Hacker News Reader

Comment by thomassmith65 | Hacker News Reader

The internet badly needs a standard system for people to verify their age*, identity**, etc but it's a terrible idea for that system not to be pseudonymous.

* as in "I am over n years old", not "my exact birthday is nnnn-nn-nn"

** as in "I am a unique human you know as <uuid>", not "I am John Q Smith"

View on HN

> "I am a unique human you know as <uuid>", not "I am John Q Smith"

That just makes <uuid> an identifier like your name. <uuid> becomes yet another piece of PII, increasing your exposure.

Further, it will even inevitably get linked to your other identifiers in various databases over time. This problem is why pseudoanonymization isn't really that useful.

The idea isn't that a human gets one uuid to be used everywhere, but that each site gets one of the human's many uuids. Someone still needs to track which uuids belong to which human, but at least it's not a random, possibly insecure or disreputable website.

So this UUID is just as anon as crypto is.

Technically, yes. Crypto is anon. Right up until there's a leak or a slip up that links your wallet address to your identity. Then just go through the entire history of the ledger to see every transaction that's ever happened with your wallet.

Or will ever happen, for that matter.

No thank you.

That is a bitcoin/transparent chain problem not a crypto problem. Monero has solved that issue for many years.

It has also more to do with zero knowledge proof than cryptocurrency.

The ID could be site unique.

So for example, your ID card could have [Name, Pubkey, DOB] signed by the issuer, where pubkey is a pubkey for the ID card holder that supports unique signatures. The card has contains the private key and can sign with it.

Then to gain access to AdultsOnly.com you sign "AdultsOnly.com" and hash the result. This value is your site-identity.

You hand the site the site identity and a zero knowledge proof that you know a [Name, Pubkey, DOB] and valid issuer signature with DOB<=DATE and pubkey matching the signature that went into the hash.

Now they know you have an ID by that issuer with an acceptable DOB, and they know that one ID == one account (so no leaked/cracked ID being used to let everyone in). But they cannot link IDs between different sites or with names... if the private keys are not possessed by the state (e.g. generated by you when you get your ID) not even the state could help convert ID to names or link IDs between different sites.

Yes, I fully understand how that works. I don't trust it (or, more properly, I think that it's unwise to to trust that it's being done properly).

This can only be done by delegating the verification to national eIDs systems. This way the website simply asks the government: is this person >18? and the trusted government platform can reply without disclosing additional information.

Why do you think that's the only way?

Your public, verifiable identity already exists because the government keeps track of it. Why would a third party need to be involved if the infrastructure is already available straight from the source? Also, if multiple providers existed, how could platforms avoid duplicates, in case of need?

You talk like we all live under the same government, and like it would be a good thing if we did.

This is your own, personal, twisted interpretation of my reply

I don't see how we can arrive at an alternative interpretation if we follow your argument to its logical conclusion.

If you don't see it then that's your problem

Not all countries have centralized systems with comprehensive national databases, some purposefully fragment record-keeping across different agencies and limit their access accordingly.

Privacy laws and constitutional protections vary widely across democracies and - in my estimation - for very good reason.

This is about pure and simple national ID. National IDs are already managed at the national level, by definition. Other kinds of records are outside of the topic

Would that be your SSN in the US for example? I don't think most people would be in favor of that.

Australia, Canada, Ireland, New Zealand, the UK, and the US have no government-issued compulsory identity cards for all citizens.

I don't want government to be able to get my id. Especially the British and German governments have proved that their lack the maturity to work with such data. They couldn't even keep their fingers from Corona app data.

I would even prefer it to give my info to Elon Musk. He may be crazy, but he wouldn't be interested in my stupid opinions.

It's not the only way, but since the government already has lots of personal information about you, having them also do the ID thing means that I wouldn't need to expose myself to yet another company or otherwise expand my attack surface.

That's not how "attack surface" works. Having your information centralized is what makes you vulnerable.

My point is that my information is already centralized in one place. Giving that information to additional places increases the odds of that information being misused, so I'm not willing to do that. It increases my vulnerability.

You can verify that you're above a certain age while remaining anonymous by way of zero knowledge proof, for example. There is no need to involve a government in a transaction of information that is outside its scope.

It doesn't need to be a national system. The relying party could give the browser a list of acceptable token providers to choose from, and the browser selects one it knows the user has already registered with, for example. There's no reason a private party couldn't be considered trusted to perform identity verification (e.g. banks have KYC requirements already).

Realistically the only acceptable sources are government. For example in the US you basically need a state ID (driver's license), military ID, or passport. And the state systems are now federally regulated (Real ID).

The bills I've seen in the US indicate that you need to use a commercially acceptable solution (so don't mandate government), and include regulations for private providers to follow (e.g. that age validators are also barred from retaining information about the validation).

Sadly, most companies aren't competent enough to delete data and the government isn't competent to verify whether they delete data or not.

I would not want my browser to do this shit.

There's some work on this at the IETF.

You should look at selective disclosure JWTs and wallets. https://datatracker.ietf.org/doc/draft-ietf-oauth-selective-...

Apple and Google are working on that but it isn't available everywhere yet so a lot of sites are outsourcing age checking to various untrustworthy companies.

What would you do with <UUID>? How would you verify that you are actually <UUID> or 18 years old?

Zero knowledge proofs from a provider who has your ID allows validation without data leaking.

Though creates other issues with, i.e. selling validation tokens.

What I'm gathering from that description is a flow that would involve three parties: Me, the restricted resource, and an ID validator. When I wanted to access the restricted resource, they'd ask for a valid token that I would then go to my ID validator to get since they've already identified me, they'd then pass that valid token back to me which I could pass to the restricted resource. They'd presumably then save that token as proof that they did their legally required validation. Is that roughly correct?

I think that's the model they're working on in the EU using Bitstring Status List, OpenID for Verifiable Presentations, and ISO 18013-5.

If you want to know more there's a reference implementation: https://github.com/eu-digital-identity-wallet/eudi-doc-archi...

Just about, yup!

I don't know about your specific link there, but the "zero knowledge" part comes from the token sent to the provider being non-reversible. A token cannot be used to identify the person who generated the token, even by ID validator.

This works because the token is just used as material in (simplified) a hash function.

Reply on news.ycombinator.com