World Open-Sources Identity Tech After 153M IDs Hit Dark Web

By Lidia Yadlos

More than 153 million driver's license scans are reportedly being offered for sale on the dark web this week, exposing one of the biggest weaknesses in online identity verification: companies routinely collect and store copies of the documents people use to prove who they are. World believes there is a better way.

The organization behind World ID has open-sourced ProveKit, technology that allows someone to prove facts about themselves, such as being over 18, holding a valid ID or having a certain nationality, without handing over the personal information behind that claim.

Instead of uploading an ID image to a company's server, ProveKit generates a cryptographic proof directly on the user's smartphone or browser. The business checking the information receives confirmation that the requirement has been met without receiving the underlying document or its other personal details.

The technology is already used within World ID. By making ProveKit open source, World is allowing developers to bring the same type of privacy-preserving verification into other apps and services.

153 Million IDs Show the Problem

The launch comes as the FBI investigates a potentially enormous identity-data exposure involving Nexus, a new dark web service reportedly offering access to more than 153 million driver's license scans belonging to people in the U.S. and Canada.

The collection reportedly extends beyond driver's licenses, with millions of additional identity and travel documents also being offered.

The source has not been definitively established, but reporting indicates the data may have originated from information collected by an identity-verification provider. That incident highlights the risk created when online businesses ask customers to upload complete identity documents.

A company may only need to know whether someone is over 18, for example, but a driver's license can expose considerably more information, including a person's full name, photograph, date of birth, address and license number.

ProveKit is designed to change that equation. If a service only needs confirmation that someone meets an age requirement, the user can prove that fact without transmitting the rest of the information contained on the ID.

Because proof generation happens locally, the underlying personal data does not need to be sent to an external server for processing.

Zero-Knowledge Proofs on a Smartphone

The technology behind that process is known as a zero-knowledge proof, a cryptographic method that allows one party to demonstrate that something is true without revealing the information used to prove it.

Historically, generating sophisticated cryptographic proofs could require significant computing resources. ProveKit has been designed to work on ordinary consumer devices.

World says proofs can be generated within seconds on a typical smartphone and in under 30 seconds on a low-end device used in its testing. The system can also operate with limited memory and supports offline use.

The toolkit targets 128-bit post-quantum security and does not require a trusted setup. It uses the WHIR hash-based commitment scheme and has been independently audited by Least Authority.

Developers can build applications using Noir, the Rust-inspired programming language developed by Aztec for zero-knowledge applications.

ProveKit's open-source repository also shows continuing development around mobile and browser-based proving.

Your ID Stays on Your Phone

Within World ID, ProveKit can verify information from NFC-enabled identity documents while keeping the underlying data on the user's device and inaccessible to World Foundation, Tools for Humanity or the service requesting verification.

That could extend well beyond crypto, including age checks, residency verification and other services that currently require users to upload sensitive documents.

ProveKit v1 is now available as production-ready open-source software, with v2 being developed to make proofs faster, smaller and more efficient.

The Nexus breach shows why that matters: if companies don't collect ID images in the first place, there is far less sensitive data available to steal.

Published on World Foundation

World Open-Sources Identity Tech After 153M IDs Hit Dark Web