# AI Scraping Will Force Us Towards Stricter Identity Systems The direction we're headed in the next 5 years if we don't change something fast: anyone with 15min and $50 can cause absolute chaos online by flooding posts on many different platforms, DDoSing, AI-bot-spamming, etc. The cost of online identity will cheapen as bots can not only bypass CAPTCHAS but generally reason about any challenge they are faced with. The thre main exceptions are identity systems that use: - biometric verification / government-issued ID KYC (ruins privacy) - hardware attestation or secure enclave (DBSC, reCAPTCHA v4) (ruins equal access) - $ money (not free, but otherwise maybe the best option?) I think over the next 5 years as the advertising industry goes through a rollercoaster around AI-bot-based adfraud, and as social media gets flooded with llm bots, people will start to demand more durable forms of verifying humanness and uniqueness of visitors. I even imagine this would include forcing secure enclave device-level enforced verification of your identity, using some state sanctioned system backed by a drivers license or bank account. --- ## Alternatives I think by far the most promising alternative to this gradual slide into closed-garden-internet is ZK-based attestation to prove identity/group membership/human-ness. https://tlsnotary.org/use-cases [TLSNotary](https://tlsnotary.org/use-cases) is a fairly recent new tool that finally allows people to attest the authenticity of arbitrary web content by using the server's own SSL cert + a clever ZK proof system that allows you to redact parts of the content and still attest to the rest. How is that useful you ask? Well... Imagine a system where a shop could ask you to prove you are over 21yo, but you don't want to reveal your birthday or actual ID to them. (e.g. if you want to buy some whiskey online). Using TLSNotary you could: 1. log into your state's DMV or vehicle registration site 2. go to your most recent registration info 3. highlight only your birth year as displayed on the page 4. Use TLSNotary to `[Attest to this text]` 5. It generates a proof you can share with anyone who needs to know you are 21yo+, without revealing your full ID It uses the original SSL certificate of the server to prove that the DMV indeed sent these bytes (so *editing the page in devtools doesn't work*), and has a remote verifier attest to an encrypted version of the page (so you're not sending anyone your full ID in cleartext). A system like this would allow sites to make sure that a single account owner is one human (i.e. prevent one person from managing thousands of accounts), without ruining privacy by forcing full KYC with some sketchy 3rd party. **More info about how it works:** https://tlsnotary.org https://tlsnotary.zervice.io/ ## Further Reading - https://docs.sweeting.me/s/so-you-want-to-build-a-social-network - https://docs.sweeting.me/s/cookie-dilemma - https://blog.cloudflare.com/introducing-pay-per-crawl/ - https://www.browserbase.com/website/blog/separating-trust-from-threat