Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

blog.google

Post reply on HN
Print view View original

191–200 of 302 posts

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#191

Post by mindslight »

miki123211 wrote: post #92
Groxx wrote: post #13

I've been trying to figure out how zero-knowledge stuff would work in practice for age verification, where "when issued" (or extremely coarse, like what year), "to whom", and "where it's used" are hidden from everyone except the individual holding the proof (since that's the gold standard, and the only one worth accepting). I get that ZK techniques work, and reveal "nothing". That's useful. But if they reveal nothing…

That's where trusted computing comes in. Your proof proves two claims. That the person proving their age is over 18, and that they're using a device and software that hasn't been tampered with. That software requires human presence at every age check. ZKPs for age assurance are trading off privacy at the expense of software malleability. Note that this has nothing to do with open source; it's perfectly fine to releas…

> Note that this has nothing to do with open source; it's perfectly fine to release the source code for the relevant software. You can even allow for reproducible builds and full auditability if that's what you want.

But note that it does have everything to do with software freedom. Being able to read the source is little consolation if you're unable to modify it. And preventing users from using modified software is the entire point of remote attestation.

"Zero-Knowledge Proof" based schemes for this problem is nothing more than a marketing scheme by Google to continue locking down devices and the previously-open web ala WEI, SafetyNet, etc. https://news.ycombinator.com/item?id=48760232

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#192

Post by amwet »

ortichic wrote: post #184

Lots of bias in this thread. But maybe we can have a technical discussion? I'm not into this topic, so maybe someone else can answer this: How "zero-knowledge" is this actually? As far as I understand, there are three parties here: 1. Me, the user; 2. The site I want to access; 3. The attestor (google? my government?). What do they know about each other? Does the site know who I am? Does the site know who my attestor…

I have some experience with zkp, so I’ll try to answer your question to the best off my ability. First on the terminology, the “attester” in this case I assume is whoever is anchoring the data or issued the credential you’re trying to prove. For the canonical example, let’s say you’re trying to prove age >= n via a government ID.

1. The site does not know who you are. This is the whole point. You generate a mathematical proof you possess a valid government ID that says “age >= n”

2. Yes. You are generating a zkp based on information anchored by the attester. In this case the ID issuing gov. That attester can be something other than a gov, but zkps are a bit useless if the site doesn’t know what exactly is being proved. In this case you are proving “I possess a government ID saying age >=n”. You must know about the government to care about this proof.

3. Not in this case. The attester only knows it has issued you an ID, but does not need to be further consulted. You could certainly construct a scheme such that you require a ZKP of recent written permission from some entity, but this is not inherent to ZKPs.

4. This is a UX question. If the ZK wallet and website are implemented in such a way that it’s always displayed when a credential is requested and what credential that is, then yes.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#193

Post by sigmoid10 »

M95D wrote: post #151
sigmoid10 wrote: post #120

Earlier quoted context omitted.

>It is suspicious to me that "age assurance" is trending EXACTLY as AI agents become capable of autonomously operating It is not, because your premise is false. This whole thing has been going on for as long as kids have been online. The early 2000s tried (and obviously failed) by using credit cards. The UK tried and failed last decade to ban porn for minors this way. AI tools are probably not even on the radar for t…

> AI tools are probably not even on the radar for the kind of politicians that keep pushing this. Forget about the politicians for a bit. There still are many regions on the globe where no age verification is mandatory, yet websites chose to implement it anyway. Why, if not for tracking and bots?

Well, because of things like COPPA I imagine most companies wouldn't want to risk anything here. So unless you have a website that is somehow guaranteed 100% blocking all traffic from the US or American citizens, you may as well implement it. But very few (if any) public websites will fall into that category.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#194

Post by tzs »

IshKebab wrote: post #122
skybrian wrote: post #115

Earlier quoted context omitted.

Websites should have an easy way to check whether the connecting device has a child lock turned on. We don’t need to identify the person using the device at all. It should be up to parents to make sure their kids use device that are locked.

This is clearly the right way to do things. Just make devices have a forced choice for their age setting on initial setup, and expose that to apps and websites. Insane that they didn't even try this simple solution first. Yeah people will get around it, but they'll get around any solution.

That’s what the California law does.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#195

Post by cortic »

Gigachad wrote: post #49
echelon wrote: post #34

Earlier quoted context omitted.

We need to stop this helicopter civilization bullshit. We're building 1984 to protect from god knows what imaginary harms. Stop putting plastic wrap around people's freedoms, liberty, and right to privacy.

The harms of smartphones and social media are about as far from imaginary as it could get. The data is screaming at us. We will look back at handing kids phones with instagram like giving kids cigarettes and think wtf were we doing.

I remember the video nasties of the 90s were 'far from imaginary dangers' for kids, before that it was rock music that the data was screaming at us about. Maybe social media does hold an actual danger this time, but we are a hysterical bunch of knee-jerk reactionary nutjobs, when it comes to new things and kids.

I wouldn't be surprised if 20 years from now we see social media as just another hysterical reaction that generated a generation of bad law, wrecking, or diminishing a number of lives, for no good reason at all.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#196

Post by tancop »

kelseyfrog wrote: post #140
Paracompact wrote: post #121

Earlier quoted context omitted.

Their argument would be, "If meth is a negative externality, we should just tax it instead of banning it in stores for kids to buy." Kids may die, but I'm sure with all that extra state revenue we'll get a nice park or museum or kickback to Tesla or something.

[flagged]

looking for me?

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#197

Post by mindslight »

ortichic wrote: post #184

Lots of bias in this thread. But maybe we can have a technical discussion? I'm not into this topic, so maybe someone else can answer this: How "zero-knowledge" is this actually? As far as I understand, there are three parties here: 1. Me, the user; 2. The site I want to access; 3. The attestor (google? my government?). What do they know about each other? Does the site know who I am? Does the site know who my attestor…

There is an important question you haven't asked: As presented, is this system secure for the implied use cases?

And the answer to that is a resounding no. As long as you can run software of your choosing, then it is trivial to proxy a zero knowledge proof such that a third party can provide proof of the given property for you to use. If the system is really zero-knowledge, then that third party will suffer no repercussions for defeating the purpose of the system. And we can easily imagine people willing to provide this service (for ideological reasons and/or simply payment).

To be secure, all of these schemes rely on an unstated assumption of remote attestation that will prevent users from running their own software. Locking down computing is Google's basic agenda, but saying this would make the systems less appealing to people, so they obviously downplay it.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#198

Post by tzs »

nerdsniper wrote: post #137
dadoum wrote: post #10

Still, I don't want to gate people based on age. Parents should at least be able to overwrite the age of their child, maybe selectively allow bypasses. My experience with a computer would have been completely different if I was blocked from half of the internet. Especially when I see which kind of content gets blocked.

I hesitate to comment on these because hundreds of comments have already said it and I don't have anything new to add. - The age-gate should just be a setting on the device: either over 18 or under 18. Websites/apps should at most only be legally required to respect the device's assertions. - Devices should be controllable by parents: let the parents decide whether the child should be age-restricted or not. - Devices…

That’s pretty close to the California law.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#199

Post by like_any_other »

Nevermark wrote: post #128

If you need personalized government attestation to visit a site, then the government has the ability to dynamically deny and rescind your individual access to any site that adopts age verification, at any time. Once adult sites adopt the system, it will creep over to any site wanting to limit their liability. Banks. Business services. Eventually almost everyone. Liability the government will dramatize and escalate. Y…

> Once adult sites adopt the system, it will creep over to any site wanting to limit their liability. Banks. Business services. Eventually almost everyone.

This needs more emphasis. Once we make (even zero-knowledge) proofs convenient and common, it'll spread, and soon it won't be just age that's getting assured.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#200

Post by squidbeak »

elcritch wrote: post #180
grey-area wrote: post #106

Earlier quoted context omitted.

Yes, a lot of it involves denigrating women and an entitled and very rigid attitude towards the male place in society (alphas etc). This is incredibly toxic for young men growing up and the women they interact with. Some of the more prominent proponents are actual pimps (the Tate brothers).

How is that different than pervasive pornography though? Many young boys now think it’s normal to ask girls for sexual acts before having ever kissed a girl.

> Many young boys now think it’s normal to ask girls for sexual acts before having ever kissed a girl.

This is a common media talking point, but are there any hard figures for this 'many'? The type you're describing existed when I was young, long before the internet. My impression of boys and young men today is that they are generally just as decent, cautious, respectful and idealistic as they ever were - but that a small crude and unpleasant minority taints the reputation of the whole generation.

Post reply on HN