Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy-preserving age and identity verification via anonymous credentials

blog.cryptographyengineering.com

Post reply on HN
Print view View original

21–30 of 64 posts

Re: Privacy-preserving age and identity verification via anonymous credentials

#21

Post by matthewdgreen »

2Gkashmiri wrote: post #11
lachiflippi wrote: post #8

I've been really enjoying all these articles proposing solutions to anonymous age verification, mainly because most of them are written as if this has never been implemented in the real world. German IDs support age verification that just returns a yes/no response to the question "is this user above the age of 18," and not a single service in the entire country supports it. Anonymous age verification isn't a technica…

I remember reading in tech magazines about the "foss" acheivement which went on to become Aadhar. Remember this was prior to 2007 I think. The idea was your id would be an autehnticator of sorts. You need to verify yourself, the website asks Aadhar if the person is genuine, the website returns binary yes no. Same for you, is gender male? Or ages above 18? They would not return any other data. In the end, it became ju…

The problem with these "yes/no" systems is that they also involve the websites you visit calling up a centralized party and asking if you're old enough. This is fine if the websites aren't interested (or if you really trust your government with your web browsing history), but gets unfortunate if you don't want to share that information.

Re: Privacy-preserving age and identity verification via anonymous credentials

#22

Post by hirsin »

nijave wrote: post #17
lachiflippi wrote: post #8

I've been really enjoying all these articles proposing solutions to anonymous age verification, mainly because most of them are written as if this has never been implemented in the real world. German IDs support age verification that just returns a yes/no response to the question "is this user above the age of 18," and not a single service in the entire country supports it. Anonymous age verification isn't a technica…

I wish all governments would just run identity services and mandate usages that return anonymous attestations. Age being the most obvious attestation but something like residence status could also be useful. Something as simple as a JWT with claims (and random uuid id) would work

It can't be quite that simple because you have a couple additional problems to solve - (effectively restating bits of the article poorly and partially)

1. You don't want these to be replayable (give your JWT to someone else to use) so they need to be bounded in some ways (eg intended website, time, proof it came from you and not someone else).

2. You don't want the government to know which website you're going to, nor allow the government and the website to collaborate to deanonymize you (or have the government force a website to turn over the list of tokens they got). So the government can't just hand you a uuid that the website could hand back to them to deanonymize.

The SD JWT and related specs solve for these, which is how mDL and other digital IDs can preserve privacy in this situation.

Re: Privacy-preserving age and identity verification via anonymous credentials

#23

Post by txrx0000 »

b112 wrote: post #19
txrx0000 wrote: post #18

If the goal was to protect the children, there are much simpler solutions. But for whatever reason, companies and governments are avoiding the simple solutions like the plague. Let me explain the simple solutions: Don't let phone manufacturers lock the bootloader on phones. Let the device owner lock it themselves with a password if they want to. Someone will make a kid-friendly OS if there is market demand and tech-s…

Where's the profit. One must be a realist. If there is no profit motive, it won't happen. Ever. One profit motive is "the government has regulations, I will be fined if I don't do this". Another is "my competitors do it, and people buy their stuff because of it". All the technical solutions are easy. And you're right, it's not about age verification, it's about profits. The same way cars are regulated to have air bag…

Profit does not drive all. There are other valuable things besides money. A healthy society must regulate shortsighted profit-seeking and power-seeking. That's what these conversations are for.

Re: Privacy-preserving age and identity verification via anonymous credentials

#24

Post by 3RTB297 »

lachiflippi wrote: post #8

I've been really enjoying all these articles proposing solutions to anonymous age verification, mainly because most of them are written as if this has never been implemented in the real world. German IDs support age verification that just returns a yes/no response to the question "is this user above the age of 18," and not a single service in the entire country supports it. Anonymous age verification isn't a technica…

This is immensely counter-intuitive to many Americans. They wrongly assume that digital IDs are some Biblical apocalyptic level invasion of privacy, when every state ID database is already 1) linked to Federal ones, and 2) full of the same data on your driver's license anyway.

I've tried to explain this to people, that a digital ID done well is better than the fraud-enabling 1960's hodgepodge in use that has served fraudsters better than citizens for 30 years. They set their teeth and refuse based on use of the word "digital" in the title alone.

It will take generational change for the US to get something as banal as a digital ID already in use in dozens of countries, for no other reason than mindless panic over misunderstanding everything about digital ID systems, how IDs even work, and how governments work.

Re: Privacy-preserving age and identity verification via anonymous credentials

#25

Post by chocmake »

lachiflippi wrote: post #8

I've been really enjoying all these articles proposing solutions to anonymous age verification, mainly because most of them are written as if this has never been implemented in the real world. German IDs support age verification that just returns a yes/no response to the question "is this user above the age of 18," and not a single service in the entire country supports it. Anonymous age verification isn't a technica…

If it is the case that German IDs supporting selective disclosure aren't seeing adoption for services then it needs to looked at what the friction is or even just because it's optional. It doesn't necessarily have to be an ulterior motive. It'd be easy to be called out as conspiratorial otherwise.

Right now with age assurance laws and online services there has been no singular approach beside falling back to use of government ID that any country has required. Each country has just said 'here are the minimum criteria, choose what you want' and left it up to services to comply.

So what have services chosen? The least friction and cheapest existing solution to be compliant. For most services that's been using readily available facial scanning services and government IDs as fallback. Not all of them of course but it's so scattered that it makes it difficult for a person to know what they'll need for one service vs another (and perhaps even avoid use of a service if their approach doesn't align with the person's values).

Without mandating better minimum privacy criteria governments can just point to the fact they're not preventing such tech from being used and leave it at that. But solutions also need to be affordable to adopt for a wide range of sites/services and have good support (interfaces, etc) around them to catch on so it's not just entirely whether tech exists per se.

Re: Privacy-preserving age and identity verification via anonymous credentials

#26

Post by dabber21 »

lachiflippi wrote: post #8

I've been really enjoying all these articles proposing solutions to anonymous age verification, mainly because most of them are written as if this has never been implemented in the real world. German IDs support age verification that just returns a yes/no response to the question "is this user above the age of 18," and not a single service in the entire country supports it. Anonymous age verification isn't a technica…

I just recently used my ID to register for a lottery website using the AusweissApp the first setup was a bit annoying, but once you are registered its actually easy to use and apparently you don't even need a phone you can use a card reader on your PC as well

Re: Privacy-preserving age and identity verification via anonymous credentials

#28

Post by ReptileMan »

Can anything from this scheme prevent the issuer from figuring out that I have verified my age to a site? If the answer is no, it is once again a non starter. Both the government and the site shouldn't know who the age verified person is and both shouldn't be able to deanonymize them even if they collude.

Re: Privacy-preserving age and identity verification via anonymous credentials

#29

Post by sanex »

jaimex2 wrote: post #16
zug_zug wrote: post #12

Earlier quoted context omitted.

All the more reason for us to get out an actual implementation of age verification that IS anonymous first, so that when a law is pushed for or passed, companies can adopt the anonymous implementation.

No, there's no compromise here. Anyone pushing for age verification or going along with it needs to get replaced by a service that is immune to government overreach.

Some of us do see value in age and identity verification if the anonymity problem is solved so I very much disagree.

Re: Privacy-preserving age and identity verification via anonymous credentials

#30

Post by ReptileMan »

lachiflippi wrote: post #8

I've been really enjoying all these articles proposing solutions to anonymous age verification, mainly because most of them are written as if this has never been implemented in the real world. German IDs support age verification that just returns a yes/no response to the question "is this user above the age of 18," and not a single service in the entire country supports it. Anonymous age verification isn't a technica…

>Anonymous age verification

Anonymity from whom? Does the German government doesn't know that Gunter Shmidt has just verified his age to the site GreatBDSMPartiesInBerlinForDragQueens.com ? Even if they obtain the logs from the site?

Post reply on HN