Hacker News Reader

Comment by hdevalence | Hacker News Reader

> by mitming the bus between the iris scanner and the rest of the unit, and making it report fresh unique scans

Hmm, I wonder if the worldcoin team also thought of that possibility?

(Yes, they did, the iris processing is done inside a hardware enclave so that the obvious attack is not possible)

https://whitepaper.worldcoin.org/technical-implementation

I am broadly anti-Worldcoin but it is reasonably competently executed at a technical level. It would be good to understand what they actually did before declaring it to be impossible.

View on HN

Hardware enclaves are never 100% impenetrable, it comes down to making the cost of attack greater than what an attacker expects to gain. Traditional card payment terminals use nominally secure hardware and yet struggle with that tradeoff to this day, and I'm not convinced WorldCoin will do any better.

The SoC they're using, the Jetson Xavier NX, is a cousin of the very thoroughly pwned (secure enclaves and all) TX1.

Further, they don't describe how the busses connecting the sensors to the SoC are encrypted and/or authenticated, which leads me to believe that they are not.

Intel gave up on shipping SGX in consumer devices because (imho) shipping secure enclaves directly to "adversaries" (the consumer being an adversary under the SGX threat model) proved too difficult to maintain.

They talk about a future bug bounty program - I'm certainly intrigued, and if the up-front hardware costs aren't too high I might give it a go.

> (the consumer being an adversary under the SGX threat model) proved too difficult to maintain.

This is what's wrong with so much of this "security" tech. It's not for our security but for that of the businesses and their business models behind it.

> I am broadly anti-Worldcoin but it is reasonably competently executed at a technical level. It would be good to understand what they actually did before declaring it to be impossible.

+1 to this. I'm very skeptical of the project (even though I know some of the people working on it), but the problem space is extremely hard and they're giving it an actual shot. If you can think of a potential problem in 5 minutes, I guarantee you that they've thought of it too.

I'm sure they are. But I'm not worried about them failing. I'm worried about them succeeding.

Can't I just bypass it with some contact lenses that distort the scan and make it unique?

Reply on news.ycombinator.com