Opening up 'Zero-Knowledge Proof' technology to promote privacy in age assurance
88 points
6 hours ago
| 9 comments
| blog.google
| HN
dadoum
4 hours ago
[-]
Still, I don't want to gate people based on age.

Parents should at least be able to overwrite the age of their child, maybe selectively allow bypasses. My experience with a computer would have been completely different if I was blocked from half of the internet. Especially when I see which kind of content gets blocked.

reply
doginasuit
3 hours ago
[-]
As a millennial-aged person I saw a fair amount of content I would not want the young people in my life to see, but it's probably not nearly as harmful as the non-age gated content that they will still have access to. There is a lot creepy youtube and tiktok content that isn't off limits but still unhealthy and my younger relatives are fascinated by it.
reply
echelon
2 hours ago
[-]
We need to stop this helicopter civilization bullshit.

We're building 1984 to protect from god knows what imaginary harms.

Stop putting plastic wrap around people's freedoms, liberty, and right to privacy.

reply
Gigachad
1 hour ago
[-]
The harms of smartphones and social media are about as far from imaginary as it could get. The data is screaming at us.

We will look back at handing kids phones with instagram like giving kids cigarettes and think wtf were we doing.

reply
AngryData
56 minutes ago
[-]
And I find that harm to be far less than the harm caused by identifying everybody all the time and censoring topics to people based on government provided tokens.
reply
echelon
54 minutes ago
[-]
Are you sure it's just kids?

In dealing with the ills of social media, you do what you do with every other negative externality - you tax it. At least the parts of it you don't like.

Designing privacy, freedom, and liberty destroying mechanisms is not the way.

Big social wants these regulations to pass so that they can get better identity tracking for ads targeting. To them it doesn't matter if the tech ushers in 1984. It makes them more money.

reply
Gigachad
51 minutes ago
[-]
It's definitely not just kids. Social media is a lot like meth, we should at a bare minimum stop giving it to kids as soon as possible. And then come to realise it's bad for everyone and should be wound back.
reply
doginasuit
4 hours ago
[-]
Zero-knowledge seems to be a bit of an oversell here. It is more like you break the knowledge up and only share the relevant parts with each party. And the facilitator (Google) arguably has access to the most information out of any of the parties involved.
reply
slwvx
4 hours ago
[-]
zero-knowledge proofs are a well-known tool in cryptography [1]. All Google is sharing is the library to implement it. Google would not have access to the information any more than they have access to the bank info of people who use Android or Gmail.

[1] https://en.wikipedia.org/wiki/Zero-knowledge_proof

reply
doginasuit
3 hours ago
[-]
It's my understanding that they are sharing the library but they will also be involved as a facilitator, at least to the extent that people use their identity wallet service. It also seems like they will have access to who you are sharing information with, which seems like the most valuable information for a company in their position, with nothing but a pinky promise that it will not be tracked. Let me know if any of that is inaccurate.
reply
_alternator_
2 hours ago
[-]
I don't know the technical details of this ZKP library, but there is no technical reason that I'm aware of that the ID provider would need to know who you are sharing with. Not to say Google didn't build it this way for business reasons.
reply
beepbooptheory
1 hour ago
[-]
Here is a good explainer of an ideal implementation of this (maybe). If its this, you would be incorrect.

https://blog.vrypan.net/2026/06/29/260629-whats-wrong-with-e...

reply
dgrin91
4 hours ago
[-]
There are true ZKP setups where no one learns anything but the absolute minimum (e.g. is this person over 16, not what is their dob). This is hard to prove though and I don't know if I trust Google to do it
reply
wmf
3 hours ago
[-]
Ideally the government would be the issuer and the facilitator but the US lacks the state capacity to do this. Maybe it will work that way in Estonia.
reply
anon-3988
1 hour ago
[-]
Age is just one metric. I don't want zero proof tech about information X. I don't want to have an identity. Full stop.
reply
ambicapter
54 minutes ago
[-]
This can be used to have zero-proof knowledge of "over 18" or "not over 18". So they don't really get your age, except that you are in two broad ranges.
reply
onion2k
8 minutes ago
[-]
If you get enough signals like that you can often narrow down a very large cohort of people to an individual.

First it's 'over 18?', then it's 'over 25?', and then 'biological sex?', 'employed?', 'enjoys posting on HN?', 'active in the early morning?' and after half a dozen questions, all with binary answers that are safe individually, you can zero in on a 23 year old woman who has a job and posts on HN in the morning.

Ask a few dozen questions like that and you'd be able to sieve an individual from a group of millions, especially if they're unlucky enough not to be absolutely typical.

reply
wmf
33 minutes ago
[-]
I think anon's point is that it could be used for other attributes in the future, like your nationality or... your social credit score (don't worry, it only proves that your score is over or under 500).
reply
watersb
5 hours ago
[-]
We need "How to talk to your legislators about zero-knowledge proofs".
reply
protocolture
4 hours ago
[-]
"Dont do age assurance, ever"

Done.

reply
Avicebron
4 hours ago
[-]
Ok, they have ignored that. I did my part and sent an email. Now what?
reply
protocolture
2 hours ago
[-]
Violent revolution I guess. Genuinely what are the other options?

I made a formal submission to the Australian Government in the very small consulting window they held for the Access and Assistance bill. Pleading with them to consider simply not introducing the law, as there was no justification for it at all. Google also made a submission against the bill, as did many large local and overseas corporations.

The government went ahead anyway.

What are the chances of me swinging any government when Google et al are on the other side, determined to provide privacy and anonymity destroying products to bolster their bottom line?

Probably worth mentioning that the Access and Assistance bill permits the Australian government to secretly (even just verbally) compel anyone building age assurance technology to secretly backdoor it to collect metadata, or any other information they choose. There's no level of safety from the government one can achieve with any app. If they resist they go straight to the Australian version of a secret national security court. The bill doesn't even make it clear whether briefing their solicitor about the request is legal. It doesn't matter how good the crypto is if the app is recording details outside of that. Its all just theatre at this point. There's no safe app, so we should completely resist all attempts to do things the government could restrict, leak or misuse.

I dont see how this is even slightly contentious in the year of our lord two thousand and twenty six, after decades of leaks affirming governments do this stuff, decades of governments and corporations dangerously failing their citizens privacy, when a particular government is hell bent on using all the personal data it can hoover up to persecute migrants and refugees. How are people blindly monofocusing on the crypto while trusting everything else?

reply
Gigachad
1 hour ago
[-]
The vast majority of the population supports banning social media for kids so revolution isn't happening. Of course the social media companies object to their product being banned. It's like cigarette companies objecting to plain packaging.
reply
vlian2088
5 minutes ago
[-]
>The vast majority of the population supports banning social media for kids so revolution isn't happening.

reddit isn't the vast majority of the population, fren. it's 1% of 4%.

unless you've got polls you could show to back your claim?

reply
protocolture
1 hour ago
[-]
>The vast majority of the population supports banning social media for kids so revolution isn't happening

Age assurance is being used in more than a single scope. I dont disagree that the revolution isnt happening, but theres no need to be so reductive.

>Of course the social media companies object to their product being banned. It's like cigarette companies objecting to plain packaging.

They aren't objecting to age assurance tools. They are objecting to the current ham fisted model, but when they can organise something less nebulous than the current regime they will be fighting to implement it first.

reply
Gigachad
59 minutes ago
[-]
Sure, the implementation details are blunt. But Facebook, Google, and Reddit have had decades to sort this out on their own and yet they have only poured fuel on the problem and watched the ad dollars rain in.

So I have little sympathy that the resulting laws are not optimal for them.

reply
protocolture
35 minutes ago
[-]
>But Facebook, Google, and Reddit have had decades to sort this out on their own

It was solved. Dont collect information.

The problem is making shitty psychotic apps, not determining who can use them.

I would much rather they cut meta into pieces and sold them off as scraps, than just scarfing up the PID of the users to make arbitrary determinations about who can have what brainrot.

reply
matheusmoreira
3 hours ago
[-]
"Do the opposite of what Meta is lobbying for"

Done.

reply
dboreham
4 hours ago
[-]
Not really any point since US legislators aren't motivated by the interests of regular people.
reply
consumer451
4 hours ago
[-]
Yes, they are not.

> Today, we open sourced our Zero-Knowledge Proof (ZKP) libraries, fulfilling a promise and building on our partnership with Sparkasse to support EU age assurance.

reply
quietthrow
2 hours ago
[-]
This seems great - one question (ideally for Alan stapleberg) why is this not available for everyone? Seems like this is only applicable to the EU? Genuine question - Why would other governments not want this for their people ? I am sure there is a flip side that EU thinks is not worth more than thier people getting this kind of privacy. But what’s has to be true for some govts to think that the flip side is more beneficial than the privacy aspect. Appreciate if someone can break down how incentive structures are different and hence the resultant choices/positions
reply
Groxx
4 hours ago
[-]
I've been trying to figure out how zero-knowledge stuff would work in practice for age verification, where "when issued" (or extremely coarse, like what year), "to whom", and "where it's used" are hidden from everyone except the individual holding the proof (since that's the gold standard, and the only one worth accepting).

I get that ZK techniques work, and reveal "nothing". That's useful.

But if they reveal nothing, isn't it wide open for abuse? Couldn't one over-18-person's proof become everyone's proof, because they can't tell it's the same proof, and the issuer can't tell where or how often the proof is being used? Or are there ways to construct data leaks that are not user-identifying but are abuse-identifying (and what would that even mean)?

reply
tzs
27 minutes ago
[-]
Briefly, your government issues you a digital signed copy of a document, such as a driver's license or passport, that gets bound to a hardware security element that you own. In current implementations these are the secure elements of smart phones, but there is no reason that standalone hardware security elements could not be supported.

When you want to provide information from that document to a third party a protocol is used which allows you to demonstrate to the third party that (1) you have a document from the government bound to your hardware security device, (2) you have unlocked the hardware security device, (3) and the document says what you say it says (e.g., "the birthdate field in this document contains a value that is more than 18 years in the past").

This third party gets no additional information about the contents of your document. The protocol takes place entirely between your device and the third party, so the government that issued you the bound document has no idea when or if you use it.

Someone over 18 person could indeed decide to help others prove age, but they would either have to do it in person or be willing to loan their unlocked security element to those others.

reply
Aurornis
3 hours ago
[-]
> But if they reveal nothing, isn't it wide open for abuse? Couldn't one over-18-person's proof become everyone's proof, because they can't tell it's the same proof, and the issuer can't tell where or how often the proof is being used?

Yep!

This is why the concept of zero knowledge age gating is such a trap for technically minded people. They imagine receiving a private cryptographic object that can be used to anonymously confirm that the government says it was issued to someone over 18.

That’s completely useless because a single leaked token could be used forever, so nobody actually considers this.

All of the real proposals have various compromises baked in. Some people want to require device attestation, so you could only do this handshake from a government approved device running a government approved operating system. Forget using Linux or maybe even a general purpose computer at all.

Other proposals involve online government handshakes in various ways, with a pinky promise that the government won’t keep logs or tap it for national security purposes. So we get back to anonymous by trust only.

reply
whiplash451
1 hour ago
[-]
We might be over complicating things here.

The governments’ focus might be on protecting genuine users (adults or not), not fighting fraudsters.

In other words if ZKP works for the vast majority of technically illiterate people with their EU ewallet, the job is done.

reply
denkmoon
1 hour ago
[-]
Absolutely. We don't look at the use of false identity documents as a failure of age gating tobacco and alcohol, it's just an accepted consequence that we try to mitigate knowing that we cannot stop all instances.
reply
countcol
2 hours ago
[-]
You can use a Linux… if it’s a Android

:(

reply
zeofig
49 minutes ago
[-]
I agree with your analysis, but doesn't that make this blogpost by google a bit overoptimistic, or even disingenuous?
reply
baby
17 minutes ago
[-]
There are different ways to think about this:

1. Imagine what the protocol would look like without privacy (zk allows you to “sign” a computation, so just do the computation in the clear)

2. Imagine what the protocol would look like by revealing a hash of the passport only (the idea of a “nullifier”, a unique identifier that hides the data and and can be revealed to prevent replays)

The first one should already answer your question: the way you would prevent replays or portability (I use your proof) is to attach some sort of session context to your proof

reply
ekr____
44 minutes ago
[-]
The proof is bound to a cryptographic key stored in a tamper-resistant module (as in a phone).

See https://educatedguesswork.org/posts/age-verification-id/#dev... for some more detail.

reply
wmf
30 minutes ago
[-]
So privacy 1, antitrust 0.
reply
Epa095
3 hours ago
[-]
Idk if this scheme is zero knowledge, but what's wrong with it? :

- you enter ph and must age-verify. It says 'your secret: "capable peanut", enter age proof below'.

- you go to age-knower (e.g bank or government page). You provide the secret phrase, and you get back a cryptographically signed json with the secret phrase, a claim 'above18', and a field stating who attested for the age (e.g government or bank or whoever).

- you paste this signed json (maybe encoded as base64 or something) into ph. It will verify that the attestee is good, then use it's public key to verify the signature, before checking that the secret is the correct one, and that it contains the age-claim.

Is the problem that if ph and the attestee colludes they can compare the secret string and figure out who you are?

reply
Groxx
3 hours ago
[-]
Yes, that allows collusion. Which has historically happened quite regularly any time money or politics are involved, which means we should not accept that strategy.

For some isolated scenarios, that collusion risk may be completely fine. But not for something that is poised to control access to the internet as a whole, or in any way relates to maintaining safe free speech on the dominant public platform for doing so (the internet). People need protection from their government (present and future), or it's not a "right", it's just temporary retroactively-revokable permission.

reply
doginasuit
4 hours ago
[-]
My understanding as someone who is just learning about the tech is that zero-knowledge isn't a great description of what is happening. The issuer (some party with the proof, like the government) shares the knowledge and that is only valid for a single verifier. So knowledge is held and is shared, just the minimum amount possible to be credible.
reply
wmf
3 hours ago
[-]
This is basically the double spending problem which has been solved in various ways.
reply
wmf
42 minutes ago
[-]
For example, Chaum's blind signatures https://en.wikipedia.org/wiki/Blind_signature let you create a credential that can be anonymously used once but it gets de-anonymized and invalidated if used a second time. This could be applied to age verification so that each credential could only be used once.
reply
Groxx
3 hours ago
[-]
It has? I've been under the impression that the "solutions" are "trust us, we don't allow that" (relying on an authority with full knowledge, as partial knowledge isn't sufficient) and "use more resources than anyone can feasibly contest" (bitcoin).

You could build a merkle tree to say "we exist after X" but not "there is no other X". And publishing that tree for verification would seemingly violate "zero knowledge", unless you know of some way to scrub that, and also hide timing information, because timing information can identify visitors to observers.

reply
rho138
5 hours ago
[-]
[2025]
reply
consumer451
4 hours ago
[-]
Yes, but it's never been more important than now. Also, I did not have enough chars for an HN title.
reply
stephen_g
4 hours ago
[-]
Funny though how whenever these laws are pushed though, the legislators are more interested in strongly identifying people to gate services despite the fact that they should have plenty of advice that things like zero-knowledge proofs exist.

I hate to be cynical but I worry that this isn't going to matter, because it really seems that a lot of the pressure behind age verification isn't actually very interested in the age verification part...

reply
consumer451
3 hours ago
[-]
Agreed. Now is our chance to very publicly inform our legislators. Not all is lost, yet.
reply
coppsilgold
3 hours ago
[-]
Unfortunately ZKP's aren't magic.

When not doing privacy oriented cryptocurrency (cough money laundering cough) with ZKP's, if you really want private verification you are in a position where a single actor can authenticate the entire world and no one will know it happened. And to prevent it you assemble the pieces necessary to deanonymize anyone.

Make no mistake. ZKP age verification, as proposed, will just require multiple parties to collude to figure out your identity.

They can't even implement ZKP for remote attestation due to the auth-the-world problem.

reply
consumer451
3 hours ago
[-]
Assuming that perfect is the enemy of good, this is still better than all the proposed alternatives, isn't it?
reply
coppsilgold
3 hours ago
[-]
With ZKP age verification, services will not be able to track you without help from the CA. The CA will not be able to track you without help from the services. Both will contain the necessary information in their databases that when combined deanonymize you. The CA is the central authority/certificate authority.

So you should assume the government can track you, because you should assume both will be streaming those identifiers to it.

reply
ekr____
43 minutes ago
[-]
This isn't correct. With ZKP-based systems even the CA can't track you. That's the "zero-knowledge" part.
reply
consumer451
2 hours ago
[-]
Yes, there is one party that can track you, which in some countries is still slightly trusted.

Ideally, no age verification would be required or proposed. However, if it is, this implementation should be the base minimum, should it not?

This is a gazillion percent better than a foreign corporation being in charge, isn't it?

reply
krupan
2 hours ago
[-]
Better than no age verification (and therefore, privacy) coupled with parents doing their job?
reply
consumer451
1 hour ago
[-]
That would be ideal. However, this is tech proposal which takes so much of the slop out of the entire thing. With this implementation, there is no profit in it, unless your government is directly cooperating, aka a scandal in many countries.
reply
emsign
5 hours ago
[-]
What's the point of giving a single point of information about yourself to a single website, when all the websites you visit use the same trackers (from Google for example) only to merge these data points together and sell them as a package.
reply
TalkingCodeMonk
4 hours ago
[-]
Because of the principle of least privilege: https://wikipedia.org/wiki/Principle_of_least_privilege

All current age verification measures open up a torrent of attack vectors on user PII and privacy. Limiting the number of entities that are able to access data is one of the best ways to prevent it's leak or abuse. Don't let perfection be the enemy of good.

But therein lies the fundamental problem with surveillance capitalism. Until the sale of personal data/metadata is outlawed, the practice of targeting content based on an individuals personal data/metadata is outlawed, there is a highly punitive cost for violations and leaks that make storage outside core business functionality a major criminal and financial risk, and the compilation of this data by "intelligence" agencies it treated as a critical attack vector to national security – the attack on each citizens civil rights that it truly is – most privacy laws and regulations are just virtue signals designed specifically avoid the root causes, and further entrench the power of monopolies and incumbents.

FYI I don't believe Google sells user data. They sell products which leverage user data to give them a critical advantage over every competitor who does not have trackers in everyones pockets/computers, does not store their entire web search/browsing history, etc. It's in the interest of big tech to protect their market advantage (like ZKP, which would prevent competitors from having a new gov-mandated vector to compile user data).

reply
sroussey
3 hours ago
[-]
Google never sold user data until the DoubleClick acquisition, from what I understand
reply