Iris Scan: Eye Codes Sell for $30 and Can Never Be Replaced

Somewhere in Cambodia and Kenya, people sold pictures of their own eyes for crypto. Then fraudsters turned around and offered those iris scans for less than thirty dollars each. A part of your body that you can never replace was priced like a pizza.

If you've ever unlocked a phone with your face, or

If you've ever unlocked a phone with your face, or walked through an airport scanner, you've handed over a piece of your body to a machine. Most of us just trust that it's locked away somewhere safe. If that makes you uneasy, that's a reasonable reaction. Today we'll look at why the iris is considered the gold standard of biometrics, and why that same strength becomes a problem when the data leaks. So how can something so secure end up for sale?

Start with what a scanner actually sees. The colored ring around your pupil is covered in tiny ridges, furrows, and specks. According to the research brief, there are more than two hundred distinguishable features in there. A camera using near-infrared light photographs your eye from about ten to forty centimeters away. Then software turns that pattern into a string of numbers. That string is called a template, and it's only five hundred and twelve bytes. That's smaller than a short text message.

Why do people trust it so much? Because the odds of two irises matching are about one in ten to the seventy-eighth power. That's a one followed by seventy-eight zeros. A fingerprint comparison uses sixty to seventy points. The iris is in a different league. According to Cambridge University's John Daugman, about sixty million people from some hundred and seventy nationalities have already been enrolled in iris systems.

It's unique, and it's everywhere

So it's unique, and it's everywhere. Does that mean it can't fail?

That's the common belief, and it's an easy one to hold. When someone tells you the odds are one in a number with seventy-eight zeros, it sounds unbeatable. But uniqueness and security are two different things. Uniqueness tells you how special the target is. Security tells you how well that target is defended.

Academic testing shows the gap. According to research reported by the Electronic Frontier Foundation, researchers built fake iris images from real iris data. In the tests, about forty percent of those synthetic images fooled the sensor. Under certain attack conditions, as many as ninety percent of the systems tested were duped. Those were lab conditions. But they were repeatable.

Remember that tiny template

Remember that tiny template? Secure systems store the template instead of a photo. You'd expect that to be safe. But researchers have shown that a stolen template could potentially be used to rebuild a fake iris image. The numbers can be turned back into something that fools a scanner.

For a bank or a border agency, that's a serious flaw. For the rest of us, it means "we only store math" isn't the same as "your eye is safe."

Now back to that thirty-dollar price tag. According to Biometric Update, those scans were collected through legitimate programs that paid people in crypto for scanning their eyes. Then the data was resold. One cybersecurity firm, Skyone, reports that complete biometric profiles, with face, iris, and fingerprints, can sell for up to five hundred dollars on dark web marketplaces.