Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance • Hacker News Board

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#261

Post by raron » Thu, Jul 02, 2026, 10:01 PM UTC

rcxdude wrote: post #235

krunck wrote: post #220

"ZKP makes it possible for people to prove that something about them is true without exchanging any other data. So, for example, a person visiting a website can verifiably prove he or she is over 18, without sharing anything else at all." But not "...without sharing anything else even when setting up your token." Can I prove that some cryptographic token A) doesn't contain any PII and B) that the token itself can't b…

As I understand it, ZKPs can prove both those properties. You can get a certificate from whoever is trusted to verify that you're over 18, and then you can use that to generate tokens that only encode the information 'X has verified that I am over 18' without either the original verifier or the entity you are providing it to being able to link that to the original certificate. See section 2 of this document: https://…

I think that depends on how do you define PII.

I suspect the ZKP proof or token is practically unique and related to you, so I could be personal data if you use the definition from GDPR.

With ZKP the entity and the original verifier shouldn't be able to match your identity to the ZKP proof or token, but the app on your phone of course can do that.

The app probably will be made some government contractor and there is no technical measure that would prevent them to just share all that data with whoever they want.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#262

Post by raron » Thu, Jul 02, 2026, 10:07 PM UTC

DennisP wrote: post #221

Aurornis wrote: post #23

Earlier quoted context omitted.

> But if they reveal nothing, isn't it wide open for abuse? Couldn't one over-18-person's proof become everyone's proof, because they can't tell it's the same proof, and the issuer can't tell where or how often the proof is being used? Yep! This is why the concept of zero knowledge age gating is such a trap for technically minded people. They imagine receiving a private cryptographic object that can be used to anonym…

You can fix the leaked token problem if your prover also proves that (a) the private token id is not on the public revocation list, and (b) the token has not yet expired. Use short expirations and auto-renew, this is just to keep the revocation list from growing forever. Attackers could still compromise the system with proxies, but you can fix that by (a) passing in a random sessionid from the server so proofs can't…

> Use short expirations

And now you can use time correlation attack to unmask people.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#263

Post by protocolture » Thu, Jul 02, 2026, 10:10 PM UTC

intended wrote: post #85

protocolture wrote: post #65

Earlier quoted context omitted.

>But Facebook, Google, and Reddit have had decades to sort this out on their own It was solved. Dont collect information. The problem is making shitty psychotic apps, not determining who can use them. I would much rather they cut meta into pieces and sold them off as scraps, than just scarfing up the PID of the users to make arbitrary determinations about who can have what brainrot.

It was solved for you . There are more people than just you (and other tech literate folk) online. I would also rather meta be cut an sold of as scraps. This is sadly not the question being framed. I’ve dedicated a portion of my life volunteering to moderate content in communities. It is an unmitigated shit show. The status quo is great for firms and corrosive for society. If theres a takeaway from this sub thread, i…

>It was solved for you.

It was solved for everyone for a long time.

>There are more people than just you (and other tech literate folk) online.

And if you bury the algorithms a lot of the other people will simply go away.

>I’ve dedicated a portion of my life volunteering to moderate content in communities. It is an unmitigated shit show. The status quo is great for firms and corrosive for society.

I stopped doing so over a decade ago. 9/10 other moderators are trying to win some kind of parasocial relationship with owners/developers/whatever. I have seen really good teams moderating really well, but they are the exception not the rule. I don't think anything proposed in this thread has any bearing on content moderation one way or the other.

>If there's a takeaway from this sub thread, is why “meta being broken up and sold for scraps” not being raised as a question in the first place.

The government and advertisers are addicted to the data that it generates. The social graph has basically replaced humint entirely for security services. Most of the defense against terrorism these days relies on idiots sending facebook messages with the details of their plans. The successful terrorists are now the ones that don't have meaningful friendships to blurt their plans out to. Its our panopticon, and "Too big to fail" doesn't even begin to describe it. Its just a matter of time until a western nation uses the data to persecute minorities, heck some people think the US government is already.

Which is why giving them more data to hoover up isn't a solution. Advertisers are squealing right now because so much content and engagement is completely fake, and they are worried about losing even more money if age detection systems add any more friction to usage. But the security agencies, the silent partner, are just patiently waiting for the kinks to be worked out.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#264

Post by protocolture » Thu, Jul 02, 2026, 10:16 PM UTC

Gigachad wrote: post #73

vlian2088 wrote: post #71

Earlier quoted context omitted.

>The vast majority of the population supports banning social media for kids so revolution isn't happening. reddit isn't the vast majority of the population, fren. it's 1% of 4%. unless you've got polls you could show to back up your claim? polls, not opinion pieces. polls asking unambiguous questions like "are you in favor of banning social media?" or "are you in favor of age verification laws?", not vague ones like…

77% of the Australian population were in support of "Proposed ban on social media for children under 16" https://yougov.com/articles/51000-support-for-under-16-socia... This was in 2024, since then the attitude is still very much that kids should be taken off social media, but that the current restrictions aren't yet working as the face scanning verification is easily bypassed.

Australia is notoriously hard to poll.

Look at the 2023 referendum.

When something is fed to us by the media, and supported by both ALP and LNP there's rarely ever public dissent. The risks of age assurance weren't given any public airtime. The few criticisms that were put to the government were shrugged off as "oh it might start working later".

Probably a comparable issue would be the MyHealth Record nonsense, where the existence of the platform was largely uncontentious, but the change to make it opt-out rather than opt-in was actually put to public debate and once some day light got in, a significant amount of people opted out.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#265

Post by protocolture » Thu, Jul 02, 2026, 10:24 PM UTC

miki123211 wrote: post #88

protocolture wrote: post #8

Earlier quoted context omitted.

"Dont do age assurance, ever" Done.

It's much easier to convince somebody to achieve their goals your way than to not achieve their goals at all. Politicians don't want to be seen as going soft on child predators and harms to children. That is a career-ending move. Whether the bills they introduce even protect children at all has no bearing on it . PR is PR. If you're essentially telling somebody that children don't need to be protected, you might feel…

Nuance is the problem, we have been experiencing death by small degrees thanks to giving lots of small wins to politicians.

Government is these days largely solved, and for politicians that's a horrendous untenable situation, so they have to keep inventing problems to solve.

All they do is stack law on law on law for no discernible public good, with only negative outcomes.

The problem is the framing of the problem. Its not "How to protect kids online". The problem is "how to protect everyones freedoms online". And the only way to do that is to say absolutely not, every single time this shit comes up.

And its disingenuous to say the least, to assume that these tools are only coming for kids on social media. These tools are coming everywhere, to everyone. You just let them in because they played the old "wont someone please think about the children" song and dance. This exact nonsense was how we got the eSafety commissioner, who was brought in with a mandate to scrub the video footage of the christchurch massacre off of the internet. Of course, now they spend a large amount of time and money trying to get all sorts of posts scrubbed off the internet, often in jurisdictions that have free speech mandates.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#266

Post by rstuart4133 » Thu, Jul 02, 2026, 10:41 PM UTC

ulrikrasmussen wrote: post #182

rstuart4133 wrote: post #130

Earlier quoted context omitted.

> But if they reveal nothing, isn't it wide open for abuse? Good point, they do contain more information than "They are over 18". The primary (usually only) thing is who is attesting they are over 18. That might be the government, or a bank. That's inevitable, because the usual flow is rather like Google's OAuth - the site needing you to prove your age rediects to the provider (Google, or whoever), who asks questions…

> the usual flow is rather like Google's OAuth - the site needing you to prove your age rediects to the provider (Google, or whoever), who asks questions to verify your identity, and then replies with "over 18" or "not over 18". This is false. There are many problems with age verification, but the EU approach does not involve the id provider in the verification flow. The site requiring verification presents a QR code…

> This is false. There are many problems with age verification, but the EU approach does not involve the id provider in the verification flow. The site requiring verification presents a QR code which encodes a presentation request and the provider controlled URL

The nit you look to be picking is "redirect" means "a web page directs your browser to go to another URL". That is an interpretation you could use, but I was using a broader one. In the EU case, it isn't the browser following the redirect, it's you. The "server" you are redirected to is a government-provided app on your phone that implements openid4vp. But the underlying principle is still the same - you are "redirected" to a third-party proof-of-age provider, who sends a reply signed by the provider.

To the OP: openid4vp is an example of a protocol that is about as private as you can get. It all works offline, so the government does not know what sites you have visited. And the age verifier has no idea who owns the phone. As you say, the connection between the phone and the person holding it is a weakness; junior could just borrow big brother's phone to prove his age.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#267

Post by pseudalopex » Thu, Jul 02, 2026, 11:39 PM UTC

philipallstar wrote: post #236

doginasuit wrote: post #170

Earlier quoted context omitted.

I would say what sets it apart is the undercurrent of anger and grievance combined with the self destructive beliefs that are prevalent in the community. It's men and boys who struggle to find acceptance and belonging, maybe even for reasons that are initially sympathetic. But instead of healthy self-reflection and feedback, they find a distorted understanding of themselves and masculinity that only reinforces their…

This is just a caricature. It's like saying all women's spaces are bad because some female influencers tell their massive followings that men should pay for expensive shopping trips on the first date. This mischaracterisation through cherry picking is destructive.

Who said all men's spaces were bad?

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#268

Post by pseudalopex » Thu, Jul 02, 2026, 11:49 PM UTC

AlexandrB wrote: post #226

grey-area wrote: post #106

Earlier quoted context omitted.

Yes, a lot of it involves denigrating women and an entitled and very rigid attitude towards the male place in society (alphas etc). This is incredibly toxic for young men growing up and the women they interact with. Some of the more prominent proponents are actual pimps (the Tate brothers).

[flagged]

Incel is a subculture.[1]

[1] https://en.wikipedia.org/wiki/Incel

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#269

Post by aussieguy1234 » Thu, Jul 02, 2026, 11:51 PM UTC

elcritch wrote: post #180

grey-area wrote: post #106

Earlier quoted context omitted.

Yes, a lot of it involves denigrating women and an entitled and very rigid attitude towards the male place in society (alphas etc). This is incredibly toxic for young men growing up and the women they interact with. Some of the more prominent proponents are actual pimps (the Tate brothers).

How is that different than pervasive pornography though? Many young boys now think it’s normal to ask girls for sexual acts before having ever kissed a girl.

The Manosphere is going to convince the impressionable young boys and men they are entitled to be treated in the same way as the men in the porn videos, consent be dammed. This is the main problem.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#270

Post by denkmoon » Fri, Jul 03, 2026, 1:34 AM UTC

echelon wrote: post #55

denkmoon wrote: post #47

Earlier quoted context omitted.

Shock sites are materially different to the harm kids do to one another on social media.

> Shock sites are materially different to the harm kids do to one another This would be the "fixed" version of your comment. The social media bit is irrelevant. Kids have always been assholes to other kids. I took the school bus a few times, and the older neighborhood kids tried to chase me down, beat me, and piss on me. That was before the internet. You can't make up for other parents' bad parenting by trying to inv…

Yeah I grew up in the kinda bad part of town taking the bus every day. I got bullied. I never had someone generate pornographic images of me though.

The internet is just society now. it's not something different. You get privacy in your home, but you don't get to go out into public and say things without it being attributed to your identity. The things you say publicly are intrinsically linked with your public identity. Why should online be any different?