Ethereum co-founder Vitalik Buterin believes that one-per-person digital ID systems, despite using zero-knowledge proofs (ZK proofs), carry risks to privacy. ZK proof wrapped IDs offered by World ID (formerly Worldcoin) using biometric data and ZK proofs have been gaining traction, recently crossing 10 million users.

Therefore, in his blog on Saturday, Buterin suggested ‘pluralistic identity’ as the “best realistic solution” to fully preserve privacy.

ZK proof wrapped IDs use ZK proofs to establish that a user has a valid ID without revealing any details of their ID, thus promising privacy. However, Buterin argued that ZK proof wrapped digital IDs still have loopholes that could compromise privacy.

ZK wrapped IDs solve ‘a lot of important problems’

Buterin concedes that “ZK-wrapping solves a lot of important problems.” Apart from ZKIDs, all options to authenticate a user’s identity on any application require the user to reveal their entire legal ID. According to Buterin:

“This is a gross violation of the common computer-security principle of least privilege: a process should only get the least authority and information required to accomplish its task.”

For instance, if an app requires a user to prove their age, the application should not be able to access any other data in the legal ID. Therefore, ZKIDs provide a crucial and previously unavailable avenue to preserving privacy, Buterin said.

Risks associated with ZK proof wrapped IDs

The designs of current ZK-identity platforms come with constraints—they allow users to create only one ID for each application. Firstly, the one-per-person ID limit means that ZK IDs do not guarantee pseudonymity, Buterin said. He explained:

“In the real world, pseudonymity generally requires having multiple accounts: one for your “regular identity” and others for any pseudonymous identities.”

Teenagers and many others already practice having multiple accounts, calling them fake and real Instagram accounts. Buterin wrote:

“…under one-per-person ID, even if ZK-wrapped, we risk coming closer to a world where all of your activity must de facto be under a single public identity.”

The single ID constraint for each application means that the “practical level of pseudonimity” offered by ZK wrapped IDs is lower. This is because, currently, services like Google accounts allow users to create up to five accounts.

Secondly, users can be coerced by governments or companies to reveal their identities on one or more applications, thus nullifying privacy preservation. For instance, an employer can ask a potential recruit to reveal their full ID on one or more social media platforms as a condition of employment.

Therefore, Buterin said that ZK does not “eliminate the possibility” that a person’s identity could be revealed under coercion.

Lastly, ZK proof wrapped IDs also come with non-privacy risks like errors.

In extraordinary or edge cases, all forms of IDs often fall short. For instance, biometric IDs may not work for users whose features have been damaged or warped by injury. Biometric IDs could also be potentially spoofed by replicas. Additionally, government IDs do not include stateless persons or those who have yet to acquire such documents. Therefore, Buterin wrote:

“These edge cases are most harmful in the case of systems that try to maintain a one-per-person property, and they have nothing to do with privacy; hence, ZK does not help.”

Pluralistic identities are the solution, Buterin said

Buterin defined pluralistic identity as “an identity regime where this is no single dominant issuing authority, whether that’s a person, or an institution, or a platform.” According to Buterin, pluralistic IDs can be explicit or implicit.

In explicit pluralistic identity or ‘social-graph-based identity,’ a user has to prove a certain feature, like their age, or that they’re human, through attestations from others in the community, who are also each verified through the same process. Explicit pluralistic ID systems can allow users to have one or more pseudonyms, with each pseudonym having its own online presence and history, Buterin claimed.

On the other hand, in an implicit pluralistic identity system, a user can provide any ID—government IDs or social media IDs—for verification. According to Buterin, implicit pluralistic identity systems reduce the possibility of a user being coerced to reveal their entire identity.

Furthermore, pluralistic ID systems are “naturally more error tolerant,” allowing people who are generally excluded, like those without the right documents, to prove their identities.

Buterin warned, however, that these benefits disappear and the system effectively turns into a one-per-person ID system when “any one form of ID gets close to 100% market share, and it becomes realistic to demand it as a sole login option.”

Mentioned in this article

A massive data breach at a company connected to the grocery retail giant Ahold Delhaize USA impacted more than 2.2 million victims.

The breach targeted Ahold Delhaize USA Services, LLC, a firm that provides support services to Ahold Delhaize USA, one of the largest grocery retail groups on the East Coast.

Stolen data from the breach varied on a person-to-person basis but included names, contact details, birthdates, Social Security numbers, passport and driver’s license numbers, financial account records, workers’ compensation details, medical records in employment histories and other employment-related records, per a notification on the Maine Attorney General’s website.

“We detected a cybersecurity issue involving unauthorized access to some of our internal US business systems on November 6th, 2024. We immediately launched an investigation with the assistance of leading external cybersecurity experts, coordinated with US federal law enforcement and began taking steps to contain the issue.

Based on our investigation, we identified that an unauthorized third party obtained certain files from one of our internal US file repositories between November 5th and 6th, 2024.”

Ahold Delhaize USA Services says it is currently notifying impacted victims and offering complimentary credit monitoring and identity protection services for two years.

Ahold Delhaize USA is the American division of a large global retailer, and its domestic corporate umbrella includes the grocery brands Food Lion, Giant Food, The GIANT Company, Hannaford and Stop & Shop.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney

A North Carolina woman was sentenced to more than four years behind bars for carrying out an identity theft and bank fraud scheme that enabled her to spend money using the personal information of her victims.

According to the U.S. Attorney’s Office, Western District of North Carolina, Jessica Bailey Sowell engaged in the scheme from March 2023 to February 2024.

Court records show that she created fraudulent identification documents using compromised personal identifying information (PII) that were obtained through stolen mail, the internet and other sources.

Sowell then used the fake documents at banks, hotels and retail stores. Investigators found that she had letters, bank cards and checks belonging to at least 26 victims of identity theft.

The 32-year-old was apprehended after a federal search warrant was executed at a hotel room where she was staying.

Investigators found a suitcase containing hundreds of mail with various names and addresses and another suitcase with store-tagged merchandise, two handwritten journals with the names and credit information of several individuals and 23 driver’s licenses from different states that show Sowell’s photograph and the PII of the identity theft victims.

They also seized from the rental vehicle that Sowell was using a credit card under the name of an ID theft victim, receipts for goods that were bought using the victim’s credit card, an identity card printer, multiple blank identity cards and holographic stickers.

Sowell, who is prohibited from possessing firearms, also kept a Taurus G3 9mm handgun in the hotel room.

On Monday, she was sentenced to 57 months of jail time followed by five years of supervised release for bank fraud, aggravated identity theft and unlawful possession of a firearm. She was also ordered to pay restitution to her victims in the amount of $47,190.25.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney

Coinbase’s legal team says the exchange’s recently disclosed data breach impacted 69,461 people.

A filing with the Maine Attorney General’s Office outlines the massive scope of the breach, which happened in late December but was not discovered by Coinbase until earlier this month.

The exchange says criminals bribed a small group of overseas customer support agents to copy the data of less than 1% of the firm’s monthly transacting users.

Coinbase notes that hacked information includes names, addresses, phone numbers, email addresses, masked social security numbers (the last 4 digits only), masked bank-account numbers, some bank account identifiers, government-ID images, account data and limited corporate data. The exchange says impacted customers were notified by email on May 15th.

Coinbase learned about the hack after receiving an email earlier this month demanding a $20 million Bitcoin (BTC) payoff in exchange for not releasing the illegally obtained info. The company refused to give in to the hackers’ demand and estimates it will pay $180 million to $400 million in remediation costs and voluntary customer reimbursements.

In a video posted to the social media platform X, Coinbase chief executive Brian Armstrong promised the exchange would pay back impacted customers, increase cyberattack defenses and relocate certain overseas customer support operations.

Follow us on X, Facebook and Telegram

Don’t Miss a Beat – Subscribe to get email alerts delivered directly to your inbox

Check Price Action

Surf The Daily Hodl Mix

&nbsp

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any cryptocurrencies or digital assets, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.

Generated Image: Midjourney