Comment by croes
2 days ago
> There is no safe age verification. There is no age verification that doesn’t put people at risk.
There are zero knowledge proofs
2 days ago
> There is no safe age verification. There is no age verification that doesn’t put people at risk.
There are zero knowledge proofs
Concrete ZKP age verification schemes are hardly zero knowledge.
Imagine your idealized ZK address verification scheme. It would go something like: I show up at a website, it sends me some challenge, I send back a signature of the challenge that could only be made by someone with an of-age ID, but without specifying who. Everyone is happy.
Now little Johnny borrows my ID, and uses it to setup some oracle that provides ID validation for every kid and bot in the country. Woops.
To stop that you must compromise the idealized zero knowledge properties of the scheme, and in doing so you create the potential for harm/risk for everyone.
Sure, it's better than sending an ID card live feed to the dark web, but the risks of ID card theft are at least somewhat easy to understand.
Some of the threats to human rights don't even require the departure from the 'idealized' model-- as even the idealized model requires an ID issuer to issue the of-age person an ID. And so if the ID ZKP is widely required then the issuer can unperson you by simply declining to issue you an ID.
BTW your example didn’t compromise zero knowledge, only after you added further requirements the zero knowledge was gone.
add MFA to the check
add a different ID check to the MFA if that doesn't work, then add more MFA to that new ID check. Eventually it has to work, right?
It's definitely worth doing infinite security in order to avoid regulating social network algorithms, because
1 reply →
To where, the site requesting the verification? Now it is no longer zero knowledge.
4 replies →
True. I built a ZK age verification based on Polish digital identity https://x.com/maciejlotkowski/status/1899896737688436844, but I didn't find a business case for it at the time.
There's a EU initiative https://digital-strategy.ec.europa.eu/en/news/commission-mak.... The direction is generally good, but I'm not very positive about the implementation (as with everything comes from the govs).
More information here about how the implementation enforces a Google/Apple duopoly: https://github.com/eu-digital-identity-wallet/av-doc-technic...
Yep, and there are a variety of other schemes like OpenID Verifiable Credentials which allow you to prove things like age without giving away everything, too.
Collecting images of people’s ID is outdated and really shouldn’t be done.