6 ms·
While I don't care about Worldcoin (I think it will fail, because they are solving the problem that does not exist), this post is false in multiple ways. First
by exo762 5y ago
While I don't care about Worldcoin (I think it will fail, because they are solving the problem that does not exist), this post is false in multiple ways.
First, retina scanning output hash is deterministic - it is supposed to generate the same result for the same eyeball. So it can't be replaced with random number generation.
Second, network does not interpret hashes, except for making sure that single hash is awarded funds only ones. Network however pays attention to whom is sending the hashes. It must be "legitimate" Orb units, likely considered to be legitimate because their public keys were whitelisted.
Third, process of distribution of initial tokens is obviously NOT OPEN. You need a "legitimate" Orb unit to participate. Which has nothing to do with how the network will behave for users already on-boarded.
Fourth, PoW has nothing to do with it. PoW is antisybil for people who might add new blocks. PoW has nothing to do with people who just want to transfer or hold funds. Or even with people who can create money according to network rules.
- deleted 5y ago[deleted]
- drexlspivey 5y ago> First, retina scanning output hash is deterministic - it is supposed to generate the same result for the same eyeball. So it can't be replaced with random number generation. His argument is valid, what stops you from replacing the retina scan with a random hash replicating a different person scanning each time and collecting new tokens? What ties the hash to the actual retina other than the device that you can mess with?
- Tenoke 5y agoPresumably the orbs produce a verifiable type of hash. E.g. whatever output it has is also encrypted with their private key + some salt and you can always check if what a user provides has that.
- New_California 5y agoYou don't understand what a hash is.
- ta23adesrg 5y agoYour confidence in your own reading comprehension is unjustified. They are simply describing signing the hash.
- exo762 5y agoIt can be done in following way. Orb can have a baked-in private key (on hardware level). Public keys are stored in the blockchain. Each hash is signed by the private key stored in the orb.
- mhluongo 5y agoThat implies a centralized signing authority though. We could do all of that without the retina scanning using normal old KYC
- Tenoke 5y agoThe orbs are centralized either way. And I personally am less worried about someone having a hash of my eyeball data than my passport and everything else.
- gcr 5y agoThat's orthogonal to the point. Here's the scenario: 1. User has a "fake" biometric A, generated via GAN or [1], that's cheap and easy to produce. 2. Suppose they can present A to any orb device, generating hash(A), which signs hash(A) using its built-in private key as usual. As long as the user can generate a fake iris biometric scan accepted by an orb, no other part of the system needs to be compromised for this attack to work. 1: http://iab-rubric.org/papers/ICPR14_1649_FI.pdf http://iab-rubric.org/papers/ICPR14_1649_FI.pdf , note that liveness detection is a cat-and-mouse game
- ThePhysicist 5y agoDRM magic inside the Orb.
- gcr 5y agoWho's to say that employees (physical orb administrators) won't be in on it?
- user-the-name 5y agoThis is a cryptocurrency project. The opportunity for scamming is much, much bigger than that.
- TechBro8615 5y agoQuality shitpost. We’ve really come full circle when a blockchain relies on DRM to work.
- _jal 5y agoIt is a thing of beauty. "The DMCA says you aren't allowed to circumvent our attack on a central pillar of the modern nation state."
- mNovak 5y agoI've got it, we need kernel-level anti-cheat...
- Tenoke 5y ago>I think it will fail, because they are solving the problem that does not exist Admittedly I never bothered to read about it but the problem they are solving is purely the distribution. Currently there's just no way to do a fair distribution where everyone gets equivalent amounts of it except perhaps with KYC but then they have to store way more personal data. I'm much more comfortable with someone having a hash based on my biometric data than having my passport and other details.
- exo762 5y ago> I'm much more comfortable with someone having a hash based on my biometric data than having my passport and other details. Same here. My point is - fair distribution is just a means to achieve a goal of "more equality". As a mean it is an equivalent of giving man a fish instead of teaching him how to fish. At most a PR stunt.
- thruway516 5y agoWell a passport can always be faked. If the world became a totalitarian dystopia and you were a freedom fighter that had to elude detection, you can always use a fake passport. Faking biometrics is much harder if they already have your data.
- Tenoke 5y agoI don't think I'd consider "it's harder to fake" a negative for the project if I was involved.
- thruway516 5y agoYes. It’s very good for the project (and the NSA), not so great for users. I’m responding to the comment that prefers to give biometric data to some random private company
- yunohn 5y agoSo… then why do they need retina scans? If the whole process has tons of checks and balances, it sounds a lot like the normal verification processes followed by governments for IDs/Visas.
- hef19898 5y agoOr banks, know your customer and all that. But the day some crypto project goes there the world implodes vor something.
- Pxtl 5y agoI don't see how the deterministic nature of retinal scanning hashes means they couldn't be forged randomly. If there's secret sauce or a secret key in the algorithm that generates the hash then it's not an open platform. And given the stakes, it's only a matter of time until that gets cracked.
- _fizz_buzz_ 5y ago> it's only a matter of time until that gets cracked. or leaked
- dom96 5y ago> First, retina scanning output hash is deterministic - it is supposed to generate the same result for the same eyeball. So it can't be replaced with random number generation. I don’t know much about retinal scanning. But for this use case, wouldn’t it be trivial to fake via something like different coloured contact lenses?
- nonameiguess 5y agoNo biometric identifier is ever deterministic. Retinal scanning is no different. Your retina doesn't look exactly the same every time, every day, from all possible angles. Eyeballs swell, get infected, can be clouded. Retina signatures can even change over the course of a lifetime in somewhat rare circumstances, usually due to glaucoma or diabetes. Identification is always probabilistic. Actually, the lowest state of the art false positive rates for biometric id is achieved by iris scans, so I have to wonder why they went with retinal scanning in this case. Note that I'm not saying you can intentionally cause a false positive or false negative very easily. These are both highly reliable identification methods. But they're not deterministic, so if you're hashing the literal scanned signature, the hash output won't be deterministic, either. Presumably, what they're doing isn't hashing at all. Normally, for biometric id you just store the signature in a database and use a thresholding function to match against it when new scans comes in.
- plra 5y ago>I have to wonder why they went with retinal scanning in this case. They didn't. It's an iris scan. The article just used "retina" and "iris" interchangeably for some reason. https://worldcoin.org/how-it-works https://worldcoin.org/how-it-works