We all know that the EU wants age verification for the web. I dont trust my country, the EU and definitely not Instagram, Twitter etc. to implement this in way where my personal data won’t be shared with anyone. But the idea that everyone on social media is a verified human beeing could also have a lot of positive effects.
Imo it would be awesome if every person could have only one single account. Bans and restrictions have much more impact which forces users to behave more like irl. You could reduce a massive amount of bots which would reduce fake news and be a time saver for mods.
As a solution for the privacy issue, I searched for open source passport verification tools and found ZKPassport which makes the proof on you own device without sending you data anywhere. It generates a deterministic Id which is salted and hashed, so you can’t find a real person from a user account or otherwise. Only this Id is sent to the server as a proof, nothing else. The code is open source and its possible to self host the backend for this system.
I try to implement ZKPassport into a lemmy fork to make a small proof of concept for this idea. Of course this needs a lot more security features for a real production scenario, because mods and server owners have much more power and the federation is more complicated with only a few servers that have passport auth enabled and some even have their own implementation of the auth.
So if the proof of concept works out well the question is, would people be rather use passport authenticated Fediverse instances when all of you data stays on your phone?
You must log in or register to comment.
No. Nobody needs my ID for me to shitpost on a forum.
Nope. We have seen time and time again that websites can not keep things like passwords safe and secured. What makes you think any of them can keep actual proper identifiable information safe and secure?
The data doesn’t even get into the platform, so they can’t store it and they can’t loose it. If an attacker gets access or leaks data it will be just hashes, no actual data
No.
This is vibe-coded nonsense.
Lol, no.
Sure I have no issue authenticating with government services. I think there are to many bad actors on the internet for a lot of the libertarian principles to hold up. 1 person 1 authenticated or multiple accounts tied to the same authentication is a good system and saves mods and users blocking the same people over and over.
Kinda suprised I see someone in favor of it, after reading all the other comments. Thanks for sharing!
ABSO-FUCKING-LUTELY NOT¡!!! I WILL NEVER EVER EVER EVER GIVE MY FUCKING ID TO A SOCIAL MEDIA SITE
NOT FUCKING EVER!!!
You didn’t read the piat before getting on your rage.
i don’t want to be identified. i don’t need others to be identified. knowing who is a bot and who isn’t would be nice, especially since LLMs exist, but if there is a way to go about it, this isn’t it.
also, what prevents an instance from just saying its users are verified, regardless of whether they have this verification system? this system wouldn’t work and either way, the majority of people in the fediverse wouldn’t want it
Fuck no, I won’t use anything online that requires me to submit any kind of ID, ever. This will inevitability be compromised no matter what assurances are offered.
Imo it would be awesome if every person could have only one single account. Bans and restrictions have much more impact which forces users to behave more like irl.
What about people who want to criticize their oppressive government without risk of being identified from their post history? People questioning their gender or sexuality who don’t want to come out to everyone yet? People who view or post NSFW things and don’t want it associated with their primary account?
There are plenty of valid reasons to have multiple accounts besides ban evasion.
Like I already wrote, its not possible to identify a real person based on the user data on the platform, even if you gain access to the database and server. No passport data is sent to the server only the id which can’t be reversed to get you’re personal data. So you can still be anonymous
Despite that: I don’t want to keep all of the internet behind a passport verification wall. This would be terrible. I imagine it more like we have some platforms or servers where people need to verify
What the fuck is your agenda?
What do you mean? I am just coding an open source project in my spare time to learn, maybe improve the web with it and ask people about their opinions. If you don’t like that you don’t need to use it, probably no one will in end.
Wtf is even the point of this then? Who is checking the IDs? If you can’t link it to a person why he’ll do they want your id?
The point is to verfiy someone does not already have an account and is not a bot. Your smartphone is checking the ID locally. Governments provide public lists of keys that match keys on the passports of their citizens, so you can download the public lists locally and check them on your device outside of any social media platform etc. Your smartphone just sends something like “this user is verified” to the server
I applaud your critical thinking, but you are asking inside a bubble that knows answers before it asks questions. I doubt such an idea can at this time in history be implemented in a grassroots way.
Thank you, I guess you are right. Still, there were some good points here and there that were worth learning. I’m going to give it a try anyway (on my local machinet) and see how it goes…
your smartphone is checking
No, no and no. I’m using lemmy on a desktop computer because typing on a phone is a PITA. Requiring a phone, or any other physical second factor authentication, is additionally antithetical to the “let’s use less resources” point of the fediverse.
governments provide the lists
No, no and no. We already don’t trust corporations, why would we trust governments? Who among here is free of sin to cast the first stone? The US? (And woe betide having to authenticate with your own government that is already repressing you)
your smartphone only sends
No no and no. No need for smartphone.
What the hell is all this crap? Who are you really working for? Make your disclosures.
You only need the phone for the inital registration, but yes I get your point.
Governments already have the data. In a certain way you already trusted them by getting your passport and the platform just checks if its correct. The important part is to verify without sending the data into the internet.
I am not working for anyone why wood I? Everything is for free and open source, I don’t even have a lemmy instance so I can’t even publish it. I will just share my code and people can do with it whatever they want.
Governments already have the data. In a certain way you already trusted them by getting your passport
Bold way of saying I “trust”. I never chose to be born in a given country, they have not obtained an informed, actionable consent on my end for that association, nor have I agreeded to have my activities bound by specifically their imagined permits regarding where this or that land ends. And once again: this does not solve for those who have their own State as one of their primary aggressors.
Nope, still 100% NO!!! I don’t care what the scheme is. I don’t trust any of the people or companies involved. I don’t trust the company that makes my cell phone, the operating system, the gov, none of it.
There is literally nothing you could say to me that would ever have me scanning my ID to access social media. I already hate this shit, Lemmy is barely acceptable. Lemmy goes ID medication and I just delete my account and the app, period. I’d be completely done.
Ok got it, thanks for your input!
Passport verification is a terrible idea. Instead of passport verification, the fediverse really lacks separating auth servers into a separate SSO component. So that you could log in to every fedi instance with the same account. It would be super convenient, and those who like to keep everything close together could just run two components side by side.
Centralizing authentication means someone gets to control access to the whole fediverse, which would be pretty fucking awful if anyone like .ml team was running authentication and had the power to easily deny anyone whose opinions they didn’t like.
SSO doesn’t work like that. Conventionally, there is an sso ml provider, an sso world provider, and anyone else from the fediverse. Any server, for example lemmy, looks at the login domain during authorization and sends a request to the server along the lines of “someone is trying to log in, send the cookies and a redirect link”; someone is redirected to the SSO server, authenticates there, and then returns back to the original lemmy node. The registration endpoint can be determined by the domain.
Like, for example, lemmy.world login 1234@lemmy.ml -> redirect to lemmy.ml for password -> redirect to lemmy.world back. Or any another instance in fediverse.
Accordingly, this is literally no different from what exists now except for one nuance — I won’t need to go to my instance anymore, find a post mirrored from world, and write a comment there. I will simply be able to log in directly on world and write whatever I want.
And passwords are in the hands of the node admins anyway. This will literally differ from the current scheme in nothing except that potentially the owner of your lemmy account could hijack your mastodon. But those who actually think about this will just make 2 SSO accounts. But how easy that will be. No 20 accounts in 20 instances… And no one will have to explain why they need 20 accounts at all. And I’ll finally be able to watch pirtube, read lemmy, and comment on mastodon from the same username. =)
UPD: Especially tough guys will just be able to host their SSO node and not bother with password hijack.
Imo it would be awesome if every person could have only one single account.
No it wouldn’t be.
I don’t suggest to implement this into every server and platform like the EU wants. But I think it would be nice to have some servers or a platform where you can be sure, that you are not just beeing manipulated by bots and trolls
Multiple identities is a completely orthogonal problem to bots and trolls. Your lack of understanding of the privacy and security concerns in this is rather troubling if you also furthermore go around saying that you are making an implementation. Is this vibecoded? Have you mathematically proven that the ID information can not be possibly reversed? Can the user selfhost the authentication backend or is the instance in control of it? (or worse, a third-party)
First of all, I am not implementing the security stuff by myself, ZKPassport did this already, its open source everyone can look at the code. Its using a secure hash function, like basically all security relevant apps do, it has been proven years ago.
I just build a bridge between two existing open source tools ZKPassport and Lemmy, everyone can do this, everyone can look at the code I wrote in the end. I am not going to vibecode this and if I would, you would see it.
Everything is open source, you can self host all of that on the server where the lemmy instance runs. The only thing you need externally are the keys from the governments, but in theory you could download them once to your server and never query anything externally after that
Bots and trolls are a very different thing than a human having multiple accounts.
Even if creating an account was limited to a single individual human, they could still run it with a bot full time or partially. Or they could get the identities of people not on the fediverse to set up bot accounts. Trolling rarely includes creating multiple accounts, and they would have the same options to create accounts for people not on the fediverse.
This approach won’t results in platform where you aren’t being manipulated by bots and trolls, but would make things worse for everyone else.
When mods ban a user because they just run a bot on it, they can never post on the server again as long as the ban is active, because they can’t login into the account anymore and need a new identity to create a new account.
Which brings us to your second point: you need a valid identity (to be precise a valid passport with nfc chip which contains a private key only your country knows), which is possible to get but a lot of effort to just create a account which probably gets banned after a few days again.
*reads headline*
FUCK NO!
*reads wall of text*
HELL FUCKING NO!
We all know that the EU wants age verification for the web.
Yes, and it needs to be fought politically.
But the idea that everyone on social media is a verified human beeing could also have a lot of positive effects.
No. No, it could not. I grew up with the idea of the Internet being a mostly separate space from real life, one where our identities do not matter as much, and want that to be the case as much as possible. “On the Internet, nobody knows you’re a dog.”
Yes it would have a lot of positive effects. The end of bot farms for a start, social media and society at large is hugely affected by the whims of bot activity.
It would cripple the large social media platforms, that’s a win.
I grew up in the same mindset as you describe.
But this reality never manifested. Instead the perceived anonymity of the social media sites, combined with the algorithm, tears our societies apart.
I don’t think that the fediverse has enough reach for such a system to make sense, but Met, Google and Tiktok certainly should use it.
The opposite of “tearing our societies apart” would be “uniting our societies”.
I come from a country (Austria) that once tried a political system where all of society was forced to unite behind a strong leader. That didn’t go very well.
So I refuse to think of “tearing our societies apart”, without further qualification, as an inherently bad thing. Better that than enforced unity of all of society where no dissent outside the Overton window is ever allowed.
combined with the algorithm
Agreed that that’s a major problem with today’s Internet. When I started to use it, the main way to publicly communicate online was web forums where threads were sorted by topic and then chronologically by when they were last posted in, i.e. with no recommendation algorithms. At the time, I was a preteen and dreamed of a world where that was a mainstream thing and way more people would be posting on forums like that.
Way more people use the Internet now, but it’s not structured that way at all anymore, and I do not understand what was so wrong with it that it needed to be replaced with algorithmic recommendations. Did that concept just not have a functioning business model, or what?
No. Never.
I refuse to let governments gatekeep who gets to have access to social media or the internet in general. Plenty of people have incredibly hard times just getting and keeping an ID card. Imagine how hard it is to get online using some Zk-SNARK-ass ‘proving’ system.
Go read this: https://www.eff.org/deeplinks/2026/10/when-no-id-means-no-internet-age-verification-and-right-access-information
If the internet was dependent on government proofs, then I’d contact every nerd I know and set up my own networks. Because I’d rather go back to using IRC than have some entity control “moderation” (read: censorship) from afar.
Webrings are staging a comeback!
