alt.hn

8/19/2026 at 1:41:10 PM

Show HN: Anonymous age verification with passkey-powered encryption

 https://loginwithone.com/

by mikeysight

8/20/2026 at 10:18:16 PM

"One stores ciphertext: encrypted blobs created with a key held by the user. Never the underlying identity data. This includes government ID and selfie data, as well as the verified email associated with the account. "

Why does it need to store even encrypted data after the result is +18, for example? Does ONE need to keep validating against the same documents every time?

by thcr

8/21/2026 at 4:56:38 AM

Great question, and also thank you for calling this out, because "selfie data" shouldn't be included in that description, since those images are not persisted at all, encrypted or otherwise (editing now). You make a very good point about being able to reissue valid proofs based on a previous verification (and I think that could even be a viable user opt-in down the road) but the identity data that is persisted serves two main purposes: 1. reusability across applications that require a proof scoped to a valid government ID for legal purposes (non-expired, for example) or with a recency requirement (fresh photo matching the ID photo to validate you're the person holding the ID), and 2. as a means for users to self-custody their identity documents for presentation as needed across the web (future KYC ambitions for the project).

by mikeysight

8/21/2026 at 6:44:22 AM

[flagged]

by tomveber

8/19/2026 at 11:24:40 PM

> When identity documents are uploaded, they are encrypted using a master encryption key derived from the user’s passkey during authentication.

ONE still sees identity documents in the clear the first time when it verifies them, right? Otherwise we could upload fakes.

Also I'm not familiar with Oauth 2.0, but doesn't ONE know the client and relying party on each verification transaction? So ONE could theoretically store records of who accessed which website, perhaps by mistaken logging configuration or because they were coerced by law enforcement.

Anyway I appreciate the consideration given to privacy.

by tangotaylor

8/20/2026 at 12:38:52 AM

> ONE still sees identity documents in the clear the first time when it verifies them, right? Otherwise we could upload fakes.

Yes that's correct, the identity documents are validated alongside the selfie before the selfie is discarded and the identity documents are encrypted by the passkey-derived encryption key prior to persistence.

> Also I'm not familiar with Oauth 2.0, but doesn't ONE know the client and relying party on each verification transaction? So ONE could theoretically store records of who accessed which website, perhaps by mistaken logging configuration or because they were coerced by law enforcement.

Yes this is a great callout. ONE does know the client and relying party on each verification transaction and could theoretically store these records (and your point about strict avoidance of logging PII is very important), but implemented properly, identifying the "who" behind a user after initial verification (the coerced by law enforcement example) would require modifying the server or client-side code to capture plaintext during a future passkey-bound decryption. This is also why I have a goal of open sourcing the server side code that processes the plaintext identity payload and running it in an enclave with verifiable attestation.

> Anyway I appreciate the consideration given to privacy.

Thank you! I appreciate the questions.

by mikeysight

8/20/2026 at 11:01:02 AM

[dead]

by tomveber

8/19/2026 at 2:02:45 PM

If you could combine this with the google oath experience somehow like age verification of my google account? I would def use that.

by akshay_akula

8/19/2026 at 2:05:52 PM

check out the demo video! I think you'll like it :) that's the exact user experience (it's built on the same OAuth protocol) but with all underlying data encrypted to your device.

by mikeysight

8/19/2026 at 2:12:19 PM

also google if you're reading this don't even think about it, patent is pending and my uncle is a lawyer

by mikeysight

8/19/2026 at 1:52:06 PM

This project has been kicking around in my head since I first heard about the webauthn PRF extension in early 2024. I've slowly chipped away at it since, and finally got things to a shareable state over the summer thanks to a very fun parental leave. Headed back to work tomorrow, so I figure there's no time like the present.

tldr: A client-held encryption key derived during passkey authentication encrypts all sensitive user data prior to persistence so that only the user is able to decrypt and reuse that data on their device. This allows short-lived, privacy-preserving age proofs to be issued to requesting applications (18+, no PII shared) without requiring users to re-upload their documents. The SSO user experience is built on top of the OAuth 2.0 Authorization Code Flow.

https://loginwithone.com - demo video + high-level architecture + FAQ

I also made the parody demo apps from the video public if anyone wants to play around with the user experience:

https://demo.brainrot.loginwithone.com https://demo.dgnrt.loginwithone.com https://demo.kirby.loginwithone.com

I suspect most will choose to pass on the ID stage for now (no offense taken, doing so is low reward in this context) but if you navigate to https://app.loginwithone.com after onboarding you can demonstrate the passkey-powered encryption on your email via the lock/unlock button.

Very open to feedback and happy to answer any questions! I plan to pull the client-side encryption functionality into an open-source typescript library for general use, so any thoughts or suggestions on what you’d like to see out of that interface would be supremely useful. Thanks all,

Michael

by mikeysight