I've been pondering how to create a system that allows user age verification without compromising privacy, especially in the context of new EU/UK regulations aimed at preventing underage access to online pornography. My idea involves two sites: one that generates a verification key after users submit their ID, and another that allows content providers to verify if a user is over 18 without knowing their identity. This way, users wouldn't have to constantly provide personal information every time they want to sign up for services like Spotify. I'm not tech-savvy, so I'm looking for a safe and practical way to implement this. Is there an established method for this, or could there be potential drawbacks to my approach?
1 Answer
A straightforward method for anonymous age verification involves using three distinct entities: the requester, the intermediary, and the verifier. When a requester needs to confirm a user's age, they send a one-time random number (nonce) to the intermediary, which forwards it to the verifier. After verifying the user's age, the verifier sends a response back to the intermediary, including a digital signature. This ensures that while the requester gets a confirmation, they never know the user's identity. This can also incorporate zero-knowledge proof methods, making it a robust option for privacy.
Creating nonces can raise concerns though; the term 'nonce' has negative connotations in the UK. We should be cautious about the language we use when discussing these systems.