Post #4013886

2026-07-22 11:35 UTC

I am, somewhat idly but perhaps less so than usual, pondering the options available to the administrators of fedi servers, who find themselves / their servers in scope of age/ID verification requirements. Shutting up shop is an option. And, in some cases, probably the most realistic one. But it won't be the right choice for everyone. Refusing to comply is also an option, although that may come with more risk than the humans behind the server are willing to bear. The other options are - IMHO, anyway - rather unattractive, but I'd like to think them through properly.

Replies (1)

@TallSimon@mstdn.ca 2026-07-22 14:11

@neil@mastodon.neilzone.co.uk (I'm not a specialist in this stuff, so here goes...) Does RFC 9576 - The Privacy Pass Architecture have potential to help? Government is the ultimate arbiter of identity. In 🇨🇦 that's provincial governments; anyone can get a drivers licence or equivalent non-driver ID. So... roughly speaking... 1. The site can send the user a token that says "Are you >15?", where the token itself contains no site identifiers, just a key string. 2. The user passes that token to the government site, (maybe using their ID card key). 3. The user gets back a government signed string with only the info that they are over 15, and the original request token. 4. The site confirms the token against the govt public key. The site is not identified to the government, the user is not identified to the site, the token only confirms the age of the requestor. The site stores no IDs. @briankrebs@infosec.exchange might have some thoughts? Maybe put RFID FIDO2 in your drivers licence for extra authentication goodness. https://www.ietf.org/rfc/rfc9576.html

Open ##4013883