Privacy-preserving age and identity verification via anonymous credentials • Hacker News Board

Re: Privacy-preserving age and identity verification via anonymous credentials

#51

Post by hirsin » Tue, Mar 03, 2026, 5:32 PM UTC

AnthonyMouse wrote: post #40

hirsin wrote: post #38

Earlier quoted context omitted.

Which is why you separate the credential issuance from the credential use, per the standard mentioned.

The cryptography provides nothing to establish that this separation is actually being maintained and there is plenty of evidence (e.g. Snowden) of governments doing exactly the opposite while publicly claiming the contrary. On top of that, it's a timing attack, so all you need is the logs from both of them. Government gets breached and the logs published, all the sites learn who you are. Government becomes corrupt/au…

I'd review the setup here. You're missing the critical distinction that the cryptography supports - separating entirely (in time and space) the issuance of the cred to the user and the use of that cred with a website.

Unless you're getting the device logs from the users device (in which case... All of this is moot) there is no timing attack. Six months ago you got your mobile drivers license. And then today you used it to validate your age to a website anonymously. What's the timing attack there.

Re: Privacy-preserving age and identity verification via anonymous credentials

#52

Post by AnthonyMouse » Tue, Mar 03, 2026, 6:16 PM UTC

hirsin wrote: post #51

AnthonyMouse wrote: post #40

Earlier quoted context omitted.

The cryptography provides nothing to establish that this separation is actually being maintained and there is plenty of evidence (e.g. Snowden) of governments doing exactly the opposite while publicly claiming the contrary. On top of that, it's a timing attack, so all you need is the logs from both of them. Government gets breached and the logs published, all the sites learn who you are. Government becomes corrupt/au…

I'd review the setup here. You're missing the critical distinction that the cryptography supports - separating entirely (in time and space) the issuance of the cred to the user and the use of that cred with a website. Unless you're getting the device logs from the users device (in which case... All of this is moot) there is no timing attack. Six months ago you got your mobile drivers license. And then today you used…

If the driver's license can generate new anonymous tokens itself then anyone can hook up a driver's license to a computer and set up a service to sign for everybody. If it can't, whenever you want to prove your age to a service you need to get a new token from a third party, and then there is a timing correlation because you're asking for the token right before you use the service.

The article proposes a hypothetical solution where you get some finite number of tokens at once, but then the obvious problem is, what happens when you run out? First, it brings back the timing correlation when you ask for more just before you use one, and the number of times you have to correlate in order to be unique is so small it could still be a problem. Second, there are legitimate reasons to use an arbitrarily large number of tokens (e.g. building a search index of the web, content filters that want to scan the contents of links), but "finite number of tokens" was the thing preventing someone from setting up the service to provide tokens to anyone.

Re: Privacy-preserving age and identity verification via anonymous credentials

#53

Post by AuthAuth » Tue, Mar 03, 2026, 7:04 PM UTC

AnthonyMouse wrote: post #37

hirsin wrote: post #22

Earlier quoted context omitted.

It can't be quite that simple because you have a couple additional problems to solve - (effectively restating bits of the article poorly and partially) 1. You don't want these to be replayable (give your JWT to someone else to use) so they need to be bounded in some ways (eg intended website, time, proof it came from you and not someone else). 2. You don't want the government to know which website you're going to, no…

> You don't want these to be replayable (give your JWT to someone else to use) so they need to be bounded in some ways (eg intended website, time, proof it came from you and not someone else). But these are the things that make it non-anonymous, because then instead of one token that says "is over 18" that you get once and keep forever, everyone constantly has to request zillions of tokens. Which opens up a timing at…

The government can already do this with the ISP. I dont think government should be part of the average person's threat model.

Re: Privacy-preserving age and identity verification via anonymous credentials

#54

Post by chucklenorris » Tue, Mar 03, 2026, 10:13 PM UTC

AnthonyMouse wrote: post #48

lachiflippi wrote: post #47

Earlier quoted context omitted.

My understanding is that the responses are signed, but in a way that prevents linking signatures across vendors, so the same card being used for verification on different sites could not be linked, while the same card being used multiple times for the same vendor could. As I'm not an expert on the crypto underlying the protocol, feel free to check the eIDAS standard for more info (the documents are in English, even i…

A cursory look implies they're using group signatures: https://en.wikipedia.org/wiki/Group_signature Which allow the group manager (presumably the government, or anyone who compromises them) to identify who signed something. If using the same card multiple times with the same site allows the site to correlate them then that obviously also allows the site to link two accounts you intended to be separate, or two sites…

ZKPs are mentioned in the technical specs but no implementation yet. Would go for lack of standardisation / lack of harware support for these protocols as the explanation but who knows..

Re: Privacy-preserving age and identity verification via anonymous credentials

#55

Post by LorenPechtel » Wed, Mar 04, 2026, 12:34 AM UTC

AuthAuth wrote: post #53

AnthonyMouse wrote: post #37

Earlier quoted context omitted.

> You don't want these to be replayable (give your JWT to someone else to use) so they need to be bounded in some ways (eg intended website, time, proof it came from you and not someone else). But these are the things that make it non-anonymous, because then instead of one token that says "is over 18" that you get once and keep forever, everyone constantly has to request zillions of tokens. Which opens up a timing at…

The government can already do this with the ISP. I dont think government should be part of the average person's threat model.

If the government can access it all too often bad actors can also access it. And all too often government and bad actors are one in the same.

Re: Privacy-preserving age and identity verification via anonymous credentials

#56

Post by LorenPechtel » Wed, Mar 04, 2026, 12:46 AM UTC

AnthonyMouse wrote: post #52

hirsin wrote: post #51

Earlier quoted context omitted.

I'd review the setup here. You're missing the critical distinction that the cryptography supports - separating entirely (in time and space) the issuance of the cred to the user and the use of that cred with a website. Unless you're getting the device logs from the users device (in which case... All of this is moot) there is no timing attack. Six months ago you got your mobile drivers license. And then today you used…

If the driver's license can generate new anonymous tokens itself then anyone can hook up a driver's license to a computer and set up a service to sign for everybody. If it can't, whenever you want to prove your age to a service you need to get a new token from a third party, and then there is a timing correlation because you're asking for the token right before you use the service. The article proposes a hypothetical…

Blocking said search indexes is probably a good thing.

I'm thinking perhaps a system where you feed it a credential, a small program runs and maintains a pool of tokens that has some reasonably finite lifespan. The server that issues the tokens restricts the number of uses of the credential. Timing attacks are impossible because your token requests are normally not associated with your uses of the tokens.

And when you use a token the site gives back a session key, further access just replays the session key (so long as it's HTTPS the key is encrypted, hard to do a replay attack) up to whatever time and rate limits the website permits.

Re: Privacy-preserving age and identity verification via anonymous credentials

#57

Post by LorenPechtel » Wed, Mar 04, 2026, 12:54 AM UTC

sanex wrote: post #29

jaimex2 wrote: post #16

Earlier quoted context omitted.

No, there's no compromise here. Anyone pushing for age verification or going along with it needs to get replaced by a service that is immune to government overreach.

Some of us do see value in age and identity verification if the anonymity problem is solved so I very much disagree.

And some of us do not believe the identity bit can be truly solved.

In the real world it's always people looking to suppress information or dissent that are pushing for such schemes. It always masquerades as protecting minors (protecting them from what? The one proper attempt to prove sexual materials are harmful found no evidence of said harm.) or as hunting for CSAM (and if you do implement an effective system it will get circumvented by putting relays in hostile countries.)

Re: Privacy-preserving age and identity verification via anonymous credentials

#58

Post by LorenPechtel » Wed, Mar 04, 2026, 12:55 AM UTC

screwt wrote: post #6

This article is a great explainer of the basics underlying anonymous credentials. I look forward to the promised follow-up explaining real-world examples. The key issue however is trust. The underlying protocols may support zero-knowledge proofs. But as a user I'm unlikely to be able to inspect those underlying protocols. I need to be able to see exactly what information I'm allowing the Issuer to see. Otherwise a "c…

And a huge incentive for the black hats to undermine the issuers. They aren't going to remain secure.

Re: Privacy-preserving age and identity verification via anonymous credentials

#59

Post by LorenPechtel » Wed, Mar 04, 2026, 12:57 AM UTC

txrx0000 wrote: post #18

If the goal was to protect the children, there are much simpler solutions. But for whatever reason, companies and governments are avoiding the simple solutions like the plague. Let me explain the simple solutions: Don't let phone manufacturers lock the bootloader on phones. Let the device owner lock it themselves with a password if they want to. Someone will make a kid-friendly OS if there is market demand and tech-s…

The basic problem is that if subversion is possible black hats will trick people into subverting it.

Re: Privacy-preserving age and identity verification via anonymous credentials

#60

Post by AnthonyMouse » Wed, Mar 04, 2026, 7:44 AM UTC

LorenPechtel wrote: post #56

AnthonyMouse wrote: post #52

Earlier quoted context omitted.

If the driver's license can generate new anonymous tokens itself then anyone can hook up a driver's license to a computer and set up a service to sign for everybody. If it can't, whenever you want to prove your age to a service you need to get a new token from a third party, and then there is a timing correlation because you're asking for the token right before you use the service. The article proposes a hypothetical…

Blocking said search indexes is probably a good thing. I'm thinking perhaps a system where you feed it a credential, a small program runs and maintains a pool of tokens that has some reasonably finite lifespan. The server that issues the tokens restricts the number of uses of the credential. Timing attacks are impossible because your token requests are normally not associated with your uses of the tokens. And when yo…

> Blocking said search indexes is probably a good thing.

I feel like "we should ban all search engines" is going to be pretty unpopular.

> And when you use a token the site gives back a session key

And then you have a session key, until you don't, because you signed out of that account to sign into another one, or signed into it on a different browser or device etc.

> The server that issues the tokens restricts the number of uses of the credential.

Suppose I have a device on my home or corporate network that scans email links. It's only trying to filter malware and scams, but if a link goes to an adult content barrier then it needs tokens so it can scan the contents of the link to make sure there isn't malware behind the adult content barrier.

If I only have a finite number of tokens then the malware spammer can just send messages with more links than I have tokens until I run out, then start sending links to malware that bypass the scanner because it's out of tokens.