Comment on Is it completely impossible to do age verification without compromising privacy?

Modern_medicine_isnt@lemmy.world ⁨1⁩ ⁨day⁩ ago

• Saledovil@sh.itjust.works ⁨14⁩ ⁨hours⁩ ago

  We could just make the middle man somebody who already needs that information, e.g. the IRS.

  source

  • Modern_medicine_isnt@lemmy.world ⁨5⁩ ⁨hours⁩ ago

    You could, but that wouldn’t address OPs question. The IRS is known for giving info to other parts of the government to aid in prosecution. And the gov has shown they are terrible at cyber security, so you might as well just post your browser history on the web.

    source
• dickalan@lemmy.world ⁨1⁩ ⁨day⁩ ago

  I figured you were wrong so I asked an AI and it confirmed what the people below you were saying, you really do seem to be talking straight out of your ass

  Yes, it is technically possible to build an accurate, high-confidence age-verification system that does not compromise privacy in the traditional sense (i.e., no central database of IDs, no name/address/DOB stored by the site, no paper trail that can be subpoenaed or leaked). The core tool that makes this feasible is zero-knowledge proofs (ZKPs), specifically age-based ZK proofs.

  How a privacy-preserving age check actually works in 2025

  1. User proves age to a trusted credential issuer once
  2. • Government digital ID (e.g., EU eIDAS wallet, some U.S. mobile driver’s licenses, Yoti, ID.me, etc.)
     • The issuer cryptographically signs a statement like “This private key belongs to someone born before 2007-11-27” without ever revealing the exact birthdate. User generates a zero-knowledge proof
  3. • Using their phone or browser, they create a proof that says:
       “I have a valid credential signed by [Trusted Issuer] that confirms I am 18+ (or 21+).”
     • Nothing else is revealed: no name, no exact age, no birthdate, no issuer identity if you want to go fully anonymous. Website verifies the proof in <1 second
     • The site checks the cryptographic signature and that the policy (“18+”) is satisfied.
     • It learns literally nothing else about the person.

  Real-world implementations that already exist or are in late-stage pilots (November 2025):

  • Worldcoin’s World ID “age 18+” orb-verified credential + ZK proof
  • Polygon ID / zkBridge systems used by some adult sites
  • SpruceID + Ethereum Attestation Service kits
  • Gitcoin Passport + ZK age attestations
  • Proof-of-Humanity + age minimum circuits
  • Yoti + ZK prototype (demoed 2024–2025)

  Remaining practical hurdles (why it’s not universal yet)

  • User has to have a compatible digital credential in the first place (adoption still <30% in most countries)
  • Friction: first-time setup takes 2–10 minutes instead of 3 seconds
  • Most adult sites don’t want to pay the (tiny) gas/verification fee or integrate the SDKs
  • Regulatory gray zone in some jurisdictions that still mandate “know your customer” records

  Bottom line
  Technically: Yes, 100% possible today with zero-knowledge age proofs.
  Practically: It exists, works, and is slowly rolling out, but the porn industry and most social platforms still prefer cheap/frictionless (but privacy-invasive) methods or just do nothing.

  So the top reply in your screenshot (“you always need a middle man with too much information”) is outdated — cryptography has already solved the “middle man” problem. The real blocker now is deployment inertia, not theory.

  source

  • phoenixz@lemmy.ca ⁨12⁩ ⁨hours⁩ ago

    you’re talking out of your ass so I asked an AI

    Pot, you are black! Signed, kettle

    source
  • njm1314@lemmy.world ⁨17⁩ ⁨hours⁩ ago

    Just for your edification anything you say after “so I asked an AI” is going to be ignored by most people. It just tells me everything that comes next is not going to be worthwhile. Might as well tell me your palm reader told you something.

    source

    • dickalan@lemmy.world ⁨7⁩ ⁨hours⁩ ago

      Ok

      source
  • Modern_medicine_isnt@lemmy.world ⁨22⁩ ⁨hours⁩ ago

    Read back what you wrote. Your first line was about a trusted credential provider. Thats a middle man. Then you talk about creating a proof. Guess what, that phone and browser are known to spy on you excessively. That’s another middle man. And odds are that same phone or browser it what you will use to access something that needs the verification. So the same phone or browser has all parts of the information.
    And of course it’s pointless because anyone could steal an ID and get themselves a key. Or steal your phone… so it wouldn’t even prove anything.

    source

    • jabberwock@lemmy.dbzer0.com ⁨18⁩ ⁨hours⁩ ago

      I’ll address the second objection first regarding the phone or browser. You’re always going to rely on some technology for the solutions that use cryptography, you just can’t do those calculations long-hand realistically. That said, look up frameworks like CTAP that allow a potentially untrusted user terminal, like a browser, to interact with a trusted hardware token. Those hardware tokens can be made fairly tamper-proof, see FIPS authorized Yubikeys, such that the phone is pretty much removed from the attestation process. Yes these can still be stolen, but they make hardware keys that are fingerprint authenticated and the biometric stays on the device. Doesn’t get much more self-sovereign than that.

      The existence of a trusted credential provider is a challenge. Fully self-sovereign credentials need to either be trust on first use or validated against a larger system everyone participates in. Even if we had some system of birth certificates tied to a distributed ledger, we would have to trust the third party recording that certificate in the first place, be it a hospital, doctor, or state entity. These trust and proof systems don’t create the trust, they just allow us to extend that trust from one claimant to a verifier. Whether you place that trust in the state, an individual, or an independent third party is up to you.

      source

      • Modern_medicine_isnt@lemmy.world ⁨5⁩ ⁨hours⁩ ago

        So, you have fully backed my response. OP didn’t ask if it was possible with some caveats. I understand a (at a high level) the technical options that can get close to what OP asked for, but it fundamentally just isn’t possible without caveats.

        source
  • TechLich@lemmy.world ⁨13⁩ ⁨hours⁩ ago

    The big flaw in this strategy is that once you have set up a signed anonymous key from the government and you can make zero knowledge proofs with it, there’s nothing stopping you from distributing that key to every kid who wants it. If it’s in the browser or an app, etc. you can publish that signed key for anyone who wants to be over 18.

    PKI only works if the owner of the private key wants it to be private. It’s effective for things like voting or authenticating because the owner of the key doesn’t want anyone else to be able to impersonate them. But if it’s only for age…

    At that point, it might as well just be a file that says “I pinky promise that I’m over 18” that the government has signed and given to you.

    source

    • jabberwock@lemmy.dbzer0.com ⁨11⁩ ⁨hours⁩ ago

      Could tie it to something like a biometric. That and storing it on a write-only device would keep it from being shared too wide. The trickiss to tie it to a true multi-factor and not just something you have (if unencrypted) or something you know (if ASCII armored).

      source

      • coriza@lemmy.world ⁨2⁩ ⁨hours⁩ ago

        Then it adds barrier to entry. If it costs money it will be a problem for the more vulnerable population. If it is free and you can have as many as you want it is gonna be abused, if there is a limit it again starts to be a problem.

        source