The limits of zero-knowledge for age-verification | Brave

Submitted ⁨⁨1⁩ ⁨day⁩ ago⁩ by ⁨floofloof@lemmy.ca⁩ to ⁨cybersecurity@infosec.pub⁩

https://brave.com/blog/zkp-age-verification-limits/

cross-posted from: lemmy.zip/post/52481309

ZKPs are often advanced as a technical remedy, promising privacy-preserving attestations of age or eligibility. Yet their deployment in practice exposes both conceptual and practical limits.

source

Comments

Sort:hotnew top

vapeloki@lemmy.world ⁨1⁩ ⁨day⁩ ago
We already have zero knowledge proof in Germany, but nearly no one uses it.

Our ID cards have an embedded private key.

The theoretical flow is (very simplified of course)

Webseite sends challenge to a locally running app

App request the ID card (NFC, you can use your mobile phone as a reader)

Reader asks for pin

Requested information from website are show (for example pseudonym id, full data, age verification onlz, so older 18 or older 21)

You acknowledge this

Signed message with requested information is send back to server

Server verifies signature with official key servers of the federal authority for our ID cards.

Works, secure and save.

But, because of privacy concerns, many users did not activate this feature and, besides some government websites, nobody essentially accepts it.

Also, it is hard to explain that, despite the fact that your ID card acting as the private key, your signature is anonymous if you don’t explicitly allow the websites to see your data
source
- Kissaki@programming.dev ⁨1⁩ ⁨day⁩ ago
  It’s new to me that it’s NFC. I was under the impression I need to buy a reader device to make use of digital auth or signature stuff.
  
  source
  - vapeloki@lemmy.world ⁨21⁩ ⁨hours⁩ ago
    It was always NFC. But using your mobile as a reader is about 6 years old now. Und only because the whole client app is open source and somebody contributed it
    
    source