[HN Gopher] Worldcoin hit with temporary ban in Spain over priva...
___________________________________________________________________
Worldcoin hit with temporary ban in Spain over privacy concerns
Author : melenaboija
Score : 125 points
Date : 2024-03-06 16:45 UTC (6 hours ago)
(HTM) web link (techcrunch.com)
(TXT) w3m dump (techcrunch.com)
| fsflover wrote:
| Discussion: https://news.ycombinator.com/item?id=39617745
| ChrisArchitect wrote:
| [dupe]
| rantee wrote:
| It's beyond laughable that the company didn't better address
| these concerns beyond performative press releases without the
| need for regulatory intervention before rolling out in any
| jurisdiction, let alone the EU. Whatever one's opinion on the
| privacy implications, it's a simply embarassing business* move
| given the number of countries with data protection legislation
| (and/or active regulators).
|
| * or whatever motive one wishes to ascribe to the mix of for- and
| non-profit entities involved in muddying the waters OpenAI-style
| ribosometronome wrote:
| Sam Altman does link OpenAI and WorldCoin.
| bagels wrote:
| How much traction does this creepy project have?
| CatWChainsaw wrote:
| Any traction is too much.
| seanhunter wrote:
| This is interesting to me.
|
| On the one hand "Proof of humanity" is an important problem and
| is surely only going to get more important as time passes. Bots
| are already better than humans at solving captchas.[1]
|
| On the other hand I cannot conceive of giving someone my
| biometric data so they can mint some blockchain thing from it,
| and although I admit I wasn't interested enough to look into it
| beyond reading a couple of articles, I really don't see how this
| specific solution makes the situation better. Eg how do they know
| someone hasn't pwned me and then hijacked my special proof of
| humanity token to using it for their bots to "prove humanity"?
|
| [1] https://arxiv.org/abs/2307.12108
| dsco wrote:
| They don't, but it's harder to kidnap someone and use their
| eye, as opposed to steal some other piece of identification. If
| you would turn it around and imagine a world without paper
| passports and government issued id's - what would you use as
| unique identifier for a person?
| pjmorris wrote:
| > If you would turn it around and imagine a world without
| paper passports and government issued id's - what would you
| use as unique identifier for a person?
|
| I'm not sure... but I'm also convinced that 'private
| corporation issued id' isn't fundamentally superior to
| 'government issued id' and has some challenges in terms of
| accountability.
| melenaboija wrote:
| Being pwned does not solely mean having access to your eye in
| this case, also why should I trust a corporation more than a
| government?
| itishappy wrote:
| > it's harder to kidnap someone and use their eye, as opposed
| to steal some other piece of identification
|
| Is it? I use my eyes a helluva lot more than I use my
| government issued SSN. In fact, I've only taken my physical
| SSN card out of storage once, but I stare at random
| (potentially camera equipped) stuff all day. Of course you
| can still steal it from me by pretending to ask for ID, but
| that's true of my eye-print as well.
| DANmode wrote:
| Pubic key of their choosing.
| isthatafact wrote:
| I wonder if an eyeball scan is really proof of humanity.
|
| This may be a dumb question, buy why could someone not simply
| create an AI-generated iris image and fool the orb into
| thinking that is a unique human?
| algorias wrote:
| First of all, it's very hard to make a printout that looks
| like the real thing to a camera. Images stored on a computer
| capture a lossy representation of what the camera actually
| "saw".
|
| Secondly, I believe that the protocol is based around the
| idea that the operator is trusted, i.e., they won't allow
| such uses of the orb. If an operator isn't trustworthy, I
| guess there needs to be a way to revoke the validity of all
| their scans.
| jiveturkey wrote:
| In fact, this is commonly done. There's an entire trade around
| having people scan their iris and you (the buyer of their
| biometric) keep the resultant token. I think what I read was
| around the more rural areas in Africa. I'm not referring to the
| "official" practice by World Coin themselves where people are
| recruited to scan (in Africa metro areas) and the participant
| actually get the tokens. There's also this underground trade in
| iris scans.
| sangnoir wrote:
| > On the one hand "Proof of humanity" is an important problem
| and is surely only going to get more important as time passes
|
| Governments have been doing this for centuries (see passports,
| identity documents, birth and death certificates). Witnessing
| attempts by private entities repeated attempts to "solve" this
| problem _and_ make a profit has shown me the limitations of
| free markets. Despite the complexity and sophistication of the
| implementation, it boils down to a record that 's looked up by
| a trusted entity who attests the validity of the subjects
| identity, or not.
| yreg wrote:
| I don't like WorldCoin, but I don't like sending internet
| services my passport and birth certificate to prove to them
| that I am human either.
|
| The actual problem - which is waiting for a solution - is
| undeniable. (This isn't often the case with cryptocurrency
| projects.)
| sangnoir wrote:
| > I don't like WorldCoin, but I don't like sending internet
| services my passport and birth certificate to prove to them
|
| That's about the least-private implementation one could
| think of; I wouldn't want to send scans of my iris to
| random Internet services either! This would be the
| equivalent raw-data implementation for Worldcoin.
|
| > The actual problem - which is waiting for a solution - is
| undeniable
|
| The solution is the government providing an oauth-like
| service. Internet services would only get a token and only
| a limited set of PII you were shown and agreed to while
| authenticating (e.g. your name, email address, and/or
| whether you're a minor/adult).
|
| No one can attest your identity without keeping a record of
| it - public service or not. IMO, having private enterprise
| do this merely increases the attack surface.
| epolanski wrote:
| I have never been asked anything like that, except when it
| was for legal compliance (such as opening a bank account).
|
| The only exception being meta a decade ago, to which I
| obviously answered by deleting anything meta related bar
| Whatsapp.
| sangnoir wrote:
| With how AI is going, attestation will become necessary
| for many social interactions we take for granted today by
| assuming there is a well-intended human in the other end.
|
| If you're hiring, or looking for a new job, the odds of
| you being tricked/phished are getting worse by the day.
| I've read stories of employees get interviewed for fake
| jobs as a long-con to get banking details, and employers
| interviewing a persona that's fronting an offshore dev
| team, or people who don't have work skills and aim to
| pick up paychecks until their dismissal is processed.
| fodmap wrote:
| This is the original announcement by the AEPD, the Spanish Data
| Protection Authority.
|
| https://www.aepd.es/en/press-and-communication/press-release...
| Rygian wrote:
| I wonder why the ban hasn't become EU-wide right afterwards.
| prof-dr-ir wrote:
| Hah so at least Worldcoin no longer has to explain why nobody _in
| Spain_ uses their product.
|
| I am afraid that they may not have an equally compelling
| explanation for the same problem in the rest of the world.
| vasco wrote:
| If you had asked me how much money you'd have to pay someone for
| them to let you scan their eyeball, I have to say I would've said
| way more than EUR35 fake euros stuck in an app. If anything it's
| eye opening (eh) how little understanding there is of the
| personal risk people are taking on.
| wnevets wrote:
| > If you had asked me how much money you'd have to pay someone
| for them to let you scan their eyeball
|
| People paid companies like 23andMe actual money for the
| privilege of mailing their DNA. Getting paid to let a company
| your eyeball sounds like an improvement.
| lottin wrote:
| I think people pay these companies for providing them with
| information about their DNA, which is quite different.
| blacksmith_tb wrote:
| Especially given that you can download your genetic data
| from 23andme. I am not sure if Worldcoin allows you
| download a copy of your iris data... no mention in their
| FAQ, at least.
| jgalt212 wrote:
| > "There's a sucker born every minute" is a phrase closely
| associated with P. T. Barnum, an American showman of the
| mid-19th century, although there is no evidence that he
| actually said it. Early examples of its use are found among
| gamblers and confidence tricksters.
|
| https://en.wikipedia.org/wiki/There%27s_a_sucker_born_every_...
| Retr0id wrote:
| Privacy aside, there's no way this can be done securely.
|
| According to https://worldcoin.org/be-a-worldcoin-operator
| they'll gladly ship the iris scanning unit to untrusted 3rd party
| operators, in a similar vein to a bank shipping out PoS card
| terminals.
|
| I'd love to have a play with one, it wouldn't surprise me if you
| could get it to mint fresh accounts out of thin air (e.g. by
| mitming the bus between the iris scanner and the rest of the
| unit, and making it report fresh unique scans)
| hdevalence wrote:
| > by mitming the bus between the iris scanner and the rest of
| the unit, and making it report fresh unique scans
|
| Hmm, I wonder if the worldcoin team also thought of that
| possibility?
|
| (Yes, they did, the iris processing is done inside a hardware
| enclave so that the obvious attack is not possible)
|
| https://whitepaper.worldcoin.org/technical-implementation
|
| I am broadly anti-Worldcoin but it is reasonably competently
| executed at a technical level. It would be good to understand
| what they actually did before declaring it to be impossible.
| Retr0id wrote:
| Hardware enclaves are never 100% impenetrable, it comes down
| to making the cost of attack greater than what an attacker
| expects to gain. Traditional card payment terminals use
| nominally secure hardware and yet struggle with that tradeoff
| to this day, and I'm not convinced WorldCoin will do any
| better.
|
| The SoC they're using, the Jetson Xavier NX, is a cousin of
| the very thoroughly pwned (secure enclaves and all) TX1.
|
| Further, they don't describe how the busses connecting the
| sensors to the SoC are encrypted and/or authenticated, which
| leads me to believe that they are not.
|
| Intel gave up on shipping SGX in consumer devices because
| (imho) shipping secure enclaves directly to "adversaries"
| (the consumer being an adversary under the SGX threat model)
| proved too difficult to maintain.
| Retr0id wrote:
| They talk about a future bug bounty program - I'm certainly
| intrigued, and if the up-front hardware costs aren't too
| high I might give it a go.
| algorias wrote:
| > I am broadly anti-Worldcoin but it is reasonably
| competently executed at a technical level. It would be good
| to understand what they actually did before declaring it to
| be impossible.
|
| +1 to this. I'm very skeptical of the project (even though I
| know some of the people working on it), but the problem space
| is extremely hard and they're giving it an actual shot. If
| you can think of a potential problem in 5 minutes, I
| guarantee you that they've thought of it too.
| epolanski wrote:
| Can't I just bypass it with some contact lenses that distort
| the scan and make it unique?
| aussieguy1234 wrote:
| How easy is it to trick this iris scanner with a fake eye?
| gitgud wrote:
| There's so many issues with biometrics:
|
| - You can't change them if they're compromised
|
| - They're unreliable, they can change with age, depends on the
| environment that they're measured in
|
| - It's not really " _proof of humanity_ " just " _proof of
| biology_ "
|
| Worldcoin is an interesting attempt though
___________________________________________________________________
(page generated 2024-03-06 23:01 UTC)