Show HN:基于通行密钥(Passkey)加密的匿名年龄验证
Show HN: Anonymous age verification with passkey-powered encryption

原始链接: https://loginwithone.com/

One 是一个以隐私为核心的身份验证平台,用户只需验证一次身份,即可在多个应用程序中重复使用,且无需共享敏感的个人身份信息(PII)。 与传统方式不同——即用户需向不同服务商重复上传身份证件和自拍照——One 采用了用户自持加密技术。应用程序仅会收到所需的特定证明(如年龄确认或真人验证)以及审计记录,而原始身份数据始终保持加密状态,并由用户独家控制。 这一基础设施解决了两个核心问题:一是消除了用户在反复进行侵入式验证流程时所面临的阻力和安全风险;二是使企业能够在无需承担存储敏感个人数据责任的情况下,满足合规性要求。作为用户自持加密数据的底层架构,One 支持包括 KYC(了解你的客户)和私有 AI 转录在内的多种应用场景,确保敏感信息绝不会泄露给第三方数据库。归根结底,One 将范式从“平台托管数据”转变为“用户掌控身份”,从而提升了整个互联网的安全性和隐私性。

开发者 Michael 推出了一个名为 **loginwithone.com** 的身份验证服务,该服务侧重于隐私保护。该项目利用 WebAuthn PRF 扩展,在密钥(passkey)认证过程中导出一个由客户端持有的加密密钥。 该密钥在数据存储前会对敏感的用户信息(如政府证件)进行加密。因此,只有用户本人而非服务方能够解密这些数据。这使得用户能够向第三方应用提供短期有效且保护隐私的年龄或身份证明,而无需重复上传文件。该服务基于 OAuth 2.0 流程构建,在保持用户对身份信息自主控制权的同时,提供了类似于单点登录(SSO)的用户体验。 虽然该服务在初步验证证件真实性时需要查看明文信息,但不会保存原始图像。该项目旨在为现有的身份提供商提供一种更安全、去中心化的替代方案,并计划开源客户端加密库,同时将服务器端处理迁移至安全飞地(secure enclaves)中,以防止未经授权的访问或记录。
相关文章

原文

Why One for businesses?

Some applications need to know that a user is old enough to use their product. Others want confirmation that there is a verified person behind an account. One returns the required identity proof in one tap, helping businesses meet their requirements without collecting personal data or putting users through a long and invasive verification flow.

Why One for users?

Users verify their identity once, then reuse it across any application that uses One. No repeated ID uploads, and no new processor to trust with sensitive data. Applications receive only the proof a user approves, not their PII. Their data stays encrypted with a key only they hold, so even a breach of One would not expose readable identity data.

Is One only for age verification?

No. Age verification is simply the first privacy challenge that One was built around. The same infrastructure can confirm that an account belongs to a verified person without revealing who they are. At its core, One is a new primitive for persisting sensitive data under user-held encryption. It can power reusable identity presentation for KYC, private AI chat transcripts, and other applications that require persistence of sensitive data without surrendering custody to the platform.

How does One store personal data?

One stores ciphertext: encrypted blobs created with a key held by the user. Never the underlying identity data. This includes government ID data, as well as the verified email associated with the account.

What does my application receive?

Only the requested proof and an audit record. For example, that a user is a verified person or is at least 18 years of age, and when the check was completed. No name, birth date, address, selfie, or ID image.

Why was One created?

Applications increasingly need to verify aspects of their users’ identities, but traditional verification methods create a new privacy problem. Users upload IDs, selfies, and other PII to providers that can read and retain it, then repeat the process across multiple applications. That creates friction and spreads sensitive data across more databases and attack vectors. One was built around a new primitive to resolve that conflict: reusable identity data encrypted with keys only the user holds. Businesses get the proof they require, while users maintain their privacy and custody of their data. Read more: The Internet Should Be More Like a Liquor Store

How can I find out more?

Email [email protected] to ask a question, discuss an integration, or request access.

联系我们 contact @ memedata.com