We all know that the EU wants age verification for the web. I dont trust my country, the EU and definitely not Instagram, Twitter etc. to implement this in way where my personal data won’t be shared with anyone. But the idea that everyone on social media is a verified human beeing could also have a lot of positive effects.
Imo it would be awesome if every person could have only one single account. Bans and restrictions have much more impact which forces users to behave more like irl. You could reduce a massive amount of bots which would reduce fake news and be a time saver for mods.
As a solution for the privacy issue, I searched for open source passport verification tools and found ZKPassport which makes the proof on you own device without sending you data anywhere. It generates a deterministic Id which is salted and hashed, so you can’t find a real person from a user account or otherwise. Only this Id is sent to the server as a proof, nothing else. The code is open source and its possible to self host the backend for this system.
I try to implement ZKPassport into a lemmy fork to make a small proof of concept for this idea. Of course this needs a lot more security features for a real production scenario, because mods and server owners have much more power and the federation is more complicated with only a few servers that have passport auth enabled and some even have their own implementation of the auth.
So if the proof of concept works out well the question is, would people be rather use passport authenticated Fediverse instances when all of you data stays on your phone?
EDIT: I don’t suggest that the whole fediverse switches to passport authentication, every instance can decide on their own. Therefore you could also have multiple accounts across multiple instances but not multiple accounts on the same instance.
You must log in or # to comment.
Nope. We have seen time and time again that websites can not keep things like passwords safe and secured. What makes you think any of them can keep actual proper identifiable information safe and secure?
The data doesn’t even get into the platform, so they can’t store it and they can’t loose it. If an attacker gets access or leaks data it will be just hashes, no actual data
No.
Lol, no.
Imo it would be awesome if every person could have only one single account. Bans and restrictions have much more impact which forces users to behave more like irl.
What about people who want to criticize their oppressive government without risk of being identified from their post history? People questioning their gender or sexuality who don’t want to come out to everyone yet? People who view or post NSFW things and don’t want it associated with their primary account?
There are plenty of valid reasons to have multiple accounts besides ban evasion.
Like I already wrote, its not possible to identify a real person based on the user data on the platform, even if you gain access to the database and server. No passport data is sent to the server only the id which can’t be reversed to get you’re personal data. So you can still be anonymous
Despite that: I don’t want to keep all of the internet behind a passport verification wall. This would be terrible. I imagine it more like we have some platforms or servers where people need to verify
Wtf is even the point of this then? Who is checking the IDs? If you can’t link it to a person why he’ll do they want your id?
The point is to verfiy someone does not already have an account and is not a bot. Your smartphone is checking the ID locally. Governments provide public lists of keys that match keys on the passports of their citizens, so you can download the public lists locally and check them on your device outside of any social media platform etc. Your smartphone just sends something like “this user is verified” to the server
I applaud your critical thinking, but you are asking inside a bubble that knows answers before it asks questions. I doubt such an idea can at this time in history be implemented in a grassroots way.
Thank you, I guess you are right. Still, there were some good points here and there that were worth learning. I’m going to give it a try anyway (on my local machinet) and see how it goes…
Nope, still 100% NO!!! I don’t care what the scheme is. I don’t trust any of the people or companies involved. I don’t trust the company that makes my cell phone, the operating system, the gov, none of it.
There is literally nothing you could say to me that would ever have me scanning my ID to access social media. I already hate this shit, Lemmy is barely acceptable. Lemmy goes ID medication and I just delete my account and the app, period. I’d be completely done.
Ok got it, thanks for your input!
your smartphone is checking
No, no and no. I’m using lemmy on a desktop computer because typing on a phone is a PITA. Requiring a phone, or any other physical second factor authentication, is additionally antithetical to the “let’s use less resources” point of the fediverse.
governments provide the lists
No, no and no. We already don’t trust corporations, why would we trust governments? Who among here is free of sin to cast the first stone? The US? (And woe betide having to authenticate with your own government that is already repressing you)
your smartphone only sends
No no and no. No need for smartphone.
What the hell is all this crap? Who are you really working for? Make your disclosures.
You only need the phone for the inital registration, but yes I get your point.
Governments already have the data. In a certain way you already trusted them by getting your passport and the platform just checks if its correct. The important part is to verify without sending the data into the internet.
I am not working for anyone why wood I? Everything is for free and open source, I don’t even have a lemmy instance so I can’t even publish it. I will just share my code and people can do with it whatever they want.
Governments already have the data. In a certain way you already trusted them by getting your passport
Bold way of saying I “trust”. I never chose to be born in a given country, they have not obtained an informed, actionable consent on my end for that association, nor have I agreeded to have my activities bound by specifically their imagined permits regarding where this or that land ends. And once again: this does not solve for those who have their own State as one of their primary aggressors.
What the fuck is your agenda?
What do you mean? I am just coding an open source project in my spare time to learn, maybe improve the web with it and ask people about their opinions. If you don’t like that you don’t need to use it, probably no one will in end.
i don’t want to be identified. i don’t need others to be identified. knowing who is a bot and who isn’t would be nice, especially since LLMs exist, but if there is a way to go about it, this isn’t it.
also, what prevents an instance from just saying its users are verified, regardless of whether they have this verification system? this system wouldn’t work and either way, the majority of people in the fediverse wouldn’t want it
ABSO-FUCKING-LUTELY NOT¡!!! I WILL NEVER EVER EVER EVER GIVE MY FUCKING ID TO A SOCIAL MEDIA SITE
NOT FUCKING EVER!!!
You didn’t read the piat before getting on your rage.
I read it. My opinion is the same. I would absolutely NEVER in a million years use my passport or any ID to log into a social media platform. Regardless of the way the data is managed. People are too clever to not devise a way to pull some kind of shenanigans with it. And it’s a slippery slope too. I don’t want to get comfortable with the idea of this. I don’t want any of us getting comfortable with this.
Sure I have no issue authenticating with government services. I think there are to many bad actors on the internet for a lot of the libertarian principles to hold up. 1 person 1 authenticated or multiple accounts tied to the same authentication is a good system and saves mods and users blocking the same people over and over.
Kinda suprised I see someone in favor of it, after reading all the other comments. Thanks for sharing!
This is vibe-coded nonsense.
We all know that the EU wants age verification for the web.
Yes, and it needs to be fought politically.
But the idea that everyone on social media is a verified human beeing could also have a lot of positive effects.
No. No, it could not. I grew up with the idea of the Internet being a mostly separate space from real life, one where our identities do not matter as much, and want that to be the case as much as possible. “On the Internet, nobody knows you’re a dog.”
I grew up in the same mindset as you describe.
But this reality never manifested. Instead the perceived anonymity of the social media sites, combined with the algorithm, tears our societies apart.
I don’t think that the fediverse has enough reach for such a system to make sense, but Met, Google and Tiktok certainly should use it.
The opposite of “tearing our societies apart” would be “uniting our societies”.
I come from a country (Austria) that once tried a political system where all of society was forced to unite behind a strong leader. That didn’t go very well.
So I refuse to think of “tearing our societies apart”, without further qualification, as an inherently bad thing. Better that than enforced unity of all of society where no dissent outside the Overton window is ever allowed.
combined with the algorithm
Agreed that that’s a major problem with today’s Internet. When I started to use it, the main way to publicly communicate online was web forums where threads were sorted by topic and then chronologically by when they were last posted in, i.e. with no recommendation algorithms. At the time, I was a preteen and dreamed of a world where that was a mainstream thing and way more people would be posting on forums like that.
Way more people use the Internet now, but it’s not structured that way at all anymore, and I do not understand what was so wrong with it that it needed to be replaced with algorithmic recommendations. Did that concept just not have a functioning business model, or what?
If the fediverse starts requiring ID to post, I won’t post. I already don’t use FB, Insta snap, TikTok, or whatever the hell else there is these days.
not even when the verification code is open source and the data never leaves your phone? Could you explain why?
It being open source doesn’t necessarily improve anything for me. I’m a software engineer and could go through the code, but it’s not like I know everything about everything nor am I specialized in security. But at that point… Why? Even if the data somehow doesn’t leave my device (which I still doubt by default because vulnerabilities are being discovered all the time) why is that worth the effort or the risk?
I didn’t have an always-on internet connection until sometime in my 20s. I can live without it.
No. Never.
I refuse to let governments gatekeep who gets to have access to social media or the internet in general. Plenty of people have incredibly hard times just getting and keeping an ID card. Imagine how hard it is to get online using some Zk-SNARK-ass ‘proving’ system.
Go read this: https://www.eff.org/deeplinks/2026/10/when-no-id-means-no-internet-age-verification-and-right-access-information
If the internet was dependent on government proofs, then I’d contact every nerd I know and set up my own networks. Because I’d rather go back to using IRC than have some entity control “moderation” (read: censorship) from afar.
Webrings are staging a comeback!
*reads headline*
FUCK NO!
*reads wall of text*
HELL FUCKING NO!
Imo it would be awesome if every person could have only one single account. Bans and restrictions have much more impact which forces users to behave more like irl.
No it wouldn’t be awesome, it would be fucking awful. Admins and mods don’t need more impact than they already have which is just cleaning up their own instances and communities without having any impact on someone doing things elsewhere. That is the whole point of federation and not replicating the centralized one account per person approach that reddit and similar corporate implementations have.
I don’t suggest to implement this into every server and platform like the EU wants. But I think it would be nice to have some servers or a platform where you can be sure, that you are not just beeing manipulated by bots and trolls
Multiple identities is a completely orthogonal problem to bots and trolls. Your lack of understanding of the privacy and security concerns in this is rather troubling if you also furthermore go around saying that you are making an implementation. Is this vibecoded? Have you mathematically proven that the ID information can not be possibly reversed? Can the user selfhost the authentication backend or is the instance in control of it? (or worse, a third-party)
First of all, I am not implementing the security stuff by myself, ZKPassport did this already, its open source everyone can look at the code. Its using a secure hash function, like basically all security relevant apps do, it has been proven years ago.
I just build a bridge between two existing open source tools ZKPassport and Lemmy, everyone can do this, everyone can look at the code I wrote in the end. I am not going to vibecode this and if I would, you would see it.
Everything is open source, you can self host all of that on the server where the lemmy instance runs. The only thing you need externally are the keys from the governments, but in theory you could download them once to your server and never query anything externally after that
Bots and trolls are a very different thing than a human having multiple accounts.
Even if creating an account was limited to a single individual human, they could still run it with a bot full time or partially. Or they could get the identities of people not on the fediverse to set up bot accounts. Trolling rarely includes creating multiple accounts, and they would have the same options to create accounts for people not on the fediverse.
This approach won’t results in platform where you aren’t being manipulated by bots and trolls, but would make things worse for everyone else.
When mods ban a user because they just run a bot on it, they can never post on the server again as long as the ban is active, because they can’t login into the account anymore and need a new identity to create a new account.
Which brings us to your second point: you need a valid identity (to be precise a valid passport with nfc chip which contains a private key only your country knows), which is possible to get but a lot of effort to just create a account which probably gets banned after a few days again.
nice idea and all… but the fediverse is already a technological nightmare for noobs… if the fediverse cant maintain participants or attract new ones, it will continue to exist in this zombie state of flat user growth/acceptance. i know many in the 'verse are happy with rolling around in their own echo chambers… (“we like it small, like our testicles!”)
i want to actually move people from those other, terrible systems.
what good is building an amazing, non-walled garden if no one fucking uses it?
Good point and this is probably one of the main issues. I think if the EU really pushes for age verification in all social media apps more people will think about alternative platforms (at least I hope so). And if this really happens the Fedivierse must implement some kind of age check too which hopefully is open source and not an external provider.
I think the key here will be that the solution integrates into some actually adopted standard. In the context of a potential mandatory age verification for EU countries, this would have to be something that is integrated into the EUDI Wallet, which is supported to have support for zero-knowledge proof of certain attributes like is the person above 16? This way it should not be different from what people would encounter on every other social media platform.
EUDI Wallet would be the easiest solution of course. But its quite hard to find out how it really works on low level as its not implemented yet. I don’t think this will ever be open sourced. In the end its maybe just one company that has all the authentication servers and self hosting one requires approval and is very costly so no one does it, just like they did it in Germany.
yeah, and remember theres already a severe barrier to entry. every additional step makes it worse.
im more likely to tell the eu to fuck right off than participate in their bullshit.
ill just move my server to some place that really doesnt give a fuck. verify that.
Fuck no, I won’t use anything online that requires me to submit any kind of ID, ever. This will inevitability be compromised no matter what assurances are offered.
