Hacker News Reader

Comment by vasco | Hacker News Reader

If you had asked me how much money you'd have to pay someone for them to let you scan their eyeball, I have to say I would've said way more than €35 fake euros stuck in an app. If anything it's eye opening (eh) how little understanding there is of the personal risk people are taking on.

View on HN

> If you had asked me how much money you'd have to pay someone for them to let you scan their eyeball

People paid companies like 23andMe actual money for the privilege of mailing their DNA. Getting paid to let a company your eyeball sounds like an improvement.

I think people pay these companies for providing them with information about their DNA, which is quite different.

Especially given that you can download your genetic data from 23andme. I am not sure if Worldcoin allows you download a copy of your iris data... no mention in their FAQ, at least.

But they provide so little information compared to the DNA you provide. You get stuff like "ancestry" signals which americans love in their quest for racial validation, but they get to connect humans to a point they can find the family of an unknown murderer whose DNA was found on a crime scene.

Which information is more precious overall, which is a call to action rather than a simple joke between friends "oh im 3% Banana".

People pay to get detailed photographs of their irises as "artwork", even in relatively privacy-conscious Germany.

I've done the scan. What personal risk do I have?

The money isn't stuck in the app by the way. I've taken out and changed to US$ about $100 and currently have $164 worth in the app and about $10 a week of coins coming in. Which is nice of them. Worldcoin is just another crypto coin like dogecoin or whatever.

Identity theft would be the first thing on most people's minds, particularly if iris scanning ever becomes more prevalent in the future and they get hacked or unintentionally leak your data, or impersonate you themselves.

Fair enough with identity theft but I think that applies to any company you have an identiy with - facebook, booking.com, banks etc. They could claim to be you in theory.

Also my id, I think, is just an optimism crypto address 0x93bf030f706e81197856e76c8a3b326640... with no name attached. You'll have a job stealing my identity with that, any more than it's easy to steal Satoshi's because you know his public bitcoin addresses.

I mean if you go to a credit card company and say I'd like to get a card in the name of some guy I don't know the name and address of but here's one of his public keys, I don't think you'll get far. Certainly not compared to getting my real name and address which is fairly exposed on the internet via phone directories and the like.

I don't think if say the photo of my iris's leaked online it would be much of a problem in the same way that the rest of my face is online and it's not much of a problem because no one accepts some photo off the web as proof of id.

One thing I think may be flawed is if I say hi I'm Tim, send me some money to the above address, then you can see all my other transactions to that address on the blockchain which breaks anonymity/privacy a bit. I'm not sure if they are going to fix that by say issuing disposable addresses but I haven't seen that so far.

What if iris scanning becomes the new "log in with your device", and what if the way worldcoin stores your iris scan is actually not encrypted?

I don't know why you're comparing a high definition full iris scan to random photo of you, they aren't the same things. The point is security is made of things you know and things you have, and eyes are hard to pass around, so someone being able to "have" your eyes to fool a scanner is useful for many classes of attacks, we don't need to know the full attack chains yet to know it's inherently a risk because it turns a thing you have into a thing you and Worldcoin and whoever worldcoin sells or gets hacked by - all have.

> ... what if the way worldcoin stores your iris scan is actually not encrypted?

Even if it's encrypted, if worldcoin gets breached in a particularly bad way (say root to their production servers) then the unencryption mechanism and keys could be leaked along with the encrypted data.

The point being that just because something is encrypted doesn't make it foolproof against everything.

> "There's a sucker born every minute" is a phrase closely associated with P. T. Barnum, an American showman of the mid-19th century, although there is no evidence that he actually said it. Early examples of its use are found among gamblers and confidence tricksters.

https://en.wikipedia.org/wiki/There%27s_a_sucker_born_every_...

Reply on news.ycombinator.com