Not at all, this is well established technology already in use all over the place.
When countries use digital IDs, they are able to carve out validating individual aspects of an identity. Just address, just over 18, just class of driver’s license, etc.
So the State has a website/wallet where the user pulls a token from the State, basically a fancy hashed OTP/Login code.
The website, which can’t derive your identity from the code, sends the code to the state API and can’t ask more than “is this hash legit” and the State API doesnt need to say more than “yup.”
Where can things go wrong? The State can ask to know who needs the token. Or even demand to know, and log what sites use it. The state can contract this out to a vendor that logs it all, making data theft far more risky.
It all depends on his the state builds requirements.
Not at all, this is well established technology already in use all over the place.
When countries use digital IDs, they are able to carve out validating individual aspects of an identity. Just address, just over 18, just class of driver’s license, etc.
So the State has a website/wallet where the user pulls a token from the State, basically a fancy hashed OTP/Login code.
The website, which can’t derive your identity from the code, sends the code to the state API and can’t ask more than “is this hash legit” and the State API doesnt need to say more than “yup.”
Where can things go wrong? The State can ask to know who needs the token. Or even demand to know, and log what sites use it. The state can contract this out to a vendor that logs it all, making data theft far more risky.
It all depends on his the state builds requirements.