Ask Lemmy

There are https://en.wikipedia.org/wiki/Zero-knowledge_proof which can do exactly what you just proposed. I'm not sure it's a foolproof answer, but it is designed to exactly deal with that identity conundrum as well as others.

In cryptography, a zero-knowledge proof (also known as a ZK proof or ZKP) is a protocol in which one party (the prover) can convince another party (the verifier) that some given statement is true, without conveying to the verifier any information beyond the mere fact of that statement's truth.

The vendor/site does not need to know a name.

The idea is that people already trust the government with their identifying info. So what the government can do is issue, for example, an opaque "age ID" that is only to be used with an "over 18?" service hosted by the government. Then anyone visiting a website with age-restrictions would provide their age ID, which tells the site nothing about the user. The site checks the "over 18?" service. At no point do arbitrary websites need to collect identifying info.

Now obviously as I've described it, there are multiple problems:

1. People could easily publish their age ID for anyone to use.
2. If people aren't careful (they aren't) then they will give too much identifying info away to sites anyway, and then those sites could correlate the age ID with their identity.

One solution is to make the age ID into a "one time password" (OTP). Much like an authenticator app, you could have an app provided by the government which generates a new random OTP on request, and it would expire in a minute or so. Then users provide that instead of a constant age ID. Like before, the site checks the "over 18?" service using the OTP.

It's still not perfect, but you'll never solve the "adult buying beer for kids" trick without counterproductive measures. There are probably some additional tricks to make it better, but I don't want to get too far into it.

EDIT: One more point. Having this "over 18?" service is itself a privacy risk, because it relies heavily on your trust in the government not to conspire with the sites you are visiting or to just log info about all of the age-restricted sites you visit. There are apparently solutions to this problem involving zero-knowledge proofs, but I don't know quite enough to explain that entirely here.

EDIT2: I got curious and did a little more reading. The zero-knowledge proof idea kinda fails to prevent credential sharing, unless you rely on some kind of hardware cryptographic vault thing. I'm not sure if that ends up being strictly better than the service idea.

Another way you might prevent the govt from logging all of the age-restricted sites you visit is to put the service behind something like Tor to make the requesting site anonymous. But this still doesn't prevent the govt from just knowing that you visited some age-restricted site at a specific time. Still not ideal.