Price:

BITCOIN

Glickman warns biometric IDs like Worldcoin are irreversible liability

Tuesday, May 12, 2026 · from 3 podcasts
  • AI-driven deepfakes are collapsing the security of traditional identifiers, with 3,000 Americans becoming identity theft victims hourly.
  • Nostr developers are racing to build decentralized proof-of-personhood systems before government-mandated digital IDs cement surveillance.
  • Privacy-preserving tech like zero-knowledge proofs allows verification of age or traits without revealing personal data.

AI has turned every piece of personal data into a public, spoofable key. Marty Bent's guest, Gerald Glickman, argues the foundational assumption of identity security - that personal information is secret - died decades ago. Fraud managers are now trapped in a losing battle against real-time deepfakes, inferring if someone is real rather than proving it with math.

"Once a biometric database leaks - and Glickman assumes all centralized databases eventually leak - the victim is compromised forever."

- Gerald Glickman, TFTC: A Bitcoin Podcast

Glickman identifies biometric projects like Worldcoin as a particular risk, creating permanent, centralized honeypots of immutable biological data. This creates a vector for authoritarian control where your face becomes a trackable serial number with no reset button. He warns the policy window for defining an alternative, privacy-preserving identity architecture is only open for another year or two, with age verification laws acting as a Trojan horse for state-mandated IDs.

On Plebchain Radio, developers David Strayhorn and Nathan Day are already building that alternative within Nostr, treating proof-of-personhood as a base layer for a decentralized immune system. With AI agents mimicking humans perfectly, they argue the community must verify itself through local social graphs and cryptographic attestations. The goal is to move beyond simple human checks to a "competence layer" where trust is contextual, decentralizing the role of licensing boards for skills from medicine to music.

Parallel development is creating the infrastructure for this new paradigm. On Nostr Compass, hosts detailed how Git Workshop now supports merging pull requests via Nostr, and RoutesterD automates decentralized LLM inference with provider scoring - showing the protocol is maturing into specialized, verifiable marketplaces. These tools provide the technical backbone for a future where identity and reputation are cryptographically proven, not centrally issued.

"The community must verify itself through local social graphs. Authenticity, not just presence, is the new premium."

- David Strayhorn, Plebchain Radio

The race is between two visions: a top-down system of biometric IDs that phones home to the state, and a bottom-up web of trust built on cryptography and selective disclosure. The tools for the latter, like zero-knowledge proofs, exist. The question is whether they can be deployed at scale before the window for choice slams shut.

Source Intelligence

- Deep dive into what was said in the episodes

Say WoT? – Ep. 5: Proof of Person with Nathan Day and David StrayhornMay 11

  • Nathan Day describes proof of place as a precursor to proof of personhood in his work on BTC Map. It involves mailing cryptographic proofs to verify physical access to a property and control of a private key.
  • Avi outlines a hierarchy of verification beyond proof of personhood: proof of profession, and then proof of competency or skill within that profession.
  • Nathan Day explains Nostr enables first-person credentials, where individuals self-assert attributes and trusted others attest to their validity, inverting the traditional authority-issued credential model.
  • David Strayhorn proposes using tags to solve the contextual web of trust problem. Users can tag others for specific expertise, and services can filter data based on tags applied by a trusted community.
  • Nathan Day notes attestations are better for binary validity checks, while subjective recommendations like music taste are more about opinion and may be a secondary challenge.
Also from this episode: (11)

Nostr (4)

  • Nathan Day argues bots are first-class citizens on Nostr, with as much right as humans. This is a feature, not a bug, but necessitates trust signals for when human verification is required.
  • David Strayhorn suggests proof of authenticity is as important as proof of personhood. The goal is for accounts to be who they claim to be, not a binary human vs. bot check.
  • Nathan Day identifies a core Nostr problem: newcomers start with zero web of trust. Proof of personhood does not solve this; reputation must be built through network interaction and actions.
  • Nathan Day states the person NIP and required attestation NIP updates are nearly ready for release, aiming for a draft on NostrHub within a week of the recording.

AI & Tech (6)

  • David Strayhorn states the proof of personhood problem existed before AI, with impersonators and bots causing issues. AI agents now make the problem far more severe and difficult to detect.
  • David Strayhorn explains that follows alone are insufficient to prove humanity. He proposes a tagging or attestation system where users publish a signed note stating they met someone in real life and verified their public key.
  • David Strayhorn contrasts Nostr's approach with the failed PGP web of trust, arguing Nostr's contextual attestations are more sophisticated and likely to succeed.
  • David Strayhorn describes decentralized lists as a method for community curation. Anyone can add items, and curation is done via social proof, ignoring low-trust actors, with the NIP suggesting NIP 7 reactions for voting.
  • Nathan Day envisions combining decentralized lists with attestations, where lists of humans are weighted by attestations from a user's web of trust and supported by out-of-band verification.
  • Avi stresses the major challenge is abstracting complex web-of-trust mechanics into an intuitive user experience that doesn't overwhelm users with jargon or options.

Culture (1)

  • David Strayhorn analogizes the desired user experience to early Google: users don't need to understand PageRank, they just need it to work. He suggests default options and layered detail for tags or attestations on a profile.

#744: Your Face Is Not A Password with Gerald GlickmanMay 11

  • Zero-knowledge proofs and selective disclosure enable privacy-preserving verification. A user can prove they are over 21 without revealing their birthdate, or prove they own a red hat without handing over the entire credential.
  • The ideal credential flow involves an issuer crafting a signed credential bound to a public key, allowing the holder to generate a one-time, non-replayable ZK proof for a verifier. No personal information is stored or transmitted.
  • Key loss is a major friction point. Solutions include key pre-rotation protocols like KERI and collaborative custody models familiar to Bitcoiners. Glickman stresses the need for deliberate, context-dependent recovery mechanisms.
  • Glickman believes the architectural choices made in the next 1-2 years will lock in the system for a generation. He cites accelerating state rollouts of digital driver's licenses and age verification laws as evidence of this narrow window.
  • The current identity verification industry has misaligned incentives, as its business model depends on charging per verification. Glickman argues states and open standards bodies must lead, as seen with Utah's SETI legislation which includes a digital identity bill of rights.
Also from this episode: (8)

Digital Sovereignty (5)

  • Gerald Glickman argues the US digital identity model is fundamentally broken because it uses compromised public identifiers like Social Security numbers as secret authenticators, equivalent to using your home address as your front door key.
  • Glickman advocates for a credential system where states issue verifiable credentials bound to a user's DIDs. This allows credential revocation (e.g., a driver's license) without destroying the user's foundational identity, giving control back to the individual.
  • Marty Bent notes age verification laws, like the Senate Judiciary Committee's 22-0 vote on the GUARD Act, are a common Trojan horse for imposing centralized digital identity systems under the framing of protecting children.
  • Glickman rejects Worldcoin's model of using biometrics as identifiers, though he approves of local device authentication like iPhone's Secure Enclave. The fight is for open systems against closed-garden solutions pushed by big tech lobbying.
  • The call to action is to engage now: examine your state's mobile driver's license implementation, support open standards work at W3C or Trust over IP, and advocate for policies like Utah's SETI that embed privacy and individual control.

AI & Tech (1)

  • The rise of AI and LLMs has drastically accelerated identity fraud, collapsing the half-life of new security controls. Glickman notes at least 3000 Americans become victims of identity theft every hour, a rate he calls unacceptable.

China (1)

  • Glickman warns against using biometrics like face or fingerprints as identifiers, as they are irrevocable and will be compromised. He points to China's social credit system as a real-world example of authoritarian control enabled by such systems.

Coding (1)

  • The proposed solution is using cryptography and open standards for decentralized identifiers (DIDs). This allows for cryptographic proof of authorship via digital signatures, shifting from probabilistic inference to mathematical certainty.

Nostr Compass Podcast #20May 8

  • Wisp 1.0.0 introduces normie mode for fiat-denominated zaps, supports NIP65 relay lists, and is now available on iOS and Android Play Stores.
  • MostrO now separates long-term identity from per-trade identity using NIP59 dual key gift wrap to prevent observer correlation across multiple trades.
  • Cleve uses Apple push notifications to wake iOS apps for NIP-46 signing, trading privacy for battery efficiency since the developer knows signing times.
  • Funster uses eCash time-locked tokens for recurring payments, mimicking Patreon, but lacks a cancelable spending path unlike Angor's Bitcoin implementation.
  • April 2023 saw major Nostr growth with NPUB BECH32 URIs, NIP45 count, event-specific zaps, custom emojis, and clients like Damus and Snort gaining traction.
  • April 2024 introduced NIP17 for private messaging, early Git over Nostr specs, and OpenSATS began long-term support for developers like Pablo and Hazard.
  • April 2025 deprecated NIP26 delegated signing, added Blossom integration NIPb7, and OpenSATS announced its 11th wave of grants including Sway and Hamster.
  • April 2026 focused on Git over Nostr refinements, migrating profile badges to Kind 30008, and the 16th OpenSATS grant wave funding Amethyst Desktop and NullNostr.
Also from this episode: (11)

AI & Tech (4)

  • Git Workshop's web interface allows direct merging of pull requests, integrates NIP51 lists for starring repos, and uses encrypted NSEC notifications.
  • Git over Nostr via ngit works for basic publication, but lacks CI/CD and mobile apps, making it unsuitable for production systems requiring low change costs.
  • RoutesterD enables automatic discovery of LLM service providers via Nostr Kind 38421 announcements and includes a Cashew wallet for Lightning payments.
  • Hazard proposes providers advertising the same model could be tested by sending identical prompts and comparing outputs to catch bad actors.

AI Infrastructure (3)

  • Grain relay replaced Mongo with NostrDB for performance gains similar to Stirfry, but lacks negentropy and full-text search, which are on its roadmap.
  • Marmot TS migrated addressable key packages from legacy Kind 443 to 30,443 to simplify SDK APIs and pave the way for multi-device support.
  • Max argues specialized Nostr apps should avoid Kind 1 posts to prevent UX confusion, favoring NIP22 for comments over Twitter-style integration.

Startups (1)

  • Crux Coach uses Nostr to publish climbing routes for Kilter boards, supports Amber login and encrypted backups via Blossom servers.

Coding (2)

  • Applesauce 6.0.0's new jQuery-like event creation system improved agent compatibility, and its relay request logic races relays to avoid dead relay timeouts.
  • Amethyst is building a Kotlin-based MediaOverQUIC stack for voice/video calls and migrated Schnorr verification to a standalone libsnorr256k1 repository.

Nostr (1)

  • Treasures publishes geocache coordinates as Kind 37,516 events with physical QR codes for proof-of-visit and supports NIP57 zaps to cache creators.