Fun

Worldcoin: Trail of Bits audit shows no vulnerability for Orb software

News Feed - 2024-03-14 11:03:36

Christopher Roark9 hours agoWorldcoin: Trail of Bits audit shows no vulnerability for Orb softwareA third-party project audit reportedly claimed that Orb devices do not record users’ iris codes onto persistent memory and only transmit codes through end-to-end encrypted messaging.11331 Total views2 Total sharesListen to article 0:00NewsOwn this piece of crypto historyCollect this article as NFTJoin us on social networksHuman identity project Worldcoin has obtained a third-party audit of its Orb software, according to a draft of a March 14 report from the development team seen by Cointelegraph. The audit was performed by Trail of Bits, which claimed to have found no vulnerabilities that “can be directly exploited in relation to the Project Goals as described,” the report stated. The full Trail of Bits report is expected to be published on March 14, according to an emailed statement from Worldcoin.


Worldcoin allows people to verify their humanity by registering with a phone number or email address or by having their iris scanned by an Orb device. When a user performs this registration, they obtain a “World ID” that can be used to prove they are an actual human. The project was co-founded by Sam Altman, who also co-founded ChatGPT developer OpenAI. Altman claimed that he helped to create Worldcoin out of fear that artificial intelligence (AI) bots may soon be able to pose as humans effectively.Source: Worldcoin on X


Privacy advocates have criticized Worldcoin on the grounds that it risks leaking users’ iris scans to hackers or governments. These iris scans could potentially be used to reveal all of the activity a person performs with their World ID.


Related:Spanish court denies Worldcoin’s injunction request against regulator


According to the report from Worldcoin, Trail of Bits began its assessment on Aug. 14, 2023. The security firm was given version 3.1.10, which was “frozen” for assessment purposes on July 8, 2023. The current version is 4.0.34, the report stated.


The auditors reportedly spent six weeks investigating the code for any potential vulnerabilities. They considered several attack vectors that a hacker could use to obtain a user’s iris scan but ultimately concluded that “our analysis did not uncover vulnerabilities in the Orb’s code that can be directly exploited in relation to the Project Goals as described.” Specifically, the auditors concluded that an attacker could not obtain the user’s iris code unless the attacker has control of one of the trusted certificates. They reportedly stated:“We believe the iris code is not written to persistent storage on the Orb and that it is included only in a single request to the Orb’s back end [...] [W]hile this configuration can be improved to make it more secure (TOB-ORB-10), it should not be possible for typical attackers to extract the iris code from the Orb’s network traffic; the attacker would have to be in control of one of the trusted certificates.”


According to the report, the auditors did make two recommendations to improve the Orb’s security. The first was to “harden” the configuration for the signup flow to ensure that future changes do not introduce security issues. The second was to replace the ZBar library used to scan QR codes during signup with a pure Rust version. The auditors claimed that ZBar might have “memory safety” issues that could leak configuration data, such as the user’s “data custody choice,” if this change was not made. The Worldcoin team implemented both of the suggested changes, the report stated.


The debate over Worldcoin’s privacy practices may continue for some time. On March 6, Spain’s Agency for the Protection of Data issued an injunction against the project, claiming that the agency needed time to investigate claims that Worldcoin violated data protection laws. In response, Worldcoin claimed that it did not violate these laws and that the Spanish government was “circumventing EU law” by issuing the injunction.# Blockchain# Privacy# Identity# AI# Worldcoin# RegulationAdd reactionAdd reactionRead moreLazarus Group moves $12M from HTX, HECO hacks to Tornado CashData privacy and security concerns worry nearly half of tech industry consumers: ReportNigerian crypto community split over govt’s bid for Binance user data

News Feed

Rammstein Vocalist in Conflict With Russian Museum Over Unauthorized NFT Sale
Rammstein Vocalist in Conflict With Russian Museum Over Unauthorized NFT Sale Till Lindemann, lead singer of the German metal band Rammstein, has angered Russia&
Easily Spend Your Bitcoin via Prepaid Debit Card or a PayPal Account with Bitcoin of America’s Easy to Use Trading Platform
Easily Spend Your Bitcoin via Prepaid Debit Card or a PayPal Account with Bitcoin of America’s Easy to Use Trading PlatformBitcoin of Americaoffers a number of convenient ways to
Dogecoin’s Fate Hinges On This Price Level, Analysts Agree
Reason to trust Strict editorial policy that focuses on accuracy, relevance, and impartiality Created by industry experts and meticulously reviewed The highest standards in reporting and pu
Portugal elections: Is the country’s crypto-friendly status at stake?
Daniel Ramirez-Escudero7 hours agoPortugal elections: Is the country’s crypto-friendly status at stake?Portugal’s general elections are crucial for the country’s blockchain and digital assets industry.1238 Total vi
9 Crypto Predictions For 2025: Nansen CEO Predicts Biggest Bull Run Ever
Este artículo también está disponible en español. In a thread on X, Alex Svanevik, CEO of leading on-chain analytics platform Nansen, unveiled nine bold predictions for t
Ana Paula PereiraJul 15, 2023‘Multichain was a big blow,’ says Andre Cronje as Fantom TVL slumpsFantom’s TVL dropped from over $364 million in early May to about $70 million on July 14. At its peak in 2022, Fantom
Crypto VCs see ‘big opportunities’ with L2 interoperability, but not AI
Robert D. Knight10 hours agoCrypto VCs see ‘big opportunities’ with L2 interoperability, but not AICointelegraph spoke to VCs to find out which sectors they’re currently interested in, as investments increased in Q
Dogecoin Cofounder Faces Harassment While ‘Meme Coin’ Hype Trends Among Investors
Dogecoin Cofounder Faces Harassment While "Meme Coin" Hype Trends Among Investors As dogecoin’s frenzy keeps making the headlines in the crypto sphere, som
First EU country adopts quantum-resistant technology
Zoltan Vardai8 hours agoFirst EU country adopts quantum-resistant technologyThe QAN stack will serve as a key component in the country’s post-quantum security layer.2109 Total views5 Total sharesListen to article 0:00N
Lido community votes to bring stETH to BNB Chain
Vince Quill11 hours agoLido community votes to bring stETH to BNB ChainLido Finance is the market leader in Ethereum staking, claiming 28.2% of net ETH deposits.527 Total views1 Total sharesListen to article 0:00NewsOwn
Mining Hardware Manufacturer Bitfury Plans to Go Public
Mining Hardware Manufacturer Bitfury Plans to Go Public Bitfury, the non-Chinese bitcoin mining hardware manufacturer, is reportedly planning to go public in the next 12 months. Th
US Central Bank Raises Rates by Half a Percentage Point, Fed’s Powell Says Similar Hikes Are on the Table
US Central Bank Raises Rates by Half a Percentage Point, Fed"s Powell Says Similar Hikes Are on the Table The U.S. Federal Reserve raised the benchmark interest rate on Wednesday a