3 ms·
>Others are outright creepy. You can't access medecine without verifying your ID? That locks lots of people out of access to healthcare (illegals, tourists, etc
by M2Ys4U 4y ago
>Others are outright creepy. You can't access medecine without verifying your ID? That locks lots of people out of access to healthcare (illegals, tourists, etc).
Does it not make sense that prescription medication can only be picked up by somebody who has been prescribed that medication (or somebody who has been delegated that authority by the prescribee)? As long as there's an offline mechanism available for verification I don't see the problem here.
>Age verification? So porn websites will store the real id of all their visitors (or alternatively a central EU age verification system will be notified every time you visit such a website)?
Presenting a token verifying that one is over 18 is not the same thing as presenting one's entire identity so that the service can verify one is over 18.
The way it could work is this: You try and access an age-restricted service (ARS). It returns a request for age verification including a unique ID. You then pass a hash of that request to the age verification service (AVS), and get back a token which is signed by the AVS. That token is then presented to the ARS, which validates that the signature and that the hash of their request are valid.
Boom, you have just verified that you are over 18 without leaking your identity to the ARS and without leaking the ARS's identity to the AVS.
- cm2187 4y agoAll you have done is to move the juicy log file to the AVS, haven't you?
- M2Ys4U 4y agoAll the AVS knows is that you're asking for an age verification token for something, but it doesn't know what the token will be used for as that information was collapsed in to a hash by you. I'm sure there could be some sort of more elaborate protocol that would preserve privacy in the case of a log breach, the one I sketched out just shows that (assuming logs remain private and there's no collusion) that the ARS doesn't need to know the user's identity and the AVS doesn't need to know the ARS's identity in order to validate the user's age.