How Meta enables de-identified authentication at scale
Mar 30, 2022Shiv Kushwah, Haozhi Xiong
Summary
Introduced Anonymous Credential Service (ACS) as a new privacy-enhancing technology (PET) to enable de-identified authentication at source, moving from reactive data minimization to proactive de-identification. Detailed the protocol leveraging anonymous credentials, VOPRFs, and blind signatures, involving token issuance and de-identified authentication phases. Highlighted real-world use cases in WhatsApp telemetry and federated learning, and discussed the ACS architecture, scaling lessons learned (credential reuse limits, traffic dithering, global rate limiting), and self-service onboarding improvements.
More from the Application Security and Permissions trail
- How We’re Building Scam Alert on WhatsApp With End-to-End Encryption and Verifiability Guarantees
- Privacy-Aware Infrastructure in the AI-Native Era: An Asset Classification Case Study
- Labyrinth 1.1: Making End-to-End Encrypted Backups Even More Reliable
- How Meta Is Strengthening End-to-End Encrypted Backups
- Post-Quantum Cryptography Migration at Meta: Framework, Lessons, and Takeaways