Google Wallet launches new age and identity verification features (ZK proofs)

Plus, you'd be giving Google your government ID. A company that collects and trades thousands of your behavioral metrics as their core business model.

The Baltics have handled this better with a Smart ID system[0] that also allows cryptographic document signing (like Adobe Sign but non-repudiable by law). It can perform proof-of-human like Altman's orbs, and allows Baltic citizens to file documents with the government, access electronic court records, electronic medical records, e-banking, and similar services.

One downside of the system is that its purpose is to identify a natural person using a service. So whichever service uses it as authentication, it will receive personal data. However, there are third-party sign-on gateways that use Smart ID (and other e-signature methods legal in the Baltics) to authenticate users and only disclose certain bits of personal information to those requesting authentication. In Lithuania, the government operates a service called the E-Government Gateway, and one can easily imagine it could be used for zero-knowledge age verification.

Ultimately, Google seems to be offering a far inferior product at a lot more risk to the user. Once again, their core business is user profiling, associating various user metrics with each profile. A government ID is the holy grail for user profiling. It's sort of like if a wolf offered a sheep-verification service - yes, we could trust the wolf to act professionally towards the sheep, despite it coming out in sheep court several times that it hasn't in the past. But is it wise to suspend disbelief like that? It's better to leave this to independent, expert companies, or even governments.

[0] https://www.smart-id.com/

And it sounds like a complete nightmare when you're one of those people whose Google account gets suspended for some random reason, with no appeal process and no way to contact actual customer service.

Now you don't have any ID either, and can't prove who you are.

> the presence of this kind of technology makes it easier for governments to say things like "all ___ content online must be restricted to ages 18+ or 21+" and actually have a way to implement that across Discord and TikTok and gaming chatrooms and everything inbetween

There will still be sites that don’t GAF. Given the damage social media has done to our polity, particularly our youth, I’m all for age gating these services at a fundamental level.

I really wish Governments would operate digital infrastructure like this. I've heard some do, sorta.

I've had similar ideas regarding how US Military ID cards work. The tech enthusiast in me loves the idea of ubiquitous strong 2FA, functioning ID systems that separate "identification" from "authentication" (looking at you, SSNs), etc.

Identity theft would become essentially impossible. Then if it were adopted by things that are fundamentally associated with your real identity (e.g., banks, payment processors, insurance providers, government institutions) then whole classes of phishing scams would become impossible.

Then there are the use cases where it's convenient for the user. Public transit, event admissions, membership cards.

Then there are the use cases where it's convenient for the provider. Alcohol sales, social media, adult content.

... Yeah, that would turn into a dystopia incredibly fast.

i am in favor of increasing government capacity

And yet governments can do this in the offline world. Why is it so much more dangerous in the online world?

You’re more worried kids won’t be able to see filth online if they want than how this will be abused by authoritarian governments to clamp down on free speech?

Railcards in the UK have a complicated history, but essentially there's a sliding scale of discount you can get up to the age of 30, in order to encourage more young people to use the rail network. You get more discount under 18, some between 18 and 25 for one price, and some between 25 and 30 for another price.

Additionally, the way the discounts work is that you buy a pass that lasts for a period of time. That then needs to work with your current age. i.e. you can't buy 2 years of discount for under 30s at 29, you can only buy 1 year, so they need to share your age and I think possibly in some cases, date of birth.

I'm not familiar with the specific situation in the UK, but age-based discounts can support many policy goals.

Maybe you want teenagers to be more independent, instead of relying too much on their parents for transportation needs. Maybe you want young adults get used to using public transit instead of driving everywhere, which can lower infrastructure costs in a densely populated country. Maybe you want to encourage retirees to get out and participate in the society, instead of sitting alone at home. Or maybe you want to encourage the use of public transit outside peak hours, which could reduce the overall need for subsidies.

Simple systems, such as age-based categories, often work well enough. Targeted subsidies can be more efficient in principle. But that assumes that regulators manage to target them properly and have the regulations implemented in software correctly and in time. All of those often fail. And even when they are successful, they may cost more than you save with better targeting. Not to mention the opportunity costs: when regulators focus on one thing, they can't work on another.

Age is a proxy for money. You want to set the price for optimum profit (assuming the rail company isn’t controlled by the government and implements social measures), so you want to charge every group of people the amount where (number of costumers)*(profit per customer) is maximized. If you would price every group the same fare, some people wouldn’t get a ticket and you would lose customers. It makes sense to charge those users less, but try to keep the profit of other groups higher by not reducing their fare.

The Railcard website you linked is pretty clear.

> For those aged 16-25, save 1/3 off rail fares for days out, seeing family and friends and even festivals!

> For those aged 60 and over, save 1/3 off rail fares for days out, holidays, seeing family and friends, and theatre trips!

So, provide proof of age via ID and get a discount. It's very common on public transit for the young and elderly to get a discount.

Speaking as one of the implementors of the ZKP system described in the article.

The identity document (e.g. driver's license) is granted by an issuer (e.g. department of motor vehicles) and stored in the user's device only. Google is not part of this flow and the document is not sent to Google or stored by Google. In fact, one major technical problem is how to make sure that the document cannot be used without having possession of the phone. To this end, the document is associated with the phone's secure element (think of a hardware yubikey already present in the phone itself) and cannot be used without the secure element.

Think of the document as a dictionary { "name": "foo", "address": "bar" ... }, although the reality is more complicated. One standard for these documents is ISO/IEC 18013-5, but other possibilities exist.

The proof itself proves the truth of a certain predicate on the document. The predicate is something like "The document parses correctly, it is bound to the device's secure element, and it contains zip_code = 012345".

The phone generates the proof at presentation time in about 1s. Another major technical difficulty is that past attempts at solving this problem required prover time of tens of seconds. Our proofs have the property that no entity, including a future quantum computer, can learn anything from the proof other than the predicate is true. See https://eprint.iacr.org/2024/2010 for the gory details. The specific predicate being proved is in Algorithm 10.

When you say "interactive" you probably mean "at presentation time", as opposed to "in advance". We generate a fresh proof at presentation time and not in advance. Be aware that the ZKP literature uses "interactive" in a different sense, in which the verifier keeps posing multiple challenges to the prover until the verifier is satisfied that the proof is correct. Our system is derived from an "interactive" protocol in this technical sense, and transformed into a "non-interactive" prover via a general transformation called "Fiat-Shamir". The net effect is that the verifier asks "tell me your age and nothing else", the prover sends one message with the proof, and that's it.

>which will use digital IDs from Google Wallet to verify user identity and ZKP to verify age

This seems to imply you have to upload your information to Google first. But if you do that then what's the point of ZKP, Google might as well just send over a signed attestation token.

> google will sell the fact that you visited that porn website to anyone who is interested.

Has Google has actually done this? According to Google, they don't sell personal information:

https://about.google/company-info/how-our-business-works/#:~...

I'm willing to believe they've broken this promise, but if you can point to some actual proof, I'd like to see it.

"sell the fact that xyz" can this phraseology die? this is not what these big companies do. they sell attention, not data.

If you're using Chrome, which most people are, I'd assume this is the case anyway?

Note - agree with your sentiment.

An 18 year old account doesn't necessarily pass the liability requirements legally.

Who would guarantee that the account has been used by the same person all those 18 years?

Nah it would be called Google Wallet Money Duo.

Google Wallet will keep working for 6 months. Then stop. Around the same time Google Money Wallet will launch. Neither will support credit cards correctly for another 6 months.

Then Google Billfold will launch...

Better than Apple Intelligence which put the cart before the horse.

> Societies rely on imperfect enforcement of the law in order to progress. There's no way to create a critical mass of resistance and disobedience that will lead to the toppling of an unfair law if you enforce the law perfectly and universally, and this will lead society to ossify.

Don't worry, it won't be perfect and universal. Politicians, the police, and their friends and family will surely make themselves exempt.

Yep, every society believes itself perfect (or about to become perfect with just one more law), and then 10 minutes later is proven hilariously wrong.

>Societies rely on imperfect enforcement of the law in order to progress.

No, they rely on leadership to progress.

>There's no way to create a critical mass of resistance and disobedience that will lead to the toppling of an unfair law

Encouraging the breaking of laws is not good. Changing laws does not require them to be broken. Allowing for a critical mass of criminals to be created is a bug and not a feature.

>if you enforce the law perfectly and universally, and this will lead society to ossify.

Even if true, that is not neccessarily a bad thing. I find unequal enforcement of the law to be a bigger issue and it allows for vague laws to exist which are selectively applied. If things were perfect much more thought would need to be put into the design of laws.

>We'd still be stuck in the mindset of a century ago.

I'd prefer living in a society like that with strong morals that doesn't cave in and make compromises.

>A society that has removed its own ability to progress is truly a horrifying prospect

As I mentioned above progress can still happen via leadership. Leadership can take in information and make decisions in the way society should be led. Cutting off the information of how much crime is happening doesn't seem like it will make it impossible to make new decisions. There are more data sources that can be used.

> Societies rely on imperfect enforcement of the law in order to progress.

This is quite a leap.

Societies would be perfectly capable of evolution as long as they are not totally convinced of their own perfection at any given moment. It is quite possible to have everyone follow a law while simultaneously supporting changing it.

> We have the results of what happens when kids grow up with no actual age verification on the internet or with video games.

A mental illness epidemic? [0]

[0] https://www.afterbabel.com/p/the-teen-mental-illness-epidemi...

even if kids stop visiting porn sites, there are many other ways of downloading porn and what they will download will be even worst

Too true. The better option is for each computing device with internet access to continuously do a biometric scan of the user (fingerprint, retina, face, etc) and check against a government controlled database that stores identity info.

Why do you think Google "gets" data in Google Wallet?