Kirill Chernyshov

@fluffykittycat and, as I said in another reply - If a privacy-preserving alternative exists, it's leverage to fight the invasive version. I'd rather have the option than not.

@fluffykittycat Anonymity in my system is from the verifier, not from the issuer. The issuer (say, a gov agency) knows who you are - same as when they issue you a passport. But the website/service checking your age learns nothing about you. So: the issuer can stop fraudulent issuance (not anonymous to them), and the verifier can't track you (anonymous to them). No circle to square - these are two different relationships.

@fluffykittycat How easy is it for you to get a fake identity that will be accepted as legit by some gov agency or even your local pub? My system does not reinvent the wheel here, it will be equally hard. But it solves a problem that to get to the pub you have to reveal your name, exact date of birth, address, etc. With this system, the verifier can't see that data even if they wanted to - it's never transmitted, not just "promised not to be stored".

@fluffykittycat And here's the thing: the mere existence of a privacy-preserving alternative gives people a much stronger argument against invasive systems. Right now when governments push for identity verification, the response is just "don't do it." If a working ZK-based system exists, the argument becomes "there is no reason to collect identity data - you can verify what you need without it." That's a far harder argument for surveillance states to dismiss.

@fluffykittycat The age verification mandates are coming whether or not privacy tech exists - that's literally what the Mullvad VPN post that started this thread is about. The question is whether those mandates get implemented with systems that deanonymize people (which is what you're rightly worried about) or with systems where deanonymization is mathematically impossible.

@wojtek what are you talking about? I'm not building vpn nor claiming it is a privacy tool.

@fluffykittycat @wojtek This is a privacy tool - it protects people, not targets them. The whole point is that no one in the chain can be identified. A regime can't build a list of "undesirables" from a system that provably reveals nothing about who holds a credential. That's the opposite of what surveillance states want. Privacy tech exists precisely so that power can't be abused against individuals.

@paranormal_distribution The verifier learns what the presenter can do, never who they are or how they get this capability. Here I'm using capability as a broad term for "some knowledge I'm willing to disclose".

@paranormal_distribution No one. The presenter asks the verifier to publish their constraints — the trusted root authorities and the current revocation list (one way hashed). The presenter then forges two proofs locally: "I hold a valid capability delegated to me only" and "no intermediate delegator in my chain is revoked, and the delegation chain starts from a trusted root". The verifier checks both proofs against the published roots — no callback, no identity disclosure, no phone-home.

@mullvadnet curious timing. just about an hour ago I forged and verified my first zero knowledge proof that can tell the verifier that proof holder was born before a certain timestamp (aka. older than N years) at the same time reveling absolutely (!) nothing about proof holders, not even those who authorize it.