Fun

Worldcoin: Trail of Bits audit shows no vulnerability for Orb software

News Feed - 2024-03-14 11:03:36

Christopher Roark9 hours agoWorldcoin: Trail of Bits audit shows no vulnerability for Orb softwareA third-party project audit reportedly claimed that Orb devices do not record users’ iris codes onto persistent memory and only transmit codes through end-to-end encrypted messaging.11331 Total views2 Total sharesListen to article 0:00NewsOwn this piece of crypto historyCollect this article as NFTJoin us on social networksHuman identity project Worldcoin has obtained a third-party audit of its Orb software, according to a draft of a March 14 report from the development team seen by Cointelegraph. The audit was performed by Trail of Bits, which claimed to have found no vulnerabilities that “can be directly exploited in relation to the Project Goals as described,” the report stated. The full Trail of Bits report is expected to be published on March 14, according to an emailed statement from Worldcoin.


Worldcoin allows people to verify their humanity by registering with a phone number or email address or by having their iris scanned by an Orb device. When a user performs this registration, they obtain a “World ID” that can be used to prove they are an actual human. The project was co-founded by Sam Altman, who also co-founded ChatGPT developer OpenAI. Altman claimed that he helped to create Worldcoin out of fear that artificial intelligence (AI) bots may soon be able to pose as humans effectively.Source: Worldcoin on X


Privacy advocates have criticized Worldcoin on the grounds that it risks leaking users’ iris scans to hackers or governments. These iris scans could potentially be used to reveal all of the activity a person performs with their World ID.


Related:Spanish court denies Worldcoin’s injunction request against regulator


According to the report from Worldcoin, Trail of Bits began its assessment on Aug. 14, 2023. The security firm was given version 3.1.10, which was “frozen” for assessment purposes on July 8, 2023. The current version is 4.0.34, the report stated.


The auditors reportedly spent six weeks investigating the code for any potential vulnerabilities. They considered several attack vectors that a hacker could use to obtain a user’s iris scan but ultimately concluded that “our analysis did not uncover vulnerabilities in the Orb’s code that can be directly exploited in relation to the Project Goals as described.” Specifically, the auditors concluded that an attacker could not obtain the user’s iris code unless the attacker has control of one of the trusted certificates. They reportedly stated:“We believe the iris code is not written to persistent storage on the Orb and that it is included only in a single request to the Orb’s back end [...] [W]hile this configuration can be improved to make it more secure (TOB-ORB-10), it should not be possible for typical attackers to extract the iris code from the Orb’s network traffic; the attacker would have to be in control of one of the trusted certificates.”


According to the report, the auditors did make two recommendations to improve the Orb’s security. The first was to “harden” the configuration for the signup flow to ensure that future changes do not introduce security issues. The second was to replace the ZBar library used to scan QR codes during signup with a pure Rust version. The auditors claimed that ZBar might have “memory safety” issues that could leak configuration data, such as the user’s “data custody choice,” if this change was not made. The Worldcoin team implemented both of the suggested changes, the report stated.


The debate over Worldcoin’s privacy practices may continue for some time. On March 6, Spain’s Agency for the Protection of Data issued an injunction against the project, claiming that the agency needed time to investigate claims that Worldcoin violated data protection laws. In response, Worldcoin claimed that it did not violate these laws and that the Spanish government was “circumventing EU law” by issuing the injunction.# Blockchain# Privacy# Identity# AI# Worldcoin# RegulationAdd reactionAdd reactionRead moreLazarus Group moves $12M from HTX, HECO hacks to Tornado CashData privacy and security concerns worry nearly half of tech industry consumers: ReportNigerian crypto community split over govt’s bid for Binance user data

News Feed

Crypto Burner Wallets Helped an IT Conference Give $40,000 to Charity
Data analytics giant Splunk raised $40,000 for charity from 10,000 attendees at its annual conference in Las Vegas last week by gifting everyone an ethereum-based blockchain wallet, in what became showcase for the powe
SEC Strategic Plan: Crypto Initiatives Among Top Priorities Over Next 4 Years
SEC Strategic Plan: Crypto Initiatives Among Top Priorities Over Next 4 Years The U.S. Securities and Exchange Commission (SEC) has revealed some initiatives involving crypto asset
Kadena Goes Live, Announces New Token Sale Aiming for $20 Million
The Kadena blockchain went live on mainnet Monday. Formally called Chainweb, Kadena’s blockchain is a proof-of-work (PoW) network similar to bitcoin.
Philippines adopts Tether’s USDT for social security payments
Prashant Jha13 hours agoPhilippines adopts Tether’s USDT for social security paymentsThe Social Security System is a state-run social insurance program that serves employees in the official, informal and private sector
Elon Musk Says Bitcoin Suitable for Store of Value, Dogecoin for Transactions as Time Names Him Person of the Year
Elon Musk Says Bitcoin Suitable for Store of Value, Dogecoin for Transactions as Time Names Him Person of the Year Tesla CEO Elon Musk, who has been named Time Magazine’s Pe
Dogecoin Price Marks Local Bottom, Can Price Run 100% From Here Again?
Este artículo también está disponible en español. Crypto analyst Trader Tardigradehas revealed that the Dogecoin price has marked a local bottom. He further provided insi
Court Ruling Threatens 17 Crypto Exchanges in Russia
Court Ruling Threatens 17 Crypto Exchanges in Russia Another batch of Russian online crypto exchanges in Russia face closure following a recent decision by a regional court. Inform
Lebanon Fights for Separation of Money and State as Residents Use Bitcoin to Evade Capital Controls
Lebanon Fights for Separation of Money and State as Residents Use Bitcoin to Evade Capital Controls Mass unrest in Lebanon due to allegations of political corruption and heavy ha
Dogecoin Breaking Out Of Falling Wedge Pattern – Analyst Reveals Target
Este artículo también está disponible en español. Dogecoin (DOGE) is consolidating below local highs after an impressive 200% surge over the past two weeks. As the bigges
Bitcoin falls below $58K on Coinbase, first time in 2 months
Tom Mitchelhill5 hours agoBitcoin falls below $58K on Coinbase, first time in 2 monthsThe price of Bitcoin briefly dropped to $57,874 amid a wider sell-off in the crypto market, while $54.9 million in Bitcoin long positi
Telegram Rejects SEC Request to Hand Over Bank Records for TON
Telegram Rejects SEC Request to Hand Over Bank Records for TON Telegram Group, the company behind the TON blockchain project, has reportedly refused to share information with the
Judge approves delaying forfeiture of donations from FTX-funded PACs
Turner Wright5 hours agoJudge approves delaying forfeiture of donations from FTX-funded PACsFormer FTX CEO Sam Bankman-Fried reportedly donated roughly $40 million directly to political candidates and PACs in 2022 before