TaggartFeb 27
Okay, obviously Persona is terribad. There is a real problem to address here though: how are organizations supposed to perform reasonable identity verification at a distance? Sophisticated impersonation attacks hit customer support lines every day. We need a reasonable defense against this.
Show threadTaggartFeb 27

I'm asking because I honestly can't imagine a solution to this particular problem that is both:

  • User friendly
  • Acceptable to privacy advocates
Show threadSoatok Dreamseeker

@mttaggart I wrote about the cryptography needed to build a solution a while ago: https://soatok.blog/2025/07/31/age-verification-doesnt-need-to-be-a-privacy-footgun/

The usability on top of the cryptography is a whole 'nother can of worms, though.

And even if you use good cryptography for privacy, if your endpoint leaks your credentials anyway, you still put users at risk.

Further, even if a good solution existed, the ways the laws and regulations that are being written about these verification requirements are often shitty on top of all that.

There's not an easy answer. But there should be.

Age Verification Doesn’t Need to Be a Privacy Footgun - Dhole Moments

“Won’t someone think of the poor children?” they say, clutching their pearls as they enact another stupid law that will harm the privacy of every adult on Earth and create Prior R…

Dhole Moments
Feb 27 at 5:03pmWeb
Show threadTaggartFeb 27

@soatok I remember this post, and I remember bumping on this line:

We would need existing identity verification services (e.g., ID.me in the USA) to vend PrivacyPass tokens that can be redeemed on third party websites.

This is where I think a lot of privacy advocates are gonna get off the bus.

Show threadSoatok DreamseekerFeb 27
@mttaggart Anonymous credentials are a well-studied area of cryptography. If they balk at them, I dunno what to say lol
Show threadTaggartFeb 27
@soatok I mean reasonable or not, state-adjacent anything is just anathema right now. It's not a technical problem!
Show threadTindraFeb 27

@mttaggart @soatok the thing I find interesting about id.me is that the reason it squicky me out is because its state *adjacent*, and its primary use case is for *members of the state* (military, though they do serve other communities).

The fact that it’s not my *state* verifying my *state service* is the weird part for me.

Show threadLinus GasserFeb 27

@mttaggart @soatok I'm sure you can cobble something together using noir - it's an awesome framework, and makes ZKPs so much nicer.

Create a circuit which has been peer-reviewed and is identified by its hash
Private input: any ID, must be rooted (signed) by a trusted third party
Public input: whatever you want to know about the ID, plus the root (public key) of the trusted third party
Proof: I have an ID with a signature verifiable by the public key and fits the requirements

Show threadRichardFeb 28

@soatok @mttaggart I think Yivi actually made this? (Disclaimer: I know just enough crypto to know I have no idea if they got it right)

But meh, if the goal really was to protect children, age verification wouldn’t be on top of the list.

Yivi - Your digital identity in one app

Yivi is de privacyvriendelijke ID-app waarmee je veilig inlogt, gegevens deelt en bewijst wie je bent. Wachtwoordloos, veilig en altijd in controle. All You. All yours.

Yivi