Patrick Lung
Patrick Lung
đź”’

Priverify: Bot prevention for websites with privacy-conscious users

Summary

Platforms with privacy-conscious audiences, like crypto companies, do not have an effective, private, and low friction bot prevention tool. Existing options like are low friction, private, but ineffective (email), or effective, but high friction and privacy-invasive (passport upload). Because they're missing these tools, crypto companies with valuable users are unable to provide signup bonuses.

Priverify prevents bot fraud without storing, sharing, or linking activity to, personal identity information. This allows websites to provide onboarding incentives and reduce spam. Over time, this can be the default bot prevention service used by any website or app.

It consists of a verification flow that websites integrate into their onboarding flow, a verified user database that store pseudonyms but no personal identity information, and an API that lets websites check if a user is verified or not.

Who needs this?

I work in crypto and it’s an industry that’s both highly financialized and with privacy-conscious users. Companies want to run user acquisition promotions, but traditional KYC products are too privacy-invasive for their audience, since they both store identity information and link it to usage.

Examples from prominent crypto companies (click on triangle next to bullet to learn more):

‣
dydx shut down a promotion after backlash storing biometrics data

dydx, a perpertuals exchange, got significant backlash after offering a new user deposit bonus that stored biometric data. Users could opt-in to do a liveness check, and biometrics data would be stored by a GDPR-compliant third party to ensure users didn’t claim the bonus multiple times.

‣
Uniswap Labs wants to cover gas for a user’s first few swaps but can’t do so

Uniswap Labs builds a mobile wallet and our growth team believes each new user has a lifetime value of $XX. A big onboarding dropoff is getting their account funded with a chain’s native token to do a trade, so we want to sponsor their first few swaps. However, as a company, we have a significant commitment to privacy, going far enough to prevent third-party analytics tools to read any user data. Since there is no sybil-resistant way of offering bonuses without collecting user data, we didn’t do this.

A similar offering we did was offering a gas rebate for a user’s first NFT transaction. We limited it to just one transaction to prevent abuse.

‣
Dapper Labs: “Privately verifying you're a unique human is pretty important - I dealt with a lot of fraud and abuse at dapper when running growth campaigns.”

More details coming soon.

‣
Gitcoin DAO funds grants based on community support, but has struggled with bots

They’ve implemented a voting model called quadratic funding, but still struggled to discern real users from bots. Now, they’ve rolled out a web3-only solution called Gitcoin Passport.

‣
Coinbase Wallet: Users are being spammed via XMTP
  • After establishing XMTP, a permission-less wallet-to-wallet messaging protocol, users are being spammed. Scammers send phishing messages from ENS pretending to be popular crypto applications.
  • They don’t have a good approach to addressing this. Coinbase Wallet updated their system to mark all new conversations as requests. XMTP is investigating adding a fee when a wallet has been flagged a lot, but there is risk of fraud, or adding a fee to send a message, but this is hard to balance user experience.
  • Unstoppable Domains partnered with Webacy, which has an API to assign a wallet health score based on on-chain activity.

I expect these needs apply to other “taboo” industries like gambling or adult content as well.

‣
Gambling, adult content, VC-backed network startups

Gambling

Every online poker room has a deposit bonus (eg. deposit up to $600 and we’ll match it). However, to safeguard this, they prevent you from withdrawing until you generate the equivalent amount in revenue for the room (eg. rake).

I haven’t seen a similar restriction for popular online casinos like Rollbit and leveraged trading platforms.

Adult content

A friend who worked at Revolut told me how a lot of people use virtual credit cards for website they don’t trust, whether it’s adult content or fiat-to-crypto conversions.

VC-backed startups in rideshare, food delivery, and meal preparation services

Many of these VC-backed startups gave free signup bonuses during their growth-at-all costs phase. Most of these were reined in afterwards due to fraud and abuse, often due to users making multiple accounts.

What do users and platforms need?

Platforms want a solution that users are comfortable opting into. Crypto natives need personal identity information to not be stored anywhere and no way to tie that data to their activity. These are the only requirement.

‣
Everything else in this list is nice-to-have, and businesses and users are OK trading these off for faster and lower friction onboarding.
  • Know the nationality of the identity document for regulation compliance (eg. no US residents)
  • Know the expiration date of the identity document (eg. to ensure criteria continue to be met)
  • Different tiers of KYC allowed - eg. phone number, drivers license, passport
  • A way to prove that a database has not been tampered with
  • No way for different apps to track users across apps
  • A way to ensure this database is usable even if our company shuts down

What does this system require?

A verification service that deletes date after verification

  • This can be a identity verification platform like Stripe Identity, Veriff, or others.
  • This service needs to agree to delete data after verification. Veriff does this.

A database of verified users that does not store, and cannot be connected to, a user’s personal information. It is connected to a pseudonymous identifier, like email or a wallet address.

  • This is the most handwavy part: I think we can do this by hashing and salting a user’s information (eg. first name, last name, DoB, ID #) and discarding the personal data. This prevents users from creating a duplicate verification.
  • Users associate an email and/or blockchain public wallet address with their verified identity to login across different apps. Users are recommended to use burner emails or wallets.

An API to let platforms to identify if a user is verified

  • Platforms provide us with an email or wallet address, and our API response lets them know if this is a verified user.
  • It is the platform’s responsibility to verify that a user does own their pseudonymous identifier (eg. click an email confirmation link or do a wallet gasless signature), as well as to keep track of emails and wallets to ensure no duplicate users.

The inspiration came from World ID, which does the above, and more, in a complex way to ensure it’s decentralized and highly accurate. However, their approach has privacy and narrative concerns (it scans eyeballs) and isn’t scalable (requires in-person visits to an expensive device). I believe that business needs can be met right now with a centralized solution with 99% accuracy.

‣
More on how they do it
World ID process
Proposal
User creates a crypto wallet
Can we have users use an email as an identifier?
Users get their iris scanned in-person
Can we rely on a trusted identity provider to verify someone is human? Eg. Stripe Identity. How about using something that adds enough friction (phone number) or a trusted institution (eg. a Coinbase account)?
This device hashes their iris code and compares against a blockchain database of previous scans. If this user has not scanned before, they add this hash into the blockchain database and discard the user’s iris information
Can we store a hash of their identity in a non-blockchain database and still ensure the data is verifiably true? Eg. See how E2E messaging apps do this
When a user signs in, they use a zero-knowledge proof method called Semaphore which allows them to prove they’re one entry in this blockchain database of verified humans, without sharing which one
Can we offer an API that offers this functionality?

Deep dive

What’s next?

Users will always want more privacy. This is much more than just a problem with crypto — I think this is the future of identity. Companies only need to know you’re unique to prevent fraud, or if you’re a certain nationality to adhere to laws. User data leakage is a byproduct of the existing system, not a core requirement.

Getting user adoption will be difficult so the focus should be here, rather than on the technology. I saw this first-hand at Kite — we built a code-autocomplete plugin like Github Copilot, but as a new startup, could only run computation on-device since users and companies didn’t trust us enough to upload their code to the cloud.

Our go-to-market needs to provide enough incentive for users to overcome their trust deficit, and low friction enough such that companies want to use it. Many companies in the space who are starting from lofty goals (universal UBI), nice-to-have’s (web3 identity), or from decentralized technology (ZK IDs that are peer-to-peer). None of these provide enough incentive to jump through what often takes 15+ minutes or an in-person visit. The strongest incentive is financial, so that’s why I want to experiment with signup bonuses.

As a network-based product, once we have verified users in our network, it’ll be easier for users to trust us, and more valuable for companies to use us. It’ll become Shopify Pay’s 1-click checkout for recognized users, but for onboarding. Once a user verifies on our network, they never have to deal with friction or privacy-invasive KYC afterwards. Companies often require users to click an email verification or sign in with a transaction. Afterwards, an API call to us can confirm that that user is verified.

🤝
Join me as a cofounder! If you know of anyone, I’d appreciate an intro too

Open questions

  • Confirm with crypto companies about their needs, and that a centralized solution with these characteristics meets their needs
  • Understand the approaches to build this. Need to learn more about data structures and cryptography

Open Thoughts

Identity verification is expensive, how do we afford this?

  • We partner with a company like Stripe, they get equity in return for providing identity services for free, forever.

What is the business model?

  • Usage-based API pricing. We are amortizing the cost of identity verification across many apps. This cost is user friction (lengthy KYC process) and money ($0.50 - $1.50 per verification).

Will crypto users and companies use centralized products?

  • I think so, if we meet their pain points. For example, users used dydx to trade futures even though it’s offchain and centralized, since it was the best place to do so.
  • Many users joined Farcaster knowing that the plan was to decentralize over time. This may be another approach we take.

‣
Research
‣
Competitor comparisons
Existing provider, like IDology
World ID
Masa Finance
My proposal
Must have
Personal information is not stored anywhere, and cannot be accessed by anyone
❌ Stored in a company’s database. Shared fully with any customer.
✅  Biometrics data is processed locally, then discarded
❓  They don’t check if an account has been used before
âś… Discarded by identity provider
No way for different apps to track users across apps
❌ Since personal information is shared with customers, websites can track users across apps
✅ Using ZKPs to indicate you’re a confirmed member, but without identifying which
❌ Uses a public soulbound token NFT to verify
âś… Either offer an API that provides a binary response, or similarly use ZKPs
Nice to have
Different tiers of KYC supported - eg. phone number, drivers license, passport
âś… Yes, many types such as data, ID, biometric
❌ Biometrics (iris scan) only
❌  2FA + captcha only
âť“ Support passports. Should we support phone number too?
A way to prove that a database has not been tampered with
❌ Need to trust the company
✅  Stored on Ethereum blockchain
✅  Stored on Ethereum blockchain
âť“ Can we store on a centralized database but prove that data is secure/unaltered (signing of some sort)?

Companies

PSE / hacks / projects

Trusted data feeds via TLS

Permissioned, verifiable data structures (Tweets, another)