Live data from Hacker News

Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

blog.google

291–300 of 302 posts

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#291
post #125

Earlier quoted context omitted.

"We" are building 1984 to make sure "We" stay in power of our EU Animal Farm.

EU? It's mostly happening elsewhere though. See: Australia. See: California. See: KIDS act. See: KOSA. Sounds like denial or tunnel vision.

Have you read the DSA?

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#292

Earlier quoted context omitted.

So can you give an example of a crazed man-hating feminist woman engaging in a mass shooting? Or just of a woman engaging in a mass shooting (alone, not with a man) in the last, say, 10 years? 20 years? 50 years? Because I can definitely give you examples of incels doing this. Not a huge amount, mind you, but at least some.

I think men hating women don't usually do mass killings. They mostly kill specific men they hate the most.

OK, the a female serial killer, killing the men she hates the most, one after the other.

Or do you just mean that some women kill a man because they hate that particular man? Because that's not what "man-hating" means. I might hate Adolf Hitler, who was a man, but that doesn't make me "a man hating man".

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#293
post #43

Earlier quoted context omitted.

Better than no age verification (and therefore, privacy) coupled with parents doing their job?

That would be ideal. However, this is tech proposal which takes so much of the slop out of the entire thing. With this implementation, there is no profit in it, unless your government is directly cooperating, aka a scandal in many countries.

I am a moron for writing this, ZKP is like magic like this.

I need to not HN after beers.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#295

Earlier quoted context omitted.

With ZKP age verification, services will not be able to track you without help from the CA. The CA will not be able to track you without help from the services. Both will contain the necessary information in their databases that when combined deanonymize you. The CA is the central authority/certificate authority. So you should assume the government can track you, because you should assume both will be streaming those…

Yes, there is one party that can track you, which in some countries is still slightly trusted. Ideally, no age verification would be required or proposed. However, if it is, this implementation should be the base minimum, should it not? This is a gazillion percent better than a foreign corporation being in charge, isn't it?

I am a moron for writing this, ZKP is like magic like this. That is the entire point, and why I posted this.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#296
post #80

Earlier quoted context omitted.

I don't really believe this is true, there are schemes which allow limited use tokens but which don't compromise the ZK nature of things - https://blog.cryptographyengineering.com/2026/03/02/anonymou...

Those schemes will never see the light of day, attribution is by design. Without attribution you will just see those tokens sold by the penny.

If you read the link, that’s not necessarily how things have to work. You can make limited-use ZK schemes, plus you fall into the usual trap of binary thinking, that if something isn’t 100% effective it is necessarily 0%.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#297
post #75

Earlier quoted context omitted.

You only need about 33 bits of information to uniquely identify every human.

Ideally, but in practice only if the bits are uncorrelated and each divides the population in half.

You typically collect kilobytes of information though.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#298

Earlier quoted context omitted.

The point of ZKP in EU wallet is that it separates checking age and privacy. You can both give a proof your age and not lose privacy.

Except that ZKP for sensitive data is far from being a thing, and also, I don't want the fucking government to have anything to do with what sites I access. Period. Why the hell do I need to login to my digital wallet to access a fucking website???

What do you mean? Proving things about sensitive data without revealing it is what ZKPs are for. If you mean that the tech isn't mature enough to be trusted yet, I think there's some truth to that, but it depends on what software we're talking about specifically. Zcash has been in production for almost 10 years now.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#299

Earlier quoted context omitted.

> I am not making an argument based on tradition. I know, and neither am I. Perhaps you misread my comment. > I couldn't care less that the web has not been government-gated for the past X years That is clear. > because through this logic you should adhere to any dumb tradition or custom humans have ever had Not only is that statement a non-sequitur, since neither of us is making an argument based on tradition, it's…

Operating a motor vehicle requires a license, and you have to present it. Drinking and other activities and purchases require showing ID to prove your age. Since the web contains the digital equivalent of many age-gated activities it's entirely reasonable, once technology advances enough, to mandate the IRL age gates to certain websites or services. Since the government currently has all of our ID data and since math…

Your assumptions are the opposite of those for an English common law country, which is why those with that background are particularly aghast.

> Operating a motor vehicle requires a license, and you have to present it.

You do not have to present it in all cases, and not to actually use the vehicle.

> Drinking and other activities and purchases require showing ID to prove your age.

Not in all cases. Purchasing alcohol in the UK may require ID (but again, not in all cases) but drinking is legal above 5 years old in areas that are not solely for the purpose of selling alcohol (crazy, but true).

That list will go on.

> Since the government currently has all of our ID data

No, it does not - for example, a passport is different to a birth certificate and they contain different amounts of identity information, and my government does not need to know other identity info regarding my work.

> mathematically secure algorithms have been invented to prove personal information without revealing it, I'd say we have reached the point where digital identification can be implemented without infringing on people's privacy any more than a clerk checking your ID.

This is too strong a statement. Having strong algorithms does not equate with the level of security you claim to exist. Implementation of the whole process is just as important.

Regardless, we have plenty of good reasons to fear any government having this information. The Japanese government, for example, has its civil service set up in a way to prevent the kind of abuses we saw in WW2. I wouldn't be surprised if the Dutch have done the same, for what should be obvious reasons.

Re: Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance

#300
post #262

Earlier quoted context omitted.

You can fix the leaked token problem if your prover also proves that (a) the private token id is not on the public revocation list, and (b) the token has not yet expired. Use short expirations and auto-renew, this is just to keep the revocation list from growing forever. Attackers could still compromise the system with proxies, but you can fix that by (a) passing in a random sessionid from the server so proofs can't…

> Use short expirations And now you can use time correlation attack to unmask people.

How? The websites don't see anything consistent from one session to the next. They can't tell when the credential is renewed, and don't see a credential id.
Post reply on HN