As I’m sure you’re aware, the auroracoin airdrop started two days ago. Predictably, the price has been tanking as people have been getting a hold of these coins, but who exactly are these people? How fairly is the airdrop being conducted?
To establish proof of Icelandic residency, the website requires that you provide a kennitala. A kennitala is basically the Icelandic equivalent of a social security number but with one key difference: It’s public knowledge. Anybody with an icelandic bank account can, if they’re aware of this, query the national database and retrieve every kennitala. Unfortunately, I do not have a contact in Iceland who can pull this database for me… But the system can still be gamed in other ways. I did my research and wrote up a quick GUI interface in visual basic that generates valid kennitala.
However, just because it’s valid doesn’t mean it exists in the national database. About 1 in every 10 referred to an existing person, which allowed me to get past the first stage of verification.
The second stage of verification is a bit trickier. You have two options. Provide them with an icelandic phone number (That’s linked to your kennitala on http://ja.is) and receieve an SMS message allowing you to proceed. This is the more difficult of the two methods, so I opted to try out the second method: facebook verification. This involves providing them various information associated with your facebook profile, and they run it through some sort of algorithm to see if you’re really from Iceland.
At minimum, your birthday and real name are associated with your kennitala. Figuring out the birthday is not a problem, this information is part of the kennitala itself. Getting the full name of the person who the kennitala belongs to is a bit more difficult. I won’t reveal how or where, but after searching for a while I found a place that inadvertently revealed this information… So now I was in business. I took an old facebook account, changed the name, changed the birthday, and updated my location to Kópavogur. Also notice that the app combs through your friend’s information too, so I deleted all non-icelandic friends and added a few dozen legitimate Icelanders. I took the extra step of liking some Icelandic pages as well, and setting up an account on ja.is
So, now I had a facebook profile, created years ago (this is another requirement of redemption), that to the eyes of an algorithm should appear to be a legitimate Icelandic citizen, with all personal information lining up with that of the kennitala. I connected to the auroracoin website through an Icelandic VPN, plugged in the kennitala, and attempted to link it to the facebook profile… And the results?
Rejected. Whatever algorithm they’re using to verify residency is surprisingly more aggressive than I thought it would be. So aggressive, in fact, that legitimate Icelanders are complaining about the system denying them. Color me surprised. Of course, we can’t rule out the scenario of Baldur himself laundering coins through the airdrop (for the record, I don’t think this is occurring), but as far as the airdrop system itself goes, I believe that it is set up pretty fairly. I’m rather impressed with it.
As for the coin itself, buying now is likely a bad idea, but after the bulk of these are distributed and the price settles to it’s natural level, depending on Icelandic sentiment, it may be worth picking some of these up. I’ll be watching very closely going into the future.
Discuss this post over at the CryptoLife Forum