So I've had this idea bouncing around in my head for a while. The annoyance of handing over my biometric data to any app that requires age verification has me worried about internet privacy, and while making my online browser social game (https://counterphase.space) I wondered what system I could build to facilitate age verification without relying on some dodgy company.
The idea is that the user owns their data and identity. You make a profile, and gradually add more and more documents to it, which the ephemeral OCR system parses, verifies, and deletes, retaining only some light metadata. The user then has a code, or selection of codes, which they can distribute and companies or anyone with an account can ping against to get essentially boolean values as a return to their question in the form of an endpoint.
Let's run through an example. Say I'm applying for a job, the employer will want to verify my documents, so maybe they ask me for a code to ping against my data, they then can ask the system 'is this the right passport number for this individual?' and the system will reply 'yes', 'no', or 'unknown'. It reveals nothing that the employer didn't already know, and even then required a personal code to access it at all. In this scenario, I could also tailor what data I want to let be accessed using this specific code, so if I wanted them to be able to verify my passport that's fine, but I might restrict access to answers about potential unspent convictions, or anything data that I might have associated with my profile. I could then also roll the code over and withdraw any further access by anyone using that code.
There's a lot to iron out here, and this is a growing space with a lot of solved issues in it already but from what I've seen, it's almost always at the service of the company, not the user. The question is always 'what information might a company need' as opposed to 'what data does the user want to share'. This is the driving force behind this project, data sovereignty. It's not a new concept to me, I worked very hard wiring together a WireGuard tunnel system for InSite to respect this exact sentiment. I am a staunch believer in the ownership of private data and will fight tooth and nail to build architecture that supports that.
Logistical issues of course arise, like how do I actually verify an identity? You need to be licenced by the government to ping against the Passport Office or the DVLA, and that's just for the UK. Let alone the fact that I would need to build comprehensive and reliable authentication tools, including fraud protection. Frankly I'm just not equipped to handle that alone, let alone go up against established companies with decades of data and lessons learned to draw from.
The solution, ironically, is to essentially outsource the actual verification process. There are plenty of reputable companies that do it, and many of them are relatively inexpensive, but none are free (at least beyond a certain scale) so the next question is how do you monetise this?
Rolling with the attitude that this is the burden of the company, then it makes the most sense to charge the company per request, maybe utilising a token system to simplify the purchase flow. I would need to then account for the cost of the outsourced verification and charge accordingly. It's a risky setup because data sovereignty is not something companies (particularly in tech) are very fond of, so their hand would have to be forced by the whim of the user en masse, which brings us to the most difficult problem.
How do you reach critical mass? It's a chicken and egg situation. Why would a company adopt this if no ones got an account? And why would users make accounts if companies aren't using it? The best solution I've found, without cultivating relationships with other companies, is to actually use it in my own game. Then at least I have a shipped version of the product to prove the concept, even if it never scales. I suppose the motivation behind this isn't to build a profitable business, rather to make a clear example of the fact that we don't have to sell ourselves to gain access to the internet. We can prove our place without putting ourselves on display.
If this kind of thing interests you, go and read The Age of Surveillance Capitalism by Shoshana Zuboff, holy crap, what a book.
Anyway, my thinking at the moment is to steer into the indie game market and create a simple SDK that indie devs can then plug into their systems. I like catering to the underserved, and things like this are made way too difficult for indie game devs and bite them hard on the arse when they find themselves in an Ofcom breach.
I'm gonna keep brainstorming, but I have more ideas about what could be lumped into this. If I'm treating it as a central source of truth for digital identity, then adding in a reliable method of proving ownership of emails (for example) could be really helpful. Maybe adding my own authenticator code systems? Even a password manager (though that's sort of its own can of worms). There's a lot to play with here but at its core, a simple API with zero trust default, serving the user instead of the company, maintaining ownership over your data. That's something I wish existed already, and seeing as it doesn't, I guess I had better make it myself!