Also from the #WorldCoin whitepaper:

Third parties "cannot track users across applications".

I don't believe this is true.

The mechanism that seems to be intended to prevent this is the "context". If I'm FooService and I get a request from a WorldID user to post something, I can send infrastructure the context "FooService20230725" and the message, and get back a proof that someone on the Official Human List did request to send the message, and a magic number N (called a "nullifier") which has the property that any other request by the same human (whose identity is otherwise not exposed to me) with the same context, will return the same nullifier.

So if I want to limit my things to one per day per human, I can just use a context including my service name and the date, and reject any that yield the same N value of the nullifier.

Or if I want to, I can always send just the context "FooService", and do whatever rate-limiting I want myself. This approach also lets me associate all requests that come from the same user! So I can track users across requests to my service.

But now what if me and the other members of my Cabal of Evil Services ALSO send in each request with a context of "EvilCabal"? That will yield Ns that will allow all members of the Cabal to track users across applications / services.

We still won't know who this person is in terms of real-world stuff, but we will be able to say that all of these requests to all of our services were from the same human, because they all returned the same nullifier N when sent with the same context.

(And if one member of my cabal does find out the government identity of some requestor, because we like sent them a package of Skittles via USPS, then we can all know it instantly, because we have the internet.)

I may be overloooking something here, but if I'm not, then it's not that third parties "cannot track users across applications", it's that third parties "cannot track users across applications unless they cooperate with each other".

And, um yeah... :)

Ah I think one protection there, to this obvious #worldcoin request-linking attack, is that I as a service provider need the user's cooperation to get the nullifier associated with a given context and user request (they, roughly, have to provide a signature on an approval of it).

So asking the user to approve a request under the "evilcabal" context might not work. :) But what if I just send one with the obvious "FooService20230725" context, and another with an empty string, or "xyRaqe"?

I guess the idea might be that we could tell everyone "never approve a request that has a context not obviously related to the action you intend to perform" and even "never approve two requests for two different contexts with one action", and if two different services were seen to be using the same context and therefore trying to track users across services, they could be named and shamed.

But once we're starting to talk about how users will have to be trained on some relatively esoteric judgments like this, I feel like we're already talking about something that is unlikely to ever be used by very many people. At least that's what my experience suggests.

@ceoln

And if the user is deliberately making service-by-service or action-by-action permission decisions...

...how is it that achieving anything different from any number of existing credential systems?

@Rose_On_Mars
The user still (in principle 😀 ) is proving they are human, keeping their true identity secret, and so on. But yeah...

@ceoln

Biometrics are just credentials you can't change when they're compromised...