Schelling point in decentralized access recovery and identification

Hey, my name is Arseniy Lebedev, I’m co-founder at NYX and today we’re gonna explore the topic of decentralized identification and consequently access recovery in blockchain.

Image for post
Image for post

The problem

While being a breakthrough technology blockchain still has problems which have been dealt with for a long time by conventional banking. For example if you forgot your PIN for a banking card, lost the card itself, lost the account number and so on, generally you just need to show your ID in the nearest bank office to restore the access. It’s different with the blockchain. There is no password recovery function or something alike, at least if decentralized access is intended. If you lose access it’s final.

It’s arguable whether we should trust some authorities to hold our private keys like some wallets do, but obviously it’s not a decentralized solution and ergo is not the current topic of discussion.

What is an identification but a mutual agreement in society that person X is the same virtual person X which has access to what the society recognizes as its property? It means that you ask some subgroup of the society to validate you as the same person who created the account and society uses different ways to make sure you are you.

We in NYX have been puzzling over this topic for a year and came up with some elegant solution.


With current technologies the only accessible feature which is more or less uniquely connected to a person is his biometry. We widely use the following types of gathering biometry data:

  • Fingerprints
  • Finger vein recognition
  • Voice recognition
  • Face recognition (visual spectrum)
  • Face recognition (IR, depth map, 3D map)

Actually when a bank clerk compares your face to what’s on the ID he/she also make a biometry comparison, more specifically face recognition. Interestingly error rate of this kind of identification isn’t as good as it intuitively seems, some modern neural networks already are more precise than humans.

The thing is that in decentralized applications we cannot trust the hardware. At the end if it’s not private key coming from your cold wallet it’s something which has been generated from fingerprint sensor, camera etc and it means that the generated data might be copied or emulated. This is the nature of digital world and in centralized solutions it’s dealt with by having trusted authorities which can create trusted hardware, generate certificates, validate digital signatures and so on. But we gotta keep things decentralized, don’t we?

Schelling point based solution

Schelling (focal) point is a game theory concept, that prisoner dilemma thingy. It was named after Thomas Schelling who discovered them and initially had slightly different application than what we’re going to explore down below. Practically it was meant to find some kind of “symbolic value” which has meaning for a specific group of respondents. For example if you ask a group of New-Yorkers where would they meet if they hadn’t means of communication, the general assumption would be the Empire State Building.

More importantly Schelling point allows you to get an unbiased opinion from participants of a poll. Basically you ask a group of people the same question and expect countable answer from binary 0–1 (yes-no) to 0-infinity. Then you find average of all answers and reward only those participants whose answer wasn’t very different from this average.

The obvious problem of Schelling point is communication. If we imagine participants coordinating when asked a question then we must assume they might all fall into average threshold of a biased answer. And they obviously will have their motivation — the reward. Thus the best strategy for the group will be to cooperate so everybody has the guarantee of getting a reward which we’re going to avoid down below. Cooperative games are generally more rewarding then non-cooperative so here we obviously need some kind of Nash equilibrium.

Let’s imagine a Schelling point based identification using face-recognition for Requester (owner or, inevitably, attacker) and Authorizers.

Requester’s side:

  1. A user makes a video of himself when creating the account. One can choose level of security, for example set flags to include depth map, or 3D-map of his face. Obviously the same level of detail will be required later;
  2. To protect further from using footages or generated imagery Requester might be required to pronounce some random words. This will help create more unique descriptor of his facial features;
  3. Moreover user might even add specific information which will give Authorizers some additional way to verify his identity, like “I got a birthmark on a cheek”;
  4. The footage is uploaded to the Swarm decentralized network — one of the kits of Web3 technology stack, on which Ethereum stands. Swarm used to save large data outside of the blockchain itself. Swarm link to the footage file (which looks something like bzzr://e776f95174686bb0682c08a491d0ddc4c7376f6bd686c31814585b79a186df3c). It is saved forever during the smart-contract upon creation and cannot be altered in any way. The footage is encrypted and not accessible to anyone including the account owner, he might only replace it with another one;
  5. Later, if access is somehow lost, Requester publishes a restore access event to the blockchain. It must include address of the account to restore;
  6. Account owner is notified on all active wallets that request has been made so he might mark it as a fraud outright (using the passphrase he presumably remembers at this variation);
  7. This event is not free and requires payment (or some other form of reward, like tokens) which will be distributed between authorizers. This also makes brute-force expensive for an attacker;
  8. In addition to payment, the Requester supply the video, in which is recorded the owner of the lost account. This video must have the same level of security (depth map, IR) as in the initial one. Smart-contract will reject videos without specific features, but even without such check one will definitely fail the consensus decision.

Authorizers side:

  1. Authorizer opens some UI application (presumably open source) to scan the blockchain to find an unsatisfied recovery access requests.
  2. Upon finding, participant is presented with both account creation footage and recovery request footage, user provided additional info, security layers (depth map, IR), possible reward for the correct answer, probably even audio.
  3. According to his impression Authorizer sets his score indicating whether in his opinion the person on the source matches to the person on the recovery footage. Currently it’s just three options “Fraud”, “Not sure”, “Match”
  4. The average of all votes is counted in smart-contract and processed as follows: “Not sure” indicates that additional footage is required or will require more Authorizers to join the process. “Fraud” will result in Requester losing the fee and wallet owner is notified; “Match” will transfer assets to the supplied account;
  5. The Authorizer receives the reward and his rating is probably automatically increased.

The obvious problem of such concept is sybil attack: an attacker might flood the network with auto generated accounts and thus receive access recovery events with higher chance.

This is dealt with in three ways:

  • Rating system, based on two variables: amount of successful recoveries, and amount of edges to a user which is essentially how many other users trust him to be their Authorizer
  • Guaranteed unbiased participant;
  • Viral growing — accounts are generated only through invites from validated ones.

The rating system per se still might be attacked with flooding just with extra steps, one can emulate the successful recoveries and even edges with a little more complicated algorithm. To fight this we use neural network and demand fee for Authorizers. Moreover we have a little more protection by that fact that some currency is burned to execute the contract itself.

Enter neural network

The most obvious decision besides making a centralized authorization center with experts (no, please) is using a cold unbiased machine. Neural-network based facial recognition is already used in some banks and this approach is growing.

We’re utilizing VisionLabs neural network which has been tested in production to validate, match and extract descriptors from presented footages. With some modifications it will be included in smart-contract and participate in a decentralized authentication with higher voting weight which will help fight bias and human errors.

Perhaps a simpler solution

Currently we have developed a simple proof-of-concept application to validate the idea. It also utilizes Schelling point but doesn’t have problem of account flooding and might be even considered safer.

Instead of having random people trying to identify a person in this variant user creates specific whitelist of those who can restore access for the account — friends, family, escrows. You still have to capture video creating the account and also upon access restore request only opinion of users from whitelist will matter. This variant includes several options like selecting minimum amount of confirmations (all, >50%, at least one highly trusted person). This also allows recovery for inheritance purposes or fixing face disfigurement, because relatives or escrows are able to acknowledge this in real life.

We’re planning to release the fully capable iOS application on Jan 24 when our pre-sale starts. Keep track on our repository and our dev diary here on Medium!


Obviously there’s a lot to explore with decentralized authorization. Here is a glimpse on what challenges we will meet:

  • Facial disfigurement
  • Racial problems: it’s scientifically proven that people of different races tell each from other worse than people of the same race
  • Twins and plain lookalikes

The “simpler solution” handles these problems surprisingly well but our goal is to reach the point when you can be identified almost instantly and wouldn’t need to rely on your immediate surrounding. We plan to make it as instant and convenient as making an Instagram story. If we reach the point where the ecosystem consist enough trusted Authorizers (like miners nowadays) the following applications might occur:

  • Authorizing sensitive actions based on person’s identity, for example transferring big amounts of money
  • Inheriting assets
  • Voting from validated persons, the whole class of “decentralized democracy” applications

We hope that this article helps you understand on what we’re doing right now. We are still working on the whitepaper and eager to listen to your suggestions on our Telegram channel, Facebook page or Twitter.

If you want a tet-a-tet you can contact me through!

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store