Global Proof of Personhood with World ID -ETHGlobal London 2024

[Music] all right hi everyone I'm Ian I do developer relations for the world coin project specifically working for tools for Humanity and in this Workshop I will go over what world ID is why World Quinn created it what you can do with World ID and most importantly how to integrate World ID into your project so World ID is our Global proof of personhood protocol that allows you to prove that you're a real human doing an action only once without revealing to anybody not even to worldcoin which unique human you are right this is a really big important question that we're answering Bots have gotten out of hand and will only continue to get worse civil resistance is a huge problem in this space and basically any project benefits from knowing that that users a human and that they only have one account World ID is built to be private inclusive and robust right all we want to know is that you're a human we don't really need to know which human you are as many people as possible need to have access to World ID and we want it to be robust ensuring that it really is just one verified World ID per real human we looked at a lot of different ways to go about solving this problem but an email or phone it's easy to get multiple of those we looked at doing kyc of government IDs but less than half of the global population has a digitally verifiable government ID webs of trust work well at smaller scales but scaling them to all of humanity is a really tough problem when your initial trusted set is only a couple hundred or a couple thousand people but Biometrics can do a really good job of proving that you're a human and proving uniqueness when it comes to Biometrics there are lots of different types of biometric markers we can use we looked at fingerprint fingerprints face scans Palm scans but those can change over time they don't scale super well to all of humanity right face and Touch ID on your phone can distinguish about one in3 million people that works fine for one to one ath authentication but doesn't do super well when you're trying to prove that you're different from millions or billions of other people DNA very very unique but it also isn't private it's it tells us a lot about who you are and that's not information we want so we settled on using the iris lots of uniqueness does not change very much over time and another benefit of it is that it's something that's really hard to do passively right you can't just snap a photo as someone's walking by they have to like choose to look into the device that we use the orb which you'll see in a second and if they don't want to get signed up they can close their eyes look away which is good consent is an important part of any system involving Biometrics so when it comes to how we actually interact with Biometrics we looked at phone sensors but the cameras just aren't high enough quality and it's somewhat difficult to trust that that device hasn't been tampered with in any way off-the-shelf Hardware is better in terms of trust but it's usually not very portable it can be expensive so we settled on building custom hardware and that is the orb which you've probably seen at our booth seen at locations around the world and the orb has been in development since late 2019 and gone through lots of different revisions to get to where we are now and the orb has a really important job it checks to make sure that you're a real human not a cat not a dog not someone holding up a photo of a human on the device it calculates an iris code a digital representation of the pattern of your iris so that can use that to prove that you're unique without having to store the images of the Iris by default the images taken by the orb are simply processed in memory and then deleted and don't need to be stored at all and then once we have verified that that Iris code hasn't been signed up at the or before it verifies your world ID World ID as a ho is built to be privacy first decentralized and open source any information that we don't need to know in order to prove that you're a unique human we don't want to collect don't want to store it's designed to be decentralized and we have a wonderful blog post that can go more in depth about that and it's open source everything relating to the protocol is already open source on GitHub all of the smart contracts the signup sequencer our all of our Dev tools and then the orb Hardware's open source the orb software will be open sourc later this year we want to be fully open about it there's lots of different use cases for World ID voting is a great example you want to know that each real person only gets to do single vote social media it's great to know that that account doesn't belong to a bot customer incentives is one I find particularly interesting I have made a lot of emails to sign up for a lot of Netflix free trials but World ID can prevent that and World ID is also super easy to integrate you can use it on the web you can use it on on mobile you can use it on chain and there's two main ways to integrate World ID sign in with World ID our open ID connect provider works just like sign in with Google or sign in with Facebook and then we have Incognito actions which are much more powerful and what you can use for onchain applications as well so I'll start by going through sign in with World ID let's see how it works so here I'll go ahead and sign in to our devel developer portal at developer. worldcoin dorg and I use World ID to sign in so I'll hit login I'll sign in with worldcoin and then from within World app I'll scan this QR code it'll load for a second the wi-fi at hackathons is always a little bit worse than we want can all there we go so I can see that I'm signing into the world coin developer portal it's a verified application and I'll tap verify with World ID and then I am signed into the developer portal in the in the dev portal I can create and manage applications and actions everything like that I'm happy to walk through that outside of the workshop because I want to get through some of the code but signing with World ID is super super simple to use there's lots of different ways you can integrate signin with World ID you can use our azero integration if you already have other signin methods with that provider you can use nextjs you can directly use some other oidc library and use our oidc well-known file to configure that easily you can custom implement the oidc flows but I'll walk through how you can do it with nextjs which is what our sign-in template repository uses and really all all you need to do is add this sign-in provider to nexo configuration and everything else related to signin gets handled automatically right so we have this provider that we'll call worldcoin and use worldcoin as the ID we configure that well-known file which is part of the open ID standard and tells it here's where you redeem an authorization code and all of the technical details like that is part of the standard we have to input the client ID and client secret that we get from our develop portal we'll use the idid token flow and then we'll map information to the user's profile so the profile. sub that is part of the like ID token format that will use the nullifier hash the unique identifier of the user in the context of your application as the ID and then for the verification level that should be renamed to verification level here that's my bad uh that will tell if the user is or verified or device verified right orb is this gold standard for knowing that that's a real person who only has one account but for users who may not be able to access an orb we also have the device credential where the world ID wallet will verify that that is a real version of the app it is a unique device with only one world ID associated with it and it's a weaker credential in terms of proof of personhood and civil resistance but it still is a way that user can sign into your application and your application can know which verification level that user has so now now that I've gone through Sig in with World ID I'll talk about Incognito actions which is what most of you will likely use in the hackathon with Incognito actions you can know that your user's a unique human doing something only once or however many times you want you can set that to be unlimited if you'd like you can let someone do something just three times um and with a specific signal and that signal is a piece of extra information that you include with the world ID proof that can't be tampered with so for voting for example that could be which person someone's voting for in an election so you know that when the user verified with World ID and created that proof they wanted to vote for this person and when you're verifying that proof you can ensure that the correct vote is actually counted when using World ID you'll use ID kit our frontend widget which will display a QR code the user scan that includes information about which application and action that user is verifying for on the mobile device zero knowledge proof will be generated and then returned to your app and your app then verifies that proof either with our developer portal API for offchain use cases or with our smart contracts onchain right and this is what that proof looks like we have the root of the Merkel tree against which the proof is generated on ethereum Main net we have a Merkle tree that is essentially the list of world IDs that have been verified at the or the nullifier hash is the unique identifier of the user in the context of Your Action the proof is a very long hexadecimal string that is the actual mathematical zero knowledge proof and then which verification level that user verified with yeah so so let's see what Incognito actions look like so we'll use the tri out page on our docs as an example here and we'll go with staging because we're going to use the simulator here the simulator is what you use instead of World app for our staging environment there's lots of different identities that you can test with so if you want to test civil resistance sort of difficult if you only have one identity you can test with but we'll go with staging we have our test action and we'll have a minimum verification level of orb verification so I'll tap continue with worldcoin this button can say whatever you'd like but it opens up the uh the widget here and if I'm running the simulator on my phone I can scan the QR code with the camera just like I did in World app but I can also just click the QR code to copy the information and paste it here in the simulator just the same as scanning it I'll go ahead and verify with the orb verification level and then this query to our developer portal API to make sure that proof verified correctly and we can see that it did now let's say I want to try verifying again we'll see that it won't verify because this person has already verified for this [Music] action so any use of incognito actions we'll start with ID kit and it's a single react component you can also use it in vanilla JavaScript as well and we have a separate package for that but all you have to do is configure your app ID and action that you got from the developer portal there's two call back functions on success is required and that's the function that gets called after the ID kit widget is closed handle verify is useful if you're doing uh offchain proof verifications with our API uh where you can verify that proof while the widget's open and display an error to the user in a pretty way but handle verify is optional and then you can set the required verification level by default that's set to orb but if you set it to the device verification level your amp will accept proofs that are either from device verified or or verified users and then we have this child that is the button that opens that widget so you can style that however you'd like make the text whatever you'd like but it just has to call open on the ID kit widget to cause it to open up this this proof response you saw earlier is the input to the hand or the on success and handle verify callback functions so we have that proof but we have to verify it and I cannot make that clear enough you have to verify that proof to verify that proof with your API the first thing you should do is take that response object and pass it to your back end you want to do this proof verification in a control context because in the front end the user could modify anything there they could just trick your application into thinking that they are verified in your back end they don't have that sort of control so all you have to do is make a single request to our developer portal API so it'll be developer. worldcoin org apiv1 verif and then your app ID the request body will include the action the signal if one was provided and then all of the information from that proof response object and then the response will be a 200 if the proof verifies and if the user hasn't already performed this action the maximum number of times for API verification you set that in the developer portal however many times you want to let the user do that and if the response is successful then you should go ahead and do whatever action it is that you wanted to gate behind World ID whether that's marking the user is verified in your database or whatever else but if it's a 400 response it will include an error code indicating why it didn't verify and it will you shouldn't do anything except present that error to the user at that point because they're not verified with World ID this one's like the API verif ification is quite simple but now we'll get into the onchain verification so we have a template repository for the cloud verification as well as the onchain verification the onchain verification I especially recommend using the template repository but to start in our Constructor there are three things that we need to set World ID is the address of the world ID router the address book in our documentation can get you the correct address based on which ch you're deploying on and then the app ID and action ID again that you get from our developer portal and in the Constructor we should compute this external nullifier It's a combination of the app ID and action ID that's used specifically to just to know which action that user is performing universally World ID as a protocol is based on semafor if any of you are familiar with that you'll probably recognize that term just for us having that app with actions within it makes it a bit easier to do multiple actions within one application and still display that application to the user in a pretty way in World app when they're verifying so they know what they're verifying for and then we'll have a function that can be in this case named verify and execute you can name it whatever you like based on what the user is doing so this should take in the signal if you're using one again the root of the Merkel tree the nullifier hash and that proof that you get from ID kit so the first thing we'll do is check if we've seen this nullifier hash before right so we have a mapping of the nullifier hashes and in this case just to a Boolean value where when when we verify approv for a specific nullifier hash we'll set it as true so that we make sure this user can only do this action once for onchain verification you do have to implement that Cil resistance in your smart contract yourself in contrast to API verification where we handle that for you but once we've checked and made sure the user hasn't done this action before we will go ahead and call verify proof on the world ID router and we'll pass that the root the group ID which is one uh that should be just a constant in your contract uh that group ID determines which credential it we're verifying for but only the orb credential is supported on chain at this time so you can hardcode that to one if you'd like um and then input the signal so we ABI encode it and hash it a specific way for the uh for the protocol that hash to field function is defined in our smart contract template we also have to input the nullifier hash that external nullifier determining what action the user forming and the proof and if that proof verifies the contract will continue but if that proof doesn't verify what for whatever reason it will simply revert at this point so once that proof verifies we should Mark that nullifier hash as true we've seen it before prevent the user from performing this action again and then at the very end of that that's when you can perform the actual action you your user wants to do whether that is minting an nft or whatever else and that is a great overview on how to build with World ID worldcoin org london24 will take you to a otion page with a bunch of resources for you our template repositories documentation developer portal Bounty info and if you have any questions I am happy to go ahead and take some now so the zero knowledge proof when you want to prove the action is generated by your app when you are scanning the QR code so my question is next when you are using a third party app for example an iPhone can you somehow call the app of worldcoin in order to gen generate this zero knowledge proof of the action so you can submit it on chain from your app not from the world coin and not from the front end on browser we will support that in the near future um but at this time you do have to use ID kit for generating that proof the is the code base of this ID kit so H maybe we can try to Port it to you're more than welcome to try it is written entirely in typescript but it is open source I will encourage you to try and I'm happy to help yeah another question um so let's say for the cases where you want to have a proof of personhood for your let's say social media or something that one person can only create one account and protect this way from the Bots what do you do for the case when the person loses access to their account because normally they would go and create another account but in this case they won't be able to create a new account because there is an action that can only be done once and it's already like done so how do you go about this issue that is a great question and with that I would say that typically you should like if you were using our signin provider for example you should encourage the user to set a second login method such as like email password connecting a wallet whatever that may be so that if they were to lose access to their world ID they can use that other method and if they lose access to that other method they can use their world ID um for something using ID kit uh you can what you can do is set it to a higher number of times that you're allowed to perform that action but make it so that that nullifier hash can only be associated with one account at any given time right so say it's a an application where my wallet is my signin I can associate my wallet address with my world ID nullifier hash in your application database or on chain but if I go to verify a different wallet with that same world ID it will just remove the associated nullifier hash from the first wallet all thanks for the presentation I have a question regarding anonymity because you you mentioned that uh world could be us one of the use cases is EV voting right and how do you dis allow linking the person like the the data that you get uh to the person or to different actions for example two different votings by the same the same person so the whole point of how World IDE is designed is that it is anonymous right so in voting for example if those votes are two different actions which they should be that nullifier hash for me if I vote with the same world ID on both of them I would have a different nullifier hash and the point is that you can't tell that those two votes came from the same person it's better for privacy um as for like that person's identity right we don't have information on that person's name address government ID number anything like that so this can work really really well for something like Dow voting and you can do one person one vote they have to connect a wallet show that they are a member of the Dow but preventing like one holder who has a bunch of the token supply for example from being able to just outvote everybody else because they have so much of the token and if any of you have any other questions in the future you can come find me at World coins booth and you can also ask in the partner worldcoin channel in Discord [Music]