5 ms·

Really strange to me that given its obviously possible to securely verify someone’s age without requiring personally identifiable information at the endpoint re

Really strange to me that given its obviously possible to securely verify someone’s age without requiring personally identifiable information at the endpoint requiring verification (or for the system verifying attributes to know the endpoint requesting verification) that anyone would even want that information flowing through their systems — unless they wanted the information for other reasons. To me, unless the prior technological features I just mentioned are baked into the law, this feels like it’s either intentional or laws are being crafted by people that have no clue what they’re doing. More generally speaking, governments should start seeing the hoarding of data by itself and others as a national security threat, open source any government systems — and offer bounties for anyone able to maintain the objectives of a system while reducing the system’s access to sensitive data. ______________ * EDIT: 100% sure that it’s technically possible to have an endpoint anonymously verify age and a verification system to do so without knowing the endpoint requesting the verification, but unable to find technical explanation of how this might be done using existing technology; might be wrong, but believe it included a combination of differential privacy and zero knowledge proofs. Does anyone have a link to detailed explanation of how to implement such a system?

readams 4y ago
It's the last one. It's just very poorly drafted legislation that hasn't been thought through. this is our one party rule in action. With no meaningful opposition, laws are not scrutinized and unintended consequences never considered.
- jeffbee 4y ago
  There are 29 members of the state legislature who are not in the "one party" and exactly zero people voted against this bill at any stage. It passed 72-0 in one chamber and 33-0 in the other.
  - wrayjustin 4y ago
    Arguably, "one party" in this sense could mean "rulers."
    - jeffbee 4y ago
      It could mean that, if you're juvenile or just stupid. It's a democratically-elected, bicameral, proportionally representative legislature with an independent executive elected in a non-partisan race.
- tick_tock_tick 4y ago
  Just look at AB5 for a perfect example.
- loeg 4y ago
  It’s poorly thought out legislation, but it’s not like the GOP is known for writing good law.
sandworm101 4y ago
Simple questions: CD or vinyl? That will identify everyone old enough to remember. Then the classic: how do you tame a horse in minecraft, which identifies everyone under 18.
- O__________O 4y ago
  Understand the trick, but think we all know people are clever, especially when they’re motivated, and bypassing systems like that would likely be trivial and even potentially result in the endpoints requiring age verification helping bypass them covertly.
  - sandworm101 4y ago
    The goal isnt to actually block children. They goal is to satisfy the corporations legal obligations: whatever scheme requires the least effort, the least information from the applicant, but still meets the minimum standard. Better idea: webcam verification of government ID. Client-side/in-browser AI software matches only name and birthday before passing OK to website. Zero information is actually transmited/stored. Patent please.
    - asdfasgasdgasdg 4y ago
      What is to stop someone from modifying chromium to always report "yes" in that case? Or is the idea that we will add another widevine style opaque binary blob to our system that handles this with an encrypted response that can't be examined by the user?
      - O__________O 4y ago
        Nothing would stop someone from hacking the system if everything was client-side.
    - O__________O 4y ago
      Not following, how would the system know the document was authentic without transmitting data; understand that client-side it would be easy to cross-reference the ID-face and Live-face and scan the barcode to extract any data attributes, such as age. Also, worth noting that assuming the individual had a smart phone, scanning document would likely provide no additional security and there numerous apps that provide real-time end user verification using biometrics.
erwinmatijsen 4y ago
IRMA [1] comes to mind. From their site: With IRMA it is easy to log in and make yourself known, by disclosing only relevant attributes of yourself. For instance, in order to watch a certain movie online, you prove that you are older than 16, and nothing else. Their docs[2] are pretty good. [1] https://irma.app/?lang=en https://irma.app/?lang=en [2] https://irma.app/docs/what-is-irma/ https://irma.app/docs/what-is-irma/
- O__________O 4y ago
  Thanks, agree system provides privacy protecting attribute verification (age, legal-voter, citizen, income, etc) — but after quickly reviewing it, does not appear to support anonymously doing so in a way that only the user knows their identity and the endpoint identity — but neither the endpoint or government know both, even if they or an attacker have access to the security tokens from the endpoint and governments servers. Did I miss something? Another user suggested Privacy Pass system, which I have reviewed before and currently reviewing to see if it fits system profile I am describing: https://news.ycombinator.com/item?id=33133758 https://news.ycombinator.com/item?id=33133758
- akira2501 4y ago
  You just have to be comfortable with a single application on your phone holding all your details for you, it having implemented the protocol perfectly, and having amazing protections around the handling of the third-party request phases. And this is all to improve the privacy of children?

readams 4y ago

It's the last one. It's just very poorly drafted legislation that hasn't been thought through. this is our one party rule in action. With no meaningful opposition, laws are not scrutinized and unintended consequences never considered.

jeffbee 4y ago
There are 29 members of the state legislature who are not in the "one party" and exactly zero people voted against this bill at any stage. It passed 72-0 in one chamber and 33-0 in the other.
- wrayjustin 4y ago
  Arguably, "one party" in this sense could mean "rulers."
  - jeffbee 4y ago
    It could mean that, if you're juvenile or just stupid. It's a democratically-elected, bicameral, proportionally representative legislature with an independent executive elected in a non-partisan race.
tick_tock_tick 4y ago
Just look at AB5 for a perfect example.
loeg 4y ago
It’s poorly thought out legislation, but it’s not like the GOP is known for writing good law.

sandworm101 4y ago

Simple questions: CD or vinyl? That will identify everyone old enough to remember. Then the classic: how do you tame a horse in minecraft, which identifies everyone under 18.

O__________O 4y ago
Understand the trick, but think we all know people are clever, especially when they’re motivated, and bypassing systems like that would likely be trivial and even potentially result in the endpoints requiring age verification helping bypass them covertly.
- sandworm101 4y ago
  The goal isnt to actually block children. They goal is to satisfy the corporations legal obligations: whatever scheme requires the least effort, the least information from the applicant, but still meets the minimum standard. Better idea: webcam verification of government ID. Client-side/in-browser AI software matches only name and birthday before passing OK to website. Zero information is actually transmited/stored. Patent please.
  - asdfasgasdgasdg 4y ago
    What is to stop someone from modifying chromium to always report "yes" in that case? Or is the idea that we will add another widevine style opaque binary blob to our system that handles this with an encrypted response that can't be examined by the user?
    - O__________O 4y ago
      Nothing would stop someone from hacking the system if everything was client-side.
  - O__________O 4y ago
    Not following, how would the system know the document was authentic without transmitting data; understand that client-side it would be easy to cross-reference the ID-face and Live-face and scan the barcode to extract any data attributes, such as age. Also, worth noting that assuming the individual had a smart phone, scanning document would likely provide no additional security and there numerous apps that provide real-time end user verification using biometrics.

erwinmatijsen 4y ago

IRMA [1] comes to mind. From their site: With IRMA it is easy to log in and make yourself known, by disclosing only relevant attributes of yourself. For instance, in order to watch a certain movie online, you prove that you are older than 16, and nothing else. Their docs[2] are pretty good. [1] https://irma.app/?lang=en https://irma.app/?lang=en [2] https://irma.app/docs/what-is-irma/ https://irma.app/docs/what-is-irma/

O__________O 4y ago
Thanks, agree system provides privacy protecting attribute verification (age, legal-voter, citizen, income, etc) — but after quickly reviewing it, does not appear to support anonymously doing so in a way that only the user knows their identity and the endpoint identity — but neither the endpoint or government know both, even if they or an attacker have access to the security tokens from the endpoint and governments servers. Did I miss something? Another user suggested Privacy Pass system, which I have reviewed before and currently reviewing to see if it fits system profile I am describing: https://news.ycombinator.com/item?id=33133758 https://news.ycombinator.com/item?id=33133758
akira2501 4y ago
You just have to be comfortable with a single application on your phone holding all your details for you, it having implemented the protocol perfectly, and having amazing protections around the handling of the third-party request phases. And this is all to improve the privacy of children?