Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Privacy-preserving age and identity verification via anonymous credentials

blog.cryptographyengineering.com

Post reply on HN
Print view View original

11–20 of 64 posts

Re: Privacy-preserving age and identity verification via anonymous credentials

#11

Post by 2Gkashmiri »

lachiflippi wrote: post #8

I've been really enjoying all these articles proposing solutions to anonymous age verification, mainly because most of them are written as if this has never been implemented in the real world. German IDs support age verification that just returns a yes/no response to the question "is this user above the age of 18," and not a single service in the entire country supports it. Anonymous age verification isn't a technica…

I remember reading in tech magazines about the "foss" acheivement which went on to become Aadhar. Remember this was prior to 2007 I think.

The idea was your id would be an autehnticator of sorts. You need to verify yourself, the website asks Aadhar if the person is genuine, the website returns binary yes no. Same for you, is gender male? Or ages above 18?

They would not return any other data.

In the end, it became just another "formality" and tool for politicians and to flex muscles.

People ended up taking photocopies of your card "just in case" and "that's the norm" even when it was said that's a bad idea.

People still do Aadhar kyc but it is in hands of politicians now and the bureaucracy.

Re: Privacy-preserving age and identity verification via anonymous credentials

#12

Post by zug_zug »

imglorp wrote: post #7

We all know these laws are about suppressing dissent and not about age. If anyone implemented this privacy preservation scheme, would all the laws flip to say "yeah we really did mean it govt id tied to your post".

All the more reason for us to get out an actual implementation of age verification that IS anonymous first, so that when a law is pushed for or passed, companies can adopt the anonymous implementation.

Re: Privacy-preserving age and identity verification via anonymous credentials

#13

Post by lwkl »

screwt wrote: post #6

This article is a great explainer of the basics underlying anonymous credentials. I look forward to the promised follow-up explaining real-world examples. The key issue however is trust. The underlying protocols may support zero-knowledge proofs. But as a user I'm unlikely to be able to inspect those underlying protocols. I need to be able to see exactly what information I'm allowing the Issuer to see. Otherwise a "c…

In Switzerland a digital identity like this will launch this summer and the underlying infrastructure and app is open source. And the issuer of the ID and the registry that holds and verifies credentials are separated. The protocol also isn't novel and is already used in other countries (Germany(?)).

For more information check the out technology behind it: https://www.eid.admin.ch/en/technology

Re: Privacy-preserving age and identity verification via anonymous credentials

#14

Post by Normal_gaussian »

screwt wrote: post #6

This article is a great explainer of the basics underlying anonymous credentials. I look forward to the promised follow-up explaining real-world examples. The key issue however is trust. The underlying protocols may support zero-knowledge proofs. But as a user I'm unlikely to be able to inspect those underlying protocols. I need to be able to see exactly what information I'm allowing the Issuer to see. Otherwise a "c…

This is exactly it. It is a huge issue if the authentication can trivially become non-privacy preserving in a way that is impenetrable to users.

Re: Privacy-preserving age and identity verification via anonymous credentials

#15

Post by chocmake »

There's a good explainer and Q&A of BBS+[1], which is one such zero-knowledge anonymous credentials standard, in a joint talk by cryptographer Brent Zundel. It covers the history of getting it into the W3C verified crentials spec and how various competing verified credential standards aren't privacy-preserving or as performant. It seems very promising and has considered various pitfalls.

From what I understand the issuer signs a credential and then the user on their local device generates unique proofs based on the signature each time, preventing verifiers from colluding/tracking the original signature across services. It also seems to be designed with safeguards against the issuer.

Info based on credentials can be selectively disclosed like whether you're over 18 or whether you have above a certain threshold in an account without disclosing the underlying data.

Obviously if the type of services you use need literal PII then they can still tie activity to a real-world identity but for services only requiring age assurance being able to prove you're over 18 without providing the actual age or other identifiers is better than solutions being actively used.

[1] https://www.youtube.com/watch?v=dXlRIrrb9f4

Re: Privacy-preserving age and identity verification via anonymous credentials

#16

Post by jaimex2 »

zug_zug wrote: post #12
imglorp wrote: post #7

We all know these laws are about suppressing dissent and not about age. If anyone implemented this privacy preservation scheme, would all the laws flip to say "yeah we really did mean it govt id tied to your post".

All the more reason for us to get out an actual implementation of age verification that IS anonymous first, so that when a law is pushed for or passed, companies can adopt the anonymous implementation.

No, there's no compromise here. Anyone pushing for age verification or going along with it needs to get replaced by a service that is immune to government overreach.

Re: Privacy-preserving age and identity verification via anonymous credentials

#17

Post by nijave »

lachiflippi wrote: post #8

I've been really enjoying all these articles proposing solutions to anonymous age verification, mainly because most of them are written as if this has never been implemented in the real world. German IDs support age verification that just returns a yes/no response to the question "is this user above the age of 18," and not a single service in the entire country supports it. Anonymous age verification isn't a technica…

I wish all governments would just run identity services and mandate usages that return anonymous attestations. Age being the most obvious attestation but something like residence status could also be useful.

Something as simple as a JWT with claims (and random uuid id) would work

Re: Privacy-preserving age and identity verification via anonymous credentials

#18

Post by txrx0000 »

If the goal was to protect the children, there are much simpler solutions. But for whatever reason, companies and governments are avoiding the simple solutions like the plague.

Let me explain the simple solutions:

Don't let phone manufacturers lock the bootloader on phones. Let the device owner lock it themselves with a password if they want to. Someone will make a kid-friendly OS if there is market demand and tech-savvy parents can install that and lock the bootloader.

What about the non-tech-savvy parents?

Don't restrict people from sideloading apps. Let the user set a password-based app installation lock if they want to. It should be a toggle in the phone's settings. Someone will make kid-friendly apps if there is demand. This lets average parents control what apps get installed or uninstalled on their kid's phone.

But what about apps or online services that adults also use?

Apps and online services can add a password-protected toggle in their user account settings that enables child mode. Let the user set the password and toggle it themselves. Parents can take their child's phone and toggle this.

----

Notice how easy these things are to implement? All of these features could be implemented in less than a week. But instead of doing this, they want to implement much more complicated schemes where the gov and corps control all the toggles, and you control none. Why is it like that? Surely there are no ulterior motives, right?

Re: Privacy-preserving age and identity verification via anonymous credentials

#19

Post by b112 »

txrx0000 wrote: post #18

If the goal was to protect the children, there are much simpler solutions. But for whatever reason, companies and governments are avoiding the simple solutions like the plague. Let me explain the simple solutions: Don't let phone manufacturers lock the bootloader on phones. Let the device owner lock it themselves with a password if they want to. Someone will make a kid-friendly OS if there is market demand and tech-s…

Where's the profit.

One must be a realist. If there is no profit motive, it won't happen. Ever.

One profit motive is "the government has regulations, I will be fined if I don't do this".

Another is "my competitors do it, and people buy their stuff because of it".

All the technical solutions are easy. And you're right, it's not about age verification, it's about profits.

The same way cars are regulated to have air bags, couches be made from non flammable materials, and so on.

Human nature has been the same forever. It will never, ever change. Ever. Profit drives all.

Re: Privacy-preserving age and identity verification via anonymous credentials

#20

Post by PunchyHamster »

lachiflippi wrote: post #8

I've been really enjoying all these articles proposing solutions to anonymous age verification, mainly because most of them are written as if this has never been implemented in the real world. German IDs support age verification that just returns a yes/no response to the question "is this user above the age of 18," and not a single service in the entire country supports it. Anonymous age verification isn't a technica…

It's also gateway to push more. Once APIs are in place and databases are full, what's another "check" or a bit of info to add ?

Surely the safety of children is worth it right ?

Post reply on HN