Status-react: Add human validation for referral program

[hesterbruikman]

Feature Issue

Add human validation component (e.g. Captcha)

User Story

As a system
I want to ask the user to complete a task that is difficult for a machine
So that I know that the user is likely human and I can determine what permissions and attributions to apply

Description

With permissionless account creation, it is trivial to bypass any blacklists and spam whitelists with requests; Creating infinite addresses to requests permissions, attributions, credits, etc. This can be mitigated by imposing limitations on permissions, attributions and credits.

Unfortunately, particularly in case of the referral program, imposing limits causes issues. Permissionless account creation through scripts can allow for unlimited StarterPack claims, but imposing limits increases the average cost per acquisition for new users.

An alternative mitigation is to include a human validation task. Allowing to claim a StarterPack only if this task is completed.

Requirements

• The task can be a captcha or an activity in the application (TBD)
• Task needs to be easy such that it does not significantly decrease attributions
• Task is accessible from multiple entry points in the app (see image below for first entry points)
• Task is suitable for Desktop interaction

Entry points

Acceptance Criteria

• User has to perform a task. If task is completed, Starter Pack can be claimed
• Task is triggered from all entry points

Notes

[hesterbruikman]

@Simona-Pop @cammellos here's an issue to add human validation (e.g. captcha). Not included as concept requirement, but I think an important one:

• Serves referral program release as soon as possible

Referral program is instrumental for growth and one of the fasting things we can do to help people 'earn SNT' on day 0. As I imagine there are a lot of directions we can go into both in terms of tasks and UI, I'd give preference to whichever comes in a off the shelve react native library.

cc @errorists @simonam88 @j-zerah

[hesterbruikman]

Potential task discussed with @johnlea-quiup:

• Referral bonus after the address that received StarterPack is used to buy stickers or register a stateofus ENS name

More generally the idea here is:

• to include tasks with on chain interaction; not requiring in app tracking
• spend funds on revenue generating activities (opposed to onboarding alone, which in itself only costs the org)
• stacked rewards, getting a higher bonus based on more activities (i.e. essentially getting a cut of SNT revenue generating activities of anyone you ever invited)

[bitsikka]

@hesterbruikman for this

An alternative mitigation is to include a human validation task. Allowing to claim a StarterPack only if this task is completed.

How about Human verification via BrightID?

I was scanning through Gitcoin GR8 hackathon bounties that is going on right now and saw BrightID sponsored one

https://github.com/BrightID/BrightID/issues/657

Immediately, my head started turning with ideas about status integration. Having limited knowledge of BrightID at the time, I submitted a rough work plan that does not reflect this particular idea.

In the gitcoin bounty application: https://gitcoin.co/issue/BrightID/BrightID/657/100024287

I said this:

BrightID integration with https://status.im/get (mobile) such that we can use BrightID as an alternative public name in Status (alongside ENS names that already exists). Extra integration (maybe) - have verification party alternative to Discord within Status

But as I started researching the above idea seems to be clicking for me right now.

BrightID mobile app is actually a react-native app just like Status - It actually seems possible to build entire functionality of BrightID mobile app right within Status even. But that is probably out of the scope for this hackathon bounty right now.

I'm going to play with it, see how it goes.

[hesterbruikman]

@bitsikka Thanks for pointing to this. And break a leg with the Bright idea hackaton! Didn't know that was part of the grants round tbh.

I can see this used a permission to join a community. Where we could have a range of permission options for community creators to choose from. I'll try out the Bright ID Discord bot, that would be closest to the community use case.

As far as more dedicated use for features more closely managed by Status org a direction that's looked at is https://iden3.io/ (as mentioned in chat on Status). I'd need to educate myself more on both BrightID and iden3 to understand pros and cons of each (cc @johnlea-quiup)

[bitsikka]

@hesterbruikman not sure I'll make it :(

I bricked my mac book pro updating to Big Sur 3 days ago. In a panic I brought a new one, managed to move data from old, and finally got up and running just now.

Never-the-less, I'm going to continue the exploration. If not anything, I'll be re-oriented with Status code base, so that I will be able to contribute some meaningful contributions henceforth.

[acolytec3]

Just chiming in here since @bitsikka and I have been discussing this on the BrightID discord some. I think a naive implementation of the BrightID version of this task would be that the referral task includes a deeplink to the BrightID app where the user authorizes BrightID nodes to create a contextId which can then be programmatically verified by the Status app directly through an http GET call to the /verifications endpoint on a BrightID node.

[cammellos]

Scoping this for 1.11 as we will have no chance to deliver by 1.10

[bitsikka]

Scoping this for 1.11 as we will have no chance to deliver by 1.10

Cool! Thanks! @cammellos 👍

The experiment I'm trying out with BrightID is just that for now.

I expect there'd be more evaluation, discussions and clarity needed on various sybil-resistance/identity-protocol possibilities before it is decided to settle on one

I'll keep it all posted here on how it goes with BrightID approach

[hesterbruikman]

Further design input:

The need for a verification might be generic and can be captured in a modular verification dialog design

Webview modal that can include captcha, IP verification, or both, depending on what is required for a given service

[bitsikka]

@hesterbruikman and all those interested, please join BrightID discord's #☯status channel https://discord.gg/jk8jdsdr for latest update. I submitted the POC for hackathon few minutes before the deadline 😅 🤞

it only has a very much a shortcut/hacky basic integration of linking and checking verification through the profile tab, list-item button below ENS

[bitsikka]

cc @3esmit need your help with smart-contract based integration that BrightID has template for(therefore maximally decentralized / secure) rather than interacting with rest api backend (temporarily implemented currently in POC)

@cammellos / status-go backend team, need your help with persisting verification data

but first let us all decide for certain if it is a good idea to go with BrightID route for social-identity/sybil-resistance and more

please join brightID discord to investigate - link ☝️

[bitsikka]

Current POC implementation is in my fork of status-react https://github.com/bitsikka/status-react

Failed attempt at persisting verification data implementation is in my fork of status-go https://github.com/bitsikka/status-go

[bitsikka]

I had fun with the idea/hackathon, got started getting updated with 1 year of status-react progress that I had missed. Will be able to continue contributing hereforth 💪 😅 now. As well gained a renewed and deep appreciation for how the core team is wresting with seemingly insurmountable task of delivering the goods 🙏

[bitsikka]

Current POC implementation is in my fork of status-react https://github.com/bitsikka/status-react

Failed attempt at persisting verification data implementation is in my fork of status-go https://github.com/bitsikka/status-go

Just to set expectation, no sybil-resistance integration yet :( - just a basic, hacky/shortcuty integration (linking/verification) for now