@david @bjoreman @HennaVirkkunen On the point of using identity documents directly: either you have to send the signed attestation to the site/app for verification, which would deanonymize you; or some gatekeeper like a government site would have to do it and give the result to a site/app and in that case the gatekeeper knows what apps/sites you are using, which is a huge privacy invasion. Also doesn't protect well against a kid using someone else's ID to verify, so it's mostly security theater.
From a technical standpoint, if you want to restrict access to a website based on some form of identity data, you either trust the web providers or you trust the state. If the state legally prohibits itself from recording which sites you visited or even how many times you used the service, the issue should be settled. If, for whatever reason, even reasons of principle, the state is deemed untrustworthy, then the issue has no technical solution because it is fundamentally a political one.
CC: @bjoreman@toot.cafe @HennaVirkkunen@ec.social-network.europa.eu
CC: @bjoreman@toot.cafe @HennaVirkkunen@ec.social-network.europa.eu
@david @bjoreman @HennaVirkkunen At any rate, Mastodon is too short a format to go into the details of issues with ZKPs for age attestation, so some useful pointers: