so what if I sell this service to under-18 people in exchange for $30 each time?
Apart from me going to jail, I mean. How would the protocol prevent this?
replies(2):
The basic premise is to leverage your bank (who already has had to perform KYC on you to open an account) to attest to your age for age-restricted merchant sites (pornhub, gambling, etc) without sharing any more information than necessary.
Flow works like this:
1) You go to gambling.com
2) They request you to verify your age
3) You choose "Bank Verification"
4) You trigger a WebAuthn Credential Creation flow
5) gambling.com gives you a string to copy
-------------
6) You log into your bank
7) You go to bank.com/age-verify
8) You paste in the string you were given
9) The bank verifies it/you and creates a signed payload with your age-claims (over_18: true, over_21: false)
10) You copy this and go back to gambling.com
---------------
11) You paste the string back into gambling.com
12) You perform WebAuthn Auth flow
13) gambling.com verifies everything (signatures, webauthn, etc)
14) gambling.com sets a session-cookie and _STRONGLY_ encourages you to create an account (with a pass key). This will prevent you from having to verify your age every time you visit gambling.com
The mechanics might feel off, but it feels like this in the neighborhood of a way to perform anonymous age verification.
This is virtually free, and requires extremely light infra. Banks can be incentivized with small payments, or offer it because everyone else does and don't want to get left behind.
Your modified kernel can redirect communication attempts with the hardware to another device, but you'll still need a "sanctioned" device every time.
This system makes a lot of sense in corporate environments where compatible hardware can be bought and managed en masses. It doesn't make a lot of sense for something like this. Still, it's technically and practically possible to use such a mechanism, even if it's not advisable.
Webauthn isn't necessarily going to save you, though, and websites need to blacklist any hardware that has been found compromisable in the past (i.e. most consumer laptops, many consumer phones) and it won't work on Android phones running custom ROMs that don't implement the full security service but rather load in the bare minimum to get the API working.