Workshop: Global Proof of Personhood with World ID - ETHGlobal Sydney is 2024

[Music] hi everyone I'm Ian I do developer relations and Partnerships at tools for Humanity uh the initial contributor to the world coin project and I'm here to tell you about world ID how to use it in your hackathon project and anything else you need to know about it so what I'll go over in this Workshop what is World ID why worldcoin created it what you should do with it and most importantly for the hackathon how to integrate World ID so to start World ID is our proof of personhood protocol with World ID a user can prove online that they're a unique human doing an action only once without revealing to anybody which unique human they are and this is something that's really valuable online I'm sure we've all had to do captas and you've probably realized that they're getting trickier and trickier over time and that's cuz AI is getting better and better at doing them but eventually we reach a point where AI can solve any of the captures that we can come up with that normal human could also solve and if that's the case we've got a problem but World ID helps with that right this is the big question that world ID is trying to answer how do you know who or what is a real and unique person we want to know that you're human that you're not a bot social media's gotten ruined by Bots as I'm sure we all know and we want to know that you're only doing something one time cable resistance is something that gets talked about a lot in this space and World ID can help with that as well World ID has been built to be private inclusive and robust or sorry stick here for a second we don't want to know anything about which unique human you are just that you are a unique human we want it to be something that as many humans in the world can use as possible and we want to make sure it's robust so that each real human can only get one world ID not have multiple and we looked at a lot of different ways to try and fulfill those requirements using an email address or a phone number getting multiple emails is about the easiest thing in the world doing kyc of official IDs is great for knowing that that person is a real human and they only have that one ID but less than half of the global population has a digitally verifiable government ID web of Trust Systems work well at smaller scales but a web of trust that starts with a 100 or a thousand initial trusted people can't scale to all of humanity super effectively because every hop away from that initial trusted set you are is inherently the less trusted you are within that system and so we settled on using Biometrics we looked at a lot of different bi biometric factors that you can use fingerprints phase scans and palm scans all have the same issues and that a there isn't actually enough entropy for distinguishing uniqueness at the scale of all of humanity and B they change too much over time so if someone were to sign up with a face scan once and then 15 years later try to sign up again their face might have changed enough you can get plastic surgery things like that we also looked at DNA and pretty quickly decided not to go with that one because it's not private enough you can't use DNA without knowing a lot about that person right they gender information about their race what part of the globe they might be from and so we settled on using the iris and when it comes to Iris Biometrics then how do we go through and actually collect that biometric data to process but not have to store we looked at phone sensors and off-the-shelf Hardware but phone sensors are hard to trust and also often aren't at a high enough level of detail for again distinguishing uniqueness amongst all of humanity offthe shelf Hardware had some of the same problems it's also quite expensive isn't very easily transported and things like that so we settled on building custom hardware and I'm sure some of you have seen this Hardware before it is the worldcoin orb the orb has been in develop velopment since 2020 it's gone through lots of different revisions but we are now starting to scale up production of the orbs to have them in more places around the world and the orb's job is to make sure that you're a real human not a cat not a dog not someone holding up a photo of a human not a mannequin head the orb takes a photo of each of your irises on the device calculates an iris code a digital representation of the pattern of your iris and then we check that that Iris code is unique against everyone else who's ever verified at the orb and once we know that that's unique we verify your world ID so we don't ever have to store those images of your irises or of your face they actually get self-coded on your phone and you can choose to delete them if you'd like all we have to store is that Iris code so World ID is privacy first decentralized and open source so again privacy first most important thing is that we don't have those photos we don't have to store them they're on your phone in your custody in your control World ID is built to be decentralized so right now tools for Humanity is the only company that builds these orbs but the world coin Foundation has issued grants to other companies to start designing and operating orbs of their own and it's open source every single part of the protocol from Smart contracts on chain to our developer tools that I'll walk you through today all of that is open source in addition Ally the orb hardware and most of the orb software is also open source there's lots of different use cases where World ID can be valuable right for voting for example being able to prove that you only cast one vote and then it's a real person who placed this vote but not revealing who placed that vote is super helpful on social media having a different type of verified check mark where you know for a fact that that account belongs to a real human they only have that one account associated with that world ID and that it's definitely not a bot that's super valuable I think customer incentives are also a super interesting one has anyone here ever tried to use a discount code twice right I have plenty of times like I've gotten my fair share of Netflix free trials before they got rid of that but with World ID they can know that this real person is only getting this discount or this free trial or this sign up bonus once and it prevents gaming those systems meaning that they're more likely to offer you a bigger incentive or just keep them around instead of getting rid of free trials altogether like Netflix did we've also built World ID to be super super easy to integrate you can use it on the web you can use it on mobile devices you can use it on chain and there's two main ways to integrate World ID sign in with World ID and Incognito actions so let's start with sign in with World ID sign in with World ID follows the oidc specification open ID connect so if you've ever built anything that uses sign in with Google sign in with Facebook sign in with apple it's the same set of specifications there and there's lots of different libraries and tools you can use to implement oidc Au zero is a great one next.js is a very simple to use one where you can even custom imple ment the open ID connect flows into your application but I'll walk through how you can do this with next off to use sign in with World ID in NEX dooth this block of code is all you need this is the provider configuration in the next off like Handler uh so you're just setting the ID of this sign-in method that well-known file is a file on our server that lists a lot of the configuration information for open ID you have to put in the client ID and client secret that you get from our developer portal when you create an application there and then you're mapping the profile information so the ID and name will both be the unique identifier for that user in your application for World ID and then whether they are orb verified or simply just device verified so Sig in with World ID is super simple to use and then we have the more powerful but slightly more complex Incognito actions and these are what most of you will likely use especially if you're using World ID for anything on chain so Incognito actions proves that that user is a unique human doing something usually once but it can actually be whatever limit you'd want to set it can be once it can be twice it can be 10 times it can be as many times as you want and then optionally with a specific signal that is a piece of information tied to that zero knowledge proof that can't be tampered with so in a voting use case for example that signal might be which person they're voting for on a ballot you know that that signal was an input when that proof was generated and then when your application goes to verify that proof if that signal doesn't match what was provided when the proof is being generated the proof won't verify so the user can know that their vote is actually being counted for the person who they meant to vote for and the flow for World ID is pretty simple user will scan a QR code from their phone on their mobile device that holds their world ID they will generate that Zer knowledge proof for your application that zero knowledge proof gets returned back to your app and then your app will verify that proof either with our developer portal for cloud verifications or with our smart contracts on chain this proof response here is what you get back from ID kit our front end SDK so the Merkel root is the root of the Merkel tree onchain that is essentially the list of verified World IDs so anytime you verify your world ID at the orb you share the public Key Of Your World ID and this only gets revealed when you're at the orb and it gets added into this Merkel tree so that Merkel route is valid for up to a week so that proof can be verified for some time after you actually generate it um but that gets returned as part of the proof so you know what route the proof was generated against the nullifier hash is the unique identifier of the user in the context of your app ID and action so that is what we use to make sure that a user is only doing an action once because every time they try to perform the same action they'll generate the same nullifier hash but if they try to gen if they try to perform a different action they get a totally different nullifier hash and there's no way to tell that those two actions were performed by the same person based on the information from World ID obviously if they were to use the same crypto wallet or the same email address you can tell that those are the same person but from World ID itself there's no way to tell the proof is a much longer heximal string than what's shown here uh and that is the actual zero knowledge proof body itself and then the verification level tells you if that user is orb verified or device verified and that also tells which Merkel tree to actually verify that proof against so let's see what world ID actually looks like for an end user so I have our docs pulled up here we have this try it out page that just shows a nice little demo for you here and instead of using World app I'm going to use our simulator which you'll probably get quite familiar with When You're Building World ID application this is how you act as a user in our staging environment you have lots of different identities that are already prever verified right you can generate more there's a thousand of them for you to pick from so I hope you don't run out in 36 hours if you do you might have a problem but this button here continue with worldcoin is what your user might see on your application so we've set our action name there's an app ID set in our docs we're going to say we want to require the orb verification level so when I click continue with worldcoin it pops up this widget with this QR code normally your user would scan this you can also scan it with your camera if you're using the simulator from your mobile phone at simulator. coin.org but for testing what we can also do is just click on the QR code to copy the information within it in the simulator we click paste code and we paste it in and it's just as if I had scanned that QR code with my phone pH camera so then in the simulator I can choose whether I want to verify with the orb or the device credential I'll go ahead and verify with the orb credential and now the back end for our documentation is sending a request to our developer portal to verify the proof that was generated by the simulator and we see that that proof successfully verified so we're all good there but if I try to do it again we'll see that it won't let me we can see that this person is already verified for this action so when you're using our developer portal backend for verifying these proofs it handles the Cil resistance checks and we'll make sure that that user only gets to perform the action as many times as you set in our developer portal but if you're doing on chain proof verification you have to configure that yourself in your smart contract but now let we know what id kit looks like for our users let's get into how you actually integrate it so every integration starts with ID kit for Incognito actions whether you're doing cloudproof verifications or onchain proof verifications and it's a single react component we do also have a vanilla JS version of the library I'm more than happy to tell you more about that it's also covered in our documentation but for the sake of the workshop here I'll go with react because generally I see a lot of react nextjs apps at these hackathons so for the ID kit widget you give it the app ID and action that you configure in our developer portal you'll set the minimum verification level you want this defaults to the orb verification level um if you're doing onchain proof verifications we only support the orb credential on chain so you can just leave the verification level out of there entirely and then on success and handle verify are two callback functions handle verify is optional on success is mandatory they just get called at different points handle verify gets called as soon as that zero knowledge proof is returned from the user and it gets called while you saw that like pending state in the little demo on success gets called after handle verify runs or when the widget is closed if handle verify wasn't specified so handle verify is useful for cloud verifications where you want to show the error to the user in a pretty way if the proof doesn't verify because ID kit will show that error like you saw when I tried to verify a second time but on success is useful for onchain verifications where you then immediately want to go to sending a transaction with that proof in the call data and then there's one child component and that is the button that will open ID kit you can configure that button to look like whatever you'd like it's totally up to you and then we get this proof response back as we saw earlier but we have this proof response back and a mistake that I've seen people make before is that they see the green check mark on ID kit and go okay great this user's verified but until you actually verify that proof with our API or in your smart contract on chain all you have is a claim that this user is verified right you have to verify that proof and if you don't verify that proof proof or don't at least make a good effort to verify that proof in your hackathon project you will not be eligible for bounties from us so to verify the proof for a cloud action it's quite simple if you're someone who's built on world ID before this will look new to you uh because we've added this verify cloudproof function that handles the call to our developer portal API for you so all you have to do in this case is pass that proof object that you got from ID kit to your application's back end it has to be from your back end not from the front end as well as the signal if you used one so you you pass the proof and the signal to your back end and then pass the proof app ID action and signal if you used it into the verify Cloud proof function and then it will return a success or failure if it fails it will include a an error code and detail explaining the error otherwise it just return success and then you can send that response back to your front end to present that to the user the reason you need to do this proof verification from your back end is that on the front end everything can be manipulated by a user so if you only gate whatever action it is you want to gate world gate behind World ID in your front end the user could simply spoof a successful response from the developer portal and trick your application to letting them go forward in your back end it's a secure context where the user has to provide that proof and then you get to verify it you know it's the real developer portal that's sending that response so that's why you have to do that from your back end and not the front end now for on chain proof verification it's slightly more com complex as most things on chain are unfortunately but we do have templates for this as well as all of the other Integrations I'm showing here so for onchain verification first we have our Constructor the world ID value here is the address of the world ID router contract this is information is available in our docs uh and that router contract is what you call the verify proof function on we have this router contract so that when we deploy new contracts or ADD add new credential types in the future you don't have to change what contract address you're interacting with and then you can set the app ID an action ID in your Constructor to save gas if there's only one action that you want your users to perform most use cases will do this uh but you can also pass in the action ID as part of the function call data if you have a situation where you need multiple actions to be generated on the Fly for example and this external nullifier is a combination of the app ID and action and that's terminology that you might have seen if you're familiar with sopore uh a z knowledge proof system from psse FR of the ethereum foundation and that's because World ID is built on top of suor I can dive deeper into that if you're curious after the workshop um but in this case you just need to know that you calculate the external nullifier by hashing the app ID and action ID together this specific way I recommend just using this code that's in our template instead of trying to mess around with it too much so then in your smart contract you'll have the function that gets called to actually verify the proof and do whatever it is that the user wants to do so for this you can take in the signal the root the nullifier hash and the proof and the first thing we do here is we check to make sure we haven't seen that that nullifier hash before that's because we have to implement the Civil resistance in our own smart contract once we know we haven't seen this nullifier hash before we call verify proof on that world ID router pass it the root the group ID which will currently always be one for onchain applications that group ID of one specifically signifies that this is orb verification we hash the signal a specific way in order to make sure it's within the field of the curves used for the zero knowledge proof system pass the nullifier hash and that external nullifier that we calculated earlier in the Constructor and the proof and if the proof verifies this program will simply continue if the proof doesn't verify it will revert so that really simple execution flow is how we can tell if that proof is good or not so after the proof verifies if we're still running we should then Mark that nullifier half as seen so that the user can't perform that action again and then after all of that is when you'd want to go ahead and have your code to do whatever it is that you want to gate behind World ID that can be minting some tokens claiming an nft whatever you'd like but that should be after you mark that nullifier hash is used so that is the overview of how to build with World ID what world ID does you can go to worldcoin toor2 to see a notion page that has a lot of this information within it links to our template repositories and you can also find me at our booth I usually don't sleep very much during hackathons because if I wasn't here working I would be here hacking with you so I'm more than happy to help out answer any questions you might have and thank you all so much for your time [Applause] [Music]