←back to thread

Show HN: Anonymous Age Verification

(gist.github.com)
70 points jwally | 1 comments | 31 Aug 25 17:14 UTC | HN request time: 0s | source

So I'm not an expert in this area, but here's an attempt at cost effective, anonymous, age verification flow that probably covers ~70% of use cases in the United States.

The basic premise is to leverage your bank (who already has had to perform KYC on you to open an account) to attest to your age for age-restricted merchant sites (pornhub, gambling, etc) without sharing any more information than necessary.

Flow works like this:

1) You go to gambling.com

2) They request you to verify your age

3) You choose "Bank Verification"

4) You trigger a WebAuthn Credential Creation flow

5) gambling.com gives you a string to copy

-------------

6) You log into your bank

7) You go to bank.com/age-verify

8) You paste in the string you were given

9) The bank verifies it/you and creates a signed payload with your age-claims (over_18: true, over_21: false)

10) You copy this and go back to gambling.com

---------------

11) You paste the string back into gambling.com

12) You perform WebAuthn Auth flow

13) gambling.com verifies everything (signatures, webauthn, etc)

14) gambling.com sets a session-cookie and _STRONGLY_ encourages you to create an account (with a pass key). This will prevent you from having to verify your age every time you visit gambling.com

The mechanics might feel off, but it feels like this in the neighborhood of a way to perform anonymous age verification.

This is virtually free, and requires extremely light infra. Banks can be incentivized with small payments, or offer it because everyone else does and don't want to get left behind.

Show context
drhodes ◴[31 Aug 25 19:18 UTC] No.45086168[source]▶
Just an FYI: In the US, 5.6 million households are unbanked.

https://www.fdic.gov/news/press-releases/2024/fdic-survey-fi...

replies(3): >>45086520 #>>45086744 #>>45090854 #
oncallthrow ◴[31 Aug 25 20:23 UTC] No.45086744[source]▶
Okay, and those 5.6 million probably aren't accessing sites that require age verification. Not every solution needs to work for 100% of people.
replies(3): >>45086807 #>>45087110 #>>45094615 #
1. alwa ◴[31 Aug 25 21:08 UTC] No.45087110[source]▶
What on earth would lead you to conclude that unbanked households don’t use online services? I can’t imagine any possible set of starting assumptions that would lead there, short of fairly cartoonish assumptions about the demographics the FDIC pointed out at that link.

Even within the unbanked households, the FDIC link points out that 1/3 use online non-bank services instead. And independently of that, it makes sense that even cash households might interface with online commercial activity: pick up gig work through DoorDash or UberEats or whatever; get paid out through a neighborhood informal-cash-service operator (multiservicio, hawala, guy who informally cashes out undocumented drivers). Or through opening a Venmo or CashApp account instead of a bank account.

That leads to a slightly stronger form of the claim: that those 5.6 million are likely to have undergone KYC/AML through other, non-bank financial providers…

But even then, why should a bank account be connected to whether or not you’re an adult in society’s eyes?