There's no reason Aristotle or Veratad should see who the underlying requestor is. Yoti should receive the verification request, strip the context, make the request - that's it. The fact that it isn't structured that way and they are tagging on additional metadata suggests per-query economics, which creates a direct incentive to route more verifications through more parties, exactly backwards from data minimization. I'm not going to call it a rev share, but the architecture is consistent with one.
While ZKP is more useful in limiting how much info is provided and, depending on implementation letting you make sure of the full scope of information acquired....if it literally only validates age then there's nothing other than logistics preventing a single adult from authenticating the entire world.
If a government mandates age verification and tolerates companies like Yoti as enforcers of their law, it's exactly the same thing. If politicians aren't willing to see that new laws are enforced with integrity, then these corrupt politicians are the problem and need to face the consequences.
Company A hires company B to offload the burden to do age checks, company B takes the burden to do it securely and only returns an age result to company A (no personal identifiable information).
Company A here could be any site, they are good at creating content, they should not be processing sensitive data. Company B is the expert, their job is to process personal data, confirm age, destroy data.
"When a bartender checks an ID, they quickly verify a customer's date of birth and identity before serving them. Companies like Yoti that employ digital age verification claim their products function the same way, but in a completely private manner."
-------------
Company A is not the problem. They called the cops to do cop things. That's fine. Company B (e.g. Yoti) is the one that's operating like a cop. If Yoti is getting paid by those it shares user data with, that's corruption. If they're not being paid, then it's mere criminal negligence.
If governments are to mandate age verification, then they also need to implement privacy standards for the gatekeepers and enforce them.
People need to learn to distrust such systems and exposing failings such as this one is a good way to do it.
We aren't going to be free of this stuff until the average Joe's mom hear of "forced age verification" and associate it to "unsafe".
As far as device fingerprinting goes, this is pretty tame, compared to what something like chatgpt does: https://www.buchodi.com/chatgpt-wont-let-you-type-until-clou...
The far more concerning part are your pictures/document scans getting sent to them.
An open letter to Georgia Institute of Technology and University of California, Irvine requesting retraction and correction of false statements
https://www.yoti.com/blog/open-letter-to-georgia-institute-o...
The rest of the IEEE Symposium on Security and Privacy papers are listed at https://sp2026.ieee-security.org/accepted-papers.html
Many of these systems are added to digital wallets due to legal requirements or fraudulent cases. For example, one case of fraud that I’m aware of happened in Chile, where citizens were able to open bank accounts digitally with just their ID. But since there is no good biometric information, many criminals took the IDs of homeless people to open accounts and move money around.
Sadly, these shitting things happen, then companies use these services to avoid the liability, and then these services abuse the information they have.
People don’t have much choice unless their representatives in government do something; it’s not about apathy: you can stop using one bank app, but not all of them otherwise you’ll be out of the financial system.
Silly as they were trying to be, the concept still holds -
Facial biometrics can and do get compromised too. Your example of IDs taken from the homeless - what the heck prevents organized criminals from taking pictures or recordings of their faces too?
Already there's malware out there stealing facial recognition data from infected devices (ESET reported on this nearly two years ago). Unlike changeable passwords, once your facial recognition data is compromised then that's it. Scammers can now impersonate you on top of having defeated this additional layer of fraud prevention.
Yoti is used by governments. Principled stances are all good and well for hn comments but eventually collide with reality
But what are the dangers? I mean concretely, in a way that can affect their day to day life, with significant probabilities.
HN is a tech forum, people here are very aware the tech risks. But talk to anyone in a given field and they will find a way to scare you. Don't go out in the sun without SPF50 gear or you will get cancer, your house electrical system is a fire hazard because you don't have the latest breakers, buy a gun, don't buy a gun, have this and that survival equipment, learn self defense, never talk to the cops, don't leave your drink unattended,...
At some point, people just want to stop worrying and do their things. And guess what, most people are fine! In fact considering how many things can turn bad, normal people are rather good at avoiding the worst despite an apparently carefree attitude. Meaning they are not so bad at evaluating risks, and that society has pretty good guardrails.
So cut normal people some slack unless they are in immediate danger (for example if they are in the process of responding to fishing), uploading their picture to Yoti is not that. They have other worries in their own field.
Inform them, but don't press it, and if you are in the field, your job is to help normal people be carefree, not cause more anxiety, they have more than enough already.
The thing is, this kind of stuff already happens all the time. The number of spam calls people suffer through are a direct result of companies digging through the contacts list after being granted that permission (though often without being granted that permission), then selling that data to brokers. Data breaches that wipe people's credit or force a credit freeze because they bought something ten years ago are another common one. Or think about package stalking, where people get access to someone's purchase history and the tracking number to a purchase so that they can steal it in transit or once it arrives. There's a number of beatings and murders that have happened because of police officers being able to access surveillance tools to track former romantic partners or spouses. All of these are different parts of the lack of privacy, and they're all getting worse because the tools that are used to surveil are becoming more widespread and more accessible.
Privacy is a protection against the intelligent attacks of other humans. It is not a frill that can be taken away without ridiculous and trailing harm.
Yoti's letter then gets angry that "face" data is not passed to third parties. That is not what is alleged.
Not to mention the repeated veiled threats about how they "could" sue academics investigating their systems.
It is absolutely incredibly sus as a letter.
What's pretty damning is that you make it appear like you know the paper but you claim things that the paper doesn't claim. In the exact same style of those who wrote the article, interesting.
You claim that "The paper alledges that a series of high entropy identifying metadata about the users system is passed to a very large amount of third parties"
That is FALSE, the paper doesn't say that, it actually says that the high entropy metadata is sent to Yoti servers, actually encrypted with client side keys on top of TLS which makes it impossible for any third party to even read it.
Reporting here extract from the paper: --- Once the user’s face is properly aligned, the SCM collects and processes a significant amount of data that is sent to Yoti’s servers. In particular, it collects the photo captured from the user’s camera and telemetry, including significant high-entropy browser and device metadata (see Table 2). It also includes data about the camera’s properties, the FPS of the camera stream, and metrics about download and processing times.
The SCM uses some cryptography, which we briefly describe here before returning to its implications in Section 5.5.3. If the image encryption setting is enabled (as it is by default), the SCM encrypts the captured image using AES-GCM with a key and initialization vector (IV) derived in the browser. Similarly, the telemetry and metadata collected is also encrypted under AES-GCM in the browser. ---
Then you claim "including the site being visited, and that has potential to link the real identity of the user to the site they are verifying with."
Which perfectly highlights the issue, as it seems like you might have gotten that from the Abstract section of the paper.
The great thing is that the paper itself disproves all of that when you read all the details. And anyone can find out that the key section where there is actual sharing of data with third parties (not the visiting site) is when the credit card check method is used for example. Which is pretty inevitable, to do a credit card check you need to use a payment provider which will have to process the data necessary to do that.
Now credit card check to confirm someone's age is something that existed since ever, and it can only be done by interacting with a payment provider (which is the claimed third/fourth party in the paper) and I can assure you that no one gets paid by the payment provider so you can check a credit card, actually you have to pay them a fee. So in this case Company A is paying a fee to Company B that is running the age check and Company B has its own costs like paying the payment provider a fee to conduct the credit card check. Company B doesn't get paid by anyone else other than Company A, there is no bribe man.
You can clearly see the bias and political intention behind all of this, see also how they use the word "broadcasting" which has a very specific meaning (broadcasting is the distribution of something to a dispersed public audience) which is not what the paper is claiming, there is no broadcasting, any payment provider requires authenticated private and secure connection.
When it comes to the age estimation method and ID document, the paper does not claim that any of that is shared with third parties, as by tracking the network traffic it can see that it goes directly to Yoti. Yoti itself claims and audits his system to prove that any of the personal data they process never leaves their system and is immediately deleted as soon as the age check is done.
The reality is Company B has nothing to gain by keeping or sharing people's data because all they do is based on Company A trusting them and any risk that destroys that trust is unacceptable.
What this political campaign is doing is trying to cast doubts on that trust with lies. So that people like you go and do the campaign for them.
Yoti is being so heavily attacked because they proved that this can be done following high privacy standards, which annoyed quite a lot of people (think the big porn operators for example, which wouldn't be surprising if they are also donors for those privacy groups). It is all about money. If those privacy groups cared about your privacy they would be talking about Google/Apple that know everything you do, anywhere you go, any website or app you use, they even have your biometrics (they say on your phone sure). But as US companies they are obliged to share any data with the US gov if requested and can't tell that to anyone if they ever got that request.
Lay the chat about broken social contract and how governments are a threat thick enough and officials may decide it’s better if you’re not on a plane at all
I'm just hoping that enough people can be convinced that systems of governance are not immune ethereal constructs run like videogame logic where you cannot do anything not explicitly written down. Too many people think that enforcement of anything works like a zap from God instead of being a mechanism that needs enforcers to pull it off.