[zelphirkalt]

Even easier, just get tokens that carry no other information from ones government, and the government runs an API, that for a given token tells whether that token is valid. Can tokens be stolen? Maybe. Can your face be stolen? Today yes.

[spragl]

Hash-chains allows the solution to be token-less. You no longer need those per transaction information leaking API calls. You also avoid dependency on a single provider.

The communication in connection with a transaction would only go between the identity owner (Bob) and the provider (Cycle shop).

[sebstefan]

No API, they sign the tokens with the government's private key and you verify them with the government's public key

If discord needs to contact an API, then the government can associate the token with you, and you with discord, and know what you browse online. No thank you.

[pbmonster]

What's stopping kids from all using the token of that one older brother?

[choo-t]

Same thing as using the ID or photo of the same older brother : Nothing.

[pbmonster]

No, using another ID has a much higher barrier: more likely to get caught (it's the same ID, after all - tokens might (or should) be better anonymized so services don't build user profiles just using the age tokens), more likely to get punished (there's a real name attached to it), more likely to lead to a video verification request to compare ID picture with actual face.

[choo-t]

Discord say they won't keep a copy of the ID, so getting caught for duplicate ID would contradict this narrative.

[zelphirkalt]

I don't see how this is worse than using a TAN list, or using someone's phone to circumvent 2FA.