Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Can you provide an example of how an age verification system wouldn’t require providing some identifying information to the government or a company when accessing content?


An example is the EU Digital Identity Wallet that the EU is in the midst of implementing. This is a system to allow you to store a copy of your ID documents on a device you own that included a secure element. Most people will use their smartphone.

The agency that issues your documents can give you a digital copy that is cryptographically bound to the secure elements in your device.

When you want to prove your age to a web site it uses a zero knowledge proof (ZKP) based protocol to prove to the site that the documents bound to your secure element show that age. Nothing but the fact that they show that age and that they are bound to your element is disclosed to the site.

The ZKP proof protocol communication is just between your device the site. The government that issued your ID is not involved, so they don't know where you have used the ID or even if you have used the ID.

BTW, this is not limited to age. It can be used with any data on your ID. For example if German political forum wanted to verify you were German before allowing you to post you could use this system to disclose to them that your ID has "Germany" in the country field and that would be all that is disclosed.

For those outside the EU, Google has released an open source library for implementing things like this [1].

[1] https://news.ycombinator.com/item?id=44457390




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: