6 ms·

Our state-issued eID cards are supposed to have a function that allows anonymous age verification to a trusted party. It should work like this: a requesting par

by janci 2y ago

Our state-issued eID cards are supposed to have a function that allows anonymous age verification to a trusted party. It should work like this: a requesting party sends a request signed by state-issued certificate to the ID card, the card verifies the request authenticity and responds with a signed confirmation of legal age and that signature then can be verified by the requester. No personal information is shared. While I do not aggree with pervasive age restrictions, this is a nice technical solution to privacy preserving age verification

drdaeman 2y ago
Just curious: 1) which country/eID is this? and 2) does it send the date of birth back, or does it perform a zero-knowledge proof that the date of birth is greater or equal than a given value (current date minus age requirement)?
- jer0me 2y ago
  A handful of states, including California, have a digital ID that can do this. It only sends the fact that you’re over a certain age. There’s a video halfway down this page showing the process in Apple Wallet: https://learn.wallet.apple/id/ https://learn.wallet.apple/id/ (notice “Age Over 21”)
rs186 2y ago
So kids just memorize their parents' driving license when they don't pay attention, and this is bypassed, just like in the old days.
- Jolter 2y ago
  I don’t think that’s how a state e-ID works.
- djsjajah 2y ago
  No. Kids would need to memorize the private key of their parents id card.
  - hellojesus 2y ago
    What stops me, a random person, from publishing my private key online for anyone to use?
    - tremon 2y ago
      Common risk awareness, one would hope. What's to stop a random criminal from using that private key to take out a big loan in your name?
      - hellojesus 2y ago
        I would assume that my private key for pricing my identity to random websites is different than that used to make financial transactions. Why would I ever elect to keep it the same?
cogman10 2y ago
Really comes down to "how sure do you want to be that the person is the right age"? Or the "how hard would it be for a preteen to buy beer?" test. With an eID card, if it's just saying "yes, this person is old enough" then any teen can swipe a device with an eID card and start using it.
- lll-o-lll 2y ago
  So it’s tied to biometrics/other 2nd factor as with passkeys. Wouldn’t stop mini-me of course…
Aloisius 2y ago
> No personal information is shared. You'd know the state they're a legal resident of as they use state-specific keys used for signatures. If the request allows checking arbitrary ages like Apple's, then you can get their age with a handful of requests. If one has to verify every visit, then you can get exact birthdate eventually. If the one verifying has to pass data to the verifier site or the request to the verifier has any site/app/company-specific IDs (again, Apple), then you're leaking what you're visiting to the verifier. And not to beat a dead horse, but as long as there are jurisdictions that don't require age verification in the world, children can easily use a free VPN or proxy to avoid checks altogether at which point, one has to ask, why do it at all?
- solidsnack9000 2y ago
  "...at which point, one has to ask, why do it at all?" It seems like this line of thinking would lead you to ask the same question of literally any law, wouldn't it? Laws often don't rely on being 100%. Even though there is a law saying people need to wear a seat belt, they can just not wear it! So what's the point, &c, &c?
  - Aloisius 2y ago
    If you don't wear a seatbelt, you can be ticketed. Not only is enforcement practical, but it has a measurable impact on behavior. If you use a VPN to visit a porn site to bypass age verification, you haven't broken the law as it applies to sites, not users. There will be no measurable impact on underage people visiting since the barriers to VPNs/proxies are almost nil while still costing money to enforce on non-tech savvy adults - an overall detriment to society. Laws that are unenforceable and don't benefit society are bad laws.
    - solidsnack9000 2y ago
      Let me see if I understand the situation you're describing clearly. It seems like you're saying that all or most young people will be able to -- and be inclined to -- use VPNs to visit porn sites, and will do so. They won't be able to visit porn sites in their own jurisdiction -- let us call it jurisdiction J -- because those sites have to perform age verification, but they will be able to visit porn sites in other jurisdictions, since they can send traffic that appears to originate in those jurisdictions. Those porn sites are not in J and so don't have to enforce J's rules. When I think about this situation, though, it just seems like it would lead lawmakers to require VPN sites to perform age verification.
kallistisoft 2y ago
There's an issue with the flow you described; the party requesting verification shouldn't directly interact with the verifying agent (the state) as this leaks to the state the identity of the requesting 3rd party. The correct flow for preserving anonymity is: the requesting party issues a challenge token to the user -- the token header describes the type of request (>=18yo?) and the token body is completely random(). The user then takes this token and has the challenge verified (signed) on their side, the signed token is then returned to the requester. This way the state never knows the identity of the challenge issuer. () Note that this scheme requires good faith on the part of the challenge issuer that the token body is actually random, although it would seem that a simple DH-key mechanism would patch this vulnerability.
- janci 2y ago
  I think it is a tradeoff between "everybody can request age verification" and "only state-licensed parties can request age verification". I don't think everybody's ID card should tell anyone if the holder is adult or not, especially wirelessly
- hellojesus 2y ago
  What prevents the requesting party from saving the random bytes and then connecting with the signing party to link the user with the service?
archon810 2y ago
The new laws, such as the one that just passed in Utah, require kids to get the consent of their parents to install apps. So now add that complexity to the flow. https://apnews.com/article/utah-app-store-age-verification-7e31de07ddca7b32cc82f7ead2c4adc9 https://apnews.com/article/utah-app-store-age-verification-7... https://le.utah.gov/~2025/bills/static/SB0142.html https://le.utah.gov/~2025/bills/static/SB0142.html

by janci 2y ago

drdaeman 2y ago

Just curious: 1) which country/eID is this? and 2) does it send the date of birth back, or does it perform a zero-knowledge proof that the date of birth is greater or equal than a given value (current date minus age requirement)?

jer0me 2y ago
A handful of states, including California, have a digital ID that can do this. It only sends the fact that you’re over a certain age. There’s a video halfway down this page showing the process in Apple Wallet: https://learn.wallet.apple/id/ https://learn.wallet.apple/id/ (notice “Age Over 21”)

rs186 2y ago

So kids just memorize their parents' driving license when they don't pay attention, and this is bypassed, just like in the old days.

Jolter 2y ago
I don’t think that’s how a state e-ID works.
djsjajah 2y ago
No. Kids would need to memorize the private key of their parents id card.
- hellojesus 2y ago
  What stops me, a random person, from publishing my private key online for anyone to use?
  - tremon 2y ago
    Common risk awareness, one would hope. What's to stop a random criminal from using that private key to take out a big loan in your name?
    - hellojesus 2y ago
      I would assume that my private key for pricing my identity to random websites is different than that used to make financial transactions. Why would I ever elect to keep it the same?

cogman10 2y ago

Really comes down to "how sure do you want to be that the person is the right age"? Or the "how hard would it be for a preteen to buy beer?" test. With an eID card, if it's just saying "yes, this person is old enough" then any teen can swipe a device with an eID card and start using it.

lll-o-lll 2y ago
So it’s tied to biometrics/other 2nd factor as with passkeys. Wouldn’t stop mini-me of course…

Aloisius 2y ago

> No personal information is shared. You'd know the state they're a legal resident of as they use state-specific keys used for signatures. If the request allows checking arbitrary ages like Apple's, then you can get their age with a handful of requests. If one has to verify every visit, then you can get exact birthdate eventually. If the one verifying has to pass data to the verifier site or the request to the verifier has any site/app/company-specific IDs (again, Apple), then you're leaking what you're visiting to the verifier. And not to beat a dead horse, but as long as there are jurisdictions that don't require age verification in the world, children can easily use a free VPN or proxy to avoid checks altogether at which point, one has to ask, why do it at all?

solidsnack9000 2y ago
"...at which point, one has to ask, why do it at all?" It seems like this line of thinking would lead you to ask the same question of literally any law, wouldn't it? Laws often don't rely on being 100%. Even though there is a law saying people need to wear a seat belt, they can just not wear it! So what's the point, &c, &c?
- Aloisius 2y ago
  If you don't wear a seatbelt, you can be ticketed. Not only is enforcement practical, but it has a measurable impact on behavior. If you use a VPN to visit a porn site to bypass age verification, you haven't broken the law as it applies to sites, not users. There will be no measurable impact on underage people visiting since the barriers to VPNs/proxies are almost nil while still costing money to enforce on non-tech savvy adults - an overall detriment to society. Laws that are unenforceable and don't benefit society are bad laws.
  - solidsnack9000 2y ago
    Let me see if I understand the situation you're describing clearly. It seems like you're saying that all or most young people will be able to -- and be inclined to -- use VPNs to visit porn sites, and will do so. They won't be able to visit porn sites in their own jurisdiction -- let us call it jurisdiction J -- because those sites have to perform age verification, but they will be able to visit porn sites in other jurisdictions, since they can send traffic that appears to originate in those jurisdictions. Those porn sites are not in J and so don't have to enforce J's rules. When I think about this situation, though, it just seems like it would lead lawmakers to require VPN sites to perform age verification.

kallistisoft 2y ago

There's an issue with the flow you described; the party requesting verification shouldn't directly interact with the verifying agent (the state) as this leaks to the state the identity of the requesting 3rd party. The correct flow for preserving anonymity is: the requesting party issues a challenge token to the user -- the token header describes the type of request (>=18yo?) and the token body is completely random(). The user then takes this token and has the challenge verified (signed) on their side, the signed token is then returned to the requester. This way the state never knows the identity of the challenge issuer. () Note that this scheme requires good faith on the part of the challenge issuer that the token body is actually random, although it would seem that a simple DH-key mechanism would patch this vulnerability.

janci 2y ago
I think it is a tradeoff between "everybody can request age verification" and "only state-licensed parties can request age verification". I don't think everybody's ID card should tell anyone if the holder is adult or not, especially wirelessly
hellojesus 2y ago
What prevents the requesting party from saving the random bytes and then connecting with the signing party to link the user with the service?

archon810 2y ago

The new laws, such as the one that just passed in Utah, require kids to get the consent of their parents to install apps. So now add that complexity to the flow. https://apnews.com/article/utah-app-store-age-verification-7e31de07ddca7b32cc82f7ead2c4adc9 https://apnews.com/article/utah-app-store-age-verification-7... https://le.utah.gov/~2025/bills/static/SB0142.html https://le.utah.gov/~2025/bills/static/SB0142.html