today I created a burner google account. these days google requires an Android phone in order to even create an account so I used an old phone to scan the QR code ( I am pretty sure this lets google grab all of the metadata of the mobile phone ). after about 1 hour creating the account. google’s automated system disabled the account however I appealed and got the account back. before someone asks I need google because of where I live.

this made me wonder what if google mandates age verification? if there were age verification google would immediately notice that I am creating another account ( burner account ) which it won’t like. burner account won’t be created in the first place!

we already have too much surveillance and this makes it worse. my mobile number is already tied to my read government identity. I DO NOT want my online account to be tied to my read identify too! it is sad, it really is

  • hirihit640@sh.itjust.worksEnglish
    14·
    9 days ago

    Zero-Knowledge Proofs Aren’t Age Verification Silver Bullets

    The idea behind ZKPs is that you are issued a “token” that vouches for your age every time you log in, creating a constant link back to the entity that verified you. The issuer of the tokens these AV schemes rely on could track every time that credential is used, creating a dangerous trail of metadata on any user they wanted to target. The issuer itself could be pressured by authoritarian governments to remove a user’s access to a service, essentially removing that person’s access to the internet entirely.

    a centralized identity verification system creates a single point of failure that is extremely vulnerable to both cyberattack and authoritarian overreach.

    Personally I’m optimistic that tech like this can be used in positive ways, but imo they should be developed transparently (open source) and decentralized.

    • ryannathans@aussie.zone
      English
      2·
      9 days ago

      How could the issuer track when a credential is used? Isn’t the whole point that the issuer isn’t needed for verification of the ZKP?

      • hirihit640@sh.itjust.worksEnglish
        31·
        9 days ago

        Because the credential is unique. Imagine you submit it every time you log into Google, Facebook, and Youtube. They could all collude and see that the same age verification token was used and link the accounts.

        • ryannathans@aussie.zone
          English
          3·
          9 days ago

          They are use once tokens, you get given like 50 or 100 when issued. There’s no way to link them

          • hirihit640@sh.itjust.worksEnglish
            1·
            9 days ago

            If they are use once tokens then you need to get more. If implemented badly, they could be asking for a new one every time, and now the issuer knows whenever you are using them. I’m not sure exactly what implementstion flaws The EFF article was talking about but they have links if you want to learn more.

            Edit: also, now that I think of it, if it’s single use, then they need to be invalidated every time they are used. So this probably also notifies the issuer every time a token is used, and which token it was. There are probably ways to do this privately but it is a tricky problem, and something the government probably won’t get right the first time, which is the main issue that the EFF is talking about.

            • ryannathans@aussie.zone
              English
              1·
              9 days ago

              The single use part is just for your privacy, they don’t have to be invalidated. You could just have them last a week or <time interval> on issue

              • hirihit640@sh.itjust.worksEnglish
                1·
                8 days ago

                You’re talking about potential implementations. EFF is talking about issues in current implementation. As I said in my very first comment, I’m sure it can be done properly. The EFF is worried that if the current implementation is rolled out now, the system will stay unfixed for years and make privacy even worse.

                But anyways, since you seem knowledgeable about the EUDI implementation and I’m too lazy to look it up, do you know if the current implementation allows a website to collude with the issuer to get the identity of a user?

                • ryannathans@aussie.zone
                  English
                  1·
                  8 days ago

                  My reference point is cloudflare’s research on zero knowledge proofs used to issue anonymous tokens to bypass (pre-complete) captcha checkpoints.

                  Neither website nor issuer (nor the combination) can determine the identity of a user from the token (hence zero knowledge), but other techniques entirely unrelated to the cryptography can identify a user. For example network or browser metadata or traditional browser fingerprinting.

                  • hirihit640@sh.itjust.worksEnglish
                    1·
                    8 days ago

                    I see so it seems like we were talking past each other. I’m aware of Cloudflare’s token system. As well as other systems like GNU Taler and Monero. So clearly privacy preserving systems can be built. But I also trust the EFF, and if they say the current system has major flaws I’m inclined to believe them

    • state_electrician@discuss.tchncs.deEnglish
      23·
      9 days ago

      In that argument the issuer is a private entity. In my argument the issuer is my country itself and they’re not involved in the proof, because it happens on my device. The EUDI wallet, at least in theory, will be trusted, because it is signed by an EU member state. And it runs on my device, so the state doesn’t know what I use it for. Just like a physical ID.

      • hirihit640@sh.itjust.worksEnglish
        21·
        9 days ago

        Ok so you clearly didn’t read the article because it calls out EUDI explicitly:

        By the end of 2026, the 27 states within the European Union are expected to have infrastructure in place to do age verification within a “mini-wallet” app that will live inside the EUDI (European Digital Identity) Wallet. This is being met with plenty of warranted criticism from digital rights experts. The “mini-wallet” version is already being rolled out, with promises that the ZKPs are in working order. But recent insights show that the ZKP features aren’t yet turned on except for the closed demo/prototype build (not the version of the app people are using “out of the box”), which the vast majority of everyday users can’t access.

        Worse still, a security researcher found they could bypass the app’s system using a quickly built Chrome extension that tricked the app into repeatedly accepting the same “over-18” token. It did so without ever asking for fresh verification.

        Over 400 security researchers signed an open letter stating that age assurance checkpoints, even if implemented with privacy in mind, would cause more harm than good. A primary focus of their concern, which we share, is the fact that a centralized identity verification system creates a single point of failure that is extremely vulnerable to both cyberattack and authoritarian overreach.

        Once the “mini-wallet” version of this is fully integrated into the EUDI Wallet, it will replicate these same failures, perhaps more, but at a much larger scale. At that point, the failures will involve many more pieces of sensitive information that the EUDI Wallet contains: passports, driver’s licenses, travel information, financial information, to name a few.