←back to thread

70 points jwally | 1 comments | | HN request time: 0s | source

So I'm not an expert in this area, but here's an attempt at cost effective, anonymous, age verification flow that probably covers ~70% of use cases in the United States.

The basic premise is to leverage your bank (who already has had to perform KYC on you to open an account) to attest to your age for age-restricted merchant sites (pornhub, gambling, etc) without sharing any more information than necessary.

Flow works like this:

1) You go to gambling.com

2) They request you to verify your age

3) You choose "Bank Verification"

4) You trigger a WebAuthn Credential Creation flow

5) gambling.com gives you a string to copy

-------------

6) You log into your bank

7) You go to bank.com/age-verify

8) You paste in the string you were given

9) The bank verifies it/you and creates a signed payload with your age-claims (over_18: true, over_21: false)

10) You copy this and go back to gambling.com

---------------

11) You paste the string back into gambling.com

12) You perform WebAuthn Auth flow

13) gambling.com verifies everything (signatures, webauthn, etc)

14) gambling.com sets a session-cookie and _STRONGLY_ encourages you to create an account (with a pass key). This will prevent you from having to verify your age every time you visit gambling.com

The mechanics might feel off, but it feels like this in the neighborhood of a way to perform anonymous age verification.

This is virtually free, and requires extremely light infra. Banks can be incentivized with small payments, or offer it because everyone else does and don't want to get left behind.

Show context
drhodes ◴[] No.45086168[source]
Just an FYI: In the US, 5.6 million households are unbanked.

https://www.fdic.gov/news/press-releases/2024/fdic-survey-fi...

replies(3): >>45086520 #>>45086744 #>>45090854 #
szszrk ◴[] No.45090854[source]
So? I'd say the 340 million of people that actually could verify with a bank is not a bad attempt.

1. 7 million (2020) has no proper ID [0].

2. 120 million struggle with reading [1], and you can assume at least 7 million realistically can't read.

3. Banks already do identity verification across the world, even on behalf of the governments themselves.

I see many challenges in what OP is proposing, but banking adoption across population is not one of them.

[0] https://www.voteriders.org/voter-id-research/

[1] https://www.apmresearchlab.org/10x-adult-literacy

replies(1): >>45090941 #
1. jwally ◴[] No.45090941[source]
You get it! Thank you!

My attempt at _a_ solution isn't _THE_ solution; but it seems like there's legitimately something around leveraging existing KYC infra that could get a solid 98 out of 100 - and can realistically be implemented in a realistic timeframe.

If I'm AYLO and have been cut off from 1/3 of the U.S. for the last 18 months, I'm contacting every lawyer, cryptographer, and engineer I can get my hands on to try and get _anything_ out of this concept or ones like it.