this post was submitted on 24 May 2025
549 points (97.4% liked)
Technology
70285 readers
3446 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Tokenization is the easy solution.
You go onto you state gov website and get a token that just says "this is an adult." Nothing else. Token lasts 10 minutes.
Cut and paste into the site. They authenticate without saying who theu are, back to the gov site, "yo, this legit?" State says "looks like something we would do." State keeps no records of WHO validated the token, just that it was a legit token.
Same way that routers connect to VPN services.
How does the state verify that you're an adult and therefore should have a token?
This solution simply seems to be kicking the can down the road
Not at all, this is well established technology already in use all over the place.
When countries use digital IDs, they are able to carve out validating individual aspects of an identity. Just address, just over 18, just class of driver's license, etc.
So the State has a website/wallet where the user pulls a token from the State, basically a fancy hashed OTP/Login code.
The website, which can't derive your identity from the code, sends the code to the state API and can't ask more than "is this hash legit" and the State API doesnt need to say more than "yup."
Where can things go wrong? The State can ask to know who needs the token. Or even demand to know, and log what sites use it. The state can contract this out to a vendor that logs it all, making data theft far more risky.
It all depends on his the state builds requirements.