News for hackers. Stuff that matters.
Re:Worldcoin: A solution in search of its problem by lolinder on Sunday July 30, 2023 @01:19PM (#36933531)
> While Worldcoin may have developed an algorithm that reliably distinguishes unique irises among its test pool, it’s not clear that it will work with a pool orders of magnitude larger.

This is a really key problem. The main application of biometrics today is in cell phones, and for those we operate on the assumption that we're trying to distinguish between the authorized user and a quite small pool of non-authorized people who will have physical access to the device: family members, friends, co-workers, and the occasional thief. This threat profile allows the biometric algorithm to err on the side of usability—it's more important that the algorithm consistently open the phone when shown the user's fingerprint or face than it is that there be no other human being on the planet who could open it.

Worldcoin has a very different threat profile, and it's not obvious to me that is possible to have a usable biometrics system (with an acceptably low false negative rate) that also has absolutely zero risk of hash collisions when the pool of unique people you need to distinguish is the size of the entire planet.

Re:Worldcoin: A solution in search of its problem by kibwen on Sunday July 30, 2023 @03:01PM (#36934719)
> the pool of unique people you need to distinguish is the size of the entire planet

Not merely the size of the entire planet. If they hope that this scheme lasts in perpetuity, it will need to distinguish between all individuals who will ever be born.

Re:Worldcoin: A solution in search of its problem by panarky on Sunday July 30, 2023 @04:18PM (#36935500)
If the iris hash function produces a false negative, does the owner of the iris lose access to their assets?
Re:Worldcoin: A solution in search of its problem by remcob on Sunday July 30, 2023 @04:19PM (#36935515)
This is essentially the Birthday paradox. You need a quadratically better false match rate to deduplicate than to authenticate. It’s also why Worldcoin went with Irises (highest entropy among biometrics), custom hardware, custom optics and an in-house trained algorithm.
Re:Worldcoin: A solution in search of its problem by ajb on Sunday July 30, 2023 @05:30PM (#36936198)
The Iriscode (if it's the same as Daugman's iriscode) has tested so far to have 249 bits of entropy, or over 10^74 combinations [1]

So even with the birthday paradox you'd need 10^37 people before having a good chance of a collision, which is rather more than we are likely to have in the next few centuries.

Of course, it's possible that there are some subpopulations who don't have this amount of entropy in their irises, most obviously the small number of people who have a birth defect such that they are born without eyes.

[1]https://www.cl.cam.ac.uk/~jgd1000/binomdata.html

Re:Worldcoin: A solution in search of its problem by matthewdgreen on Sunday July 30, 2023 @05:33PM (#36936225)
This is a really good comment. But of course the problems in authentication and de-duplication are also different in that you care about adversarial false-positives much more once authentication is the goal. As I understand things, Worldcoin claims the retina scans won’t be used to control funds (or other services.) I am skeptical that many of those users will retain their non-biometric wallet credentials long-term, which will leave you with a database of biometric credentials that will have to be used for authentication if you want to use those credentials for anything important in the future.
Re:Worldcoin: A solution in search of its problem by b1n on Sunday July 30, 2023 @05:01PM (#36935929)
This is assuming you are trying to create a perfect system. The "good enough" version of this solves most Sibil Attacks[1].

[1] https://en.wikipedia.org/wiki/Sybil_attack

Re:Worldcoin: A solution in search of its problem by lolinder on Sunday July 30, 2023 @07:22PM (#36937064)
I'm not even talking about intentional Sybil attacks, I'm talking about the very real possibility that people get excluded from this system because the system mistakenly identifies them as having already scanned in.

If the goal of this is really as ambitious as they claim, with every single person on the planet getting UBI through it, their biometric system needs to be strict enough to not conflate two people and flexible enough to match the same iris when scanned a second time for verification. I don't believe the tech is there.

Re:Worldcoin: A solution in search of its problem by cwkoss on Monday July 31, 2023 @05:36AM (#36940382)
I have very little faith that orbs can't be fooled by synthetic irises.
Re:Worldcoin: A solution in search of its problem by tim333 on Thursday August 03, 2023 @10:28AM (#36986451)
I'm not sure that matters. I got scanned yesterday. Once you've done the scan they give you a crypto wallet with a private key and I think that's the last time you have to scan. It's only really there to stop me going up a second time to get more free tokens. If someone with the same irises tries to sign up I guess a human will have to decide if they are genuine or a scammer. Not a big deal I think.