Post #4013883

2026-07-22 14:11 UTC

@neil@mastodon.neilzone.co.uk (I'm not a specialist in this stuff, so here goes...) Does RFC 9576 - The Privacy Pass Architecture have potential to help? Government is the ultimate arbiter of identity. In 🇨🇦 that's provincial governments; anyone can get a drivers licence or equivalent non-driver ID. So... roughly speaking... 1. The site can send the user a token that says "Are you >15?", where the token itself contains no site identifiers, just a key string. 2. The user passes that token to the government site, (maybe using their ID card key). 3. The user gets back a government signed string with only the info that they are over 15, and the original request token. 4. The site confirms the token against the govt public key. The site is not identified to the government, the user is not identified to the site, the token only confirms the age of the requestor. The site stores no IDs. @briankrebs@infosec.exchange might have some thoughts? Maybe put RFID FIDO2 in your drivers licence for extra authentication goodness. https://www.ietf.org/rfc/rfc9576.html

Replies (2)

@TallSimon@mstdn.ca 2026-07-22 14:21

@neil@mastodon.neilzone.co.uk @briankrebs@infosec.exchange @ardaxi@hsnl.social I will postscript with: 1. Yes, for-profit, algorithm-driven social media should be incinerated in a plasma-arc like the hazardous material that it is. 2. Yes, a list of specific ID questions should be formulated so that minimum information transits. 3. Yes, kids are going to find a work-around in about 30 seconds, but at least this way we don't have piles of loose drivers licenses on open Amazon storage buckets. 4. Yes, this involves educating your Member of Parliament on a technical issue when they are probably already thumbing the "call security" button under the desk because the recognize you from your last interaction. 5. Yes, this involves government IT actually having their 💩 together which I do understand is a very unlikely scenario.

Open ##4014093
@ardaxi@hsnl.social 2026-07-22 14:19

@TallSimon@mstdn.ca @neil@mastodon.neilzone.co.uk That's basically how Yivi works, except the user stores a signed token of attributes, like being over 16, 18, 21 etc locally on their device, signed by some issuer (like a government).

Open ##4314755