I can’t speak to Germany’s system, but there’s no need for a site to tell the verification service its identity. If it just asks “is the current session authenticated to someone over 16” and gets an answer back. Identity of both parties remains secret.
Theoretically, it’s possible for the user to authenticate their age without either the site or service knowing the user’s identity. Quick and dirty example:
There’s a thing called a ring signature that allows one to prove that one of a large number of people digitally signed something. Let’s say a million people all have private keys whose corresponding public keys are registered to a database after they flashed their state ID at a post office or something to prove they are ≥18 years of age. So, John Smith uses his private key plus all 1 million public keys to sign a statement that he sends to a server saying he’s ≥18. The server then takes all 1 million public keys plus the signed message John provided and verifies that his signature is among the 1 million but cannot calculate which exact public key belongs to John. The verification process requires all 1 million public keys as input; you cannot, for example, try an omit each public key one-by-one to see which causes the verification process to fail.
Currently, there is ongoing research on how to make compact ring signatures since they can be very large the more public keys are involved.
That said, even if you had scalable compact ring signature technology, I’d be more worried about advertiser deänonymization efforts once a user has logged in that check browser canvas size, IP address, user agent, font availability, etc. See https://coveryourtracks.eff.org/
Also, ring signatures for age verification don’t actually verify age, just that someone proved their age at some point in the past to the owner of the public key database; just like an adult can log into YouTube on behalf of their children and let the children go to town, John could give anyone access to his private key regardless of age.
no way to verify it isn’t beyond “trust me bro” and I don’t trust them
If the verification service is structured like oauth, then the request could be passed through the browser as signed plaintext. You could verify that the requesting site is only passing a minimum age request to the service. That would be as straightforward as viewing the interaction in your browser’s debug tooling.
If you say that you don’t trust the signature, and that it could be used to smuggle identifying information across, there’s a couple of ways to deal with that: open source and audited provider governed by legislation; information theory that would show personally identifying information wouldn’t fit into a field of that size; and “personal auditing” where you can try throwing data at the service to see if you can trick it into accepting invalid input (that really goes with the previous point, because the only field you can usefully vary is the signature).
Surely that’s not zero knowledge since the government can see every site you visit, which is the whole point of these laws anyway
I can’t speak to Germany’s system, but there’s no need for a site to tell the verification service its identity. If it just asks “is the current session authenticated to someone over 16” and gets an answer back. Identity of both parties remains secret.
Theoretically, it’s possible for the user to authenticate their age without either the site or service knowing the user’s identity. Quick and dirty example:
There’s a thing called a ring signature that allows one to prove that one of a large number of people digitally signed something. Let’s say a million people all have private keys whose corresponding public keys are registered to a database after they flashed their state ID at a post office or something to prove they are ≥18 years of age. So, John Smith uses his private key plus all 1 million public keys to sign a statement that he sends to a server saying he’s ≥18. The server then takes all 1 million public keys plus the signed message John provided and verifies that his signature is among the 1 million but cannot calculate which exact public key belongs to John. The verification process requires all 1 million public keys as input; you cannot, for example, try an omit each public key one-by-one to see which causes the verification process to fail.
Currently, there is ongoing research on how to make compact ring signatures since they can be very large the more public keys are involved.
https://en.wikipedia.org/wiki/Ring_signature
That said, even if you had scalable compact ring signature technology, I’d be more worried about advertiser deänonymization efforts once a user has logged in that check browser canvas size, IP address, user agent, font availability, etc. See https://coveryourtracks.eff.org/
Also, ring signatures for age verification don’t actually verify age, just that someone proved their age at some point in the past to the owner of the public key database; just like an adult can log into YouTube on behalf of their children and let the children go to town, John could give anyone access to his private key regardless of age.
No need to, but no need for it not to either. And no way to verify it isn’t beyond “trust me bro” and I don’t trust them
If the verification service is structured like oauth, then the request could be passed through the browser as signed plaintext. You could verify that the requesting site is only passing a minimum age request to the service. That would be as straightforward as viewing the interaction in your browser’s debug tooling.
If you say that you don’t trust the signature, and that it could be used to smuggle identifying information across, there’s a couple of ways to deal with that: open source and audited provider governed by legislation; information theory that would show personally identifying information wouldn’t fit into a field of that size; and “personal auditing” where you can try throwing data at the service to see if you can trick it into accepting invalid input (that really goes with the previous point, because the only field you can usefully vary is the signature).