Sam Altman Wants Your Eyeball | Hacker News Reader

Sam Altman Wants Your Eyeball

privacyguides.org

153 pointsChiptuneIsCool161 comments

I'm an ophthalmologist. I look at irises all day. People's irises change over the course of their life. Sometimes dramatically if they have some kind of pathology. Are they updating their model periodically? What keeps someone from getting locked out of their crypto gains if they develop an iris nevus or have cataract surgery or start on flomax?

Thanks for this interesting point of view. However, it may makes sense to consider whether the gap you point to can be reduced significantly with AI, by training it separately with aging eye data using existing medical data independent from the general iris pool. I have no idea how realistic that would be personally.

I wondered this with things like FaceID. In my head, every time it unlocks it’s tweaking and tuning the what it knows to be the user, so it can adapt as a person ages, goes through weight changes, etc. However, in practice this may not be the case, since there is an easy backup and a person can re-register pretty easily.

On the topic of eyes, my dad recently had surgery on his eyes and they did one at a time, for obvious reasons. That could be a way to transition. Register both, have surgery on one, let it heal, register the healed eye, have surgery on the other, then register that. Always using the good and registered eye to authenticate. But this isn’t realistic. It requires way too much forethought and planning, when people’s minds are elsewhere.

Are you willing to gatekeep you wealth behind an AI that might hallucinate that your iris has changed more than it actually has?

Why would you assume I'm in any way partial to this technology? If AI is being used to tackle medical domains, it stands to reason they would try to use it to overcome what the GP considers to be important constraints, especially since the guy in question also runs an AI company.

And what part of "I have no idea how realistic that would be personally" implies that I think it can be done without the danger of hallucinations.

lol

I presume that you would want your crypto gains to require “proof of identity” to access, not just “proof of humanity”, which is what World provides.

Also, once you have generated keys with your eyes, you use the keys, not your eyes, as tokens to validate your humanness.

The iris thing is only used to open an account to stop you getting multiple accounts. After that access is private key. Maybe I'll try going back for a second account!? My irises may be different enough 2 years on?

Meanwhile, in reality, banks have solved proof of humanity, identity (KYC), and financial services for a long time. Any account in the world can be proven human by making a debit/credit card transaction from a card with a matching name.

For the first time, you can now give your biometrics to OpenAI to do nothing more than you already can. This is just a pure cult of personality.

I can only assume that you don’t work in financial technology if you believe that KYC is a solved problem.

Proving authenticity in an increasingly diasporic society is difficult.

We should seek to either reduce or embrace entropy in the design of our systems. You either want systems which prove there are no Sybil attacks, or you manufacture halls of mirrors.

This is a continuous battle, there’s no panacea here, even the eye scan has threat vectors.

Calling KYC a solved problem is ludicrous.

It depends what you mean by solved.

Banks tend not to over engineer things. KYC can be seen as a 3 sided trade off: cost of KYC infra/process/etc, lost revenue from denied business and fines from regulators.

They (the banks) don’t really care about the social goals of KYC, they just try to best optimize for expected value in the trade offs.

The regulators understand this, and are basically fine with it. They have their own trade offs they are balancing.

Both sides mostly find and equilibrium.

Even considering the social goals there's no need for a 100% solution. We only need to stop most fraud and reduce the impact of the fraud that does happen to a sufficiently low level.

One of the more important goals isn't to directly stop fraud but instead to provide tools that give end users results that scale with the amount of effort invested. The level of risk should be a tradeoff that the end user is able to make.

Current solutions mostly allow for that but certainly have some rough edges.

I’ve been working on KYC recently, curious to hear what the problems with it are in your opinion?

Synthetic identities, probably

Speaking as a fraud detective, it appears to be completely ineffective.

Well yeah, you're only looking at the instances of fraud. You're not investigating fraud that never happened because it was prevented, that would be impossible.

KYC and KYCd accounts are a high volume item on the grey / dark net

it appears to not really do much at all

I think thst the goal of KYC is to get information about the entity opening an account, to e.g. make sure it isn't used for money laundering. Whether this account gets stolen later is out of scope for KYC.

right so its useless?

No, it's not: you still want to make it as hard as practically possible to criminals to launder money.

Worldcoin is supposed to be anonymous - you don't give your name. A theory behind it was on things like HN you could show you were human without having to do a KYC id proof, though that never took off, at least in two years I haven't come across it. In practice it works as number go up crypto ponzi like most of that field.

"Any account in the world can be proven human by making a debit/credit card transaction from a card with a matching name."

A reminder: neither the Visa nor Mastercard payment networks have any ability to match, or authenticate, cardholder name.

We pretend that they do and we're used to merchants and operators (and web forms) insisting on exact matches of cardholder name ... but it's all a fiction.

As long as you get the digits - and the supporting number/zip portions - correct, the transaction will run with "Mickey Mouse" ... or even "A B" (initials).

This is in contrast to AMEX whose network does have cardholder name verification.

Interesting, I didn't know about this. Do you know why web forms require the name as well then? Is it just to give some additional sense of security to the user or try to scare scammers? Do you have some resources explaining the inner workings more in detail?

Even if you 100% believe in your heart that Altman would never do anything negative with these scans that doesn't mean someone else won't if/when they get access to them. People may trusted 23andMe with their genetic data but now no one knows who will end up owning it and why the buyer believes buying the data is profitable.

https://wydaily.com/latest/regional-national/2025/05/08/23an...

Every company is exactly one CEO away from doing anything none would ever expect.

Not only companies sadly.

Most companies are exactly 0 CEOs away from that

When talking about government surveillance, people often ask some version of 'well, if you're not doing anything wrong, what are you afraid of?'. My response is always, 'It's not that I don't trust our current government, I don't trust all future governments that come after this one'.

I hope given the recent events of having some hired thugs rifle through government databases (including the OPM, which supposedly has very sensitive data from security clearance applications), that maybe letting people collect and store data on you should be avoided at all cost.

The older I get, the more I understand the stereotype of the eccentric former techie who no longer wants anything to do with modern technology or society

> 'well, if you're not doing anything wrong, what are you afraid of?'

I like to go with the simpler "I hold lots of sensitive data for people who trust me: my family, my friends, my employer. One would have to be a sociopath to disclose other people's secrets without their consent."

> "I hold lots of sensitive data for people who trust me: my family, my friends, my employer. One would have to be a sociopath to disclose other people's secrets without their consent."

Oh, that's a good one. I'ma totally steal that...

I see no reason to trust the current government, nor any of the previous ones in my lifetime.

Why would people distrust governments more than companies? I never understood that part.

Because the government has more power over you. Thus, they deserve more scrutiny and suspicion.

I guess the point is whether it's a private company collecting your data, the good government, or the bad government that gives the access to your data to random non-vetted individuals for fun, the end result is the same — your data ends up with people who have the ability and desire to cause you harm.

Except the ostensible motive of the government is to serve its people, whereas the company’s motive is either those of the people who control the company or profit.

Even then, if the government is weak than the ‘more power over you’ is simply false. Maybe the magnitude of the power is more for a government, but companies apply their power with much more frequency.

> the ostensible motive of the government is to serve its people

I see your history teachers did a poor job. My condolences.

Personal attacks are not welcome here. Btw, "the apparent motive of the government is to serve its people" still stands even if the government does not serve its people.

  > the ostensible motive of the government is to serve its people

Your conclusion doesn't seem to match your usage of "ostensible". Yes, /democratic/ governments claim to serve its people, but do not necessarily do so. You should always be suspicious and critical of your government in an effort to ensure that the stated goal and actions are aligned. You should always be treating your government as adversarial. In fact, if you read a lot of the writings of people influential to the founding of the US you'll find that they were explicitly trying to design a system where they say its biggest adversary was itself.

But also, there are plenty of governments that do not even pretend to serve its people. They are completely self-serving and transparent about that fact. You never know when one is going to turn into the other but often going from ostensibly benevolent to explicitly malevolent is relatively mild, but gaining back freedom usually requires a lot of bloodshed. There's always exceptions, but this is common. The wort part is that people frequently vote in the malevolent leaders. Democracies can turn into autocracies without spilling a single drop of blood. I'm unaware of the reverse ever happening.

> ostensible

That's a very load-bearing word there.

Isn't it the case that companies are hiding in the government's shadow? Who enables a government to exert power over its people?

> Who enables a government to exert power over its people?

Mostly the police and military, not the companies.

https://en.wikipedia.org/wiki/Regulatory_capture

True, but the government also has more accountability.

Exhibit A: freedom of speech. Public institutions have a very high bar they have to meet to ensure freedom of speech. The private sector has nothing of the sort.

You can be banned or censored for just about anything in the private sector. So when we move really important stuff to the private sector, that can be a problem.

In action: payment processors, which provide essentially public infrastructure, censoring immoral or profane content, such as pornography.

I distrust both, but the government is generally capable of much more significant threats to me. Notably it is the government which prevents companies from posing similar threats (at least currently, in the west).

Sorry, I was only giving government surveillance as an example, I trust no one to protect my privacy, government or corporation.

I mean, I dont want the private details of my life exposed, illegal or not. Who does

I know, it's not as if I just let the cops walk through my house whenever they want. I just don't understand the "I've got nothing to hide" defense.

It is insane to defend Sam Altman here, but it looks to me that World goes out of their way to not to link the biometric data to identity or even save it. Sure you need to trust the black box but if the company gets taken over there is no data to for the new evil owners to access.

Same happened with Komoot, a popular German outdoors app. They have millions of tracks and user profiles, it's also a bit of a social network.

From one day to the next they sold to the Italian "developer company" Bending Spoons.

That company acquired Brightcove a few months earlier and several other services like Evernote, Meetup, companies which have nothing to do with "outdooring".

From one day to the next they got access to my 13.000 tracked km, 800 hours of data. My profile is set to private, but now I have to assume that all this data will be sold to advertisers. "Anonymized".

It's kind of different in that with 23andMe they know your name and genetic data. With Worldcoin you don't give your name and they just get a photo of your eyes.

> they just get a photo of your eyes.

this comes across as if you are attempting to downplay the importance of this biometric data which is weird considering Altman is paying to get access to just a photo of your eyes.

They are more paying to get you signed up to and using their payment system. The eye thing is not so different to most online banking wanting to see photo id and sometimes a selfie vid that matches to check who you are. Except they get less info - just the image, not your name, dob and id number which banks want.

So anyone who can scan your eyes can get into your bank account is very different compared to 23andme where you can give fake information as a name, buy a test with cash and they collect limited data that isn't worth much to advertisers. The first opens up many risks and surveillance opportunities that are different from the second where pooling of dna can link you to physical crimes or paternity confirmation where dna is found.

The first wants one data breach anywhere to last a lifetime and the second is a bigger media story because people believe what we can do with the dna 23andme collects is more than reality.

No, the system doesn't work like that. The eye scan is just to check you don't get multiple accounts. After that it's like a crypto wallet with access by private key.

no, there shouldn't be a photo, only a hash, which is useless by itself.

I don’t think it’s the same, the eye scan isn’t linked to any other PII so all they know is “this is an eye scan of a human being.” What kind of abuse could be done with that data? I don’t think they even store the scan, they store a hash of it.

And on the other hand, I do wish there was a way to distinguish real humans from bots on the Internet. I think it’s only a matter of time until the web becomes useless thanks to AI. What’s a better solution?

I would trust Apple, though.

They did that here in the Phillipines and they exploit the poor. They give money for people to allow them to scan their eyes. These people do not know the consequences of what they are doing.

What are the consequences?

That you can be identified, cataloged and controlled, potentially. We have the technology to create heaven or hell depending on who controls it…

Is it certain that impoverished people would weigh those potential consequences more heavily than being paid today?

For that matter, do we expect that the impoverished people the gp commenter refers to would resist, say, government-led efforts to compel their biometrics from them? [0]

[0] e.g. https://www.csmonitor.com/World/Asia-South-Central/2022/0425...

Everyone deserves food and political freedom in my opinion. We could probably do it too if we actually tried.

I agree! I think what rubbed me was the idea that the people taking Altman’s deal “do not know the consequences of what they are doing.”

Down that road lies a paternalistic flavor of charity, a spirit of “protecting them from themselves.” And that seems to evoke the idea that poor is the same as ignorant. That there’s only one correct value to assign to your biometric data, and anyone who values theirs differently must do so because they’re ignorant, rather than just having different values from you.

We can advocate for political freedom, material security, and just societies—and probably get better results—if we don’t model people as helpless or uninformed or without agency just because they’re in a socially vulnerable position.

> We can advocate for political freedom, material security, and just societies—and probably get better results—if we don’t model people as helpless or uninformed or without agency just because they’re in a socially vulnerable position.

Sam Altman has a far greater capacity for agency than an impoverished Filipino signing away his biometric data for the price of a Domino’s pizza.

Poor people are not ignorant, they are desperate though. And that's why using their private data is despicable.

People are selling things that should be inalienable, ostensibly because they really need to. The most immediate, glaring problem is that they are poor. This can be answered:

> > Is it certain that impoverished people would weigh those potential consequences more heavily than being paid today?

The answer is: No, it is not certain. Why? Because they are poor.

Poor people have less agency. That’s just a fact. And they are being preyed upon by Altman. Making this about whether poor Filipinos are making an informed agreement with an AI bro is tone-deaf.

If I tell you to give me your money or I'll kill you, by your reasoning it is good for you that you gave me the money. You are completely ignoring the situation that I set up where you had to do a bad thing to protect yourself from an even worse thing, and that you'd be even better off if some guy killed me so that I couldn't kill you.

Poor people would sell a kidney if the otherwise consequence is starvation.

That is not a good measure for the willingness of a decision

True, but does that mean the solution is to force the starvation because their choice to alleviate it was insufficiently willing for our tastes? At least they’ll starve with two kidneys, and we hope the would-be kidney recipient can get by on dialysis a while longer?

By all means let’s engineer a world where people are never faced with crappy choices. But people are living in the present, not the glorious future: Taking away the choice in this case doesn’t seem to fix the situation, and deprives people of a benefit they’d accept if you let them choose.

But laying the cornerstone for a dystopian future doesn‘t help either.

By your logic we shouldn’t fight child labor or drug trafficking.

All that feeds people too.

> True, but does that mean the solution is to force the starvation because their choice to alleviate it was insufficiently willing for our tastes? At least they’ll starve with two kidneys, and we hope the would-be kidney recipient can get by on dialysis a while longer?

That’s not what anyone who objects to this thinks and you know it. Anyone who objects to people selling away something dear because they are poor want (1) those people to not be poor and (2) those other people to not prey on them. People are outraged when people are forced to drink dirty water—they are not outraged at desperate people for drinking dirty rainwater.

It’s a false choice.

> By all means let’s engineer a world where people are never faced with crappy choices. But people are living in the present, not the glorious future: Taking away the choice in this case doesn’t seem to fix the situation, and deprives people of a benefit they’d accept if you let them choose.

I’m Sam Altman and I approve this message.

not that it makes it any better, but you're saying that like it's impossible to do now what you're describing. you're already in the system, whether you like it or not, both public and private one(s).

Is that any different from reality now? At least they throw a few dollars at you for it.

I suspect that my face has been recorded and linked to my profile at several stores. Palantir or similar have probably scrapped all of the internet looking to link a face to an identity.

Real ID just because fully required for domestic air travel.

Has your eye been recorded at the store?

What does a picture of your eye allow that fingerprints, face scans and other passport biometrics that have already been collected and linked do not? Honest question.

Yes the government and or private companies don’t have a copy of my fingerprints and I’d honestly rather they didn’t have pictures of my face on record either. Just because we’ve become accustomed to these breaches of our privacy doesn’t mean they are good.

> Just because we’ve become accustomed to these breaches of our privacy doesn’t mean they are good.

100% this. The fact that the governments and corporations have enough information at their fingertips to identify people from chance photos is, IMO, not good.

However that genie is out of the bottle and there is no way to get it back in. Cameras are ubiquitous and one can get a decent quality fingerprint from store camera footage. Any time I do eye exam the doctor takes an eye scan and uploads it somewhere. Passport biometrics are becoming required and most countries will match it with a face scan on border crossing. And this is just a tip of the iceberg.

I would like to be wrong, but IMO the only solution to the government being able to track anyone they like (or, rather, do not like) is via legislation, not technology. And with various 3-letter agencies being routinely allowed special access "because security" this path is unlikely to be viable either. My 2c.

> And this is just a tip of the iceberg.

My teeth were 3D scanned at very high resolution by my dentist the other day. He is leading edge and is now doing it for all patients (was previously only patients with replacement needs). I assume the information is going to some US provider somewhere.

Iris scanning and lots of other biometrics like capillaries can be done from a distance (e.g. iris scan at airport security in NZ).

umm.....

you should check on that. a lot of countries have pushed fingerprint databases for a while now.

> that have already been collected

That would require a big "source" for this claim.

Feel free to downvote me, please provide a source because it's false so far.

Fine, I will bite at this sealioning

Recent month-ago story of police department looking to trade its mugshot face database for access to facial recognition software: https://news.ycombinator.com/item?id=43853297

Government directly looking to share biometrics.

In the EU it is mandatory to provide your fingerprints and a biometric scan of your face to the government. The data is stored on your government issued identification card.

That train has already sailed. We can be identified and found in any number of ways already. Our kids will not imagine any other way.

As you say, the future can become heaven or hell.

The consequence is that you can have an actual fair global economy and better wealth distribution

Renders biometric auth pointless.

> These people do not know the consequences of what they are doing.

They might have known the consequences, but money is money. I feel like for 99% of people there is a certain sum of money for which they will give into pretty much any kind of data collection. Even I'd give into it if they gave me enough. The bar is just higher, but there does exist a certain $X for which I would give in as well.

Most times I’ve been biometrically catalogued, I wasn’t paid for the privilege. The government just kind of said I had to, and I wasn’t in a position to argue.

I guess I am in some sense compensated by the data brokers who psychometrically profile my internet use and resell their conclusions—but “free ad-supported internet content” isn’t exactly fungible cash…

How much would you want for your genome?

I haven't thought about an exact number, but I'd probably cave in for $20M.

I'd finally be able to afford a house, never have to work for a toxic company again in my life, and could afford various preventative medical care without relying on insurance.

Basically, "life-changing" money.

Interesting, thinking about it - makes sense the money has to be life-changing, as you’d be selling the data of generations - or maybe there is some kind of formula that can be derived from gene distribution and kinship (you pass on 50% of your genes, etc.)

Why are these rich assholes so obsessed with tracking everyone?

> Tools for Humanity bragged about many large partnerships that should make any privacy advocates shiver in dread: the Match Group dating apps conglomerate (Tinder, OkCupid, Hinge, Plenty of Fish), Stripe, and Visa are some of them.

Visa and Stripe being involved in this should indeed make everyone shiver and push back against this. Altman is not a good person and this company has already had its unethical practices exposed[0].

[0] https://icj-kenya.org/news/worldcoin-case-postponed-amid-con...

Control. You have to have a good inventory to apply and audit controls.

In the AI driven future we are heading into, telling the difference between AI-bot and human might become a valuable good.

Why? And how would that even work? Just because an online account is tied to a verified real human doesn't guarantee that the content isn't coming from an AI-bot.

The “person” could just be copying and pasting AI output. Eye scanning can’t stop that at all

Maybe it would allow you to rate-limit and/or ban by the human, which is probably more effective than banning by IP address.

(Obviously Worldcoin is shady as shit, I'm not defending it.)

It's a blockchain, so you can keep permanent record of what a person is doing and when and where they got caught violating the rules. It won't stop the infractions from happening at first, but it will make it very easy to avoid them happening again. And if this gets widespread, people might think twice before risking their blockchain personhood certificate.

You're missing the point. How would they get caught violating the rules in the first place? You (and the HN admins) have no way of knowing whether I typed this comment in myself or an AI bot used my account to do it.

It will be trivial however to hold you liable for the content no matter its source, when it is tied to your irl identity instead of a pseudonym.

So they're going to get rich from introducing both the problem and its nightmare of a solution.

Or they just want to sell us minority report style ads.

Because they have to be able to sell you the cure to the disease they created: pretty soon nearly all content online will be AI-generated, and the only way you'll be able to tell if you're talking to a human is with cryptographically-sealed boot chains, verified with remote attestation, and with this eyeball device at the end to make sure there's a human there.

In the future:

Easy Remote Job Opportunity! Pay is $1/hr. Perfect for retirees, disabled, and even kids! Requirements: have an eye ball. Duties: whatever you want, except when this device beeps, look into the camera.

Is Amazon's Mechanical Turk or whatever paying people to solve captchas still a thing?

I didn't even think of this workaround. Genius in its simplicity.

It's about time my dog got a job.

> the only way you'll be able to tell if you're talking to a human is with...

Or the tried-and-true method of trusting only friends, friends of friends, recommendations from friends, etc.

Yes but the point is not to ensure that you know that you're interacting with a human. The point is for whoever paid for the ad to know that a real human is seeing it (and not, for instance, and AI in a docker container).

That's a good point, thanks. I interpreted "sell you the cure to the disease they created" as selling it to the public, but I'm sure advertisers would love to make Fifteen Million Merits a reality.

It makes me think of the idea of legibility[1]: it's hard to understand incredibly large and complicated systems, so the solution is to simplify, and then enforce that simplification. From a high-level perspective, it seems reasonable to surveil everyone, to help them. I think someone really can delude themselves into thinking that it's necessary, utilitarian-style.

Now, if we designed technology for humans, we'd realize that most humans have local networks of trust. E.g. I talk to my friend in person, she tells me her discord handle, now we've established trust. In addition, trust is something that's gradually built, not given all at once in a EULA[2].

[1]: https://www.ribbonfarm.com/2010/07/26/a-big-little-idea-call...

[2]: https://ruben.verborgh.org/blog/2024/10/15/trust-takes-time/

Information is a prerequisite for manipulating the masses. The writing has been on the wall on that front since at least Cambridge Analytica.

Hopefully everyone who handed over their DNA to 23andMe will remember how that ended before they hand over their iris to Sam.

They haven't seen any impact yet. Nobody is rejecting them from insurance or job offers yet.

It's worse with 23andme, too, because the blast radius is all of your relatives that didn't take the test at all.

I did the worldcoin scan thing a couple of years ago and it's all quite jolly. The article is a bit scaremongering. Re:

>Simply put, the premise is this: scan your eyeball, get a biometric tag, verify yourself, buy our apps (and cryptocurrency). ... Minority Report style technology

it's not really like that. They take a photo of your eye to check you are a new person and not someone who has an account already, then give you an account which is like an anonymous crypto wallet with a private key. You never do an eye scan again in normal use. They give you free crypto/money rather than you needing to buy anything. I've been given ~$300 - it fluctuates a fair bit with crypto prices.

I recommend it to anyone who's curious / positive about new tech.

> I recommend it to anyone who's curious / positive about new tech.

What does this have to do with curiosity or new-tech positivity? Nothing.

Give biometric data, get fluctuating ~$300. You did nothing else than sell something you have. I'm not judging.

how will we solve distinguishing real humans over bots online?

It it's our goal to solve this issue via authentication, then we might as well let the government authenticate us, instead of Sam Altman.

<< I recommend it to anyone who's curious / positive about new tech.

I would ask that you elaborate a little more. I am an example of one. I like LLMs, but I cringe internally and externally at times at some of the things people seem to want to use them for ( and I just saw a presentation that basically said the equivalent of "add AI here, happy sunshine leaves there". And how? Magic. Nobody knows. ). I like crypto, but it is impossible to not see million rugpulls, scams and so on out there. I like technology, but I am very, very aware of the issues with basic human nature.

I guess so. It's pretty similar to getting a crypto wallet and some altcoin. I guess whether you find that interesting is down to the individual.

Another thing - I just logged in and they have mini apps in the world app including one paying 61% interest to deposit your worldcoins. It's like a whole ponzi-economy in there!

Biometrics are not a viable solution to the sybil problem.

The more biometric tech converges on the ability to get a cryptographic hash of one's body, the further it retreats from the kind of thing that a layperson will trust. You end up with a root of trust that <1% of the population can verify and then you end up asking 100% of them to rely on systems built on that root. You're never going to be able to convince even a majority of people that some clever hacker hasn't cracked an iris scanner and associated millions of fake ID's with millions of AI's for scam purposes.

It needs to be the kind of thing that lets Alice assert that this key goes with Bob just after she shook Bob's hand in meatspace. Something where, in order for Bob to have two identities according to Alice, he'll have to meet her in meatspace twice and manage to have her not notice that she's already met him once before. PGP key signing parties were pretty much there, they just came too early (and not enough work was done to teach the masses about them).

The web becomes more of a dark forest with each passing day. Eventually the cost of maintaining your part of the trust graph will be lower than the cost of getting screwed by some root of trust that you can't influence or verify. I'm sad to say that I think the point where these lines cross is significantly down and to the right of where we are.

> PGP key signing parties were pretty much there, they just came too early (and not enough work was done to teach the masses about them).

I won't dispute that PGP key signing parties coupled with government ID work very well for certain very specific usecases such as validating distro maintainers.

However for more mainstream and widespread uses that never occurred, what about work on the tooling? I've yet to see a web of trust implementation that really felt like it was properly generalized, scalable, and intuitive to interact with.

Case in point, if you wanted to implement a distributed code auditing solution on top of git and signed commits, what library would you use for the web of trust graph calculations? And would key signing parties be a usable root of trust for that with the current state of the software ecosystem? My personal view is that both of those things are woefully lacking.

I'd agree that they're both woefully lacking, but there's nothing fundamental preventing them from being successful, it just hasn't been done yet because our existing institutions are not yet degraded to the point where that juice is worth the squeeze.

Biometrics, on the other hand, are flawed for in a much more fundamental way.

Biometric data is valuable. Assuming that Musk's DOGE crew copied data obtained from US gov agencies, they may have also obtained biometric data of EU citizens. At least some countries have shared citizens' fingerprints with the US. Not just Visa Waiver Program applicants' but as I understand, previous government of Poland made a deal to share all citizens' fingerprints. And these are collected from anyone renewing their government ID card.

> previous government of Poland made a deal to share all citizens' fingerprints

This piqued my interest, but I couldn't find anything. Do you know where I could find more information about it?

Sadly, I'm unable to find specific documents confirming it. AFAIK, Poland agreed to biometric data sharing with the US Office of Biometric Identity Management in exchange for loosening travel requirements. That said, US seems to be pushing[0] for more such agreements.

[0] https://www.statewatch.org/news/2023/august/eu-and-usa-ploug...

You got me thinking and I’m not sure my fingerprints or any other biometric data have ever formally been recorded by the federal, provincial, or local governments.

In most cases the most biometric data is your photo and I guess height?

So beginning to normalize the collection of eyeball data as a thing is a pretty significant escalation.

In EU, obtaining an identity card needs one’s recent biometric(important!) photo and certain finger prints. Not sure about US.

Also where I work, to enter certain facilities, I also need to not only scan my badge, but also my fingerprint or sometimes palm(may sound absurd but I am sure some of you work in same sector).

> In most cases the most biometric data is your photo and I guess height?

As I mentioned - Polish id renewals require fingerprints scan and this data was likely shared with the US Office of Biometric Identity Management.

Where it comes to passports, fingerprint scans were required for years and in Poland (and I'd guess all EU passports) there's a low quality black and white photo printed inside, but the card/book has an embedded NFC with a higher resolution color photo. Whenever airport security takes one's passport, they swipe it over NFC reader and compare your face with a higher quality version than you see on the physical item, which usually is low quality photo crossed with anti-forgery Guilloché[0] lines. Feel free to read your passport and id with a raspi/arduino and NFC reader :)

[0] https://en.wikipedia.org/wiki/Guilloché

They did that in Kenya and now a judge has ordered that they deleted all that data https://www.financemagnates.com/cryptocurrency/worldcoin-ord...

Which I'm sure he absolutely totally did. Trust him. Just like US judges telling Elon and DOGE to delete treasury data. I'm sure they did it, scouts honor!

Aside from the issue of biometrics not being covered by the 5th amendment (so I won’t use them for login purposes), I’m hesitant to arrange incentives such that melon baller based crime is lucrative.

This whole idea doesn't make any sense. Someone with a world ID could still be running AI agents on their behalf with their private key, or use stolen / bought keys from other people. On the other hand, Sam Altman could be running millions of fake personas, because they can generate keys from thin air. Also, Sam Altman would have the power to invalidate your keys, or the keys of people he doesn't like. It would be an absolute catastrophe if this system was used for voting or something important.

Something I don't understand is how is that so bad? Even today one can buy passport data, social security numbers etc on black markets leaked by government employees in most countries. Once they start using more biometric data I'm sure it will be leaked as well.

If we assume that all this information is permanently available in a public blockchain, how does it change anything for society really? I can think of security checks becoming better, what are the negative possibilities?

Justifying what Worldcoin is doing by comparing them to black market leaks isn't helping their case.

I'm not justifying Worldcoin and I don't know all the details about what they are doing.

My realistic assumption is that all this data will become public one way or another, so I'm trying to understand how we can make sure it can't be abused.

Why would anyone want anything to do with Sam Altman to have control of it though?

At least if it's open, access is equal.

He can chortle my (eye)balls!

Anton doesn't call me anything. He grimly does his work, then he sits motionless until it's time to work again. 4o could take a page from his book.

https://en.wiktionary.org/wiki/chortle

Altman is evil to want everyone’s retina scan but he will probably get it because most people don’t care anymore.

The article describes him targeting the most vulnerable to get his first 500k users. It's not that people don't care it's that they are powerless in the fact of a well-funded adversary.

I'm always struck by how sci-fi writers, in a way, act like prophets. It's as if common sense or imagination keeps pointing us toward the same outcomes. As strange as it sounds, if we don't wipe ourselves out, we somehow already know what the future holds.

This is the same guy who worked at OpenAI because he "loved" what he does and he wasn't doing it for money. ( Until this year obviously ;) )

P.S. Not blaming him for this behavior, probably I would also change my mind immediately if someone offered me 7% of $300B

Do you really think everyone out there is willing to be a sell out?

Nothing wrong being a sell out - except when you claim to not be one.

I clearly said: "probably I would", I didn't generalize it to everyone

Absolutely. Everyone has a price.

Speak for yourself. I don't agree with your idea on prostitution.

He already had enough wealth that he was in a threshold where it wouldn't matter if he got a few more billion if that the was the lifestyle he was willing to lead. There isn't a magical kind of sugar, or drug that's available to a multi-billionaire but not someone with 100s of millions.

If somebody is trying to get billions, they're doing it because they're the type of person that wants to be a part of politicis, and a power player. That kind of person was never going to just give up the opportunity to make more money and gather more power to do more things that they see as neccessary and as good.

What are you referring to with "until this year"? There was a report last year that Sam Altman would receive equity in the new for-profit, but he denied this, and the recent restructuring post makes no mention of it.

So this is the future-billionaires won't just sell us services, they'll trap us in entire ecosystems they control. I'd be more surprised if X doesn't eventually turn into one of them in recent future.

So where's the line? What as X not yet done to make you suggest that it is not already the kind of trap that you're describing?

They are not wanting to scan my retinas. For now. They are approaching it more from the bottom.

hey atleast it is a for-profit, so no chance of that particular rug-pull.

"Tools for Humanity (TFH), a for-profit company co-founded by Sam Altman, Alex Blania, and Max Novendstern in 2019."

Nein.

No.

terrifying now, common place in 10 years.

like fingerprints or facial scans

Speaking of Dickish dystopian "Minority Report style technology":

https://news.ycombinator.com/item?id=38398910

DonHopkins on Nov 23, 2023 | parent | context | favorite | on: The Eyes Have It (1953)

"Lies, Inc." aka "The Unteleported Man" had an eye eater!

https://www.academia.edu/2360689/The_Missing_Pages_of_THE_UN...

Freya said, "Tell me. What is the 'eye-eater'? I have to know." Her breath caught in her throat; raggedly, she managed to breathe, but with difficulty.

"A fungiform," the taller of the THL agents said briefly. "One that resides here." He said nothing further. [...]

The eye-eater said pleasantly, "Mr. Ben Applebaum, reach inside me and you will find a slightly-different edition of Dr. Bloode's Text. A copy of the twentieth edition, which I ingested some time ago... but as far as I can determine, not already dissolved by my gastric juices." The idea seemed to amuse it; the lower portion of its face split apart in a peal of excrutiatingly-penetrating laughter.

"You're serious?" Rachmael said, feeling disorganized. And yet the eye-eater was correct; if it did possess a later edition of the text he most certainly had reason to seek it out -- wherever it lay, even within the body of the offensive eye-eater. "Look, look," the eye-eater exclaimed; it held in one of its longer [...]

https://sickmyduck.narod.ru/dick15-0.html

"A lie," the eye-eater rumbled ominously; again its pseudopodia whipped viciously, seeking out the agile creditor balloon, which dipped and bobbed barely beyond the flailing reach of the several sucker-impregnated arms. "As a matter of fact, this gentleman here-" It indicated Rachmael. "My understanding is that the lady and this individual are emotionally involved. Miss Holm is-was, whatever-a friend of mine, a very close friend. But hardly my mistress." The eye-eater looked embarrassed. [...]

https://survivorbb.rapeutation.com/viewtopic.php?f=179&t=419...

Let me quote one of Dr. Bloode's quite singular Thingisms.

"'Thingisms'?" Rachmael felt baffled -- and wary. He had a deep intuition that the Thingism, whatever it was, would not be amusing. Not to him, anyhow, or to any human.

"I always enjoyed this one," the eye-eater intoned, its saliva spilling from its mouth as it writhed with glee. "Consider: since you are about to read the book, here is Thingism Number Twenty, dealing with books.

"Ahem. 'The book business is hidebound.'"

After a pause, Rachmael said, "That's it?"

"Perhaps you failed to understand. I'll give you another gem, one more particular favorite of mine. And if that fails to move you ... Oooohhh! That's a Thingism! Listen! 'The representative of the drayage firm failed to move me.' Oooohhh! How was that?" It waited hopefully.

Baffled, Rachmael said, "I don't get it."

"All right." The eye-eater's tone was now harsh. "Read the book purely for educational purposes, then. So be it. You want to know the origin of this form which I have taken. Well, everyone will take it, sooner or later. We all do; this is how we become after we die."

He stared at it.

"While you ponder," the eye-eater continued, "I'll delight you with a few more Thingisms of Dr. Bloode's. This one I always enjoy. 'The vidphone company let me off the hook.' How was that? Or this one: 'The highway construction truck tore up the street at forty miles an hour.' Or this: 'I am not in a position to enjoy sexual relations.' Or --"

-- "Lies, Inc.", by Phil Dick

For e-commerce to continue, there has to be a way to confirm that the transfer of funds from a bank or credit account to the vendor’s account is approved by a human who controls the bank/credit account. As AI-powered scams become more sophisticated, this confirmation will get harder/more expensive, to the point where e-commerce might not work for most goods.

Perhaps generating “proof of humanity” digital signatures from retina scans isn’t the optimal solution, but I’ve yet to hear of any other privacy-preserving approaches. Perhaps transacting online will a require government-issued ID.

In the US there is a bill that's been floating around Congress for a while called the improving digital identity act.

https://www.congress.gov/bill/118th-congress/senate-bill/884...

Reply on news.ycombinator.com