More and more services ask for a full ID scan or a selfie just to confirm you're over 18. The question needs one bit. The scan hands over your name, photo, date of birth and document number, and it ends up stored by the site or a vendor.
And it leaks. Last October, Discord confirmed that about 70,000 government ID photos, uploaded for age checks, were exposed through a support vendor. There's a better credential already in your pocket: the chip in your passport or ID card, signed by your government.
zkagent uses it:
→ your phone reads the chip and checks the government's signature
→ the site asks one question: "over 18?"
→ it gets yes or no, nothing else
→ no upload, no photo, no copy of your document anywhere
It can also answer "one person, one account" per site without saying who you are. And for government services, KYC and similar checks, it answers yes/no questions about the document ("valid for 6 more months?", "does the name match?") without the site ever seeing it.
It works today on Android, open source under Apache-2.0. Take it, change it, run your own. You don't have to start from scratch.
Honest limits: tested on one phone and two documents so far, and it's minimal disclosure, not zero-knowledge.
https://github.com/hamr0/zk...