Privacy-preserving age and identity verification via anonymous credentials • Hacker News Board

Re: Privacy-preserving age and identity verification via anonymous credentials

#61

Post by AnthonyMouse » Wed, Mar 04, 2026, 8:01 AM UTC

AuthAuth wrote: post #53

AnthonyMouse wrote: post #37

Earlier quoted context omitted.

> You don't want these to be replayable (give your JWT to someone else to use) so they need to be bounded in some ways (eg intended website, time, proof it came from you and not someone else). But these are the things that make it non-anonymous, because then instead of one token that says "is over 18" that you get once and keep forever, everyone constantly has to request zillions of tokens. Which opens up a timing at…

The government can already do this with the ISP. I dont think government should be part of the average person's threat model.

> The government can already do this with the ISP.

This is what VPNs or public libraries are for.

> I dont think government should be part of the average person's threat model.

Tell that to the people in places with governments that are a threat to the average person.

"It can't happen here" is a dangerous hubris.

On top of that, do notice that there is more than one government. What happens when Salt Typhoon comes for this stuff?

Re: Privacy-preserving age and identity verification via anonymous credentials

#62

Post by krunck » Wed, Mar 04, 2026, 6:38 PM UTC

If issuer knows the identity of the user and the signature that it sent to her, and if the user passes on the signature to the resource, what's to keep the issuer and resource from conspiring and sharing information to track the behavior of the user? One has to assume that the signature is going to be just as unique as the serial number the user generated.

see this image from the article: https://blog.cryptographyengineering.com/wp-content/uploads/...

Re: Privacy-preserving age and identity verification via anonymous credentials

#63

Post by LorenPechtel » Wed, Mar 04, 2026, 10:20 PM UTC

AnthonyMouse wrote: post #60

LorenPechtel wrote: post #56

Earlier quoted context omitted.

Blocking said search indexes is probably a good thing. I'm thinking perhaps a system where you feed it a credential, a small program runs and maintains a pool of tokens that has some reasonably finite lifespan. The server that issues the tokens restricts the number of uses of the credential. Timing attacks are impossible because your token requests are normally not associated with your uses of the tokens. And when yo…

> Blocking said search indexes is probably a good thing. I feel like "we should ban all search engines" is going to be pretty unpopular. > And when you use a token the site gives back a session key And then you have a session key, until you don't, because you signed out of that account to sign into another one, or signed into it on a different browser or device etc. > The server that issues the tokens restricts the n…

Search engines should not be using website search capabilities. That's putting an undue load on the systems. A board I'm involved with recently had to block search for guests because we were getting bombarded with guest searches that looked like some bot was taking a web query and tossing it around to a bunch of sites. Many of them not even in English.

Re: Privacy-preserving age and identity verification via anonymous credentials

#64

Post by nijave » Fri, Mar 06, 2026, 3:25 PM UTC

hirsin wrote: post #22

nijave wrote: post #17

Earlier quoted context omitted.

I wish all governments would just run identity services and mandate usages that return anonymous attestations. Age being the most obvious attestation but something like residence status could also be useful. Something as simple as a JWT with claims (and random uuid id) would work

It can't be quite that simple because you have a couple additional problems to solve - (effectively restating bits of the article poorly and partially) 1. You don't want these to be replayable (give your JWT to someone else to use) so they need to be bounded in some ways (eg intended website, time, proof it came from you and not someone else). 2. You don't want the government to know which website you're going to, no…

Imo these are nice to haves. The physical system of ID cards already has these problems but works well enough.

People can loan their ID to someone else (ask college kids with an older sibling...)

When you use your physical ID, the government frequently can deanonymize you either through automated databases (especially when purchasing drugs) or subpoenaing for camera footage, visitor lists, etc