Privacy-preserving age and identity verification via anonymous credentials • Hacker News Board

Re: Privacy-preserving age and identity verification via anonymous credentials

#31

Post by tsimionescu » Tue, Mar 03, 2026, 2:25 PM UTC

3RTB297 wrote: post #24

lachiflippi wrote: post #8

I've been really enjoying all these articles proposing solutions to anonymous age verification, mainly because most of them are written as if this has never been implemented in the real world. German IDs support age verification that just returns a yes/no response to the question "is this user above the age of 18," and not a single service in the entire country supports it. Anonymous age verification isn't a technica…

This is immensely counter-intuitive to many Americans. They wrongly assume that digital IDs are some Biblical apocalyptic level invasion of privacy, when every state ID database is already 1) linked to Federal ones, and 2) full of the same data on your driver's license anyway. I've tried to explain this to people, that a digital ID done well is better than the fraud-enabling 1960's hodgepodge in use that has served f…

Oh, that's not the half of it. In my own country, digital ID adoption was a political hot topic for a long time after the Orthodox Church realized that the new chips contain 12-digit long IDs that might contain the sequence 666. This despite everyone in the country having a legal ID with a number code that can also happen to contain this same sequence - but somehow the mere possibility of this happening in the digital IDs sparked a huge outrage and made politicians avoid the topic for quite a while.

Re: Privacy-preserving age and identity verification via anonymous credentials

#32

Post by dabber21 » Tue, Mar 03, 2026, 2:37 PM UTC

ReptileMan wrote: post #30

lachiflippi wrote: post #8

I've been really enjoying all these articles proposing solutions to anonymous age verification, mainly because most of them are written as if this has never been implemented in the real world. German IDs support age verification that just returns a yes/no response to the question "is this user above the age of 18," and not a single service in the entire country supports it. Anonymous age verification isn't a technica…

>Anonymous age verification Anonymity from whom? Does the German government doesn't know that Gunter Shmidt has just verified his age to the site GreatBDSMPartiesInBerlinForDragQueens.com ? Even if they obtain the logs from the site?

afaik it comes directly from your ID's card chip, there is an App inbetween that temporarily stores that data so it can be submitted to the service you are registering to

Re: Privacy-preserving age and identity verification via anonymous credentials

#33

Post by derbOac » Tue, Mar 03, 2026, 2:46 PM UTC

3RTB297 wrote: post #24

lachiflippi wrote: post #8

I've been really enjoying all these articles proposing solutions to anonymous age verification, mainly because most of them are written as if this has never been implemented in the real world. German IDs support age verification that just returns a yes/no response to the question "is this user above the age of 18," and not a single service in the entire country supports it. Anonymous age verification isn't a technica…

This is immensely counter-intuitive to many Americans. They wrongly assume that digital IDs are some Biblical apocalyptic level invasion of privacy, when every state ID database is already 1) linked to Federal ones, and 2) full of the same data on your driver's license anyway. I've tried to explain this to people, that a digital ID done well is better than the fraud-enabling 1960's hodgepodge in use that has served f…

I agree that there's a lack of awareness of what happens in other countries with ID, but I think it is also a different situation in the US.

States in the US in a lot of ways are more comparable to countries in the EU. It's not exactly like that but in many ways it is. So it would be like requiring an EU ID on top of a national ID.

I also don't think privacy per se is the real issue of concern, it's concern about consolidation of federalized power. Privacy is one criterion by which you judge the extent to which power has been consolidated or can be consolidated.

The question isn't "can this be federalized safely in theory", it's "is it necessary to federalize this" or "what is the worse possible outcome of this if abused?"

As we are seeing recently, whatever can be abused in terms of consolidated power will be eventually, given enough time.

I guess discussions of whether or not you can have cryptographic verification with anonymity kind of miss the point at some level. It's good to be mindful of in case we go down the dystopian surveillance route, but it ignores the bigger picture issues about freedom of speech, government control over access (cryptographic guarantees of credential verfication don't guarantee issuance of the id appropriately, nor do they guarantee that the card will be issued with that cryptographic system implemented in good faith), and so forth.

Re: Privacy-preserving age and identity verification via anonymous credentials

#34

Post by jeroenhd » Tue, Mar 03, 2026, 2:49 PM UTC

lachiflippi wrote: post #8

I've been really enjoying all these articles proposing solutions to anonymous age verification, mainly because most of them are written as if this has never been implemented in the real world. German IDs support age verification that just returns a yes/no response to the question "is this user above the age of 18," and not a single service in the entire country supports it. Anonymous age verification isn't a technica…

The age verification system is being developed with an EU-wide standard. It's supposed to become part of the EU digital wallet initiative.

The trick with age verification is to do it in a way that doesn't allow tracking by the service itself (i.e. returning the same token/signature every time) or from the government (shouldn't see what sites you use when). That has pretty much been solved now, though.

Re: Privacy-preserving age and identity verification via anonymous credentials

#35

Post by fwn » Tue, Mar 03, 2026, 2:57 PM UTC

sanex wrote: post #29

jaimex2 wrote: post #16

Earlier quoted context omitted.

No, there's no compromise here. Anyone pushing for age verification or going along with it needs to get replaced by a service that is immune to government overreach.

Some of us do see value in age and identity verification if the anonymity problem is solved so I very much disagree.

Might be vulnerable to classic salami tactics, though. Once we arrive at a general consensus on new norms that expect age verification online, we can just legislate it to ID users as a step 2.

Maybe wait for the next terror-attack before pushing for it, but it's an easy fix to a culture that already accepted a layer control against the user. The end user will only perceive a small difference in whether they provide full ID or just verified age information.

I want to believe that some supporters of age verification are not cynical. However, whatever good can be achieved through age verification seems such a small win, compared to the dangerous precedent it sets for the internet in general. I cannot get my head around it.

Re: Privacy-preserving age and identity verification via anonymous credentials

#36

Post by Izkata » Tue, Mar 03, 2026, 3:02 PM UTC

hirsin wrote: post #22

nijave wrote: post #17

Earlier quoted context omitted.

I wish all governments would just run identity services and mandate usages that return anonymous attestations. Age being the most obvious attestation but something like residence status could also be useful. Something as simple as a JWT with claims (and random uuid id) would work

It can't be quite that simple because you have a couple additional problems to solve - (effectively restating bits of the article poorly and partially) 1. You don't want these to be replayable (give your JWT to someone else to use) so they need to be bounded in some ways (eg intended website, time, proof it came from you and not someone else). 2. You don't want the government to know which website you're going to, no…

But one overlooked advantage of manually copying JWTs is that the user doesn't have to blindly trust they're not hiding extra information. They can be decoded by the user to see there's only what should be there.

Re: Privacy-preserving age and identity verification via anonymous credentials

#37

Post by AnthonyMouse » Tue, Mar 03, 2026, 3:07 PM UTC

hirsin wrote: post #22

nijave wrote: post #17

Earlier quoted context omitted.

I wish all governments would just run identity services and mandate usages that return anonymous attestations. Age being the most obvious attestation but something like residence status could also be useful. Something as simple as a JWT with claims (and random uuid id) would work

It can't be quite that simple because you have a couple additional problems to solve - (effectively restating bits of the article poorly and partially) 1. You don't want these to be replayable (give your JWT to someone else to use) so they need to be bounded in some ways (eg intended website, time, proof it came from you and not someone else). 2. You don't want the government to know which website you're going to, no…

> You don't want these to be replayable (give your JWT to someone else to use) so they need to be bounded in some ways (eg intended website, time, proof it came from you and not someone else).

But these are the things that make it non-anonymous, because then instead of one token that says "is over 18" that you get once and keep forever, everyone constantly has to request zillions of tokens. Which opens up a timing attack, because then the issuer and site can collude to see that every time notbob69 signs into the website, Bob Smith requested a token, and over really quite a small number of logins to the site, that correlation becomes uniquely identifying.

Meanwhile we don't need to solve it this way, because the much better solution is to have the site provide a header that says "this content is only for adults" than to have the user provide the site with anything, and then let the user's device do what it will with that information, i.e. not show the content if the user is a minor.

Re: Privacy-preserving age and identity verification via anonymous credentials

#38

Post by hirsin » Tue, Mar 03, 2026, 3:09 PM UTC

AnthonyMouse wrote: post #37

hirsin wrote: post #22

Earlier quoted context omitted.

It can't be quite that simple because you have a couple additional problems to solve - (effectively restating bits of the article poorly and partially) 1. You don't want these to be replayable (give your JWT to someone else to use) so they need to be bounded in some ways (eg intended website, time, proof it came from you and not someone else). 2. You don't want the government to know which website you're going to, no…

> You don't want these to be replayable (give your JWT to someone else to use) so they need to be bounded in some ways (eg intended website, time, proof it came from you and not someone else). But these are the things that make it non-anonymous, because then instead of one token that says "is over 18" that you get once and keep forever, everyone constantly has to request zillions of tokens. Which opens up a timing at…

Which is why you separate the credential issuance from the credential use, per the standard mentioned.

Re: Privacy-preserving age and identity verification via anonymous credentials

#39

Post by ReptileMan » Tue, Mar 03, 2026, 3:10 PM UTC

dabber21 wrote: post #32

ReptileMan wrote: post #30

Earlier quoted context omitted.

>Anonymous age verification Anonymity from whom? Does the German government doesn't know that Gunter Shmidt has just verified his age to the site GreatBDSMPartiesInBerlinForDragQueens.com ? Even if they obtain the logs from the site?

afaik it comes directly from your ID's card chip, there is an App inbetween that temporarily stores that data so it can be submitted to the service you are registering to

So the app could phone home if it so desires?

Re: Privacy-preserving age and identity verification via anonymous credentials

#40

Post by AnthonyMouse » Tue, Mar 03, 2026, 3:16 PM UTC

hirsin wrote: post #38

AnthonyMouse wrote: post #37

Earlier quoted context omitted.

> You don't want these to be replayable (give your JWT to someone else to use) so they need to be bounded in some ways (eg intended website, time, proof it came from you and not someone else). But these are the things that make it non-anonymous, because then instead of one token that says "is over 18" that you get once and keep forever, everyone constantly has to request zillions of tokens. Which opens up a timing at…

Which is why you separate the credential issuance from the credential use, per the standard mentioned.

The cryptography provides nothing to establish that this separation is actually being maintained and there is plenty of evidence (e.g. Snowden) of governments doing exactly the opposite while publicly claiming the contrary.

On top of that, it's a timing attack, so all you need is the logs from both of them. Government gets breached and the logs published, all the sites learn who you are. Government becomes corrupt/authoritarian, seizes logs from sites openly or in secret (and can use the ones from e.g. Cloudflare without the site itself even knowing about it), retroactively identifies people.