2 ms·

Such a system could (and perhaps should) be generalized to all boolean expressions involving personal details of users. A website should be able to specify a l

Such a system could (and perhaps should) be generalized to all boolean expressions involving personal details of users. A website should be able to specify a list of access conditions, such as (is not from Iran, Syria, North Korea or Cuba) and ((comes from the US and is over 21) or (does not come from the US and is over 18)). Instead of requiring the user to give them enough personal data to verify those assertions, it could just ask their certificate authority and receive a true/false answer, without receiving a reason why this answer is true or false. Such a system could also provide seamless CAPTCHAs and abuse prevention mechanisms. Let's say every website would receive a random (but cryptographically signed) string on each visit. The CA would log what user received what string. As long as the user behaved properly, they wouldn't be identifiable to the website owner. However, a court could force the CA to hand over the information of an abusive user for whom a certain string was generated. Website owners could also ask the CA to never let a user with a given string onto their website again, still without knowing a single thing about that user.

formerly_proven 5y ago
This exists, it's called attribute-based credentials. Is this a good idea? Only if you trust the inspector(s). Do you? Probably not.
pimterry 5y ago
> Instead of requiring the user to give them enough personal data to verify those assertions, it could just ask their certificate authority and receive a true/false answer, without receiving a reason why this answer is true or false. This doesn't preserve privacy though: now your verification authority necessarily hears about every website you visit that wants verification, and can trace your every move. They could absolutely issue you with a wide selection of certificates you could use to independently verify yourself though, preserving privacy all round. A certificate for "comes from the US", a certificate for "is over 21". Come up with a big list of criteria, issue a true or false certificate for each, and then you can provide the combination required to satisfy whatever a website needs to confirm from you. You need an expiry for some though. "You're over 18" is permanently true. "You're under 18" is clearly not, but it's easy enough to set an expiry date. Meanwhile "You're an American citizen" isn't necessarily permanent, but becomes invalid unpredictably. You could publish revocations or just require occasional revalidation though.

formerly_proven 5y ago

This exists, it's called attribute-based credentials. Is this a good idea? Only if you trust the inspector(s). Do you? Probably not.

pimterry 5y ago

> Instead of requiring the user to give them enough personal data to verify those assertions, it could just ask their certificate authority and receive a true/false answer, without receiving a reason why this answer is true or false. This doesn't preserve privacy though: now your verification authority necessarily hears about every website you visit that wants verification, and can trace your every move. They could absolutely issue you with a wide selection of certificates you could use to independently verify yourself though, preserving privacy all round. A certificate for "comes from the US", a certificate for "is over 21". Come up with a big list of criteria, issue a true or false certificate for each, and then you can provide the combination required to satisfy whatever a website needs to confirm from you. You need an expiry for some though. "You're over 18" is permanently true. "You're under 18" is clearly not, but it's easy enough to set an expiry date. Meanwhile "You're an American citizen" isn't necessarily permanent, but becomes invalid unpredictably. You could publish revocations or just require occasional revalidation though.