4 ms·

This is interesting to me. On the one hand "Proof of humanity" is an important problem and is surely only going to get more important as time passes. Bots are

This is interesting to me. On the one hand "Proof of humanity" is an important problem and is surely only going to get more important as time passes. Bots are already better than humans at solving captchas.[1] On the other hand I cannot conceive of giving someone my biometric data so they can mint some blockchain thing from it, and although I admit I wasn't interested enough to look into it beyond reading a couple of articles, I really don't see how this specific solution makes the situation better. Eg how do they know someone hasn't pwned me and then hijacked my special proof of humanity token to using it for their bots to "prove humanity"? [1] https://arxiv.org/abs/2307.12108 https://arxiv.org/abs/2307.12108

dsco 3y ago
They don't, but it's harder to kidnap someone and use their eye, as opposed to steal some other piece of identification. If you would turn it around and imagine a world without paper passports and government issued id's - what would you use as unique identifier for a person?
- pjmorris 3y ago
  > If you would turn it around and imagine a world without paper passports and government issued id's - what would you use as unique identifier for a person? I'm not sure... but I'm also convinced that 'private corporation issued id' isn't fundamentally superior to 'government issued id' and has some challenges in terms of accountability.
- melenaboija 3y ago
  Being pwned does not solely mean having access to your eye in this case, also why should I trust a corporation more than a government?
- itishappy 3y ago
  > it's harder to kidnap someone and use their eye, as opposed to steal some other piece of identification Is it? I use my eyes a helluva lot more than I use my government issued SSN. In fact, I've only taken my physical SSN card out of storage once, but I stare at random (potentially camera equipped) stuff all day. Of course you can still steal it from me by pretending to ask for ID, but that's true of my eye-print as well.
- DANmode 3y ago
  Pubic key of their choosing.
isthatafact 3y ago
I wonder if an eyeball scan is really proof of humanity. This may be a dumb question, buy why could someone not simply create an AI-generated iris image and fool the orb into thinking that is a unique human?
- dangirsh 3y ago
  Preventing such attacks is one of the main reasons why custom hardware is required. For more info, search for "spoof" in this section of the whitepaper: https://whitepaper.worldcoin.org/technical-implementation#why-custom-hardware-is-needed https://whitepaper.worldcoin.org/technical-implementation#wh...
- algorias 3y ago
  First of all, it's very hard to make a printout that looks like the real thing to a camera. Images stored on a computer capture a lossy representation of what the camera actually "saw". Secondly, I believe that the protocol is based around the idea that the operator is trusted, i.e., they won't allow such uses of the orb. If an operator isn't trustworthy, I guess there needs to be a way to revoke the validity of all their scans.
  - wkat4242 3y ago
    What if you print it to a custom contact lens similar to those cosplay lenses? The operator wouldn't even notice
- tim333 3y ago
  They have human operators too to help you stop using AI-generated photos, or your pet cat, or your kids - there's an age limit. The main purpose of the scan it to check for uniqueness so you can't keep going up and get 50 accounts.
jiveturkey 3y ago
In fact, this is commonly done. There's an entire trade around having people scan their iris and you (the buyer of their biometric) keep the resultant token. I think what I read was around the more rural areas in Africa. I'm not referring to the "official" practice by World Coin themselves where people are recruited to scan (in Africa metro areas) and the participant actually get the tokens. There's also this underground trade in iris scans.
sangnoir 3y ago
> On the one hand "Proof of humanity" is an important problem and is surely only going to get more important as time passes Governments have been doing this for centuries (see passports, identity documents, birth and death certificates). Witnessing attempts by private entities repeated attempts to "solve" this problem and make a profit has shown me the limitations of free markets. Despite the complexity and sophistication of the implementation, it boils down to a record that's looked up by a trusted entity who attests the validity of the subjects identity, or not.
- yreg 3y ago
  I don't like WorldCoin, but I don't like sending internet services my passport and birth certificate to prove to them that I am human either. The actual problem - which is waiting for a solution - is undeniable. (This isn't often the case with cryptocurrency projects.)
  - sangnoir 3y ago
    > I don't like WorldCoin, but I don't like sending internet services my passport and birth certificate to prove to them That's about the least-private implementation one could think of; I wouldn't want to send scans of my iris to random Internet services either! This would be the equivalent raw-data implementation for Worldcoin. > The actual problem - which is waiting for a solution - is undeniable The solution is the government providing an oauth-like service. Internet services would only get a token and only a limited set of PII you were shown and agreed to while authenticating (e.g. your name, email address, and/or whether you're a minor/adult). No one can attest your identity without keeping a record of it - public service or not. IMO, having private enterprise do this merely increases the attack surface.
    - jt2190 3y ago
      > I wouldn't want to send scans of my iris to random Internet services either! You don’t. You generate some secure keys using iris data. You send the internet service a copy of your public key. They can use that to verify that you are human, but not who you are.

dsco 3y ago

They don't, but it's harder to kidnap someone and use their eye, as opposed to steal some other piece of identification. If you would turn it around and imagine a world without paper passports and government issued id's - what would you use as unique identifier for a person?

pjmorris 3y ago
> If you would turn it around and imagine a world without paper passports and government issued id's - what would you use as unique identifier for a person? I'm not sure... but I'm also convinced that 'private corporation issued id' isn't fundamentally superior to 'government issued id' and has some challenges in terms of accountability.
melenaboija 3y ago
Being pwned does not solely mean having access to your eye in this case, also why should I trust a corporation more than a government?
itishappy 3y ago
> it's harder to kidnap someone and use their eye, as opposed to steal some other piece of identification Is it? I use my eyes a helluva lot more than I use my government issued SSN. In fact, I've only taken my physical SSN card out of storage once, but I stare at random (potentially camera equipped) stuff all day. Of course you can still steal it from me by pretending to ask for ID, but that's true of my eye-print as well.
DANmode 3y ago
Pubic key of their choosing.

isthatafact 3y ago

I wonder if an eyeball scan is really proof of humanity. This may be a dumb question, buy why could someone not simply create an AI-generated iris image and fool the orb into thinking that is a unique human?

dangirsh 3y ago
Preventing such attacks is one of the main reasons why custom hardware is required. For more info, search for "spoof" in this section of the whitepaper: https://whitepaper.worldcoin.org/technical-implementation#why-custom-hardware-is-needed https://whitepaper.worldcoin.org/technical-implementation#wh...
algorias 3y ago
First of all, it's very hard to make a printout that looks like the real thing to a camera. Images stored on a computer capture a lossy representation of what the camera actually "saw". Secondly, I believe that the protocol is based around the idea that the operator is trusted, i.e., they won't allow such uses of the orb. If an operator isn't trustworthy, I guess there needs to be a way to revoke the validity of all their scans.
- wkat4242 3y ago
  What if you print it to a custom contact lens similar to those cosplay lenses? The operator wouldn't even notice
tim333 3y ago
They have human operators too to help you stop using AI-generated photos, or your pet cat, or your kids - there's an age limit. The main purpose of the scan it to check for uniqueness so you can't keep going up and get 50 accounts.

jiveturkey 3y ago

In fact, this is commonly done. There's an entire trade around having people scan their iris and you (the buyer of their biometric) keep the resultant token. I think what I read was around the more rural areas in Africa. I'm not referring to the "official" practice by World Coin themselves where people are recruited to scan (in Africa metro areas) and the participant actually get the tokens. There's also this underground trade in iris scans.

sangnoir 3y ago

> On the one hand "Proof of humanity" is an important problem and is surely only going to get more important as time passes Governments have been doing this for centuries (see passports, identity documents, birth and death certificates). Witnessing attempts by private entities repeated attempts to "solve" this problem and make a profit has shown me the limitations of free markets. Despite the complexity and sophistication of the implementation, it boils down to a record that's looked up by a trusted entity who attests the validity of the subjects identity, or not.

yreg 3y ago
I don't like WorldCoin, but I don't like sending internet services my passport and birth certificate to prove to them that I am human either. The actual problem - which is waiting for a solution - is undeniable. (This isn't often the case with cryptocurrency projects.)
- sangnoir 3y ago
  > I don't like WorldCoin, but I don't like sending internet services my passport and birth certificate to prove to them That's about the least-private implementation one could think of; I wouldn't want to send scans of my iris to random Internet services either! This would be the equivalent raw-data implementation for Worldcoin. > The actual problem - which is waiting for a solution - is undeniable The solution is the government providing an oauth-like service. Internet services would only get a token and only a limited set of PII you were shown and agreed to while authenticating (e.g. your name, email address, and/or whether you're a minor/adult). No one can attest your identity without keeping a record of it - public service or not. IMO, having private enterprise do this merely increases the attack surface.
  - jt2190 3y ago
    > I wouldn't want to send scans of my iris to random Internet services either! You don’t. You generate some secure keys using iris data. You send the internet service a copy of your public key. They can use that to verify that you are human, but not who you are.