
thisnow.be
845 posts

thisnow.be
@_this_now
likes are bookmarks...









World, Sam Altman's digital identity project, just unveiled World ID 4.0, what the company calls "full-stack proof of human" infrastructure. The partner list: Tinder, Zoom, DocuSign, Shopify, Okta, AWS, and Vercel. Altman opened by saying we're heading to a world where AI generates more content than humans. Pantera Capital says we've already crossed that threshold. World's answer is an iris-scanning device called the Orb that creates a unique cryptographic ID proving you're a real person. 18 million people across 160 countries have already verified. Tinder is rolling out "verified human" badges in the U.S. after a Japan pilot. Zoom built a feature called "Deep Face" that verifies the person on a video call isn't a deepfake. DocuSign is adding proof-of-human checks to digital signatures. Shopify is enabling verified-human commerce. The most significant announcement is AgentKit, infrastructure that lets AI agents carry cryptographic proof they're acting on behalf of a verified human. Okta built an agent delegation system on top of it. The problem World is solving is real. The question is whether a centralized iris-scanning identity layer controlled by the same person whose company helped create the problem is the right answer. Altman is the CEO of OpenAI. He built the flood. Now he's selling the ark.

I watched this World ID 4.0 presentation Sam Altman & co put on the other day. A few people have asked what I think, given the work I do on identity and proof of humanity. Honestly, my reaction is more layered than I thought it might be. At face value, it actually does a lot right. Open protocol. Zero-Knowledge proofs. Biometric data that stays on the user's device. These are genuinely good design choices. There are scenarios where what they've built could useful. Iris biometrics are strong. Hardware attested verification has anti-Sybil properties that pure software can't easily match. But proof of humanity is too important to leave to any single scheme. There are some structural concerns I keep coming back to. The trust chain has unverifiable links. The orb hardware and firmware are open source in design, but you can't verify the orb in front of you actually runs that source. Same shape problem as voting machines. The app is its own version of this. The thing actually handling your biometric data on your phone isn't open source, as far as I can tell. It could be — and if it were, that would be a real step forward. Without it, you're trusting a closed binary the same way you're trusting a closed orb. And even where biometric algorithms are published openly somewhere, that doesn't help on its own. What matters is the binary you're running. Without reproducible builds and published checksums, there's no way to verify the code you can read on GitHub is the code actually executing on your device. "The algorithm is open source" is not the same as "I can verify what's running." Issuance is centralised. Only World ID orbs issue credentials. One organisation gates humanity-as-a-credential globally. For something this load-bearing, that's a very big single point of trust - even if the team holding it has the best intentions today. The proof is device-bound, which makes recovery brittle. Lose your phone, lose your humanity. There's no graceful path back - you have to find another orb and start over. For a system meant to be permanent identity infrastructure, that's a serious failure mode for normal users. And one global ID creates correlation pressure even with zero-knowledge proofs. The fact that two pseudonyms share the same World ID is itself revealing. A single credential presented across services is structurally different from per-context identifiers backed by the same underlying verifications. What I think matters more than any specific scheme is the principles. No single party should gate humanity globally, including any company, including any government, including what I do with @Holochain and @WeAreFlowsta . The user, not the issuer, should control what's revealed to whom. Recovery should be graceful, not "find another orb." And hardware attestation is a useful input, but it shouldn't be the answer. So, where does this point? For me, proof of humanity probably shouldn't be one credential at all. It's a portfolio of signed attestations a person assembles over time from sources they trust. Peers who know them, groups they're part of, third-party verifiers, even hardware attested proofs where those make sense, and present selectively to whoever is asking. No single issuer. No centralised global ID. Recovery happens through your social graph if you lose everything. That shape solves things a single issuer system can't. It also lets schemes like World ID slot in as one valid input among many, rather than positioning any one of them as the answer. "Who is a human?" is one of the most important infrastructure questions of the next decade. It's too important to be answered by any one source.



A new strategic update is live! ⚡️ It's difficult to summarize everything that has been getting delivered across Holochain, Holo, Unyt and the wider community. But here is a small word cloud that points at some of it: Reliability - iroh - HOT-HF Tech Migration Test - Edge Nodes - Holo Web Conductor - Wind Tunnel - atomic multi-currency trades - blockchain bridging - Joining Service - Flowsta - Moss - AD4M - configurable membranes - p2p payment rails Read the full update here: blog.holochain.org/ongoing-delive…

















