6 ms·
The internet badly needs a standard system for people to verify their age*, identity**, etc but it's a terrible idea for that system not to be pseudonymous. *
by thomassmith65 1y ago
The internet badly needs a standard system for people to verify their age*, identity**, etc but it's a terrible idea for that system not to be pseudonymous.
* as in "I am over n years old", not "my exact birthday is nnnn-nn-nn"
** as in "I am a unique human you know as <uuid>", not "I am John Q Smith"
- delusional 1y agoWhat would you do with <UUID>? How would you verify that you are actually <UUID> or 18 years old?
- Tadpole9181 1y agoZero knowledge proofs from a provider who has your ID allows validation without data leaking. Though creates other issues with, i.e. selling validation tokens.
- delusional 1y agoWhat I'm gathering from that description is a flow that would involve three parties: Me, the restricted resource, and an ID validator. When I wanted to access the restricted resource, they'd ask for a valid token that I would then go to my ID validator to get since they've already identified me, they'd then pass that valid token back to me which I could pass to the restricted resource. They'd presumably then save that token as proof that they did their legally required validation. Is that roughly correct? I think that's the model they're working on in the EU using Bitstring Status List, OpenID for Verifiable Presentations, and ISO 18013-5. If you want to know more there's a reference implementation: https://github.com/eu-digital-identity-wallet/eudi-doc-architecture-and-reference-framework https://github.com/eu-digital-identity-wallet/eudi-doc-archi...
- Tadpole9181 1y agoJust about, yup! I don't know about your specific link there, but the "zero knowledge" part comes from the token sent to the provider being non-reversible. A token cannot be used to identify the person who generated the token, even by ID validator. This works because the token is just used as material in (simplified) a hash function.
- Almondsetat 1y agoThis can only be done by delegating the verification to national eIDs systems. This way the website simply asks the government: is this person >18? and the trusted government platform can reply without disclosing additional information.
- jrvieira 1y agoWhy do you think that's the only way?
- Almondsetat 1y agoYour public, verifiable identity already exists because the government keeps track of it. Why would a third party need to be involved if the infrastructure is already available straight from the source? Also, if multiple providers existed, how could platforms avoid duplicates, in case of need?
- jrvieira 1y agoYou talk like we all live under the same government, and like it would be a good thing if we did.
- Almondsetat 1y agoThis is your own, personal, twisted interpretation of my reply
- jrvieira 1y agoI don't see how we can arrive at an alternative interpretation if we follow your argument to its logical conclusion.
- Almondsetat 1y agoIf you don't see it then that's your problem
- wmf 1y agoApple and Google are working on that but it isn't available everywhere yet so a lot of sites are outsourcing age checking to various untrustworthy companies.
- JohnFen 1y ago> "I am a unique human you know as <uuid>", not "I am John Q Smith" That just makes <uuid> an identifier like your name. <uuid> becomes yet another piece of PII, increasing your exposure. Further, it will even inevitably get linked to your other identifiers in various databases over time. This problem is why pseudoanonymization isn't really that useful.
- deleted 1y ago[deleted]
- thomassmith65 1y agoThe idea isn't that a human gets one uuid to be used everywhere, but that each site gets one of the human's many uuids. Someone still needs to track which uuids belong to which human, but at least it's not a random, possibly insecure or disreputable website.
- baby_souffle 1y agoSo this UUID is just as anon as crypto is. Technically, yes. Crypto is anon. Right up until there's a leak or a slip up that links your wallet address to your identity. Then just go through the entire history of the ledger to see every transaction that's ever happened with your wallet. Or will ever happen, for that matter. No thank you.
- akimbostrawman 1y agoThat is a bitcoin/transparent chain problem not a crypto problem. Monero has solved that issue for many years. It has also more to do with zero knowledge proof than cryptocurrency.
- nullc 1y agoThe ID could be site unique. So for example, your ID card could have [Name, Pubkey, DOB] signed by the issuer, where pubkey is a pubkey for the ID card holder that supports unique signatures. The card has contains the private key and can sign with it. Then to gain access to AdultsOnly.com you sign "AdultsOnly.com" and hash the result. This value is your site-identity. You hand the site the site identity and a zero knowledge proof that you know a [Name, Pubkey, DOB] and valid issuer signature with DOB<=DATE and pubkey matching the signature that went into the hash. Now they know you have an ID by that issuer with an acceptable DOB, and they know that one ID == one account (so no leaked/cracked ID being used to let everyone in). But they cannot link IDs between different sites or with names... if the private keys are not possessed by the state (e.g. generated by you when you get your ID) not even the state could help convert ID to names or link IDs between different sites.
- mooreds 1y agoThere's some work on this at the IETF. You should look at selective disclosure JWTs and wallets. https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-disclosure-jwt/ https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-...