Worldcoin developer argues against selfie biometrics as effective proof of humanity

Selfie biometrics cannot be relied on to show you are a real person, and government ID documents do not scale. These provocative opinions were shared in a recent Forbes Technology Council (fee-based) post by Tools for Humanity Head of Protocol Steven Smith.

Tools for Humanity is the developer for Worldcoin, so Smith has an interest in making a case for cryptographic digital ID as preferable to other forms of remote identity verification.

The article refers to a viral post in which a selfie made with AI was convincing to even savvy individuals.

The problems posed by bots and deepfakes are enumerated, from robots defeating CAPTCHAs to the threat of injection attacks against biometric systems.

The post refers to presentation attack detection or biometric liveness technologies only obliquely, via a reference to an article about the viral post that notes a May, 2022 report by Sensity. Sensity found that most of what it said were ten among the most widely-adopted KYC biometrics vendors were “severely vulnerable to deepfake attacks.”

While liveness detection has long been considered necessary for robust KYC, it was not offered as a default service by all KYC vendors in May of 2022, calling into question how many PAD systems were actually defeated in the test. Sensity’s point that adequate security is a moving target and not enough KYC providers were treating it that way remains valid, but it does not prove that selfies can no longer confirm a person is real.

Smith argues that government IDs are not private, and “regimes with expansive surveillance networks” can access centralized databases to track interactions they might prefer, or even think, are kept private. Further, state-backed ID documents do not scale, Smith says. This is because, in addition to a billion people lacking ID (the World Bank now says closer to 850 million, but round numbers are always preferred in marketing), 3.4 billion people hold analog IDs that cannot be digitally verified.

The first point would seem to undermine the second, however, as database checks to verify the authenticity of an ID document are built into many of the KYC market’s leading products. The combination of authoritative database checks and biometrics is considered by many in the identity verification industry to be the best practice for proving claims about identity, but is not explicitly discussed at all in the post.

Smith points out the value of blockchain and zero-knowledge proofs (ZKPs) for preserving privacy while proving claims. But he also notes that these two technologies alone are insufficient to provide reliable proof of humanity. Hence the inclusion of biometrics in the Worldcoin project.

Some combination of technologies is clearly needed to establish proof of personhood on the internet.

“It’s a matter of whether these proof of personhood services will be privacy-preserving, decentralized and accessible to the entire world,” Smith writes.

Article Topics

biometric liveness detection  |  biometrics  |  face biometrics  |  proof of personhood  |  selfie biometrics  |  Tools for Humanity  |  World