Privacy-Preserving Proof of Personhood at the HTTP Layer - Viki Val

Transcript

Hey, hey. So, welcome everyone. I'm Vicki and welcome to the talk about X511 and why the web needs a human layer. Uh, I'm doing usually experimental blockchain air research these days and bleeding edge implementations. If you want to look at GitHub or Twitter, I'm always active there. And question is why do we need like a human layer for the internet? Well, the answer is kind of obvious.

>> Basically, humans do not really surf web anymore. And according to the research like mo most than half of the web is browsed by the AI agents or air crawlers and basically whole Tik Tok and Instagram is just AI UGC slop. So instead of having like a real content, you see like these fancy AI cats doing stuff. And outside of that, especially in crypto, you have these AI agents doing airdrops and farming points. And basically, no one really uses your product or you don't know if it's a real user or just a agents.

And so what changed? Agents can already use browsers. It was released like few months ago that thanks to the like playright NPC you can just hook hook up your agent and he freely browses uh models can interpretate pages and forms. So basically you don't need to click on the internet at all and basically >> every service who is trying to solve this runs into some sort of edge case and in the end you are basically rate limiting your users or just yeah having capture on the site which really hurts accessibility and especially with the capture is it

basically creates a friction. So basically your agent could probably solve capture better than I do. I have problems with that. And yes, you are trying to match all these bridges or cars or whatever that is. You are training the AI model and in the end you are just guessing same as the AI model and in the end you punish the real users. So how to make the accessibility latency better? Well, you can use like QIC or know your customers, but in the end, you trying to extract information about your users, which is not really good. And in the

end, most of the currency or crypto exchanges don't need your name, don't need your passport, don't need the scan of your document. They usually need like a smaller answer. Are you sanctioned? And are you over 18? Yes or no. That's it. That's what they need. But thanks to the jurisdiction, they're yeah, they have to do this. And can we do it better? Well, we'll see. So, let's say hi to X511. And the whole point of X511 was that let's try to make an endpoint. There's no app specific. You don't need to create sort of any other abstraction.

You don't need to do any upload and you don't need to disclose any personal data. So the mental model behind this was something similar to X42. Do you know X42? Perfect. So X42 is basically a gateway where you can access to some endpoint when you pay and we try to do the same with the cred ZK credentials. So instead of proving that you paid, you are proving that you are a real person or somewhere someone trustworthy. And yes, that's why we took uh inspiration and X42. Basically, what X42 enabled was that you have agent native payments for clients, APIs and agents. You basically

pay then retry and you get the resource. So you just pay and X511 is the same just you prove then retry and you get the resource by proving that you are real. Uh how so how does it work in the general is that you trying to get uh trying to access some endpoint for example slprotected you get the response instead of 402 you get 511 with a page with QR or dib link depends like what kind of provider you want to use user scans prove it prove himself or herself we generate the uh self or zk password are the providers we use they read it generate the zk a proof. We post it back

to the server. Server verifies and validates the proof and gives you the access token. We set the cookie and you can browse freely the web. Easy as that. And so thanks to my friend, he's like a huge nerd in web technology. We focus on developer experience first. So this is all you need. Basically 15 lines of code and you are running. You don't need to know how ZK works. You need to know how cell works. ZK passports just yeah have 15 lines of code and you can you can use that. So instead of like EU having this special ultra expensive app that is full of bugs 15 lines of code and it works with any other modern like

TypeScript standard browser. So such as Hono, Elijah whatever you can imagine. We don't use any magic. it just works and yeah we are we got also inspired by a cookie standard cookie and out so it's cookie based HTTP only same site and secure it's configured with TTL or time to leave so we set now 30 days so you can you don't need to verify yourself for next 30 days once you verify yourself prove it prove it and you can browse freely and of course you don't need to disclose anything or yeah you are not forced to do that. So we were

thinking like how to how to make this like catchable cuz it's hard to imagine like what to what to do with X511 and we are trying to now build a small app for humans and it's a simple poll app where app needs one property if the one if the person is real and he or she gets one vote but the whole point of the app is that the one poll per day with a hot day with a hot take. So basically Grock makes them so the grog takes like last 24 hours or what happens in the world makes a poll about it and people can basically vote like what's the take if it's pineapple on pizza good or not.

Well, you can you are human. You can try to vote and you don't need you don't need to disclose anything. I don't need to know if where are you from, if you are over 18. I just know I just need to know if you are real or not. And at the moment only nullifier is stored. So we know that you voted only once and you can also choose what you want to disclose. So where X511 fits? Well, depends on your use case. You can you you can prove if you are human on the various discord servers. So you don't need to farm for engagement. You can make age gating. So instead of yeah you having their own app you can just use X511 to do that. So and

it works also with the crypto apps. You can have fair air drops, you can have fair quest, fair voting with like civil resistant constraints and also API. You don't need to limit users. So you just require proof if they are real and give them better tier. So you don't need to worry that someone creates like million fake emails just they have their identity and they are limited to amount of passwords created on this planet.

And how about agents? Well, that's a very good question. We've been thinking like how to use agents with this X511. And we iterated to the point that we don't want to be anti- AI agents because like agents can be super practical for many things. I personally use Hermes. I use Open Claw for many things. And probably the thing is like hm I could delegate my identity to browse by and or also send some sort of emails or do some sort of negotiation on my behalf. Well, it's it's nice experiment.

So what we are missing currently is a primitive to delegate identity from a real person to the agent. So you know that there is a AI agent that is backed by a real human which is kind of nice. Well, it has sort of limitations. We've been we've been talking to lawyers like how to do that the best. We don't have an answer yet. So, websites today try to decide whether the current person looks human or not. And the better would be like websites can prove that you are backed by a real human.

So in the end uh web needs a human layer and captures are here to yeah to prove something which doesn't work in the end. QIC reveals too much so you can get kidnapped. So only X511 ask for the smallest and useful proof. And basically that's it. Let's make web more human and visit us at x511.org. Thank you.

>> Nice. >> Any questions? >> Uh so it's not being anti- agent. I feel that it's an understatement. So with this protocol, I can rent out my personhood to to to anyone like you can you can basically buy big like if you want to scrape the web as like 10,000 people it's really easy to set up a service where I can you know ear earn a little money by being one of those 10,000 >> well that's the gray market I know a few people that were buying passports to

overcome some legislations in the casinos Buying a passport means that like you like renting a passport is problematic. >> Uh renting a proof for one occasion is like completely normal in the world of crypto. Like that's something I would do without hesitation. >> You still need a passport to make a proof. So unless someone doesn't borrows you your passport, it's basically useless. >> Yeah, but that's what I'm saying that this thing protects me from all those things. So I I I'm not going to rent my passport because I know that somebody could take out a loan in my name. But creating a ZK proof of something particular and harmless, of course, without a second thought.

Thank you. Any other questions? No. >> Okay. Thank you. >> Thank you.