5 ms·

>> strong age-verification expectations [...] can only come at the expense of anonymous browsing No, this is not true, there are numerous ways for a system to

>> strong age-verification expectations [...] can only come at the expense of anonymous browsing No, this is not true, there are numerous ways for a system to authenticate a user without the endpoint requesting the authentication knowing who the user is — or the system verifying the user knowing what endpoint system is requesting the authentication; only the user knows both who they are and the endpoint they want access to.

LegionMammal978 4y ago
How could the user verify that the endpoint never learns anything about the user's identity, and that the system never learns anything about the requesting endpoint? In situations where privacy is particularly sensitive, either or both could have a motive to learn more about the user.
- O__________O 4y ago
  I have seen it explained before, believe it was done using a combination of combination of differential privacy and zero knowledge proofs, but might wrong. Currently trying to find a detailed explanation of how to implement such a system using existing technology. In mean time, if anyone else is aware of such a system, please post a link. EDIT: This appears to cover some aspects, still reviewing it and to confirm it covers all the system attributes I described: https://crypto.stackexchange.com/questions/96232/zkp-prove-that-18-while-hiding-age https://crypto.stackexchange.com/questions/96232/zkp-prove-t...
  - LegionMammal978 4y ago
    Hmm, I don't think that protocol as described would be sufficient for the government. What would prevent Alice (age 18) from sharing her signed age statement with her friend Charlie (age 17), who passes it to Bob to falsify his age? The government would not want underage users to collude with 18+ users to gain access to age-gated endpoints.
    - O__________O 4y ago
      Agree, still trying to find full explanation, seen it described before. Aside from sharing the token, other issue is if the endpoint cached the token, it’s unique and could be cross-referenced to deanonymize the user if 3rd-party or government gained access to list of tokens an endpoint collected. Obviously looking for example, but if you’re able to think of an additional issues that need to be accounted for, let me know.
      - LegionMammal978 4y ago
        Yep, that's another thing I was thinking of: if Alice uses the same token all the time for every endpoint, then the endpoints could trivially use that as a unique identifier to track Alice. Perhaps the government could create a service for Alice to create new age tokens whenever she wants. Even then, if the government actively compelling endpoints to hand over their data is within the threat model, the government could inspect any cached temporary tokens to deanonymize the users. This could perhaps be mitigated with some way for users to irreversibly transform the temporary tokens given by the government, but I'm not sure if that's possible while retaining the ability for endpoints to verify the tokens. Overall, though, the sharing problem seems to me to be the biggest issue by far with this scheme. What makes a user an individual human? In current implementations, their unique government ID (perhaps made illegal to falsify) is used for this. But I can't see how individual humans can be distinguished in a privacy-preserving way.
        O__________O 4y ago
        My memory was that the tokens enter a pool of tokens and that neither government or endpoint is able to trace which user used which token and they’re one-time use tokens, so users are unable to share them. Never really gave system much thought at the time, since governments rarely want less data or to provide anonymous access — and average person does not care about anonymous access, in fact, in my experience they want everything logged. Same topic could easily be applied to numerous functions such as border crossings, but governments want to track who is crossing instead of just checking individual authorization to enter.
- rkagerer 4y ago
  No matter how you design this, at some point it involves trusting a third party who views your ID doesn't leak PII to other parties. This problem doesn't exist with today's simple prompts that just ask for your birthday and blindly trust the end user.
  - LegionMammal978 4y ago
    Indeed. It seems like most proposals delegate this role to the government, since they already have your basic ID anyway. The question is, how can the website operators interact with the government in such a way that the websites don't learn which government ID you have, and the government doesn't learn which websites you're visiting? Surprisingly (to me at least), certain cryptographic tricks can do a pretty big chunk of that, by having the website/government and user/government interactions occur ahead of time. But as far as I can see, there's still the issue with these tricks that 18+ people could share their access with under-18 people, which the government would want to prevent.
    - O__________O 4y ago
      I actually do have an economic technical solution to the issue of remote authentication of user’s physical presence using zero-trust systems that makes sharing a one-time token impossible, but currently not motivated to share it, since it’s possible I might want to use it myself formally; super simple, very possible someone else has already used it before. Realize you have to take my word for it, but to me, that’s non-issue. Also, does appear Privacy Pass covers the other aspects, which is covered on this page, but still trying to work through if it covers all aspects of a system that at least for myself I would be agreeable to use for things like: age verification, citizenship, captchas, etc — basically anonymous verification of identity attributes.
      - LegionMammal978 4y ago
        Huh, I read up on Privacy Pass, and it really does seem to have the properties I'm looking for. Taking the government as the issuer/attester, it seems like the endpoint (origin) gives a challenge to the user (client), the user requests a token from the government (which, critically, the government can verify without knowing the user's ID), and uses this token to respond to the endpoint's challenge. Thus, the government might learn that some user accessed that particular endpoint (depending on the exact setup used), but cannot learn who it was. And since it does not know the user's identity, it cannot censor a particular user, only potentially a particular endpoint. I also don't really see how present physical identity could be proven in a privacy-preserving manner, if you don't trust the government or endpoints not to abuse that physical data. Alas, even if I take your word for it, I doubt that governments would implement such an indirect system for age verification in practice, especially since they might want to revoke any erroneously-issued tokens. (And even if anonymous non-circumventable age gating were to become a reality, I still wouldn't be a fan of differential privacy regulations for minors, since many ordinary sites would become inaccessible to teenagers from following the path of least resistance. Either impose the regulations on all users, impose them gradually depending on age, or don't impose them at all.)
Stupulous 4y ago
Have there been instances of governments providing cryptographic identification services yet? That seems like a hugely beneficial thing they could do in this space (with the side benefit of social websites that aren't overrun with children). The only part that would be challenging is preventing the government authentication servers from knowing which websites you're visiting.
- O__________O 4y ago
  Trying to post everything in same spot, see this comment for more information: https://news.ycombinator.com/item?id=33133010 https://news.ycombinator.com/item?id=33133010
- teaearlgraycold 4y ago
  Google and Apple are both implementing an ISO that will allow for you to prove you are over 21, 18, etc. It’s just a super verified boolean. The tech can also provide much more, but you can think of it like OAuth scopes. The user is shown what will be shared from a set of discrete properties.
  - greggman3 4y ago
    There is no way those properties won't include PII 99.999% of the time. Your option will be to identify yourself or not access the site
    - btown 4y ago
      The option in "Sign In With Apple ID" to provide a randomized email address that proxies to your own, alongside the boolean, would do a lot to mitigate this. Of course, Apple can associate you with your usage of the site (and it's worth keeping a close eye if they start to pivot more towards advertising as a revenue stream), but the site itself would be unable to.
    - teaearlgraycold 4y ago
      That is a yet to be solved problem. But people are working to make sure that doesn't happen.
mindslight 4y ago
In an ideal world, yes. Blind signatures and all that. But that isn't how collection-maximizing surveillance companies work. Right now, the lowest friction is to ask for birthdays where they can get away with it, but never really verify. If the law gives them a reason to verify, then the incentive is to expand their plaintext-based all-knowing systems to perform verification. Sure, we'd likely see a startup that promises to do privacy-respecting age verification, but it would go nowhere. What incentive would there be for Google et al to adopt it, as opposed to say just requesting your driving license number with a message implying that California "made" them to do this ? The companies without the cloud to demand personal info would then outsource the verification to the bigger surveillance companies.
- mistrial9 4y ago
  unfortunately, there are Thiel-like support services in the wings actively building business bridges at every step. Some elements in society really do try to get paid to surveil others, and that will continue. I predict only hard-won litigation, meaningful laws with enforcement, and public discussion like this, will slow the slide on the slippery slope.
  - mindslight 4y ago
    "Some" ? The entire market cap of modern Silicon Valley is based upon monetizing surveillance. This topic demonstrates one of the main pathologies of the US model of governance. Instead of pushing constructive actionable privacy restrictions for everyone, the government is poised to create another hook that merely emboldens corporate control. What we need is a US GDPR with an analogous definition of consent - if implementing functionality to examine and delete my data is too hard, then just don't store surveillance records about me in the first place! But what we'll end up getting is ineffectual nonsense to be nullified with more clickwrap legalese that nobody reads.
    - mistrial9 4y ago
      > The entire market cap of modern Silicon Valley is based upon monetizing surveillance. no, its not.. but a bulk of FB/Google dollars that are, dwarfs a lot of other things.. its a sick situation, I can agree with that.. important to speak out
soulofmischief 4y ago
You have to ask yourself if we should be building these kinds of censorship tools to begin with. If I wasn't allowed to use the internet the way I did as a kid, I wouldn't be here today.
- mixmastamyk 4y ago
  I first used the internet in my mid-twenties and am here today.
  - soulofmischief 4y ago
    I'm not sure how this is related. What does your experience have to do with another's?
cm2187 4y ago
That would require some privacy focused gvt infrastructure. The reality is that pretty much all gvt these days are all in on privacy invasion and monitoring.

LegionMammal978 4y ago

How could the user verify that the endpoint never learns anything about the user's identity, and that the system never learns anything about the requesting endpoint? In situations where privacy is particularly sensitive, either or both could have a motive to learn more about the user.

O__________O 4y ago
I have seen it explained before, believe it was done using a combination of combination of differential privacy and zero knowledge proofs, but might wrong. Currently trying to find a detailed explanation of how to implement such a system using existing technology. In mean time, if anyone else is aware of such a system, please post a link. EDIT: This appears to cover some aspects, still reviewing it and to confirm it covers all the system attributes I described: https://crypto.stackexchange.com/questions/96232/zkp-prove-that-18-while-hiding-age https://crypto.stackexchange.com/questions/96232/zkp-prove-t...
- LegionMammal978 4y ago
  Hmm, I don't think that protocol as described would be sufficient for the government. What would prevent Alice (age 18) from sharing her signed age statement with her friend Charlie (age 17), who passes it to Bob to falsify his age? The government would not want underage users to collude with 18+ users to gain access to age-gated endpoints.
  - O__________O 4y ago
    Agree, still trying to find full explanation, seen it described before. Aside from sharing the token, other issue is if the endpoint cached the token, it’s unique and could be cross-referenced to deanonymize the user if 3rd-party or government gained access to list of tokens an endpoint collected. Obviously looking for example, but if you’re able to think of an additional issues that need to be accounted for, let me know.
    - LegionMammal978 4y ago
      Yep, that's another thing I was thinking of: if Alice uses the same token all the time for every endpoint, then the endpoints could trivially use that as a unique identifier to track Alice. Perhaps the government could create a service for Alice to create new age tokens whenever she wants. Even then, if the government actively compelling endpoints to hand over their data is within the threat model, the government could inspect any cached temporary tokens to deanonymize the users. This could perhaps be mitigated with some way for users to irreversibly transform the temporary tokens given by the government, but I'm not sure if that's possible while retaining the ability for endpoints to verify the tokens. Overall, though, the sharing problem seems to me to be the biggest issue by far with this scheme. What makes a user an individual human? In current implementations, their unique government ID (perhaps made illegal to falsify) is used for this. But I can't see how individual humans can be distinguished in a privacy-preserving way.
      - O__________O 4y ago
        My memory was that the tokens enter a pool of tokens and that neither government or endpoint is able to trace which user used which token and they’re one-time use tokens, so users are unable to share them. Never really gave system much thought at the time, since governments rarely want less data or to provide anonymous access — and average person does not care about anonymous access, in fact, in my experience they want everything logged. Same topic could easily be applied to numerous functions such as border crossings, but governments want to track who is crossing instead of just checking individual authorization to enter.
rkagerer 4y ago
No matter how you design this, at some point it involves trusting a third party who views your ID doesn't leak PII to other parties. This problem doesn't exist with today's simple prompts that just ask for your birthday and blindly trust the end user.
- LegionMammal978 4y ago
  Indeed. It seems like most proposals delegate this role to the government, since they already have your basic ID anyway. The question is, how can the website operators interact with the government in such a way that the websites don't learn which government ID you have, and the government doesn't learn which websites you're visiting? Surprisingly (to me at least), certain cryptographic tricks can do a pretty big chunk of that, by having the website/government and user/government interactions occur ahead of time. But as far as I can see, there's still the issue with these tricks that 18+ people could share their access with under-18 people, which the government would want to prevent.
  - O__________O 4y ago
    I actually do have an economic technical solution to the issue of remote authentication of user’s physical presence using zero-trust systems that makes sharing a one-time token impossible, but currently not motivated to share it, since it’s possible I might want to use it myself formally; super simple, very possible someone else has already used it before. Realize you have to take my word for it, but to me, that’s non-issue. Also, does appear Privacy Pass covers the other aspects, which is covered on this page, but still trying to work through if it covers all aspects of a system that at least for myself I would be agreeable to use for things like: age verification, citizenship, captchas, etc — basically anonymous verification of identity attributes.
    - LegionMammal978 4y ago
      Huh, I read up on Privacy Pass, and it really does seem to have the properties I'm looking for. Taking the government as the issuer/attester, it seems like the endpoint (origin) gives a challenge to the user (client), the user requests a token from the government (which, critically, the government can verify without knowing the user's ID), and uses this token to respond to the endpoint's challenge. Thus, the government might learn that some user accessed that particular endpoint (depending on the exact setup used), but cannot learn who it was. And since it does not know the user's identity, it cannot censor a particular user, only potentially a particular endpoint. I also don't really see how present physical identity could be proven in a privacy-preserving manner, if you don't trust the government or endpoints not to abuse that physical data. Alas, even if I take your word for it, I doubt that governments would implement such an indirect system for age verification in practice, especially since they might want to revoke any erroneously-issued tokens. (And even if anonymous non-circumventable age gating were to become a reality, I still wouldn't be a fan of differential privacy regulations for minors, since many ordinary sites would become inaccessible to teenagers from following the path of least resistance. Either impose the regulations on all users, impose them gradually depending on age, or don't impose them at all.)

Stupulous 4y ago

Have there been instances of governments providing cryptographic identification services yet? That seems like a hugely beneficial thing they could do in this space (with the side benefit of social websites that aren't overrun with children). The only part that would be challenging is preventing the government authentication servers from knowing which websites you're visiting.

O__________O 4y ago
Trying to post everything in same spot, see this comment for more information: https://news.ycombinator.com/item?id=33133010 https://news.ycombinator.com/item?id=33133010
teaearlgraycold 4y ago
Google and Apple are both implementing an ISO that will allow for you to prove you are over 21, 18, etc. It’s just a super verified boolean. The tech can also provide much more, but you can think of it like OAuth scopes. The user is shown what will be shared from a set of discrete properties.
- greggman3 4y ago
  There is no way those properties won't include PII 99.999% of the time. Your option will be to identify yourself or not access the site
  - btown 4y ago
    The option in "Sign In With Apple ID" to provide a randomized email address that proxies to your own, alongside the boolean, would do a lot to mitigate this. Of course, Apple can associate you with your usage of the site (and it's worth keeping a close eye if they start to pivot more towards advertising as a revenue stream), but the site itself would be unable to.
  - teaearlgraycold 4y ago
    That is a yet to be solved problem. But people are working to make sure that doesn't happen.

mindslight 4y ago

In an ideal world, yes. Blind signatures and all that. But that isn't how collection-maximizing surveillance companies work. Right now, the lowest friction is to ask for birthdays where they can get away with it, but never really verify. If the law gives them a reason to verify, then the incentive is to expand their plaintext-based all-knowing systems to perform verification. Sure, we'd likely see a startup that promises to do privacy-respecting age verification, but it would go nowhere. What incentive would there be for Google et al to adopt it, as opposed to say just requesting your driving license number with a message implying that California "made" them to do this ? The companies without the cloud to demand personal info would then outsource the verification to the bigger surveillance companies.

mistrial9 4y ago
unfortunately, there are Thiel-like support services in the wings actively building business bridges at every step. Some elements in society really do try to get paid to surveil others, and that will continue. I predict only hard-won litigation, meaningful laws with enforcement, and public discussion like this, will slow the slide on the slippery slope.
- mindslight 4y ago
  "Some" ? The entire market cap of modern Silicon Valley is based upon monetizing surveillance. This topic demonstrates one of the main pathologies of the US model of governance. Instead of pushing constructive actionable privacy restrictions for everyone, the government is poised to create another hook that merely emboldens corporate control. What we need is a US GDPR with an analogous definition of consent - if implementing functionality to examine and delete my data is too hard, then just don't store surveillance records about me in the first place! But what we'll end up getting is ineffectual nonsense to be nullified with more clickwrap legalese that nobody reads.
  - mistrial9 4y ago
    > The entire market cap of modern Silicon Valley is based upon monetizing surveillance. no, its not.. but a bulk of FB/Google dollars that are, dwarfs a lot of other things.. its a sick situation, I can agree with that.. important to speak out

soulofmischief 4y ago

You have to ask yourself if we should be building these kinds of censorship tools to begin with. If I wasn't allowed to use the internet the way I did as a kid, I wouldn't be here today.

mixmastamyk 4y ago
I first used the internet in my mid-twenties and am here today.
- soulofmischief 4y ago
  I'm not sure how this is related. What does your experience have to do with another's?

cm2187 4y ago

That would require some privacy focused gvt infrastructure. The reality is that pretty much all gvt these days are all in on privacy invasion and monitoring.