Thank you, I guess you are right. Still, there were some good points here and there that were worth learning. I’m going to give it a try anyway (on my local machinet) and see how it goes…

What do you mean? I am just coding an open source project in my spare time to learn, maybe improve the web with it and ask people about their opinions. If you don’t like that you don’t need to use it, probably no one will in end.

You only need the phone for the inital registration, but yes I get your point.

Governments already have the data. In a certain way you already trusted them by getting your passport and the platform just checks if its correct. The important part is to verify without sending the data into the internet.

I am not working for anyone why wood I? Everything is for free and open source, I don’t even have a lemmy instance so I can’t even publish it. I will just share my code and people can do with it whatever they want.

First of all, I am not implementing the security stuff by myself, ZKPassport did this already, its open source everyone can look at the code. Its using a secure hash function, like basically all security relevant apps do, it has been proven years ago.

I just build a bridge between two existing open source tools ZKPassport and Lemmy, everyone can do this, everyone can look at the code I wrote in the end. I am not going to vibecode this and if I would, you would see it.

Everything is open source, you can self host all of that on the server where the lemmy instance runs. The only thing you need externally are the keys from the governments, but in theory you could download them once to your server and never query anything externally after that

Kinda suprised I see someone in favor of it, after reading all the other comments. Thanks for sharing!

EUDI Wallet would be the easiest solution of course. But its quite hard to find out how it really works on low level as its not implemented yet. I don’t think this will ever be open sourced. In the end its maybe just one company that has all the authentication servers and self hosting one requires approval and is very costly so no one does it, just like they did it in Germany.

Ok got it, thanks for your input!

The point is to verfiy someone does not already have an account and is not a bot. Your smartphone is checking the ID locally. Governments provide public lists of keys that match keys on the passports of their citizens, so you can download the public lists locally and check them on your device outside of any social media platform etc. Your smartphone just sends something like “this user is verified” to the server

When mods ban a user because they just run a bot on it, they can never post on the server again as long as the ban is active, because they can’t login into the account anymore and need a new identity to create a new account.

Which brings us to your second point: you need a valid identity (to be precise a valid passport with nfc chip which contains a private key only your country knows), which is possible to get but a lot of effort to just create a account which probably gets banned after a few days again.

I don’t suggest to implement this into every server and platform like the EU wants. But I think it would be nice to have some servers or a platform where you can be sure, that you are not just beeing manipulated by bots and trolls

Like I already wrote, its not possible to identify a real person based on the user data on the platform, even if you gain access to the database and server. No passport data is sent to the server only the id which can’t be reversed to get you’re personal data. So you can still be anonymous

Despite that: I don’t want to keep all of the internet behind a passport verification wall. This would be terrible. I imagine it more like we have some platforms or servers where people need to verify

Good point and this is probably one of the main issues. I think if the EU really pushes for age verification in all social media apps more people will think about alternative platforms (at least I hope so). And if this really happens the Fedivierse must implement some kind of age check too which hopefully is open source and not an external provider.

not even when the verification code is open source and the data never leaves your phone? Could you explain why?

Yeah I thought about that too, the documentation is also a bit thin for a privacy related topic. I need to check the code of it, analyse what they are doing and how.

Nice thank you, I need to start with small steps, but yes it opens new opportunities for a lot of nice privacy related features.