How can the Auroracoin distribution verify that the recipient does not receive coins using the id of somebody else?

If Icelanders use their ids everywhere then many Icelanders potentially know another Icelander's id.

Does Aurora restrict each Icelander to have only one Aurora address per Icelander id?

Does Aurora filter the Icelanders' locations by IP address?


Good questions!

If I understood the site's content correctly the answer to 2nd question is yes: At each distribution, each Icelander citizen will be given coins only once, so I guess one AUR-address per Kennitala ID is enforced somehow.

The part I'd like to know is how they're going to track which citizen has applied for which distribution: Should a lot of coins remain unclaimed from 1st airdrop, the total will be distributed again, and again, and finally (in case a lot of coins are still unclaimed) a bunch will be destroyed and the rest donated to a charity.

So a crypto-currency savvy Icelander could potentially apply for all 3 distributions, a less savvy might apply for just the last 2 or even just for the last one. And they'd all be using the same address each time. Unless they're using a centralized database, how to know which citizen has not applied for current distribution round?

A theoretically perfect airdrop should concern only with a citizen with a valid Kennitala, not on whence in the world they're connecting from, hope organizers are not using geolocation.


Some people have tried to hack the airdrop system. So far, it seems the Facebook algorithm is not so naïf as could be expected: as the activation via SMS to the citizen's registered cell-phone seemed much unlikelier to succeed, the blog's author grabbed a kennitölur number, located the full name and created a Facebook account ex-professo. It failed!

It must be indeed possible to game the system as some Icelanders have complained in the forums of someone else receiving their coins. But then some others complain of the system rejecting them (false negative). Too bad most of the recipients are cashing right away, provoking the drop in prices currently seen. In the future, other national-economy-savior coins should take this into account and do something to void it.

  • 1
    You hint at some Facebook algorithm being used to make sure that the actual recipient is requesting the payout, yet you don't explain how it confirms the recipient's identity. Essentially, that would be the first question. If you have read up on it already, could you add that information?
    – Murch
    Apr 5 '14 at 21:35
  • No, for good or bad I've not seen Ódinsson revealing how it works. The SMS activation scheme is really straight forward: ID #, name, plus an SMS from the registered phone. Registration via Facebook doesn't just check name, date and place of birth and contacts - would be really interesting to see if the method is released after the airdrop.
    – Joe Pineda
    Apr 6 '14 at 17:28
  • So, it essentially requires you to have a Facebook account, an Icelandic ID, and a phone number? Is it just me or does that sound like a lovely dataset to sell to someone?
    – Murch
    Apr 6 '14 at 18:41
  • Exactly! It sounds so easy to game, right? For what I've read, the national citizens database is already downloadable, if you know whence. Faking an SMS to make it appear it was sent from a specific cell phone would be more tricky. I'd like to know what they're checking in the Facebook accounts to decide fake from real... I find it miraculous the very small number of complaints I've read about people not getting their coins.
    – Joe Pineda
    Apr 6 '14 at 22:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.