4 ms·

That's not correct. With a government issued signed digital ID cryptographically bound to a hardware security module you can use a zero-knowledge proof based pr

by tzs 1y ago

That's not correct. With a government issued signed digital ID cryptographically bound to a hardware security module you can use a zero-knowledge proof based protocol to prove to any third party site that (1) you have a signed government ID, (2) you have the hardware security module that it was bound to when the government issued it to you, and (3) the date of birth field on that ID says you are older than the site's age threshold. This reveals no other information to the site. The EU is on track to deploy such a system by the end of 2026. They are currently doing field testing involving thousands of users.

thescriptkiddie 1y ago
zero-knowledge proofs don't work like that
- tzs 1y ago
  https://eprint.iacr.org/2024/2010 https://eprint.iacr.org/2024/2010 https://github.com/eu-digital-identity-wallet/av-doc-technical-specification/blob/main/docs/annexes/annex-B/annex-B-zkp.md https://github.com/eu-digital-identity-wallet/av-doc-technic... https://blog.google/technology/safety-security/opening-up-zero-knowledge-proof-technology-to-promote-privacy-in-age-assurance/ https://blog.google/technology/safety-security/opening-up-ze... https://news.ycombinator.com/item?id=44457390 https://news.ycombinator.com/item?id=44457390
immibis 1y ago
Yup. For $5 (hypothetically) I'll use my ID to make that ZKP for you, and you can pass it to the site.
ranger_danger 1y ago
But it still doesn't prove that the person creating the proof is the person who was assigned the government ID, right? What's to stop someone from using their ID to power a bunch of bots? And AFAIK unless the company has a database/API for all the existing IDs in the world, I would think it doesn't stop forged IDs from existing. And even then, corrupt employees could still issue forged IDs... there's no guarantee that a single ID equals a single person forever.
wkat4242 1y ago
But can you still have multiple accounts then? I do need to have that for many services. And if you can, what stops you from creating accounts and giving them to others?

by tzs 1y ago

thescriptkiddie 1y ago

zero-knowledge proofs don't work like that

tzs 1y ago
https://eprint.iacr.org/2024/2010 https://eprint.iacr.org/2024/2010 https://github.com/eu-digital-identity-wallet/av-doc-technical-specification/blob/main/docs/annexes/annex-B/annex-B-zkp.md https://github.com/eu-digital-identity-wallet/av-doc-technic... https://blog.google/technology/safety-security/opening-up-zero-knowledge-proof-technology-to-promote-privacy-in-age-assurance/ https://blog.google/technology/safety-security/opening-up-ze... https://news.ycombinator.com/item?id=44457390 https://news.ycombinator.com/item?id=44457390

immibis 1y ago

Yup. For $5 (hypothetically) I'll use my ID to make that ZKP for you, and you can pass it to the site.

ranger_danger 1y ago

But it still doesn't prove that the person creating the proof is the person who was assigned the government ID, right? What's to stop someone from using their ID to power a bunch of bots? And AFAIK unless the company has a database/API for all the existing IDs in the world, I would think it doesn't stop forged IDs from existing. And even then, corrupt employees could still issue forged IDs... there's no guarantee that a single ID equals a single person forever.

wkat4242 1y ago

But can you still have multiple accounts then? I do need to have that for many services. And if you can, what stops you from creating accounts and giving them to others?