Idena integration proposal

[RiccardoM]

Summary

This issue is strictly related to the verification of a Desmos profile thought the usage of external services that's described inside #240. Particularly, it describes how we could integrate Idena, a Proof-of-Person blockchain to allow users certifying they are not bots.

Context

The last week I accidentally stepped on Twitter user "Nagato" tweet which contained a list of Cosmos-based projects. Of all the ones listed, one caught my attention in particular: Idena.

Stating from their website, we can see the following:

Idena is the first proof-of-person blockchain where every node is linked to a cryptoidentity - one single person with equal voting power. Idena is one of the most decentralized blockchains.

To start mining Idena, you need to prove you're a unique human. It does not require the disclosure of any personal data (no KYC). You have to appear online when the validation ceremony starts and solve a series of flip-tests (CAPTCHAs).

Digging deeper into this, I found that they created a new kind of CAPTCHA, called Flip. This consists of finding what it seems to be the most correct set of images between two given images, based on the fact that those sets tell each one a story:

Also, they avoid any Sybil attack by making the verification process completely synchronous:

How do you ensure that the network does not have duplicate users?
The uniqueness of participants is proven by the fact that they must solve and provide the answers for flip-puzzles synchronously. A single person is not able to validate herself multiple times because of the very limited timeframe for the submission of the answers.

The validation status of a participant is not forever. It expires when the next epoch starts. Participants should prolong their validation status for every new epoch.

After reading all of this, I thought that this project is very promising and might solve us a lot of problems as well. Those include, but are not limited to:

• identifying Sybil accounts on the network
• identifying bots or fake accounts on the network
• identifying Sybil validators no the network
• ...and many more

So, after this realization, I started searching for a documentation of the project, and I got in contact with one of the developers. Here is everything that I discovered.

Working with Idena

Running a node

To run a node, the easiest way to do this is to simply download their node client. This is used to sync with the chain as well as to complete the validation ceremony that happens every once in a while. You can get the node software here.

Querying the chain

Once you run a node, it will generate an API key that can be used to query the chain itself. The API key is located inside the following file:

• Linux: ~/.config/Idena/node/datadir/api.key
• MacOS: ~/Library/Application Support/Idena/node/datadir/api.key

Such key can then be used to query the chain state using their RPC.
Note. You have to use localhost:9119 as the node address, instead of the default localhost:9009.

The most interesting query is the one that allows you to query the profile of different users, and see their current status. This is
called Get identity and is placed under the Dna API section. Here is an example of response of such query:

Get identity response

{
  "address": "0x0022b21237cc1eab8e3bbd50fa5bff152ffe5cb8",
  "profileHash": "",
  "stake": "84.125028004327062497",
  "invites": 0,
  "age": 6,
  "state": "Verified",
  "pubkey": "0442e4703f2bb76167334fbf0942955587486f9d5e65bf7651924e709dd0a69bc23b018dc627b7356fa5b039e6dbb4bcb7dc36de84ab083b9b0992545b4b91eb8a",
  "requiredFlips": 3,
  "availableFlips": 4,
  "flipKeyWordPairs": null,
  "madeFlips": 0,
  "totalQualifiedFlips": 22,
  "totalShortFlipPoints": 20,
  "flips": null,
  "online": false,
  "generation": 3,
  "code": "0x43270812eece07bfb8cb3e07",
  "invitees": null,
  "penalty": "2.232788918751292123",
  "lastValidationFlags": null
}

Inside such response, the most interesting field is of course the state one. This can assume different values, ranging from Undefined to Human. In order to comprehend the different meanings you need to read the doc. In short, Newbie, Verified and Human all guarantee that you are most likely a human.

Implementation proposal

What I propose we do is to implement a connection between a Desmos profile and an Idena profile. Ideally, we want the process to be composed of the following steps:

1. We require the user their public key.
2. We create a unique proof that they are going to sign to prove they own the account
3. The user signs the unique proof and gives us the signed one.
4. We make sure that the proof is signed correctly.
5. If the proofs match, we assign the Idena profile to Desmos.

Once the pairing is complete, the clients will be able to get the connected Idena profile from Desmos, and then verify the current status through the usage of the Idena APIs. Ideally, we want to have an Idena node as well so that apps can use that to query the chain state instead of having to create their own.

Conclusion

I think this chain might solve us a lot of problems, and integrating it with Desmos might be really interesting. I also think that the integration could be done using CosmWASM.

This process could also be particularly useful to apply also to validators, requiring them to create a Desmos profile and verify the humanity of it through Idena. If we can then somehow display this inside BigDipper, it might make it easier for people to choose between validators when deciding to who delegate some tokens.

What do you guys think about all of this? @bragaz @kwunyeung

[kwunyeung]

I'm still waiting for the verification as I have missed the last one on 1 Feb but I doubt if this flip is secured enough for proof of person. It seems this can be easily solved by bot with a trained CNN model.

[RiccardoM]

@kwunyeung I think you can read more about why Flips are secured here. From what I can see it's pretty secure against AI attacks since computers have no common sense and cannot understand the connection between images.

Also, flips are created brand new each validation round.

[leobragaz]

I'm still waiting for the verification as I have missed the last one on 1 Feb but I doubt if this flip is secured enough for proof of person. It seems this can be easily solved by bot with a trained CNN model.

You didn't miss it! It's on friday 14:30 CET!

[kwunyeung]

It will be 9:30pm here. I'm not sure if I can be available for the verification. 😅

[RiccardoM]

It will be 9:30pm here. I'm not sure if I can be available for the verification.

Yeah, they even have a FAQ about timing on their site: https://idena.io/?view=faq#faq-validation-2