5 ms·

Any decentralized system that uses biometrics for authentication rather than just identification is doomed to fail spectacularly. Biometrics are like a usernam

by cwkoss 3y ago

Any decentralized system that uses biometrics for authentication rather than just identification is doomed to fail spectacularly. Biometrics are like a username NOT like a password. When a piece of wolrdcoin is inevitably compromised, people have no means of rolling a new iris. The whole thing will come crashing down. There are so many stupid decisions this team is making. Like, users can opt into the orbs retaining their iris scan for network quality assurance purposes. Would any sane person ever opt into an ATM storing their PIN number for quality assurance? It is an implicit bounty for hacking the orb. And the fact that they seem to need further quality assurance points to the fact that they aren't confident people will have continuous access to their accounts. Best case, I'd imagine anyone who has a catastrophic eye injury would also permanently lose access to their accounts - but I suspect the reality is much worse.

__alexs 3y ago
As much as I think Worldcoin is dumb they do get this part right in that they only use the iris scan as a unique identifier to prevent multiple sign ups from the same physical bag of meat^H^H^H^H^H person.
- tamimio 3y ago
  >unique identifier to prevent multiple sign up Yet there’s already a black market where you can buy multiple accounts with real iris.
  - __alexs 3y ago
    There is still a 1:1 relationship with accounts and people. They have just cut out some extra steps when the original account creator does whatever it is the 3rd party wants them to do manually. That some people might use their Worldcoin account to do things on behalf of someone else is a different problem from the one OP was referring to.
- cwkoss 3y ago
  Huh, I don't understand the intended security benefit of the iris scans at all then. If the system has value inside of it, inevitably people will figure out how to make synthetic irises that fool the orb, nullifying the sybil attack prevention benefit. Surely someone could get a handful of real iris scans (using the same open source hardware) and generate a huge number of plausible synthetic iris datas. Is the idea that in the current moment of the tech arms race, if someone steals an iris scan, the capability to synthesize an artificial iris that encodes that scan has not yet been developed? Have they published a 'solution' to what happens if you are holding worldcoin in an iris-associated account and then: - your scan data is stolen, ex. fake orb scans you and publishes your iris data on the internet for anyone to use - someone throws acid in your face, your irises don't scan the same anymore. how does this affect the user's ability to access their wallet? (is there additional private key management needed to use worldcoin securely? is the iris scanning thing really nothing more than a temporary sybil countermeasure..?)

by cwkoss 3y ago

__alexs 3y ago

As much as I think Worldcoin is dumb they do get this part right in that they only use the iris scan as a unique identifier to prevent multiple sign ups from the same physical bag of meat^H^H^H^H^H person.

tamimio 3y ago
>unique identifier to prevent multiple sign up Yet there’s already a black market where you can buy multiple accounts with real iris.
- __alexs 3y ago
  There is still a 1:1 relationship with accounts and people. They have just cut out some extra steps when the original account creator does whatever it is the 3rd party wants them to do manually. That some people might use their Worldcoin account to do things on behalf of someone else is a different problem from the one OP was referring to.
cwkoss 3y ago
Huh, I don't understand the intended security benefit of the iris scans at all then. If the system has value inside of it, inevitably people will figure out how to make synthetic irises that fool the orb, nullifying the sybil attack prevention benefit. Surely someone could get a handful of real iris scans (using the same open source hardware) and generate a huge number of plausible synthetic iris datas. Is the idea that in the current moment of the tech arms race, if someone steals an iris scan, the capability to synthesize an artificial iris that encodes that scan has not yet been developed? Have they published a 'solution' to what happens if you are holding worldcoin in an iris-associated account and then: - your scan data is stolen, ex. fake orb scans you and publishes your iris data on the internet for anyone to use - someone throws acid in your face, your irises don't scan the same anymore. how does this affect the user's ability to access their wallet? (is there additional private key management needed to use worldcoin securely? is the iris scanning thing really nothing more than a temporary sybil countermeasure..?)