Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

blog.google

Post reply on HN
Print view View original

231–240 of 302 posts

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#231

Post by rcxdude »

geek_at wrote: post #225
krunck wrote: post #220

"ZKP makes it possible for people to prove that something about them is true without exchanging any other data. So, for example, a person visiting a website can verifiably prove he or she is over 18, without sharing anything else at all." But not "...without sharing anything else even when setting up your token." Can I prove that some cryptographic token A) doesn't contain any PII and B) that the token itself can't b…

Of course not? The idea would be a government (who already has your age data for example) will allow you to create a signed message and the platform you are verifying your age to doesn't know who you are, what age you are but that you are of age

And also, crucially, that the government does not get to know what platforms you are visiting. (the process goes: you get a certificate for certain facts, then your 'ID wallet' generates a ZKP itself that can prove that you have a certificate of any subset of those facts, and neither the certificate issuer nor the receiver of that proof can link that to anything but those facts, even if they collude)

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#232

Post by mohsen1 »

ortichic wrote: post #184

Lots of bias in this thread. But maybe we can have a technical discussion? I'm not into this topic, so maybe someone else can answer this: How "zero-knowledge" is this actually? As far as I understand, there are three parties here: 1. Me, the user; 2. The site I want to access; 3. The attestor (google? my government?). What do they know about each other? Does the site know who I am? Does the site know who my attestor…

Computer Scientist Explains One Concept in 5 Levels of Difficult

https://www.youtube.com/watch?v=fOGdb1CTu5c

This video is very beautifully explains it

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#233

Post by echelon »

fwipsy wrote: post #72
echelon wrote: post #55

Earlier quoted context omitted.

> Shock sites are materially different to the harm kids do to one another This would be the "fixed" version of your comment. The social media bit is irrelevant. Kids have always been assholes to other kids. I took the school bus a few times, and the older neighborhood kids tried to chase me down, beat me, and piss on me. That was before the internet. You can't make up for other parents' bad parenting by trying to inv…

Just because you survived it doesn't mean that it's "not real harm." I am sympathetic to privacy concerns, but the downsides also need to be taken seriously and mitigated where it's possible to do so without critically compromising privacy.

When privacy disappears, liberty soon follows.

You are cheerleading the erosion of our freedom for a harm that you can't even quantify.

Tax and fine Meta for selling to kids and the social media targeting them will disappear. That is the correct solution, and it is so ridiculously easy to implement.

Instead we have insiders and lobbyists crawling out of the woodwork to suggest we place tracking of everyone's identities onto every internet ingress. That makes these companies even wealthier, but -- much worse -- it gives the government and people in power a new noose to hang us. One that they'll never give up once they obtain it.

We'll have to sign in with social credits by the time I retire, and they'll revoke your access for wrongthink and send minders to your location to reeducate you. Think that's not real? It's happening right now in other countries. It is real, and it's coming if you help them pass the laws.

STOP TRYING TO FORCE ID VERIFICATION OF ONLINE ACTIVITY.

If you do this, you're the enemy of freedom.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#234

Post by scotty79 »

tsimionescu wrote: post #209
scotty79 wrote: post #173

Earlier quoted context omitted.

Given how large it is, I don't think it's a high stat. Especially compared with other subcultures. And we don't blame feminism for every instance where a man is killed by a man hating woman.

> And we don't blame feminism for every instance where a man is killed by a man hating woman. The fact that this is basically unheard of, while incels shooting up schools is somewhat common, may explain why blame is often thrown at one movement and not the other.

[flagged]

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#235

Post by rcxdude »

krunck wrote: post #220

"ZKP makes it possible for people to prove that something about them is true without exchanging any other data. So, for example, a person visiting a website can verifiably prove he or she is over 18, without sharing anything else at all." But not "...without sharing anything else even when setting up your token." Can I prove that some cryptographic token A) doesn't contain any PII and B) that the token itself can't b…

As I understand it, ZKPs can prove both those properties. You can get a certificate from whoever is trusted to verify that you're over 18, and then you can use that to generate tokens that only encode the information 'X has verified that I am over 18' without either the original verifier or the entity you are providing it to being able to link that to the original certificate.

See section 2 of this document: https://eudi.dev/2.4.0/discussion-topics/g-zero-knowledge-pr... . If there are any objections that this is not technically feasible to achieve in practice, I would like to know what they are.

(Also, AFAIK, setting up such a thing would comply with any of the age-verification laws that are being proposed around the world. You could even set up this as two arms of the same company and be able to prove to your users that while you've seen all their IDs, you cannot link their usernames to their IDs. This still isn't the best because you're still handling their PII with associated risk of leaks but it's a lot better than anyone is doing ATM)

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#236

Post by philipallstar »

doginasuit wrote: post #170
sciencejerk wrote: post #97

Earlier quoted context omitted.

I had to Google "man-o-sphere". Is it particularly more dangerous or toxic than other identity-based activist communities? Genuinely curious to know

I would say what sets it apart is the undercurrent of anger and grievance combined with the self destructive beliefs that are prevalent in the community. It's men and boys who struggle to find acceptance and belonging, maybe even for reasons that are initially sympathetic. But instead of healthy self-reflection and feedback, they find a distorted understanding of themselves and masculinity that only reinforces their…

This is just a caricature. It's like saying all women's spaces are bad because some female influencers tell their massive followings that men should pay for expensive shopping trips on the first date. This mischaracterisation through cherry picking is destructive.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#237

Post by rcxdude »

oceansky wrote: post #214
amwet wrote: post #192

Earlier quoted context omitted.

I have some experience with zkp, so I’ll try to answer your question to the best off my ability. First on the terminology, the “attester” in this case I assume is whoever is anchoring the data or issued the credential you’re trying to prove. For the canonical example, let’s say you’re trying to prove age >= n via a government ID. 1. The site does not know who you are. This is the whole point. You generate a mathemati…

Does the "attester" knows who is requesting the information? Can they map which places requests which person?

AFAIK, If the scheme is designed properly, then no. The attestor only knows who they have issued certificates to and the verifier only knows that they have a user that has been verified by that user. Neither the attestor or the verifier can link the two any further than that, even if they collaborate.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#238

Post by rcxdude »

hoppp wrote: post #187
ortichic wrote: post #184

Lots of bias in this thread. But maybe we can have a technical discussion? I'm not into this topic, so maybe someone else can answer this: How "zero-knowledge" is this actually? As far as I understand, there are three parties here: 1. Me, the user; 2. The site I want to access; 3. The attestor (google? my government?). What do they know about each other? Does the site know who I am? Does the site know who my attestor…

Its not really possible to know. the system is valid zkp but any of the services in practice can still collect personally identifiable information from their users. There is also nothing stopping the attestor to collude with the site you want to access, to reveal information about you.

If you are controlling the middle part of the zkp (or at least can validate it), then identification should not be possible through the zkp even if the attestor and and site collude with each other (they could maybe collude based on some other information, like IP address or browser fingerprinting, ofc).

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#239

Post by rcxdude »

mindslight wrote: post #197
ortichic wrote: post #184

Lots of bias in this thread. But maybe we can have a technical discussion? I'm not into this topic, so maybe someone else can answer this: How "zero-knowledge" is this actually? As far as I understand, there are three parties here: 1. Me, the user; 2. The site I want to access; 3. The attestor (google? my government?). What do they know about each other? Does the site know who I am? Does the site know who my attestor…

There is an important question you haven't asked: As presented, is this system secure for the implied use cases? And the answer to that is a resounding no . As long as you can run software of your choosing, then it is trivial to proxy a zero knowledge proof such that a third party can provide proof of the given property for you to use. If the system is really zero-knowledge, then that third party will suffer no reper…

This is a big one, yeah. It looks like the current proposed system in the EU requires attestation that the relevant keys are stored in a certified HSM that will e.g. rate-limit the generation of keys.

(I found a list of requirements for them here: https://eudi.dev/2.4.0/annexes/annex-2/annex-2-high-level-re... )

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#240

Post by scott_w »

elcritch wrote: post #180
grey-area wrote: post #106

Earlier quoted context omitted.

Yes, a lot of it involves denigrating women and an entitled and very rigid attitude towards the male place in society (alphas etc). This is incredibly toxic for young men growing up and the women they interact with. Some of the more prominent proponents are actual pimps (the Tate brothers).

How is that different than pervasive pornography though? Many young boys now think it’s normal to ask girls for sexual acts before having ever kissed a girl.

Huge gap between producing material that depicts (presumably) consensual sexual activities between adults and telling young boys to commit rape.
Post reply on HN