Ask HN: Is there a way to ensure one-person-one-account at all? Without relying on any document issues from government, without excluding disabled person, and without requiring the admin to personally know each users. Using credit card doesn't tell if two accounts are created by distinct person. And it exluced person without credit card. There are some (incomplete) approach to check if the user is a person or a bot, but not if the users are distinct person as of my knowledge. |
I don't think your documents get shared with the website directly, just your verification status, but I'm not 100% sure about that.
And I think the verification process mixes and matches ID checks, employment records, credit records, text messages, etc., kinda like how a bank asks you "Which of these streets, if any, did you ever live on?". There are different questions for different kinds of verifications.
> Without relying on any document issues from government
This does not seem to fit their criteria for a solution
At the end of the day, I don't think there's any non-governmental, non-biometric, non-financial way to really cross-check physical and online identities. It's gotta be tied into the real world somehow, and outsourcing it makes a lot more doable...
But yeah, if they don't want the user to have to provide documents at all, I think they're just SOL.
The airport pay-to-skip-lines company (can't remember their name) uses a similar iris scanner setup to check people in, but presumably there they have tight controls over their devices and have human employees always standing by to try to limit abuse. It'd be pretty suspicious if you walked in with a fake eyeball or such there.
But anyone can buy a Worldcoin orb, right? Is it going to be like the console DRM wars, where once someone manages to root or extract a private key from such from a device, they can use it to make fake identities?
Seems kinda like a tough problem when you really mean to follow through, especially when making the least amount of concessions. It'd probably be easiest to integrate with existing government systems like eID, but that's region-specific and who knows how trustworthy that is long-term. I guess, there's also these sorta weird identification services that banks use (hold ID card and face into the video feed and variants), but same problem.
As for conceiving such a system in the first place, good luck ;)
Text messages are a little harder to fake/share, I suppose, but also more expensive to verify.
See the experiential point that it is better to keep the 80/20 rule in mind. Most users are not going to abuse the system, and those that do, do so with dozens or hundreds of accounts, not 2-3
I have never used my real-world identity on the internet, and won't start now. I think it's a bit nuts that people are willing to, but to each their own.
You could get by with requiring a unique phone number, but that still risks excluding users, and can get expensive if you intend on catering to an international audience. Even in that case, some people may have a landline and a cell phone, or they may use a friend/spouse/relative’s phone to circumvent your limits.
In the US, anyway, you can also get burner phones for about $10 at local stores. I do this routinely if someone is requiring a phone number to register for something that I really want to register for.
Are the cameras watching the purchase? Can you pay cash? Is any record beyond a sales receipt generated?
there are governments out there that will happily make/accept fake identities to beat these systems
it's a tradeoff and we don't know the details of OP's project, but I suspect they are worrying about free tier abusers (as this is the most typical reason this question is asked on HN)
Personally, I'm not concerned with that level of anonymity, though. I just don't want to give my actual phone number to random companies.
But for the passkey/2FA stuff, it can all be implemented in software, and a script or botnet could easily generate them by the hundreds. They're not tied to a hardware signature (i.e., you don't need multiple devices or even fake virtual devices, they're just algorithms).
These are all advanced techniques the vast majority of users are not going to use to fake multiple accounts. Most users will never make multiple accounts to access a free tier. Abusers are far and few between and typically generate multiple signals. I've seen this in production systems and there are ways to deal with it.
80/20 rule my friend
I guess I assumed that if you wanted only "distinct human accounts", you would also want to exclude bot-generated ones, but maybe not.
In my experience, it's not worth worrying about until you have users, and if you have this problem, it's a good sign and you'll have the resources to better deal with it by then