The data doesn't even get into the platform, so they can't store it and they can't loose it. If an attacker gets access or leaks data it will be just hashes, no actual data

Thank you, I guess you are right. Still, there were some good points here and there that were worth learning. I'm going to give it a try anyway (on my local machinet) and see how it goes...

What do you mean? I am just coding an open source project in my spare time to learn, maybe improve the web with it and ask people about their opinions. If you don't like that you don't need to use it, probably no one will in end.

You only need the phone for the inital registration, but yes I get your point.

Governments already have the data. In a certain way you already trusted them by getting your passport and the platform just checks if its correct. The important part is to verify without sending the data into the internet.

I am not working for anyone why wood I? Everything is for free and open source, I don't even have a lemmy instance so I can't even publish it. I will just share my code and people can do with it whatever they want.

First of all, I am not implementing the security stuff by myself, ZKPassport did this already, its open source everyone can look at the code. Its using a secure hash function, like basically all security relevant apps do, it has been proven years ago.

I just build a bridge between two existing open source tools ZKPassport and Lemmy, everyone can do this, everyone can look at the code I wrote in the end. I am not going to vibecode this and if I would, you would see it.

Everything is open source, you can self host all of that on the server where the lemmy instance runs. The only thing you need externally are the keys from the governments, but in theory you could download them once to your server and never query anything externally after that

Kinda suprised I see someone in favor of it, after reading all the other comments. Thanks for sharing!

EUDI Wallet would be the easiest solution of course. But its quite hard to find out how it really works on low level as its not implemented yet. I don't think this will ever be open sourced. In the end its maybe just one company that has all the authentication servers and self hosting one requires approval and is very costly so no one does it, just like they did it in Germany.

Ok got it, thanks for your input!

The point is to verfiy someone does not already have an account and is not a bot. Your smartphone is checking the ID locally. Governments provide public lists of keys that match keys on the passports of their citizens, so you can download the public lists locally and check them on your device outside of any social media platform etc. Your smartphone just sends something like "this user is verified" to the server

When mods ban a user because they just run a bot on it, they can never post on the server again as long as the ban is active, because they can't login into the account anymore and need a new identity to create a new account.

Which brings us to your second point: you need a valid identity (to be precise a valid passport with nfc chip which contains a private key only your country knows), which is possible to get but a lot of effort to just create a account which probably gets banned after a few days again.

I don't suggest to implement this into every server and platform like the EU wants. But I think it would be nice to have some servers or a platform where you can be sure, that you are not just beeing manipulated by bots and trolls