Hacker News Reader

Comment by Aurornis | Hacker News Reader

> The government doesn't learn which web sites you visit, and the web sites don't learn anything about you other than you are certified to be age ≥ 16.

If the zero-knowledge proof doesn't communicate anything other than the result of an age check, then the trivial exploit is for 1 person to upload an ID to the internet and every kid everywhere to use it.

It's not sufficient to check if someone has access to an ID where the age is over a threshold. Implementing a 1:1 linkage of real world ID to social media account closes the loophole where people borrow, steal, or duplicate IDs to bypass the check.

View on HN

As I mentioned elsewhere, you’re falling for letting perfect be the enemy of good. The ZKP + phone biometrics only needs to raise the cost of bypass above what adolescents have access to. And no, you can’t just share the same ID because there’s revocation support in the mDL and it’s difficult to extract the raw data once it’s stored on the trusted element. This is very similar to how credit cards on phones work which are generally very difficult to steal.

Sorry, you’re not thinking like a group of 15 year olds trying to get online.

The revocation list means nothing when they can get ahold of someone’s older sibling’s ID and sign up for social media.

Did everyone just forget what it’s like to an ambitious kid who wants to get online?

Do people really think a platform that needs people to jump through these hoops and use this imaginary international ID architecture is feasible?

Does anyone really think that kids won’t just set their location to Estonia and/or use a VPN to circumvent all of this?

This. The parties that this will detriment are all older people. Kids will simply bypass it.

You’re thinking like a group of technically proficient 15 year olds and their friends. That’s a small minority. The vast majority of teens are likely to be stymied.

Revocations are not for the individual ID but if an exploit is found compromising the IDs stored on a trusted element. Your older siblings ID can’t be used to sign for millions of accounts - just those who the older sibling lets borrow their phone that has their ID (and assuming there isn’t some kind of uniqueness cookie that can be used to prevent multiple accounts under a single ID). That’s a much different and more manageable problem (fake ids via older siblings have been a thing for forever).

>As I mentioned elsewhere, you’re falling for letting perfect be the enemy of good

No, this line of reasoning deserves nothing but absolute contempt when it comes to laws. We are not talking about getting the finnicky API to work at your job. Too often laws have had unintended consequences as a result of loopholes or small peculiarities. If the damn law doesn't even work on a fundamental level then it should be opposed on principle.

You’ve just described literally every single law. Congrats. You’re now appreciating what it’s like to live in a law-based society.

It don't have to be perfect, but it need to have some way to do spot checks.

If there is no risk involved, everyone will jump on doing it.

There are technical methods to detect and revoke large-scale reuse of an uploaded id. I wrote more detail in another comment.

That only covers large-scale reuse. It doesn't cover lending your id to your younger sibling if you want to, or if they find a way. Maybe that should be acceptable anyway. Same as you can lend your phone or computer to someone to use "as you", or you can buy them cigarettes and alcohol. Your responsibility.

Reply on news.ycombinator.com