Freebird

The Problem

The internet has a surveillance problem baked into its infrastructure. Not because of malicious actors, but because useful systems require identity by default.

• Rate limiting requires tracking users
• Access control requires accounts
• Spam prevention requires surveillance
• Resource allocation requires registration
• "One person, one vote" requires identity databases

Even privacy-respecting services must collect your data to function. The architecture demands it.

Freebird's Answer

Freebird uses VOPRF cryptography (Verifiable Oblivious Pseudorandom Function) to separate "can you?" from "who are you?" for the first time in a practical, deployable way.

Think of it as anonymous digital cash for authorization. Users receive unforgeable, unlinkable tokens that prove permission while revealing nothing about identity.

• Prove you're authorized without revealing who you are
• Rate limiting without tracking
• Access control without accounts
• Spam prevention without surveillance
• One person, one vote—anonymously

Cryptographic Guarantees

Not privacy theater. Not "we promise not to look." Mathematical impossibility of surveillance.

Real-World Applications

Freebird isn't theoretical. It solves concrete problems for municipalities, healthcare systems, educators, and communities.

Sybil Resistance

"Anonymous" doesn't mean "unlimited." Freebird includes multiple mechanisms to prevent abuse without surveillance:

Invitation System (Trust Graphs)

Users invite others. Abuse traces back through the invitation chain. Bad actors get cut off—along with everyone they invited. Social accountability without identity.

Proof of Work

Computational cost per token. Prevents bot farms without collecting data.

WebAuthn / Hardware Keys

"Proof of humanity" via hardware authenticators. No biometrics stored, no accounts created.

Rate Limiting

IP-based throttling for basic protection. Stackable with other mechanisms.

Technical Architecture

┌─────────────────────────────────────────────────────────────────────┐
│                         Freebird System                              │
│                                                                      │
│   ┌──────────────┐         ┌──────────────┐         ┌────────────┐  │
│   │    Issuer    │         │   Verifier   │         │   Redis    │  │
│   │   (Rust)     │         │   (Rust)     │         │  (State)   │  │
│   │              │         │              │         │            │  │
│   │ - VOPRF eval │         │ - Token auth │         │ - Nulls    │  │
│   │ - Sybil      │         │ - Multi-     │         │ - Invites  │  │
│   │   checks     │         │   issuer     │         │ - WebAuthn │  │
│   │ - Key mgmt   │         │   federation │         │            │  │
│   └──────────────┘         └──────────────┘         └────────────┘  │
│          │                        │                       │         │
│          └────────────────────────┴───────────────────────┘         │
│                                  │                                   │
│                         ┌────────▼────────┐                         │
│                         │   TypeScript    │                         │
│                         │      SDK        │                         │
│                         │                 │                         │
│                         │ Browser/Node.js │                         │
│                         └─────────────────┘                         │
└─────────────────────────────────────────────────────────────────────┘

Implementation Status

Why Open Infrastructure Matters

Privacy technology that requires trusting a company is privacy theater. Freebird is infrastructure, not a service.

• Self-hostable: Run your own issuer. No dependencies on us.
• Federated: Multiple issuers can exist. Verifiers choose whom to trust.
• Auditable: Every line of code is public. Every cryptographic claim is verifiable.
• Forkable: Don't like our decisions? Fork it. The protocol is the product.

This aligns with Mozilla's vision of an internet that's open, accessible, and respects users. It aligns with NLnet's mission of trustworthy, open infrastructure. Privacy shouldn't be a product you buy—it should be infrastructure everyone can build on.

Funding Goals

Freebird's core technology works. Funding accelerates adoption and hardening.

Try It

git clone https://github.com/flammafex/freebird
cd freebird
docker compose up

That's it. Issuer on localhost:8081, verifier on localhost:8082.

# Get a token
curl -X POST http://localhost:8081/v1/oprf/issue \
  -H "Content-Type: application/json" \
  -d '{"blinded_element": "..."}'

# Verify it
curl -X POST http://localhost:8082/v1/verify \
  -H "Content-Type: application/json" \
  -d '{"token": "..."}'

Full documentation at github.com/flammafex/freebird/docs.

Standards & Prior Art

Freebird implements established cryptographic standards:

• IETF CFRG VOPRF Draft — The core protocol
• Privacy Pass Protocol — Related work from Cloudflare/Apple
• RFC 9380 — Hash-to-curve specification
• FIPS 186-5 — P-256 curve specification

We're not inventing cryptography. We're making existing, peer-reviewed cryptography deployable.

Team

Built by The Carpocratian Church of Commonality and Equality—a 501(c)(3) religious nonprofit building infrastructure for digital dignity.

Other projects: Clout (trust-graph social network), HyperToken (distributed simulation engine).