Worldcoin Implements Personal Custody for Enhanced User Data Control and Security

According to PANews, Worldcoin, co-founded by Sam Altman, announced on its official blog that it is implementing personal custody, which was initially announced during the launch of World ID 2.0. Personal data custody, or personal custody, means that the information used to generate iris codes during Orb generation and World ID verification (images, metadata, and derived data) is stored on the user's device. This approach allows users to control the flow of this data, not only for deletion but also for any future use before deletion. Previously, this information was deleted by default. In addition to giving users control, personal custody also unlocks new use cases for World ID by enabling facial authentication for high-security applications. With facial authentication, users can verify at any time that the person who obtained the World ID during Orb verification is the same person. Importantly, this works locally on the user's device without allowing the user's data to leave the phone. For Worldcoin, enabling users to control data flow through personal custody is an important step towards consolidating the project's user-centric architecture and building a more secure World ID network. Personal custody consists of four components: user devices, Orbs, data packets containing images, and temporary backend storage for transmission. Importantly, the backend cannot decrypt the user's data packets. The process works as follows: the user's phone generates a public-private key pair to encrypt its data, then transmits the public key to the backend; the backend generates an additional key for all data requiring double encryption and passes the public key to the Orb; during the verification process, the Orb creates the necessary images to verify the World ID; then, the Orb creates the user's personal data packets, encrypts them, signs them to ensure authenticity and security, and sends them to the backend before deleting the images; the user's encrypted data packets are first downloaded to their phone and then deleted from the backend.

查看原始新闻