this post was submitted on 09 Feb 2026
279 points (98.9% liked)
Privacy
45978 readers
1274 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
founded 6 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Of course, a government has many ways they can legislate your rights, freedom and privacy away. But if you want to do this in a way that preserves privacy, this is how you do it.
Of course the government knows who you are; they have to. They issue your ID, and that makes them the only organisation that can issue your eID. But a government that serves its people would provide this an a service, with the proxy, to ensure privacy is respected.
And of course with a warrant they can and should be able to demand access to the proxy's or the website's logs. But only with a warrant. That is the bar that the government should always have to clear before they can get access to any citizen's privacy.
I agree that a government that wants privacy can actually do it in a way that ensures privacy. That's also what I was saying.
My point was that this is up to the government, and no amount of "route the request through a proxy" would patch that up, that's not gonna help this case. If the government wants to protect privacy, they can do it without you needing to use proxies, and if the government wants to see what sites you visit using these certificates, they can do it even if you were to use proxies, because this is not something that's tracked in the networking layer, it's in the application layer.
If the proxy is independent, I don't see how the government can know what the requesting site is. They can only see the proxy. I don't mean a standard network proxy of course, but a proxy for the entire request. That's probably the source of our misunderstanding.
They don't need to know the requesting address in order for them to know if it was you the person corresponding to that proof of age, because the information is in the data being exchanged. These kind of verifications don't depend or rely on IP address or networking, these are credentials that are checked on the application layer.
In fact, they don't even need to directly communicate with the government for this.
This is equivalent to a registration office for a service asking you provide a paper stamped by the government that certifies your age without the paper actually saying who you are.. the service does not need to contact the government if they can trust the stamp in the paper and the government official signature (which in this case is mathematical proof). And even though the service office can't see your name in the paper, the government knows that the number written in the paper links to you individually, because they can keep record of which particular paper number was issued to which individual, even if your name wasn't written in the document itself.
So, the government can, at any given time, go to those offices, ask them to hand in the paper corresponding to a particular registration and check the number to see who it belongs to.
The traceability is in the document, not in the manner in which you send it. It does not matter if you send the document to a different country for someone else to send it from a different address, on your behalf (ie. a proxy). If the government can internally cross-reference the registration papers as being the ones linked to your governmental ID, they can know it's yours regardless of how it reached the offices. So this way they can check if you registered yourself in any particular site they wanna target and what your account is.
Obviously the government knows it's you. That's the whole purpose. But they don't know the site that's requesting this, if the proxy hides that from them.
They might not know the list of sites you visit right away in the same way they could by contacting your ISP when you are not using a proxy, but that wasn't my point.
My point is that they can check with a specific site that uses this verification method and see if you have an account on that site, and if you do, which account in particular. And in a way that is much more directly linked to you personally than an IP address (which might be linked to the household/internet access you're using but that isn't necessarily under your name).
So in this situation they can indeed know if you use any one particular site that they choose to target, as long as that site is requiring you to provide them with a document, regardless of how many layers of proxies you (or the site) choose to be under.
I'm not sure what you mean by "the site that’s requesting this", the site does not need to request anything from the government, they just need to have previously agreed on a "secret" mathematical verification method that works for every document. The digital equivalent of a stamp/signature.
But getting that information from the USP or the site would require a warrant. Not to mention that the site doesn't have to know your real identity either.
And the whole point of this exercise is to ensure that you don't have to provide any document to the site.
What I mean by the site that's requesting this, is exactly that: you need to prove to a site that you're above a certain age. For that, the site redirects you to the proxy that redirects you to the eID site, with a request to confirm that you're above a certain age.
The site has fulfilled its legal obligation to check your age, but doesn't have to know your identity, and the government doesn't have to know what site you're visiting.
I feel like you're misunderstanding the scenario we're discussing.
I feel you are talking about a different thing now. My point was surrounding what you initially said:
An eID is a digital document. You yourself are proposing that sites should request people to provide a document, one that's issued by the government to you, personally. Then later you said that using a proxy prevents the government to know what you visit.
My answer was that if you are providing a government-issued document/file to the service then the government (the issuer) can know if you visit the site just by keeping track of who did they issue each document for and requesting the sites for copies of the documents. Even if the document itself does not say your name. And that's regardless of how many proxy layers you use, since there's traceability in the document. This makes you fundamentally less anonymous to the government than before (when you could have indeed used a proxy to prevent this), this makes proxies no longer a good defense.
The service does not know you, but that's not the point, what you said is that the government can't know if you visit the site, which is the one thing I disagreed with.
I'm still talking about the same thing, but I understand the nature of our misunderstanding now. You see eID as something you download and can share (but what kind of security would that provide?). I mean an online ID service, similar to the Dutch DigiD. I assume the EU eID is also something similar, although I have no personal experience with that.
The first paragraph on Wikipedia contains a good description of what I'm talking about: https://en.wikipedia.org/wiki/Electronic_identification
The online authentication is the important part. The article also talks about physical cards with a chip, but I honestly don't quite understand how that's different from a regular chip in a passport.
When I have to access any government service, I get redirected to digID to log in, then redirected to the site I want to visit. This is very similar to other online authorisation schemes, except it's tied to me official legal identity.
My proposal is to use this not just to log in to government sites, but to use it to provide any legally required online identification, tailored to the highest amount of privacy possible in that situation. So if a site needs to confirm you're 18+, let that site ask the eID service for just your age, or even just whether you're 18+ or not, log into the eID system, and the eID system sends confirmation of your age back to the site.