We all know that the EU wants age verification for the web. I dont trust my country, the EU and definitely not Instagram, Twitter etc. to implement this in way where my personal data won't be shared with anyone. But the idea that everyone on social media is a verified human beeing could also have a lot of positive effects.

Imo it would be awesome if every person could have only one single account. Bans and restrictions have much more impact which forces users to behave more like irl. You could reduce a massive amount of bots which would reduce fake news and be a time saver for mods.

As a solution for the privacy issue, I searched for open source passport verification tools and found ZKPassport which makes the proof on you own device without sending you data anywhere. It generates a deterministic Id which is salted and hashed, so you can't find a real person from a user account or otherwise. Only this Id is sent to the server as a proof, nothing else. The code is open source and its possible to self host the backend for this system.

I try to implement ZKPassport into a lemmy fork to make a small proof of concept for this idea.
Of course this needs a lot more security features for a real production scenario, because mods and server owners have much more power and the federation is more complicated with only a few servers that have passport auth enabled and some even have their own implementation of the auth.

So if the proof of concept works out well the question is, would people be rather use passport authenticated Fediverse instances when all of you data stays on your phone?

EDIT: I don't suggest that the whole fediverse switches to passport authentication, every instance can decide on their own. Therefore you could also have multiple accounts across multiple instances but not multiple accounts on the same instance.

Looks a bit like it's vibe-coded, or AI assisted, or written by someone who isn't aware of how to comment computer code?! The project is 2 years old, though, so maybe not just vibe-coded.

Other than that, I'm all for zero-knowledge proofs and open-source, user-empowering identity management solutions. Make it open-source, distributed, resilient, customizable and privacy-first. And once you're at it, try to make it do a few other things as well. Like captchas, email encryption, nomadic identity...

Yeah I thought about that too, the documentation is also a bit thin for a privacy related topic. I need to check the code of it, analyse what they are doing and how.

Nice thank you, I need to start with small steps, but yes it opens new opportunities for a lot of nice privacy related features.

If the fediverse starts requiring ID to post, I won't post. I already don't use FB, Insta snap, TikTok, or whatever the hell else there is these days.

not even when the verification code is open source and the data never leaves your phone?
Could you explain why?

Good point and this is probably one of the main issues. I think if the EU really pushes for age verification in all social media apps more people will think about alternative platforms (at least I hope so). And if this really happens the Fedivierse must implement some kind of age check too which hopefully is open source and not an external provider.

No. Never.

I refuse to let governments gatekeep who gets to have access to social media or the internet in general. Plenty of people have incredibly hard times just getting and keeping an ID card. Imagine how hard it is to get online using some Zk-SNARK-ass 'proving' system.

Go read this: https://www.eff.org/deeplinks/2026/10/when-no-id-means-no-internet-age-verification-and-right-access-information

If the internet was dependent on government proofs, then I'd contact every nerd I know and set up my own networks. Because I'd rather go back to using IRC than have some entity control "moderation" (read: censorship) from afar.

We all know that the EU wants age verification for the web.

Yes, and it needs to be fought politically.

But the idea that everyone on social media is a verified human beeing could also have a lot of positive effects.

No. No, it could not. I grew up with the idea of the Internet being a mostly separate space from real life, one where our identities do not matter as much, and want that to be the case as much as possible. "On the Internet, nobody knows you're a dog."

It being open source doesn't necessarily improve anything for me. I'm a software engineer and could go through the code, but it's not like I know everything about everything nor am I specialized in security. But at that point... Why? Even if the data somehow doesn't leave my device (which I still doubt by default because vulnerabilities are being discovered all the time) why is that worth the effort or the risk?

I didn't have an always-on internet connection until sometime in my 20s. I can live without it.

Webrings are staging a comeback!

*reads headline*

FUCK NO!

*reads wall of text*

HELL FUCKING NO!

Imo it would be awesome if every person could have only one single account. Bans and restrictions have much more impact which forces users to behave more like irl.

No it wouldn't be awesome, it would be fucking awful. Admins and mods don't need more impact than they already have which is just cleaning up their own instances and communities without having any impact on someone doing things elsewhere. That is the whole point of federation and not replicating the centralized one account per person approach that reddit and similar corporate implementations have.

Passport verification is a terrible idea. Instead of passport verification, the fediverse really lacks separating auth servers into a separate SSO component. So that you could log in to every fedi instance with the same account. It would be super convenient, and those who like to keep everything close together could just run two components side by side.

Imo it would be awesome if every person could have only one single account. Bans and restrictions have much more impact which forces users to behave more like irl.

What about people who want to criticize their oppressive government without risk of being identified from their post history? People questioning their gender or sexuality who don't want to come out to everyone yet? People who view or post NSFW things and don't want it associated with their primary account?

There are plenty of valid reasons to have multiple accounts besides ban evasion.

Like I already wrote, its not possible to identify a real person based on the user data on the platform, even if you gain access to the database and server. No passport data is sent to the server only the id which can't be reversed to get you're personal data.
So you can still be anonymous

Despite that: I don't want to keep all of the internet behind a passport verification wall. This would be terrible. I imagine it more like we have some platforms or servers where people need to verify

Centralizing authentication means someone gets to control access to the whole fediverse, which would be pretty fucking awful if anyone like .ml team was running authentication and had the power to easily deny anyone whose opinions they didn't like.

Fuck no, I won't use anything online that requires me to submit any kind of ID, ever. This will inevitability be compromised no matter what assurances are offered.

nice idea and all.. but the fediverse is already a technological nightmare for noobs... if the fediverse cant maintain participants or attract new ones, it will continue to exist in this zombie state of flat user growth/acceptance. i know many in the 'verse are happy with rolling around in their own echo chambers... ("we like it small, like our testicles!")

i want to actually move people from those other, terrible systems.

what good is building an amazing, non-walled garden if no one fucking uses it?

i don't want to be identified. i don't need others to be identified. knowing who is a bot and who isn't would be nice, especially since LLMs exist, but if there is a way to go about it, this isn't it.

also, what prevents an instance from just saying its users are verified, regardless of whether they have this verification system? this system wouldn't work and either way, the majority of people in the fediverse wouldn't want it

yeah, and remember theres already a severe barrier to entry. every additional step makes it worse.

im more likely to tell the eu to fuck right off than participate in their bullshit.

ill just move my server to some place that really doesnt give a fuck. verify that.

ABSO-FUCKING-LUTELY NOT¡!!!!!!!!!!!!!!!!!!
I WILL NEVER EVER EVER EVER GIVE MY FUCKING ID TO A SOCIAL MEDIA SITE

NOT FUCKING EVER!!!!!!

Wtf is even the point of this then? Who is checking the IDs? If you can't link it to a person why he'll do they want your id?

The point is to verfiy someone does not already have an account and is not a bot. Your smartphone is checking the ID locally. Governments provide public lists of keys that match keys on the passports of their citizens, so you can download the public lists locally and check them on your device outside of any social media platform etc. Your smartphone just sends something like "this user is verified" to the server

I think the key here will be that the solution integrates into some actually adopted standard. In the context of a potential mandatory age verification for EU countries, this would have to be something that is integrated into the EUDI Wallet, which is supported to have support for zero-knowledge proof of certain attributes like is the person above 16? This way it should not be different from what people would encounter on every other social media platform.

Nope, still 100% NO!!!! I don't care what the scheme is. I don't trust any of the people or companies involved. I don't trust the company that makes my cell phone, the operating system, the gov, none of it.

There is literally nothing you could say to me that would ever have me scanning my ID to access social media. I already hate this shit, Lemmy is barely acceptable. Lemmy goes ID medication and I just delete my account and the app, period. I'd be completely done.

Sure I have no issue authenticating with government services. I think there are to many bad actors on the internet for a lot of the libertarian principles to hold up. 1 person 1 authenticated or multiple accounts tied to the same authentication is a good system and saves mods and users blocking the same people over and over.

SSO doesn't work like that. Conventionally, there is an sso ml provider, an sso world provider, and anyone else from the fediverse. Any server, for example lemmy, looks at the login domain during authorization and sends a request to the server along the lines of "someone is trying to log in, send the cookies and a redirect link"; someone is redirected to the SSO server, authenticates there, and then returns back to the original lemmy node. The registration endpoint can be determined by the domain.

Like, for example, lemmy.world login 1234@lemmy.ml -> redirect to lemmy.ml for password -> redirect to lemmy.world back. Or any another instance in fediverse.

Accordingly, this is literally no different from what exists now except for one nuance — I won't need to go to my instance anymore, find a post mirrored from world, and write a comment there. I will simply be able to log in directly on world and write whatever I want.

And passwords are in the hands of the node admins anyway. This will literally differ from the current scheme in nothing except that potentially the owner of your lemmy account could hijack your mastodon. But those who actually think about this will just make 2 SSO accounts. But how easy that will be. No 20 accounts in 20 instances.... And no one will have to explain why they need 20 accounts at all. And I'll finally be able to watch pirtube, read lemmy, and comment on mastodon from the same username. =)

UPD: Especially tough guys will just be able to host their SSO node and not bother with password hijack.

Ok got it, thanks for your input!

EUDI Wallet would be the easiest solution of course. But its quite hard to find out how it really works on low level as its not implemented yet. I don't think this will ever be open sourced. In the end its maybe just one company that has all the authentication servers and self hosting one requires approval and is very costly so no one does it, just like they did it in Germany.

Kinda suprised I see someone in favor of it, after reading all the other comments. Thanks for sharing!

your smartphone is checking

No, no and no. I'm using lemmy on a desktop computer because typing on a phone is a PITA. Requiring a phone, or any other physical second factor authentication, is additionally antithetical to the "let's use less resources" point of the fediverse.

governments provide the lists

No, no and no. We already don't trust corporations, why would we trust governments? Who among here is free of sin to cast the first stone? The US? (And woe betide having to authenticate with your own government that is already repressing you)

your smartphone only sends

No no and no. No need for smartphone.

What the hell is all this crap? Who are you really working for? Make your disclosures.

What the fuck is your agenda?

You only need the phone for the inital registration, but yes I get your point.

Governments already have the data. In a certain way you already trusted them by getting your passport and the platform just checks if its correct. The important part is to verify without sending the data into the internet.

I am not working for anyone why wood I? Everything is for free and open source, I don't even have a lemmy instance so I can't even publish it. I will just share my code and people can do with it whatever they want.

What do you mean? I am just coding an open source project in my spare time to learn, maybe improve the web with it and ask people about their opinions. If you don't like that you don't need to use it, probably no one will in end.

Lol, no.

This is vibe-coded nonsense.

Governments already have the data. In a certain way you already trusted them by getting your passport

Bold way of saying I "trust". I never chose to be born in a given country, they have not obtained an informed, actionable consent on my end for that association, nor have I agreeded to have my activities bound by specifically their imagined permits regarding where this or that land ends. And once again: this does not solve for those who have their own State as one of their primary aggressors.

You didn't read the piat before getting on your rage.

I applaud your critical thinking, but you are asking inside a bubble that knows answers before it asks questions. I doubt such an idea can at this time in history be implemented in a grassroots way.

I grew up in the same mindset as you describe.

But this reality never manifested. Instead the perceived anonymity of the social media sites, combined with the algorithm, tears our societies apart.

I don't think that the fediverse has enough reach for such a system to make sense, but Met, Google and Tiktok certainly should use it.

The opposite of "tearing our societies apart" would be "uniting our societies".

I come from a country (Austria) that once tried a political system where all of society was forced to unite behind a strong leader. That didn't go very well.

So I refuse to think of "tearing our societies apart", without further qualification, as an inherently bad thing. Better that than enforced unity of all of society where no dissent outside the Overton window is ever allowed.

combined with the algorithm

Agreed that that's a major problem with today's Internet. When I started to use it, the main way to publicly communicate online was web forums where threads were sorted by topic and then chronologically by when they were last posted in, i.e. with no recommendation algorithms. At the time, I was a preteen and dreamed of a world where that was a mainstream thing and way more people would be posting on forums like that.

Way more people use the Internet now, but it's not structured that way at all anymore, and I do not understand what was so wrong with it that it needed to be replaced with algorithmic recommendations. Did that concept just not have a functioning business model, or what?

Thank you, I guess you are right. Still, there were some good points here and there that were worth learning. I'm going to give it a try anyway (on my local machinet) and see how it goes...

No.

I read it. My opinion is the same. I would absolutely NEVER in a million years use my passport or any ID to log into a social media platform. Regardless of the way the data is managed. People are too clever to not devise a way to pull some kind of shenanigans with it. And it's a slippery slope too. I don't want to get comfortable with the idea of this. I don't want any of us getting comfortable with this.

Nope. We have seen time and time again that websites can not keep things like passwords safe and secured. What makes you think any of them can keep actual proper identifiable information safe and secure?

The data doesn't even get into the platform, so they can't store it and they can't loose it. If an attacker gets access or leaks data it will be just hashes, no actual data

I have high trust in my government not to abuse the knowledge and as much as I'd love to live in a world with a truely anonymous internet there are just to many people taking advantage of that anonymity and it makes platform moderation extremely tedious. I fully believe if you say something unhinged like "im gonna kill my ex wife" cops should de anon the account and be at that persons door to arrest them.

My ideal internet model is a two tiered internet. One where everyone is authenticated and an anonymous one where nobody is. If you want to whistleblow or communicate safely you are free to do so and the main Internet can be cleaned up of bad actors. For actual people who spam and stuff thats annoying but not illegal they be exponentially temp banned from that site. No perm bans if you can only have 1 identity. I'd still want people to have multiple accounts I might have one with my real name one with an alias the site and other users would have no idea but if I said I was going to do a terrorist attack or something both my accounts would get banned and I'd get arrested.

Yes it would have a lot of positive effects. The end of bot farms for a start, social media and society at large is hugely affected by the whims of bot activity.

It would cripple the large social media platforms, that's a win.

Imo it would be awesome if every person could have only one single account. Bans and restrictions have much more impact which forces users to behave more like irl.

People who would enjoy that are already at Something Awful. People flocked to Reddit because there they weren't living in constant fear of running afoul a mod and getting permabanned. Today they're fleeing Reddit for the exact same reasons.

There are definitely many benefits to living in a police state like that. But conversations also become stagnant and redundant to avoid rocking the boat too much.

No. Nobody needs my ID for me to shitpost on a forum.