Prove me it's a zero knowledge protocol or I'll pay full price

Remember the man whose Apple account was compromised and deleted by people who only knew the last 4 digits of one his credit cards? Or how a fake crying baby and knowledge of your phone number allows somebody to take control of your phone account? It takes a sliver of data to screw you over.

This is no news, so we should always have been careful. In the past, decent digital hygien was enough, because people had to target you. And you knew that if you were a target, you'd better pray, or have already achieved Snowden's digital literacy. These days, automated tools means you don't have to be a target. Everybody is a target. Anybody that can be hacked will be hacked for the sake of whatever. And the hacking possibilities are much scarier: your Facebook pictures are your next deepfake. So I restrict my digital perimeter to the bare minimum, and leave no data in places out of my control. But obviously I use the internet, so I poo data at every second. Also, places out of my control are ... out of my control, so it's not like I can request services not to track me (well, my browser does kindly ask, but 💩). So now I regularly rotate passwords, and yada yada. But please don't even try – I know I can be hacked. I'm just trying to reduce the blast radius.

All this comes however at a time when the tech fever has reached forms conocted to explicitly make me into a target. Ryanair only provides boarding passes on their app. Which means I am expected a) to have a smartphone, b) to have their crappy app, so that they can track the fluctuations of my erections. And we know how capitalism works: you don't fly Ryanair. Ops, sorry: if you can afford it, you don't fly Ryanair. The Royal Swedish Academy of Engineering enforced 2FA on all student accounts, banning all forms of MFA except Microsoft Authenticator, a choice they've been unable to motivate further than for "consistency and institutional reasons".

We've all become aware that if "if you're not paying, you're the product" a long time ago. Which matters nothing because people keep giving themselves away to collect all sorts of memberships that will eventually treat them with one free coffee after they've paid or 53 sandwiches and revealed their partner's shoe size. But it used to be that if you were entitled to some discount by your condition of existence, you wouldn't have to give anything away. This is not the case anymore. To claim your discount, you have to provide papers with your lineage dating back to the middle age and possibly a selfie with Jesus (which you can now flush a gallon of water to generate). You have to assume that anything that is stored somewhere will get exposed at some point, so nothing you wouldn't make public yourself should ever end up anywhere at all.

Lunch at a prominent Swedish university used to be discounted for students: I'd show my student card, and the underage assistent would change the rate at checkout. But because Humans need not apply and god forbid there's one step that requires manual intervention, the flow has changed.

"Scan the QR code to associate your student card with your credit card."

In Utopia, this would be fantastic. We'd all be riding horses while nobody has to take care of the petty job of throwing an eye at my unsexy student card. And technically, it's very simple: you can safely automate the verification of my student status. Take a salted hash of the card information, verify their student status, and throw the card hash into a stored set. When somebody pays, verify whether the hash of their card is in the stored set. Only hashes are stored, all computations are local, and identities are unrecoverable from the stored information.

But because 11 out of 10 people out there are clowns, I don't trust that their implementation is anything less than clownish. A merchant's POS gets all my card's information except the CVV, so I can guarantee there's at least one merchant that stores that information (and if one exists, so do many), 80% of which will store them in full. What can you do with that information? I don't know, but I'm sure somebody's going to figure out. Oh wait, somebody already did, in 2012.

"How would I decouple my card from my student status if I wanted to in the future?"
"You log in into your account."
"What account?"
"The restaurant's account."

So yeah, it's turtles clowns all the way down. What the clowns are suggesting is that in order to benefit for a 15% discount, I consent to them storing a record of my payment information, student status, email address, and probably full name and social security number too. If I'm lucky, an auto-generated plaintext password might follow.

"Thank you, I'll pay full price."