Hacker News Reader

Comment by seanhunter | Hacker News Reader

This is interesting to me.

On the one hand "Proof of humanity" is an important problem and is surely only going to get more important as time passes. Bots are already better than humans at solving captchas.[1]

On the other hand I cannot conceive of giving someone my biometric data so they can mint some blockchain thing from it, and although I admit I wasn't interested enough to look into it beyond reading a couple of articles, I really don't see how this specific solution makes the situation better. Eg how do they know someone hasn't pwned me and then hijacked my special proof of humanity token to using it for their bots to "prove humanity"?

[1] https://arxiv.org/abs/2307.12108

View on HN

> On the one hand "Proof of humanity" is an important problem and is surely only going to get more important as time passes

Governments have been doing this for centuries (see passports, identity documents, birth and death certificates). Witnessing attempts by private entities repeated attempts to "solve" this problem and make a profit has shown me the limitations of free markets. Despite the complexity and sophistication of the implementation, it boils down to a record that's looked up by a trusted entity who attests the validity of the subjects identity, or not.

I don't like WorldCoin, but I don't like sending internet services my passport and birth certificate to prove to them that I am human either.

The actual problem - which is waiting for a solution - is undeniable. (This isn't often the case with cryptocurrency projects.)

> I don't like WorldCoin, but I don't like sending internet services my passport and birth certificate to prove to them

That's about the least-private implementation one could think of; I wouldn't want to send scans of my iris to random Internet services either! This would be the equivalent raw-data implementation for Worldcoin.

> The actual problem - which is waiting for a solution - is undeniable

The solution is the government providing an oauth-like service. Internet services would only get a token and only a limited set of PII you were shown and agreed to while authenticating (e.g. your name, email address, and/or whether you're a minor/adult).

No one can attest your identity without keeping a record of it - public service or not. IMO, having private enterprise do this merely increases the attack surface.

> I wouldn't want to send scans of my iris to random Internet services either!

You don’t. You generate some secure keys using iris data. You send the internet service a copy of your public key. They can use that to verify that you are human, but not who you are.

But a keypair is just a pair of numbers that satisfy some one-way function. If there's a way to generate the keypair from iris data from a human, then surely there's a way to generate an indistinguishable keypair using some fake data that plausibly could have come from an iris (ie it shares some of the same number theoretic and distribution properties) but did not. If that's the case, then the only part of the "proof of humanity" left to attack is to spoof the hardware so things think they are calling the iris scanner and getting a real key from a real human and instead they are calling the mock iris scanner and getting a plausible but not real key from a non-human. If the solution is something along the lines of "well we thought of that so a genuine worldcoin iris scanner has to sign the data to prove that it came from a worldcoin device" then I would bet you can get hold of a signing key using social engineering. If this thing was to take off it could be valuable to do so and many of the people operating the devices would be in countries with very low GDP per capita so it could well be in the realm of possibility to bribe your way to getting it.

I'm sure they must have thought about this but I don't understand the solution.

Each Orb has a private signing key that's generated + stored inside a secure element. For more info, search for "secure element" in the following sections of the whitepaper:

https://whitepaper.worldcoin.org/technical-implementation

https://whitepaper.worldcoin.org/advancing-decentralization#...

> The solution is the government providing an oauth-like service.

This sounds great as long as you live in a strong democracy with trustworthy institutions. A lot of people don't.

Do those people not have physical identity documents issued by their non-democratic governments? What is particularly dangerous about having the same governments handle online identity for situations of thr citizens choosing? It would obviously be inadvisable to use government auth when logging into protest-against-repression.com

I have never been asked anything like that, except when it was for legal compliance (such as opening a bank account).

The only exception being meta a decade ago, to which I obviously answered by deleting anything meta related bar Whatsapp.

With how AI is going, attestation will become necessary for many social interactions we take for granted today by assuming there is a well-intended human in the other end.

If you're hiring, or looking for a new job, the odds of you being tricked/phished are getting worse by the day. I've read stories of employees get interviewed for fake jobs as a long-con to get banking details, and employers interviewing a persona that's fronting an offshore dev team, or people who don't have work skills and aim to pick up paychecks until their dismissal is processed.

I bet you have filled out a captcha or two.

It's obvious that captchas will need to be replaced by something else, no?

Captchas are there to defeat spam. You don't need to identify someone as human for that; you just need to make it expensive to post, e.g. through proof-of-work.

This isn't about proving that you are human, it is about being able to map your iris to the identity on government-issued documents.

In essence: good luck trying to exit/enter a country/location with access to the iris database that already mapped your identity after KYC for your bank account.

You are now living inside "Minority Report": https://www.youtube.com/watch?v=PPDYh9EpbmA

That's not at all how WorldCoin works. And I don't want to be a WorldCoin defender here, I don't support it.

I wonder if an eyeball scan is really proof of humanity.

This may be a dumb question, buy why could someone not simply create an AI-generated iris image and fool the orb into thinking that is a unique human?

First of all, it's very hard to make a printout that looks like the real thing to a camera. Images stored on a computer capture a lossy representation of what the camera actually "saw".

Secondly, I believe that the protocol is based around the idea that the operator is trusted, i.e., they won't allow such uses of the orb. If an operator isn't trustworthy, I guess there needs to be a way to revoke the validity of all their scans.

What if you print it to a custom contact lens similar to those cosplay lenses? The operator wouldn't even notice

They have human operators too to help you stop using AI-generated photos, or your pet cat, or your kids - there's an age limit.

The main purpose of the scan it to check for uniqueness so you can't keep going up and get 50 accounts.

Preventing such attacks is one of the main reasons why custom hardware is required. For more info, search for "spoof" in this section of the whitepaper:

https://whitepaper.worldcoin.org/technical-implementation#wh...

In fact, this is commonly done. There's an entire trade around having people scan their iris and you (the buyer of their biometric) keep the resultant token. I think what I read was around the more rural areas in Africa. I'm not referring to the "official" practice by World Coin themselves where people are recruited to scan (in Africa metro areas) and the participant actually get the tokens. There's also this underground trade in iris scans.

They don't, but it's harder to kidnap someone and use their eye, as opposed to steal some other piece of identification. If you would turn it around and imagine a world without paper passports and government issued id's - what would you use as unique identifier for a person?

> If you would turn it around and imagine a world without paper passports and government issued id's - what would you use as unique identifier for a person?

I'm not sure... but I'm also convinced that 'private corporation issued id' isn't fundamentally superior to 'government issued id' and has some challenges in terms of accountability.

Being pwned does not solely mean having access to your eye in this case, also why should I trust a corporation more than a government?

> it's harder to kidnap someone and use their eye, as opposed to steal some other piece of identification

Is it? I use my eyes a helluva lot more than I use my government issued SSN. In fact, I've only taken my physical SSN card out of storage once, but I stare at random (potentially camera equipped) stuff all day. Of course you can still steal it from me by pretending to ask for ID, but that's true of my eye-print as well.

Pubic key of their choosing.

Reply on news.ycombinator.com