Proposal for a 1-on-1 identity system protocol.

krlkrl Member Posts: 5
Having an identity system that more or less guarantees that each person can only hold one identity at a time would allow many things that would otherwise be vounerable to sybil attacks to be built.

The method i'm proposing relies on having meetings organized where people authenticate each other.

Let's call the code/procedure an identity contract.

It would work like this:

1. Register an name in the identity contract
2. Give your approximate positional data, this can be updated as you move around.

3. A few days before the date, participants in the contract are randomly grouped together based on location, and get invited to a channel to communicate a meeting point.

4. The people thus invited (maybe around 10-20 people, depending on how many are registered in this area) gather to the agreed upon meeting point.

5. At the meeting, each participant signs a statement saying who they met at the meeting, so that every person is signed by at least one other who was participating in this meetup.

6. The contract registers that the meeting was successful, and gives everyone involved one identity point.

This protocol relies on the fact that you cannot be in two places at once, and as long as you participate in a majority of your meetings, everyone can be sure that the identity you chose is your only identity within this system.

I have not been able to see any obvious attacks on this system, but maybe i'm missing out on something? Would love to hear your comments.

Comments

  • JasperJasper Eindhoven, the NetherlandsMember Posts: 514 ✭✭✭
    As llSourcell says in reddit:
    1. location can be spoofed with multiple IPs and devices
    2. collusion- group of bad guys in proximity can verify each other for different identities
    3. what prevents me from creating a new identity in a different location after my first one?
    But it is still a good idea a part of some system. For instance, some contract needs 1-person 1 ID, like Bitvote, the people involved are sure they are persons themselves, and trust themselves to not create doubles. So they go vouch for other people, and devise some system where the chance that people estimate wrong about other people is taken into account. I.e. if A is assumed trustable and vouches for B, the latter is not added, because even though A is trustable, A does not have a 100% certainty to detect a fraud.(Far from it)

    Now even with such calculations perfect, you need a way to afterwards detect frauds and draw consequences from it. Next to signing parties, i think it might be good to also add 'detectives' that get paid when they find frauds, and convince the system of such. Of course, must be able to detect false positives.
  • krlkrl Member Posts: 5
    I think i've responded to the critical reddit comments.

    The answer to the problem of registering fake accounts in remote places that vouch each other is the most interesting attack possibility.

    How you might be able to defend against this is to only allow growth of new groups from actual people traveling to set them up.

    The way i think this kind of approach makes sense, is really related to fraud and potential speed of growth.

    If you want to quickly enable identity-trust in remote regions, a system like this would probably be faster to establish, than webs of trusts growing only at the edges of real personal connections between people.

    A functioning 1-on1 system that is based on webs of trust is clearly more efficient, since you don't have to take part in these rituals, but it might actually offer some advantages.

    Thank you for the constructive feedback so far, i do think this is one of the 'big ones' in these emerging technologies.
  • JasperJasper Eindhoven, the NetherlandsMember Posts: 514 ✭✭✭
    Okey, this is starting to sound good. :) (added to bitvote wiki)

    How do you deal with people claiming the same location as different somehow. I mean, i suppose you could do GPS locations, but maybe something like local areas like cities, or portions of cities in large cities is better. Maybe going to different places and 'registering' there might tie different cities together.

    Might need some math thrown at it, also what sort of effort it takes And to figure out how to use the information. I mean, 'identity point' simply adding up is an idea, but what exactly does the number mean?
  • krlkrl Member Posts: 5
    I'm glad you're getting where i'm going with this!

    Something like approximate location would work well, GPS coordinates of the center of your city/district would work for the matching algo.

    As for identity points, the contract would just have an api to return the successfully attended meetings in the last year or something, then other contracts could calculate compound scores based on this, for use in other automatic-trust systems.

    The time of the meeting should probably be calculated from the longitude of the coordinate where the meetup will be 'centered', so that time-zone limits are harder to exploit.

    I think i want to experiment with this as part of the Berlin based Blockchain Research Group. (which i forgot to announce on the forum, but will do now)
  • ikar0sikar0s Member Posts: 6
    edited July 2015
    just use person-to-person verification

    like, I extend trust to @krl, @krl extends trust to @Jasper

    and design the web of trust so that you'd need X number of verifications to be included. each person could set the value of X.

    the most extreme would be to have X = number of users, and then go downwards from there until you reach the minimal-trustable value for X

    and combine with a hierarchy

    and have another value, Y, for levels in a hierarchy

    i extend authority to @vitalik, and I'd be Y-1 relative him

    the most extreme hierarchy would be to have Y-number of users,
    then let each user set what value of Y they trust,
    and see how low it can go
    Post edited by ikar0s on
  • juliussbensonjuliussbenson Member Posts: 5
    I've been thinking about the 1-to-1 identity key assignment problem for awhile too.
    I was thinking about a system in which, say there were 2 people who met up - the protocol would display unique QR codes on each of their phones, and the participants would be required to take a picture of their face with the QR code in the frame. Perhaps you could use some sort of facial recognition too?
    Anyways, this would make it rather difficult for participants to collude, since the people themselves aren't verifying one another's existence. The face recognition + unique QR code is really the thing doing the verifying
  • lucas2lucas2 Member Posts: 5
    edited August 2015
    what I like about it: it could scale really fast and become really popular. Ethereum needs an ID system and this could potentially scale faster then a friend-to-friend ID.

    what I don't like about it: it's invasive, it's the equivalent of the nation-state ID system except on Ethereum, people are still forced to meet with ID-providers that they might not trust and that they haven't chosen themselves. I prefer friend-to-friend IDs.
    Post edited by lucas2 on
  • lucas2lucas2 Member Posts: 5
    edited August 2015
    I became intersted in @krl's idea and I've opened a new thread,
    http://forum.ethereum.org/discussion/3117/decentralized-id-based-on-randomized-peer-to-peer-verification?new=1
    a one year old post (http://forum.ethereum.org/discussion/comment/12827) had some interesting ideas.

    It describes a proof-of-one-account ID system. The system sounds very reliable and i think it could become popular fast. The system matches random groups of people based on their location, and arranges meet-ups where these random peers sign each other's contracts and photograph each other.

    This protocol relies on the fact that you cannot be in two places at once, and as long as you participate in a majority of your meetings, everyone can be sure that the identity you chose is your only identity within this system.
    It's more invasive then friend-to-friend ID but could scale faster because if that. I'm thinking launch it and then let friend-to-friend IDs gradually replace it over the next 2-3 years.

    I'm interested in developing this. I'll open this thread if anyone else is interested in developing it with me, and for conversations about the future of proof-of-one-account IDs.
    Post edited by lucas2 on
  • brenzibrenzi Member Posts: 2
    very interesting idea and I think the 1-on-1 ID is the most urgent problem to solve to enable various DAOs. The effort in this proposal is quite high, but if there are real benefits from holding such an ID, many -if not all - people might accept the procedure. I think this could very well work in densely populated areas. But imagine a very remote village in some developing country. Given internet access, the villagers could of course meet and sign in their village, but as this is a very closed network, it has no chance to gain a lot of trust. People might have to travel far to connect to other networks. So there comes the question: what is the benefit for participation. An unconditional basic income could incentivize participation. But as such a UBI would have to use the same currency everywhere, a UBI of X tokens might make people in country A travel an entire day for signing events whereas in country B this UBI wouldn't even pay for the bus ticket to the next signing event once per month. On the other hand, the other benefits of owning such ID besides the UBI could of course make people in country B participate
Sign In or Register to comment.