pub: zkcaptcha

reclaimprotocol · Mar 12, 2024 · a05b677 · a05b677
1 parent 46e928d
commit a05b677
Show file tree

Hide file tree

Showing 11 changed files with 423 additions and 58 deletions.
diff --git a/content/posts/zk-captcha.md b/content/posts/zk-captcha.md
@@ -0,0 +1,40 @@
+---
+title: "RFP - AI friendly ZK Captcha"
+date: 2024-03-12T16:42:01-04:00
+draft: false
+---
+- Madhavan (Mads) Malolan
+
+Which side is up? Captchas are getting so hard that only AIs will be able to solve it.
+The key premise of this post is that it is getting increasingly important for AI agents to be able to access web products on behalf of the user. Captchas are an antipattern. They are not any good at keeping AI bots out anyway, at the same time they're detrimental to productivity. Companies like [Induced AI](https://www.induced.ai/) have been able to make life much easier by knocking off the easy mundane tasks for you.
+
+So, let's get rid of captchas?
+I understand the reason of having a captcha. It makes a digital resource scarce - by requiring only a human to be able to use it. If the cost of using any digital resource or service becomes zero, it becomes way too cheap to screw with the service - think spam and abuse. There's no disincentive to misbehave.
+
+One way to combat that is to attach a micropayment to every https request. It is a plausible solution and has been [around for a long while](https://wordpress.org/plugins/paid-membership/).
+
+Can we do better? I think so.
+
+Sign every HTTPS request. Ofcourse. Who hasn't thought of that?
+Let's assume every browser implements a i-dont-want-to-call-it-a-wallet. That is, there is a private key for every user on their browser.
+Now this private key adds a `header` to every https request it makes, with the signature of the request.
+
+That in itself doesn't solve the problem. Someone can spin up millions of bots and create millions of private keys at no cost.
+
+But, every browser public key is associated with an identity.
+You can make your identity stronger by attaching your national id, employment status, purchase history etc. All the contents of the identity like the national id itself, purchase history etc aren't public. But a commitment to them is. This can be achieved using Reclaim Protocol. These commitments can be stored on chain for later use.
+
+The key insight is, one proof can be added to exactly one identity. That is, your national id can be used exactly once. If it has been linked to a browser public key, it cannot be linked to another without invalidating the previous public key.
+
+The website that receives this https request will check the header and calculate the identity strength based on the quantity and quality of proofs linked with the public key. If the score is above a threshold, the user is allowed to access the full site. If not, they get access only to limited parts of the site - e.g. they can only read, not post.
+
+However, when the the user (human or bot) that is using the said browser key misbehaves on the website - the website can flag the user as abusive and publish a list. This list consists of the public keys of the abusive users and proof of their abusive behaviour using the redacted signed requests (using ZKPs) that was sent using this public key.
+Any other website can import this list from any other website. This happens all the time in IP Blocklisting. Cloudflare, Google etc share IP Blocklists. 
+
+When a public key is reported as abusive by one website, all the websites that import that list can update their scoring of the user's identity. They may do this by fetching all the proofs linked to the public key from the blockchain. They may mark all the linked proofs a abusive and re-calculate the score for the user.
+
+That way, if a user uses a public key with multiple proofs linked misbehaves on a website, they will incur losses to all their proofs and all the identity scores that will be calculated by other websites in future. So, even if they create a new browser and a new public key, the proofs they will be able to link are already tainted.
+
+This may seem like a recipe for censored on one platform, censored on all platforms kind of a situation. However, the implementation of the middleware on apache or nginx should be such that each website is able to determine its own logic for how to import lists from other websites. If someone is censored on twitter for a political opinion, twitter not only has to publish the public key but also the redacted https request itself. So, facebook that may be importing this blocklist from twitter may have its own logic to determine whether or not it wants to censor the said public key. But if twitter blocklists a user because of a ddos attempt, that is probably relevant information to facebook too.
+
+This is a public good that ought to be built. Someone is going to build it, for sure.
diff --git a/public/index.html b/public/index.html
@@ -131,6 +131,18 @@
 <main class="main"> 
 
 <article class="first-entry"> 
+  <header class="entry-header">
+    <h2 class="entry-hint-parent">RFP - AI friendly ZK Captcha
+    </h2>
+  </header>
+  <div class="entry-content">
+    <p>Madhavan (Mads) Malolan Which side is up? Captchas are getting so hard that only AIs will be able to solve it. The key premise of this post is that it is getting increasingly important for AI agents to be able to access web products on behalf of the user. Captchas are an antipattern. They are not any good at keeping AI bots out anyway, at the same time they’re detrimental to productivity....</p>
+  </div>
+  <footer class="entry-footer"><span title='2024-03-12 16:42:01 -0400 EDT'>March 12, 2024</span></footer>
+  <a class="entry-link" aria-label="post link to RFP - AI friendly ZK Captcha" href="https://blog.reclaimprotocol.org/posts/zk-captcha/"></a>
+</article>
+
+<article class="post-entry"> 
   <header class="entry-header">
     <h2 class="entry-hint-parent">RFP: Decentralized Oracles &amp; Data Guilds
     </h2>
@@ -249,19 +261,6 @@ <h2 class="entry-hint-parent">Progressive KYC
   <footer class="entry-footer"><span title='2024-01-09 19:10:15 -0800 -0800'>January 9, 2024</span></footer>
   <a class="entry-link" aria-label="post link to Progressive KYC" href="https://blog.reclaimprotocol.org/posts/usecase-kyc/"></a>
 </article>
-
-<article class="post-entry"> 
-  <header class="entry-header">
-    <h2 class="entry-hint-parent">Onboarding &amp; Loyalty Using Reclaim Protocol
-    </h2>
-  </header>
-  <div class="entry-content">
-    <p>Most apps start with a zerostate for a new user, primarily because there is no data available about the said user. Not any more. Using Reclaim Protocol, app developers can ask their users to import their user profile and activity from a website they already use.
-Until today, it was not possible for a user to import their persona from one website into another. This is largely because of unavailability of APIs on most websites....</p>
-  </div>
-  <footer class="entry-footer"><span title='2024-01-09 18:26:21 -0800 -0800'>January 9, 2024</span></footer>
-  <a class="entry-link" aria-label="post link to Onboarding &amp; Loyalty Using Reclaim Protocol" href="https://blog.reclaimprotocol.org/posts/usecase-loyalty/"></a>
-</article>
 <footer class="page-footer">
   <nav class="pagination">
     <a class="next" href="https://blog.reclaimprotocol.org/page/2/">Next&nbsp;&nbsp;»

diff --git a/public/index.xml b/public/index.xml
@@ -6,8 +6,15 @@
     <description>Recent content on Reclaim Protocol Official Blog</description>
     <generator>Hugo -- gohugo.io</generator>
     <language>en-us</language>
-    <lastBuildDate>Mon, 11 Mar 2024 16:34:13 -0400</lastBuildDate>
+    <lastBuildDate>Tue, 12 Mar 2024 16:42:01 -0400</lastBuildDate>
     <atom:link href="https://blog.reclaimprotocol.org/index.xml" rel="self" type="application/rss+xml" />
+    <item>
+      <title>RFP - AI friendly ZK Captcha</title>
+      <link>https://blog.reclaimprotocol.org/posts/zk-captcha/</link>
+      <pubDate>Tue, 12 Mar 2024 16:42:01 -0400</pubDate>
+      <guid>https://blog.reclaimprotocol.org/posts/zk-captcha/</guid>
+      <description>Madhavan (Mads) Malolan Which side is up? Captchas are getting so hard that only AIs will be able to solve it. The key premise of this post is that it is getting increasingly important for AI agents to be able to access web products on behalf of the user. Captchas are an antipattern. They are not any good at keeping AI bots out anyway, at the same time they&amp;rsquo;re detrimental to productivity.</description>
+    </item>
     <item>
       <title>RFP: Decentralized Oracles &amp; Data Guilds</title>
       <link>https://blog.reclaimprotocol.org/posts/rfp-data-guilds/</link>

diff --git a/public/page/2/index.html b/public/page/2/index.html
@@ -130,6 +130,19 @@
 </header>
 <main class="main"> 
 
+<article class="post-entry"> 
+  <header class="entry-header">
+    <h2 class="entry-hint-parent">Onboarding &amp; Loyalty Using Reclaim Protocol
+    </h2>
+  </header>
+  <div class="entry-content">
+    <p>Most apps start with a zerostate for a new user, primarily because there is no data available about the said user. Not any more. Using Reclaim Protocol, app developers can ask their users to import their user profile and activity from a website they already use.
+Until today, it was not possible for a user to import their persona from one website into another. This is largely because of unavailability of APIs on most websites....</p>
+  </div>
+  <footer class="entry-footer"><span title='2024-01-09 18:26:21 -0800 -0800'>January 9, 2024</span></footer>
+  <a class="entry-link" aria-label="post link to Onboarding &amp; Loyalty Using Reclaim Protocol" href="https://blog.reclaimprotocol.org/posts/usecase-loyalty/"></a>
+</article>
+
 <article class="post-entry"> 
   <header class="entry-header">
     <h2 class="entry-hint-parent">Proof of Provenance
@@ -244,20 +257,6 @@ <h2 class="entry-hint-parent">Self Sovereign
   <footer class="entry-footer"><span title='2023-08-15 12:36:44 -0700 -0700'>August 15, 2023</span></footer>
   <a class="entry-link" aria-label="post link to Self Sovereign" href="https://blog.reclaimprotocol.org/posts/self-sovereign/"></a>
 </article>
-
-<article class="post-entry"> 
-  <header class="entry-header">
-    <h2 class="entry-hint-parent">Tradeoffs in Proof of Personhood and Credentials
-    </h2>
-  </header>
-  <div class="entry-content">
-    <p>Vitalik published a comprehensive study and opinions on Proof of Personhood here. Though I agree with most of the article, there are a few more points I’d like to add.
-Proof of Personhood and Sybil resistance Proof of Personhood is a subset of Sybil resistance schemes. A common mistake is to collate the two.
-From wikipedia - “A Sybil attack is a type of attack on a computer network service in which an attacker subverts the service’s reputation system by creating a large number of pseudonymous identities and uses them to gain a disproportionately large influence....</p>
-  </div>
-  <footer class="entry-footer"><span title='2023-07-24 22:31:37 +0000 UTC'>July 24, 2023</span></footer>
-  <a class="entry-link" aria-label="post link to Tradeoffs in Proof of Personhood and Credentials" href="https://blog.reclaimprotocol.org/posts/proofofpersonhood/"></a>
-</article>
 <footer class="page-footer">
   <nav class="pagination">
     <a class="prev" href="https://blog.reclaimprotocol.org/">

diff --git a/public/page/3/index.html b/public/page/3/index.html
@@ -130,6 +130,20 @@
 </header>
 <main class="main"> 
 
+<article class="post-entry"> 
+  <header class="entry-header">
+    <h2 class="entry-hint-parent">Tradeoffs in Proof of Personhood and Credentials
+    </h2>
+  </header>
+  <div class="entry-content">
+    <p>Vitalik published a comprehensive study and opinions on Proof of Personhood here. Though I agree with most of the article, there are a few more points I’d like to add.
+Proof of Personhood and Sybil resistance Proof of Personhood is a subset of Sybil resistance schemes. A common mistake is to collate the two.
+From wikipedia - “A Sybil attack is a type of attack on a computer network service in which an attacker subverts the service’s reputation system by creating a large number of pseudonymous identities and uses them to gain a disproportionately large influence....</p>
+  </div>
+  <footer class="entry-footer"><span title='2023-07-24 22:31:37 +0000 UTC'>July 24, 2023</span></footer>
+  <a class="entry-link" aria-label="post link to Tradeoffs in Proof of Personhood and Credentials" href="https://blog.reclaimprotocol.org/posts/proofofpersonhood/"></a>
+</article>
+
 <article class="post-entry"> 
   <header class="entry-header">
     <h2 class="entry-hint-parent">ZK in Reclaim - an approximate explanation

diff --git a/public/posts/index.html b/public/posts/index.html
@@ -136,6 +136,18 @@ <h1>
   </h1>
 </header>
 
+<article class="post-entry"> 
+  <header class="entry-header">
+    <h2 class="entry-hint-parent">RFP - AI friendly ZK Captcha
+    </h2>
+  </header>
+  <div class="entry-content">
+    <p>Madhavan (Mads) Malolan Which side is up? Captchas are getting so hard that only AIs will be able to solve it. The key premise of this post is that it is getting increasingly important for AI agents to be able to access web products on behalf of the user. Captchas are an antipattern. They are not any good at keeping AI bots out anyway, at the same time they’re detrimental to productivity....</p>
+  </div>
+  <footer class="entry-footer"><span title='2024-03-12 16:42:01 -0400 EDT'>March 12, 2024</span></footer>
+  <a class="entry-link" aria-label="post link to RFP - AI friendly ZK Captcha" href="https://blog.reclaimprotocol.org/posts/zk-captcha/"></a>
+</article>
+
 <article class="post-entry"> 
   <header class="entry-header">
     <h2 class="entry-hint-parent">RFP: Decentralized Oracles &amp; Data Guilds
@@ -255,19 +267,6 @@ <h2 class="entry-hint-parent">Progressive KYC
   <footer class="entry-footer"><span title='2024-01-09 19:10:15 -0800 -0800'>January 9, 2024</span></footer>
   <a class="entry-link" aria-label="post link to Progressive KYC" href="https://blog.reclaimprotocol.org/posts/usecase-kyc/"></a>
 </article>
-
-<article class="post-entry"> 
-  <header class="entry-header">
-    <h2 class="entry-hint-parent">Onboarding &amp; Loyalty Using Reclaim Protocol
-    </h2>
-  </header>
-  <div class="entry-content">
-    <p>Most apps start with a zerostate for a new user, primarily because there is no data available about the said user. Not any more. Using Reclaim Protocol, app developers can ask their users to import their user profile and activity from a website they already use.
-Until today, it was not possible for a user to import their persona from one website into another. This is largely because of unavailability of APIs on most websites....</p>
-  </div>
-  <footer class="entry-footer"><span title='2024-01-09 18:26:21 -0800 -0800'>January 9, 2024</span></footer>
-  <a class="entry-link" aria-label="post link to Onboarding &amp; Loyalty Using Reclaim Protocol" href="https://blog.reclaimprotocol.org/posts/usecase-loyalty/"></a>
-</article>
 <footer class="page-footer">
   <nav class="pagination">
     <a class="next" href="https://blog.reclaimprotocol.org/posts/page/2/">Next&nbsp;&nbsp;»

diff --git a/public/posts/index.xml b/public/posts/index.xml
@@ -6,8 +6,15 @@
     <description>Recent content in Posts on Reclaim Protocol Official Blog</description>
     <generator>Hugo -- gohugo.io</generator>
     <language>en-us</language>
-    <lastBuildDate>Mon, 11 Mar 2024 16:34:13 -0400</lastBuildDate>
+    <lastBuildDate>Tue, 12 Mar 2024 16:42:01 -0400</lastBuildDate>
     <atom:link href="https://blog.reclaimprotocol.org/posts/index.xml" rel="self" type="application/rss+xml" />
+    <item>
+      <title>RFP - AI friendly ZK Captcha</title>
+      <link>https://blog.reclaimprotocol.org/posts/zk-captcha/</link>
+      <pubDate>Tue, 12 Mar 2024 16:42:01 -0400</pubDate>
+      <guid>https://blog.reclaimprotocol.org/posts/zk-captcha/</guid>
+      <description>Madhavan (Mads) Malolan Which side is up? Captchas are getting so hard that only AIs will be able to solve it. The key premise of this post is that it is getting increasingly important for AI agents to be able to access web products on behalf of the user. Captchas are an antipattern. They are not any good at keeping AI bots out anyway, at the same time they&amp;rsquo;re detrimental to productivity.</description>
+    </item>
     <item>
       <title>RFP: Decentralized Oracles &amp; Data Guilds</title>
       <link>https://blog.reclaimprotocol.org/posts/rfp-data-guilds/</link>

diff --git a/public/posts/page/2/index.html b/public/posts/page/2/index.html
@@ -136,6 +136,19 @@ <h1>
   </h1>
 </header>
 
+<article class="post-entry"> 
+  <header class="entry-header">
+    <h2 class="entry-hint-parent">Onboarding &amp; Loyalty Using Reclaim Protocol
+    </h2>
+  </header>
+  <div class="entry-content">
+    <p>Most apps start with a zerostate for a new user, primarily because there is no data available about the said user. Not any more. Using Reclaim Protocol, app developers can ask their users to import their user profile and activity from a website they already use.
+Until today, it was not possible for a user to import their persona from one website into another. This is largely because of unavailability of APIs on most websites....</p>
+  </div>
+  <footer class="entry-footer"><span title='2024-01-09 18:26:21 -0800 -0800'>January 9, 2024</span></footer>
+  <a class="entry-link" aria-label="post link to Onboarding &amp; Loyalty Using Reclaim Protocol" href="https://blog.reclaimprotocol.org/posts/usecase-loyalty/"></a>
+</article>
+
 <article class="post-entry"> 
   <header class="entry-header">
     <h2 class="entry-hint-parent">Proof of Provenance
@@ -250,20 +263,6 @@ <h2 class="entry-hint-parent">Self Sovereign
   <footer class="entry-footer"><span title='2023-08-15 12:36:44 -0700 -0700'>August 15, 2023</span></footer>
   <a class="entry-link" aria-label="post link to Self Sovereign" href="https://blog.reclaimprotocol.org/posts/self-sovereign/"></a>
 </article>
-
-<article class="post-entry"> 
-  <header class="entry-header">
-    <h2 class="entry-hint-parent">Tradeoffs in Proof of Personhood and Credentials
-    </h2>
-  </header>
-  <div class="entry-content">
-    <p>Vitalik published a comprehensive study and opinions on Proof of Personhood here. Though I agree with most of the article, there are a few more points I’d like to add.
-Proof of Personhood and Sybil resistance Proof of Personhood is a subset of Sybil resistance schemes. A common mistake is to collate the two.
-From wikipedia - “A Sybil attack is a type of attack on a computer network service in which an attacker subverts the service’s reputation system by creating a large number of pseudonymous identities and uses them to gain a disproportionately large influence....</p>
-  </div>
-  <footer class="entry-footer"><span title='2023-07-24 22:31:37 +0000 UTC'>July 24, 2023</span></footer>
-  <a class="entry-link" aria-label="post link to Tradeoffs in Proof of Personhood and Credentials" href="https://blog.reclaimprotocol.org/posts/proofofpersonhood/"></a>
-</article>
 <footer class="page-footer">
   <nav class="pagination">
     <a class="prev" href="https://blog.reclaimprotocol.org/posts/">

diff --git a/public/posts/page/3/index.html b/public/posts/page/3/index.html
@@ -136,6 +136,20 @@ <h1>
   </h1>
 </header>
 
+<article class="post-entry"> 
+  <header class="entry-header">
+    <h2 class="entry-hint-parent">Tradeoffs in Proof of Personhood and Credentials
+    </h2>
+  </header>
+  <div class="entry-content">
+    <p>Vitalik published a comprehensive study and opinions on Proof of Personhood here. Though I agree with most of the article, there are a few more points I’d like to add.
+Proof of Personhood and Sybil resistance Proof of Personhood is a subset of Sybil resistance schemes. A common mistake is to collate the two.
+From wikipedia - “A Sybil attack is a type of attack on a computer network service in which an attacker subverts the service’s reputation system by creating a large number of pseudonymous identities and uses them to gain a disproportionately large influence....</p>
+  </div>
+  <footer class="entry-footer"><span title='2023-07-24 22:31:37 +0000 UTC'>July 24, 2023</span></footer>
+  <a class="entry-link" aria-label="post link to Tradeoffs in Proof of Personhood and Credentials" href="https://blog.reclaimprotocol.org/posts/proofofpersonhood/"></a>
+</article>
+
 <article class="post-entry"> 
   <header class="entry-header">
     <h2 class="entry-hint-parent">ZK in Reclaim - an approximate explanation