Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

blog.google

Post reply on HN
Print view View original

11–20 of 302 posts

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#11

Post by [deleted] »

TalkingCodeMonk wrote: post #9
emsign wrote: post #4

What's the point of giving a single point of information about yourself to a single website, when all the websites you visit use the same trackers (from Google for example) only to merge these data points together and sell them as a package.

Because of the principle of least privilege: https://wikipedia.org/wiki/Principle_of_least_privilege All current age verification measures open up a torrent of attack vectors on user PII and privacy. Limiting the number of entities that are able to access data is one of the best ways to prevent it's leak or abuse. Don't let perfection be the enemy of good. But therein lies the fundamental problem with surveillance ca…

[deleted]

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#13

Post by Groxx »

I've been trying to figure out how zero-knowledge stuff would work in practice for age verification, where "when issued" (or extremely coarse, like what year), "to whom", and "where it's used" are hidden from everyone except the individual holding the proof (since that's the gold standard, and the only one worth accepting).

I get that ZK techniques work, and reveal "nothing". That's useful.

But if they reveal nothing, isn't it wide open for abuse? Couldn't one over-18-person's proof become everyone's proof, because they can't tell it's the same proof, and the issuer can't tell where or how often the proof is being used? Or are there ways to construct data leaks that are not user-identifying but are abuse-identifying (and what would that even mean)?

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#14

Post by doginasuit »

Zero-knowledge seems to be a bit of an oversell here. It is more like you break the knowledge up and only share the relevant parts with each party. And the facilitator (Google) arguably has access to the most information out of any of the parties involved.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#15

Post by stephen_g »

consumer451 wrote: post #5
rho138 wrote: post #3

[2025]

Yes, but it's never been more important than now. Also, I did not have enough chars for an HN title.

Funny though how whenever these laws are pushed though, the legislators are more interested in strongly identifying people to gate services despite the fact that they should have plenty of advice that things like zero-knowledge proofs exist.

I hate to be cynical but I worry that this isn't going to matter, because it really seems that a lot of the pressure behind age verification isn't actually very interested in the age verification part...

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#16

Post by dgrin91 »

doginasuit wrote: post #14

Zero-knowledge seems to be a bit of an oversell here. It is more like you break the knowledge up and only share the relevant parts with each party. And the facilitator (Google) arguably has access to the most information out of any of the parties involved.

There are true ZKP setups where no one learns anything but the absolute minimum (e.g. is this person over 16, not what is their dob). This is hard to prove though and I don't know if I trust Google to do it

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#17

Post by slwvx »

doginasuit wrote: post #14

Zero-knowledge seems to be a bit of an oversell here. It is more like you break the knowledge up and only share the relevant parts with each party. And the facilitator (Google) arguably has access to the most information out of any of the parties involved.

zero-knowledge proofs are a well-known tool in cryptography [1]. All Google is sharing is the library to implement it. Google would not have access to the information any more than they have access to the bank info of people who use Android or Gmail.

[1] https://en.wikipedia.org/wiki/Zero-knowledge_proof

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#18

Post by doginasuit »

Groxx wrote: post #13

I've been trying to figure out how zero-knowledge stuff would work in practice for age verification, where "when issued" (or extremely coarse, like what year), "to whom", and "where it's used" are hidden from everyone except the individual holding the proof (since that's the gold standard, and the only one worth accepting). I get that ZK techniques work, and reveal "nothing". That's useful. But if they reveal nothing…

My understanding as someone who is just learning about the tech is that zero-knowledge isn't a great description of what is happening. The issuer (some party with the proof, like the government) shares the knowledge and that is only valid for a single verifier. So knowledge is held and is shared, just the minimum amount possible to be credible.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#19

Post by doginasuit »

dadoum wrote: post #10

Still, I don't want to gate people based on age. Parents should at least be able to overwrite the age of their child, maybe selectively allow bypasses. My experience with a computer would have been completely different if I was blocked from half of the internet. Especially when I see which kind of content gets blocked.

As a millennial-aged person I saw a fair amount of content I would not want the young people in my life to see, but it's probably not nearly as harmful as the non-age gated content that they will still have access to. There is a lot creepy youtube and tiktok content that isn't off limits but still unhealthy and my younger relatives are fascinated by it.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#20

Post by sroussey »

TalkingCodeMonk wrote: post #9
emsign wrote: post #4

What's the point of giving a single point of information about yourself to a single website, when all the websites you visit use the same trackers (from Google for example) only to merge these data points together and sell them as a package.

Because of the principle of least privilege: https://wikipedia.org/wiki/Principle_of_least_privilege All current age verification measures open up a torrent of attack vectors on user PII and privacy. Limiting the number of entities that are able to access data is one of the best ways to prevent it's leak or abuse. Don't let perfection be the enemy of good. But therein lies the fundamental problem with surveillance ca…

Google never sold user data until the DoubleClick acquisition, from what I understand
Post reply on HN