1·
3 hours agoI understand that’s an issue with open source in general, but this specific implementation should be using zero knowledge proofs, which is provable. They are, by definition, provable programs where you can prove properties of data without revealing secrets.
The way this works in practice is:
- govt issues passport with digitally signed credentials
- I take a picture of my passport and tap my passport on my phone (you need both, the actual printed info is what “unlocks” your phone to be able to read the NFC data)
- Your phone reads off the digital signature from the govt, your date of birth, name, etc
- You download the zk proof program and it’s trusted setup files, check that their hashes match what is public and audited.
- run your passport info through that program locally, and it produces a: “You are over 21” + “From the EU” + “a nullifier” + “here is mathematical proof that this data is valid”
- you take that math proof and use it to unlock the “i am an adult mode”.
The nullifier is whats used to make sure someone can’t use their passport more than once on multiple accounts, which is the real tricky part … but there are solutions live and usable out in the world today to mitigate this problem while providing a decent level of privacy.
Really, we shouldn’t have these laws at all, they are fucking stupid…but if we are going to have them, we should at least do it the best we can.
Many people have already commented saying it’s good to go, but I also wanted to add, I have dug into their actual encrypted group messaging protocols a few years ago because I was interested in using it for a different use case, and I would say it’s pretty well thought out. I trust it, I use it daily, and I’ve looked at the code. I’m not, nor have I ever been, an auditor, but I have been paid to do cryptography and red teaming/cyber security from big orgs, so I would say I have some professional experience in the matter.