It really does sound like something out of a sci-fi flick: Millions of people let a private company run by a billionaire scan their eyeballs in exchange for digital coins that the company promises will lead to a better future. If this were Hollywood, the next phase of the plot would involve a catastrophic hack or the company CEO turning evil and enslaving humanity.
Little wonder people are wary of Worldcoin, the startup that really is using a glass-like orb to collect millions of iris scans. But if you can get past the sci-fi caricatures, it's worth noting the project is making promising strides in trying to solve a very difficult problem: how to verify our online identities without giving up our privacy.
The solution Worldcoin is using is biometrics, which have already proved to be a reliable form of authentication. In the case of irises, they are unique and virtually impossible to counterfeit. And Worldcoin is hardly the first company to use biometrics for security—every day, millions of people use their eyes or face to unlock their phone or pass through airport security. In this context, Worldcoin's orb is just a marketing device to get buzz so that enough people sign up to make the project viable.
The harder part, of course, is the privacy element. It's not a good idea to give out your biometrics willy-nilly to every startup that comes along and, if you do, you better hope they have the technology and governance structure in place to prevent abuse.
In theory, Worldcoin checks these boxes. The company says it using an advanced form of cryptography known as zero-knowledge proofs to store the iris scan records in a way that ensures that neither it nor anyone else can link them to specific individuals. And its stated goal is to decentralize the service so that neither Worldcoin nor anyone else controls the records.
This sounds good. The problem, of course, is that we have yet to find out how this will play out in reality, and there is plenty that could go wrong. For starters, the orb might have coding flaws that could let a hacker decipher all the iris scans. Or a corrupt individual at Worldcoin could modify a device to capture personal information at time of scanning. Or criminal groups could create counterfeits. And so on.
If you're curious about the specific risks posed by Worldcoin, Ethereum founder Vitalik Buterin—a privacy hawk and self-described "cypherpunk"—has published a helpful essay comparing the company's approach to other services that are using either biometric tools or trusted networks of people to verify identities.
His conclusion is that Worldcoin is making a worthy attempt to solve a very difficult problem but that the project still does pose some very real risks—as do other proposed solutions. The upshot is that, if you have an active fear of living in a sci-fi dystopia, you probably shouldn't sign up for this thing. At the same time, though, the company should get points for trying—and, for now at least, deserves the benefit of the doubt.
Jeff John Roberts
jeff.roberts@fortune.com
@jeffjohnroberts
