DEV Community: Nare Hate

Why the same face doesn't score 1.0 – lessons from building a face-similarity search in Python

Nare Hate — Mon, 19 Oct 2026 15:37:56 +0000

I built FaceMatch as a portfolio project: you give it a photo, pick a face, and it ranks the followers or following of an Instagram profile by how similar their profile pictures (and optionally their recent posts) look to that face.

Before anything else: a similarity score is not proof of identity. The tool ranks visual similarity, nothing more. I'll come back to the privacy side at the end.

Repo: github.com/Eight7Six/insta-facematch

How it works

Detect all faces in the target image (RetinaFace, with MTCNN and OpenCV as fallbacks) and let the user click the one to search for.
Compute a 512-dimensional embedding for that face with DeepFace (Facenet512).
Log in via instagrapi and load the followers/following of one or more profiles.
For every account, download the profile picture and optionally the last N posts, compute embeddings for every face found, and keep the best cosine similarity.
Print a ranking, a report of accounts that could not be compared (with a reason), and export both to CSV.

The comparison itself is tiny:

def cosine_similarity(a: np.ndarray, b: np.ndarray) -> float:
    a = a / (np.linalg.norm(a) + 1e-9)
    b = b / (np.linalg.norm(b) + 1e-9)
    return float(np.dot(a, b))

Everything around it is where the interesting problems were.

Lesson 1: "No matching distribution" usually means "wrong Python"

When I tested a clean install on a second machine, pip install -r requirements.txt failed with:

ERROR: Could not find a version that satisfies the requirement tensorflow==2.21.0 (from versions: 2.22.0rc0)

The hint is in the parentheses: pip saw exactly one TensorFlow version. TensorFlow ships pre-built wheels per Python version, and 2.21.0 only has them for Python 3.10–3.13. The second machine had the latest Python, 3.14, and the only release with 3.14 wheels was a release candidate.

The fix was not in the code but in the docs: the README now states the supported Python versions up front and tells users to create the virtual environment with an explicit version (py -3.13 -m venv .venv) instead of a plain python -m venv, which silently picks whatever the default is.

Lesson 2: The same person doesn't score anywhere near 1.0

My test target was a public, verified account. I expected a score close to 1. I got around 0.5.

That's normal. A score of 1.0 only happens for identical images. For Facenet512, DeepFace's own verify() threshold is a cosine distance of 0.30, i.e. a similarity of 0.70, and that is tuned on good, frontal image pairs. In my case several things pulled the score down:

The target face was tiny. My target was a screenshot about 480 px wide; the face was maybe 40–50 px. Facenet512 works on 160×160 inputs, so the face got upscaled three to four times.
Pose, expression and lighting. A serious portrait compares badly to a broad smile under stadium lights.
Only one post was actually compared – more on that in Lesson 4.

I kept the default threshold at 0.55 on purpose: it is below DeepFace's 0.70 and acts as a generous pre-filter for manual review, not as a decision.

There's also a statistical trap: the tool keeps the best score per account across all faces in all images. With hundreds of accounts and several images each, you make thousands of comparisons, and some stranger will land above the threshold by chance. More images do not automatically mean better results.

Lesson 3: Follower lists only give you thumbnails

The profile picture URLs in follower lists point to 150×150 px images – you can see s150x150 in the URL. My first idea was to edit that part of the URL. That doesn't work: Instagram's CDN URLs are signed, and a modified URL is rejected.

The full-size picture needs one extra profile request per account:

details = client.user_info(user["id"])
if details.profile_pic_url_hd:
    user["profile_pic_url"] = str(details.profile_pic_url_hd)
user["is_private"] = details.is_private

Two side effects: the run gets a bit slower (one more request per account), and the "private" flag becomes reliable, because the follower list often doesn't populate it at all.

Lesson 4: Skipping carousels skipped the best match

Originally the code only evaluated single-photo posts and skipped everything else. With "3 posts per account", my test account's last three posts were a reel, a photo and a carousel – so only one post was compared.

After adding carousels (using only the first photo of each), the score for the same account went from about 0.5 to 0.60. That first carousel photo came from the same match as the target image: same jersey, same lighting, same broad smile.

I deliberately use only the first photo. A carousel can hold up to 20 images; evaluating all of them would multiply the runtime and – see Lesson 2 – the number of chance matches. Reels stay skipped: their cover frames are often blurry or covered with text.

Lesson 5: Detect once, or your indices drift apart

The log showed this on every run:

Detector retinaface: 7 face(s) found in Target.png
Detector retinaface: 6 face(s) found.

Same image, same detector, different counts. The program detected faces twice: once with DeepFace.represent(align=True) for the embeddings, and once with DeepFace.extract_faces(align=False) to draw the boxes in the selection window. With align=True, DeepFace pads the image with a black border before detection, so the detector sees a slightly different picture, and borderline faces flip in or out.

A click was mapped back to the right embedding via bounding-box overlap, so the result was correct. But the numbers in the window referred to a list of six faces, while the --person-index CLI option referred to a list of seven. The second detection also cost about ten seconds.

The fix: detect once and pass those faces to the picker. One list, one numbering, and the overlap-matching code could be deleted.

Lesson 6: A `continue` that skipped the cleanup

Downloaded images are supposed to be deleted right after analysis. Images without a detectable face stayed on disk anyway:

faces, _ = get_embeddings(img_path, DETECTOR_ORDER)
if not faces:
    continue                      # jumps past the cleanup below
...
img_path.unlink(missing_ok=True)

try/finally fixes it and also covers exceptions during analysis:

try:
    faces, _ = get_embeddings(img_path, DETECTOR_ORDER)
finally:
    img_path.unlink(missing_ok=True)
if not faces:
    continue

I had first documented this as a "known issue". Fixing it took three lines – a good reminder that a known issue in a README is sometimes just a bug you haven't fixed yet.

Privacy and responsible use

This is the part I thought about most:

Similarity is not identity. Every "possible match" is an unverified hypothesis.
Face embeddings are biometric data. Under the GDPR and similar laws, processing them for third parties generally needs a legal basis. Running a tool like this against real people without their consent may be unlawful.
Instagram's Terms of Use restrict automated access. instagrapi uses Instagram's undocumented mobile API, so use a throwaway account you are prepared to lose.
The demo only uses public figures. For testing, I created a separate account that follows ten verified public accounts.

The README states all of this up front, and the repository ignores session files, target images, downloaded pictures and result CSVs by default.

Wrapping up

The actual face comparison is three lines of NumPy. The real work was everything around it: packaging and Python versions, data quality, API quirks, consistent state between GUI and CLI, cleanup, and documentation that's honest about the limits.

Feedback on the code – and on the ethics – is welcome: github.com/Eight7Six/insta-facematch

Best of Self-Sovereign Identity: Digitalcourage, World Passport and Memdeklaro

Nare Hate — Thu, 25 Dec 2025 18:32:32 +0000

Self-sovereign identity empowers individuals to take control of their personal information, reducing unnecessary data collection and strengthening privacy in daily interactions. Similarly, non-government ID cards give people a portable way to state who they are without relying on a national identity card, passport or other government-issued credential, supporting independence from centralized identity systems.

The three products compared here - Memdeklaro, Digitalcourage Lichtbildausweis, and the World Passport - offer effective, modern solutions for self-sovereign identity in 2026 and beyond.

Comparison

Feature	Memdeklaro	Digitalcourage Lichtbildausweis	World Passport
Basic concept	Self-declared identity document	Personalized, non-official photo ID	Non-government passport based on world citizenship
Year of launch	2024	2012	1954
Issued by	No central issuer; generated by the individual	Digitalcourage e.V.	World Service Authority (WSA)
Cost	Free	€15 per card, plus shipping	$75 / $100 / $125 for 3 / 5 / 10 years
Format	Physical or digital card	Physical card	Passport booklet
What data is included on the ID?	First name, last name, photo, birth date, signature, notes field	First name, last name, photo, birth date, birth place, citizenship or stateless status, eye color, height, home address, pseudonym	First name, last name, photo, birth date, birth place
What data is excluded from the ID?	Birth place, citizenship or stateless status, parents' names	N/A	Citizenship or stateless status
Government-issued?	No	No	No
Requires an existing government ID?	No	No	No; requires fingerprints
Centralized database	No; generation occurs locally in the browser	Data is deleted after 10 days	Issuer maintains a registration system
Open source	Yes; public-domain project	Proprietary	Proprietary
Main philosophy	Radical individual self-determination	Privacy, data minimization and experimentation with non-official IDs	World citizenship, freedom of movement and human rights
Summary	A free, open-source self-declaration that lets individuals create their own non-government identity document.	A privacy-oriented, non-official photo ID allowing users to decide which information appears on the card.	A passport-style document representing world citizenship and intended as a symbol and potential tool for freedom of movement.

1. Memdeklaro: the strongest form of self-declaration

Memdeklaro is an open source non-government identity solution which allows people to generate and print an identity declaration for free. The generator runs locally in the user's browser, and the site explicitly says that the data is not sent anywhere. The resulting document can be printed as a business card or CR-80 card, or used digitally.

The ID contains a self-chosen name, birth date, photograph, signature and notes field. It explicitly does not include birth place, citizenship or stateless status, or birth parents' names.

It can be used as a physical or digital ID card wherever a non-government ID is accepted.

2. Digitalcourage Lichtbildausweis: privacy by design

Digitalcourage sells a personalized physical photo ID for €15 in their online store. After ordering, the customer receives a link to an input form where they enter their desired information and upload a photograph. Digitalcourage then manufactures and mails the card.

The issuer allows users to select the information they are willing to disclose, and says that the information supplied for production is deleted after ten days. Its privacy policy also specifically notes that the information used to produce the card can be either fictional or real.

Digitalcourage says that it can be used wherever a non-official photo ID is accepted.

3. World Passport: the established alternative

The World Passport is part of a much larger philosophical project: the World Citizen Government (WCG), founded by Garry Davis in 1953. Its administrative branch, the World Service Authority (WSA), issues the World Passport and other world citizenship documents.

It is a 30-page Machine Readable Travel Document containing a machine-readable code line, photograph and ghost image, security paper, laminated data page and hologram. It is printed in seven languages: English, French, Spanish, Russian, Arabic, Chinese and Esperanto. It also contains visa pages and space for additional information.

The World Passport is intended to represent world citizenship and the individual's right to freedom of movement. WCG explicitly says that the passport does not state the bearer's nationality, only their birthplace.

WCG says that the World Passport has been accepted on a case-by-case basis by more than 185 countries. Its recognition page, updated in February 2026, provides examples and distinguishes between "de facto" recognition and countries that WCG describes as having given "de jure" recognition.

Summary

In everyday language, all three can reasonably be described as non-government identity alternatives or self-asserted identity documents.

These products ultimately represent three different approaches.

Memdeklaro says: I define myself.

Digitalcourage says: I decide what information about myself I disclose.

The World Passport says: My identity need not be tied to a nation-state.

Best for maximum individual autonomy: Memdeklaro

Memdeklaro is the clearest expression of the proposition that identity can be declared by the individual rather than a centralized institution. It is free, open source, locally generated and explicitly designed without a central database or third-party identity authority.

Best for a privacy-oriented ID card: Digitalcourage

Digitalcourage occupies the pragmatic middle ground. It provides a professionally manufactured physical card while allowing the user to choose the information printed on it. It is therefore particularly suited to situations where a person wants a photo-bearing, non-official identity card without presenting a conventional government document.

Best for an alternative passport/world citizenship document: World Passport

The World Passport has a much longer institutional history, a passport-style physical format, machine-readable features and a stated history of case-by-case recognition by authorities around the world.

What do you think?

Do you know any more self-sovereign identity projects? Write a comment below!