this post was submitted on 05 Apr 2026
874 points (99.5% liked)
Technology
83499 readers
4651 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
What do you mean? The system already exists in Germany and whatever website or app asking if you‘re an adult will only get exactly that information. Not your face, not your name, not even your age. They will simply receive a verified Y/N from a government service. Needless to say no US company implemented it because they would miss out on a lot of sweet sweet data.
Surely that's not zero knowledge since the government can see every site you visit, which is the whole point of these laws anyway
I can't speak to Germany's system, but there's no need for a site to tell the verification service its identity. If it just asks "is the current session authenticated to someone over 16" and gets an answer back. Identity of both parties remains secret.
Theoretically, it's possible for the user to authenticate their age without either the site or service knowing the user's identity. Quick and dirty example:
There's a thing called a ring signature that allows one to prove that one of a large number of people digitally signed something. Let's say a million people all have private keys whose corresponding public keys are registered to a database after they flashed their state ID at a post office or something to prove they are ≥18 years of age. So, John Smith uses his private key plus all 1 million public keys to sign a statement that he sends to a server saying he's ≥18. The server then takes all 1 million public keys plus the signed message John provided and verifies that his signature is among the 1 million but cannot calculate which exact public key belongs to John. The verification process requires all 1 million public keys as input; you cannot, for example, try an omit each public key one-by-one to see which causes the verification process to fail.
Currently, there is ongoing research on how to make compact ring signatures since they can be very large the more public keys are involved.
https://en.wikipedia.org/wiki/Ring_signature
That said, even if you had scalable compact ring signature technology, I'd be more worried about advertiser deänonymization efforts once a user has logged in that check browser canvas size, IP address, user agent, font availability, etc. See https://coveryourtracks.eff.org/
Also, ring signatures for age verification don't actually verify age, just that someone proved their age at some point in the past to the owner of the public key database; just like an adult can log into YouTube on behalf of their children and let the children go to town, John could give anyone access to his private key regardless of age.
No need to, but no need for it not to either. And no way to verify it isn't beyond "trust me bro" and I don't trust them
If the verification service is structured like oauth, then the request could be passed through the browser as signed plaintext. You could verify that the requesting site is only passing a minimum age request to the service. That would be as straightforward as viewing the interaction in your browser's debug tooling.
If you say that you don't trust the signature, and that it could be used to smuggle identifying information across, there's a couple of ways to deal with that: open source and audited provider governed by legislation; information theory that would show personally identifying information wouldn't fit into a field of that size; and "personal auditing" where you can try throwing data at the service to see if you can trick it into accepting invalid input (that really goes with the previous point, because the only field you can usefully vary is the signature).
“Hey, Uncle, can I use your age tokens to do my research homework? The rich kids all get to use the entire Internet because their uncles let them ride their age credentials. Thanks!”
I don't see how other methods aren't immune to this issue without asking you to do verification every day.