←back to thread

70 points jwally | 1 comments | | HN request time: 0.519s | source

So I'm not an expert in this area, but here's an attempt at cost effective, anonymous, age verification flow that probably covers ~70% of use cases in the United States.

The basic premise is to leverage your bank (who already has had to perform KYC on you to open an account) to attest to your age for age-restricted merchant sites (pornhub, gambling, etc) without sharing any more information than necessary.

Flow works like this:

1) You go to gambling.com

2) They request you to verify your age

3) You choose "Bank Verification"

4) You trigger a WebAuthn Credential Creation flow

5) gambling.com gives you a string to copy

-------------

6) You log into your bank

7) You go to bank.com/age-verify

8) You paste in the string you were given

9) The bank verifies it/you and creates a signed payload with your age-claims (over_18: true, over_21: false)

10) You copy this and go back to gambling.com

---------------

11) You paste the string back into gambling.com

12) You perform WebAuthn Auth flow

13) gambling.com verifies everything (signatures, webauthn, etc)

14) gambling.com sets a session-cookie and _STRONGLY_ encourages you to create an account (with a pass key). This will prevent you from having to verify your age every time you visit gambling.com

The mechanics might feel off, but it feels like this in the neighborhood of a way to perform anonymous age verification.

This is virtually free, and requires extremely light infra. Banks can be incentivized with small payments, or offer it because everyone else does and don't want to get left behind.

1. tamimio ◴[] No.45086661[source]
Shifting the power from the state to banks.. what could go wrong!!

Hell no! Banks should NOT assume an expanded role in transaction processes; rather, their involvement should be further reduced. The objective should be to establish public consensus that positions banks as an optional payment method, not as an integral component of daily activities. Even in scenarios where banks do not access personal identification information, their institutional power should be constrained rather than extended.

Cashless payment systems present inherent risks for surveillance and control, as they channel all transactions through centralized, heavily monitored networks. Individuals flagged within these systems may face severe exclusion from economic participation without due process protections.

KYC protocols may have poorly regulated flagging databases that lack the procedural safeguards associated with formal criminal records. Unlike criminal records, which require due process for inclusion and can be destroyed, banking flags operate without comparable regulatory oversight. This transfers significant power to corporate entities and their stakeholders, having this “shadow” power that would control the public.

Regardless of anonymity provisions, banks should function solely as optional convenience tools for payment processing, not as mandatory intermediaries in financial transactions or any process. The integration of banking systems into essential processes is the worst for anyone who cares about surveillance free society and create a concentrated institutional power, and it will reduce individual autonomy, financial or not.