For the extra paranoid, I can confirm that it does work offline after you press the button and let it load. You can hide your face until it loads, and then cut the connection. Be sure to close the tab before you go online again.

Service Workers are a thing.

If you're extra extra paranoid, use a disposable VM in Qubes OS.

https://www.qubes-os.org/doc/how-to-use-disposables/

Wait—service workers can keep running after a tab is closed?!

Maybe or maybe not, depending on browser implementation. They can be kept in memory if the browser sees no memory need.

But they might store stuff to localStorage. Right - localStorage is also a thing. And so are cookies.

Or just open it in private browsing?

Or disable service workers

Worth it to be told I am more attractive than 100% of the Spice Girls.

Spice Girls back then or Spice Girls now?

It doesn't specify, so I can only assume both and which it compares to depends on how ugly the user is.

Devil’s advocate here. What could go wrong?

If you open a website in a fresh browser context and let it use your camera, isn’t this about the same as walking down a street with CCTV cameras?

Most people have such weird and illogical views on privacy. A website collecting face pictures without anything else is pretty useless. Walking in to a retail store owned by a company using facial recognition on a huge range of owned stores is a serious privacy issue.

Face pictures and IP adresses...

And browser fingerprint and operating system.

And the bait on the hook is not a good indicator either - an appeal to a deep drive or insecurity in many people.

Obviously not determinative in itself ,but if I wanted to harvest a lot of faces in a hurry, that's exactly the sort of bait that I would use (I can hardly think of a better one off the top of my head).

So what's the concern here ? I'm sure I have plenty of photos of me online tagged by other people.

Do those photos show you operating system and browser ?

Not useless at all, there are usually enough pictures of people on the internet with names, metadata, etc attached to immediately link and identify. Basically what Clearview does (did?). I would not be surprised if this was a data collection siphon.

> I would not be surprised if this was a data collection siphon.

Except for it being sponsored by Eu - home to the most effective privacy jurisdiction on the planet.

The same organization pushing for mass surveillance?

I don't think this is a scam/data collection site (as others have recognized the researcher involved, etc.), but what would stop a random website from claiming it was "sponsored by the EU"?

Easy enough to check using browser dev tools.

> Devil’s advocate here. What could go wrong?

Could be used for a scam, by a stalker, for social engineering, or several other evil ploys. Today, there are so many possible bad actions which are happening... On average, they are unlikely, but not impossible. And who knows about the long run.

> If you open a website in a fresh browser context and let it use your camera, isn’t this about the same as walking down a street with CCTV cameras?

In my country, there are harsh regulations on public cameras. Private people are not even allowed to capture you outside from being in the background.

Could be a scam, but the guy has a Dutch accent and talks about privacy, so it's probably fine.

(I'm 54% averagely normal)

Which country is that?

A member of the European Union, there are strong regulations for all countries here.

You have to weigh “what could go wrong?” with “what could go right?”

The worst case scenario is far greater in magnitude than the best case scenario.

Just not worth any risk here.

A website can collect millions of faces in a few hours. A CCTV camera can only collect data from a single area.

It's more akin to those spying doorbells from Amazon and friends, which I personally would try to avoid when I can.

The concentration of data and the lack of necessity of your face being recorded in the first place change the decision making process significantly.

It could use that to impersonate you in a mobile banking application through biometric authentication. It's getting pretty popular in my country (I think it's required by law or something).

> fresh browser context

I get your point, but I am not sure how fresh our browser context is.

I just mean private browsing or incognito or whatever. It’s 2 seconds away in any popular browser.

web site has much more information about you that it can connect.

Don't we all have tons of pictures of ourselves online already?

Almost all, yes. The people who don't are obviously not normal, so they don't need the website.

And by that logic, people who do are normal so they don't need to use the website either. So no one needs to use the website :)

that's not how logic works

I hope you're not diagnosing people for a living

But could be a fine statistician

not all of us ^^

No. Zero.

Do you avoid tourist attractions and cities so that you aren't included in other people's photos? Even though I'm not an Apple customer, for example, I'm sure they could infer much of my movements from their photo database using only other people's photos (I live in a city).

No

Gonna pile on another "no."

No

Nope.

No. This kind of auto-defaulting to "tons" baffles me quite hard.

Observation bias.

N-not really…

They give a pinky promise, that they won't do evil!

EU funded project, really not very risky.

> Government-funded project, really not very risky.

No thanks.

I'm guessing you're from the US and the parent poster is from the EU?

Correct. I don't care which government is in question, though. None are worthy of my trust or data.

I work for a company that does projects that are sometimes funded by the EU. I've never heard of the EU ever asking for something in return. You submit your project, the EU either decides to give you money, or not, and you do your project. Sometimes they check whether you've actually done what you said you'd do. No one in the EU has time to deal with the output of the billions of euro's they invest in random projects.

That's true, but there's:

A. No way for me to verify nothing shady is in the investment deal, and

B. The government may be able to turn around when the project gets big, and say "hey remember when we funded you? Yeah, now we have a say. We need you to do ___."

I don't like using software or projects funded by things I disagree with. And the government is overwhelmingly so.

It's not clear if you're trying to make us feel better (the EU doesn't care about this project's data) or worse (the EU has ineffective oversight over this project -- anything could be going on).

That's not true. You clearly have no clue of the administrative side of things.

If its a small project they very rarely «check» that you have done what you have done. A lot of it is self reporting. The reporting of course takes a while and you have to describes for instance your results, which wouldn’t be too hard to fake but I assume very few do this.

Ah thank you for enlightening us with your treasure trove of information.

Did you read the terms of service? ;)

Do you believe the terms of service?

I believe that I verified it runs locally, even offline, not sending data to a remote server.

At least for the moment

What's their incentive to change that after the HN surge?

Yep, another magic spell akin to 'software license' that is supposed to dispell all evil.