TechPrufer
Get started
Meta
Meta logoMeta · Feature trail

De-identified Authentication

1 post · Apr 2021 – Mar 2022

What this trail covers

Meta's Anonymous Credential Service (ACS) enables de-identified authentication at the source, enhancing privacy and security for various use cases like de-identified telemetry and federated learning. The service architecture is designed for high availability and multitenancy, with features like token scope isolation and key rotation. Scaling lessons learned include optimizing credential reuse, mitigating traffic spikes through dithering and rate limiting, and streamlining onboarding with self-service.

All Meta trails
  1. How Meta enables de-identified authentication at scaleThis post introduces Meta's Anonymous Credential Service (ACS) which leverages anonymous credentials and VOPRFs to enable de-identified authentication. It details the two-phase authentication process (token issuance and redemption), the underlying protocol involving blind signatures, and real-world use cases such as de-identified telemetry on WhatsApp and federated learning. The architecture is described, including its C++ implementation on Twine, Thrift APIs, and use case-specific key material for isolation. Key scaling challenges and solutions are discussed, including credential reuse limits, traffic spike mitigation via dithering and rate limiting, and improved onboarding processes with self-service portals and SDKs.
  2. DIT — enabling de-identified data collection on WhatsAppThis post details the implementation of De-identified Telemetry (DIT) for WhatsApp, building upon the Anonymous Credential System (ACS). It introduces a two-step logging workflow using Verifiable Oblivious Pseudorandom Functions (VOPRFs) to obtain anonymous tokens before sending telemetry data. Key technical challenges addressed include curve choice (Curve25519 with mitigations for static DH attacks), unlinkability guarantees through pseudonymous identifiers and token rotation, re-identification risk mitigation by removing IP addresses and measuring joinability, rate limiting via key rotation and credential redemption tracking, and communication cost optimization by reusing tokens and co-locating ACS servers. The post also references the Privacy Pass protocol and blind signatures as inspirations.