Continuing the discussion from TWiT 1098: Usain Volt: Minimal disclosure technology can make age verification work. Verifiable Digital Credentials Explained: How They Work And Why They Matter | Okta
1 Like
That document pushes for
You approve a request on your phone to share just the information that shows you are over 18
which is easy to say, but papers over that it completely deanonymizes you. One of the big concerns about “age verification everywhere” is it means you’ll be identifiable and trackable everywhere and it will be that much easier for a government that doesn’t like what you have to say to track you down and shut you up.
1 Like
How am I deanonymized, and to whom? Here’s how I understand the system Okta has outlined:
The vendor, in this example, merely verifies that the credential I’ve presented (which theoretically only carries a 0 or 1 depending on if I’m over 18) is signed by a trusted issuer.
The issuer, the state govt in this example, has signed my credential at an earlier date, but has no interaction with this transaction. They don’t see that I’m at the fireworks stand at 20:05 on 28/8/26 in Small Town, USA purchasing 400 M80s. They’re a CA in the traditional PKI model.
The verifier, If done correctly, should be an open source application actually presenting the credential to the vendor - that “approve” button we push on our device. I think whoever writes the application would be the biggest risk in this trust chain; they could possibly track transactions and have access to the full credential. Hence the open source. Ideally it would be something akin to Steve Gibson’s SQRL, where anyone can write an application to fill this role.
I’ll point out that this is basically how the payment card industry operates currently except it was designed and implemented behind closed doors before anybody had the slightest concept of privacy in a digital age. Visa et alii are the verifier and they’re the issuer/CA. The goal Okta is aiming for is to separate these roles.
3 Likes
How exactly did you expect the message to arrive on your phone? Your phone is intimately tied to you in many ways.
The first thought I had was, "who among us is completely anonymized today anyway???"
I would imagine the vendor’s payment processor runs a server that prompts for a connection from the verifier application. As anonymous as any web connection can be. A properly written verifier application can be sufficiently anonymous, hence the open source nature.