4 ms·

How could the user verify that the endpoint never learns anything about the user's identity, and that the system never learns anything about the requesting endp

How could the user verify that the endpoint never learns anything about the user's identity, and that the system never learns anything about the requesting endpoint? In situations where privacy is particularly sensitive, either or both could have a motive to learn more about the user.

O__________O 4y ago
I have seen it explained before, believe it was done using a combination of combination of differential privacy and zero knowledge proofs, but might wrong. Currently trying to find a detailed explanation of how to implement such a system using existing technology. In mean time, if anyone else is aware of such a system, please post a link. EDIT: This appears to cover some aspects, still reviewing it and to confirm it covers all the system attributes I described: https://crypto.stackexchange.com/questions/96232/zkp-prove-that-18-while-hiding-age https://crypto.stackexchange.com/questions/96232/zkp-prove-t...
- LegionMammal978 4y ago
  Hmm, I don't think that protocol as described would be sufficient for the government. What would prevent Alice (age 18) from sharing her signed age statement with her friend Charlie (age 17), who passes it to Bob to falsify his age? The government would not want underage users to collude with 18+ users to gain access to age-gated endpoints.
  - O__________O 4y ago
    Agree, still trying to find full explanation, seen it described before. Aside from sharing the token, other issue is if the endpoint cached the token, it’s unique and could be cross-referenced to deanonymize the user if 3rd-party or government gained access to list of tokens an endpoint collected. Obviously looking for example, but if you’re able to think of an additional issues that need to be accounted for, let me know.
    - LegionMammal978 4y ago
      Yep, that's another thing I was thinking of: if Alice uses the same token all the time for every endpoint, then the endpoints could trivially use that as a unique identifier to track Alice. Perhaps the government could create a service for Alice to create new age tokens whenever she wants. Even then, if the government actively compelling endpoints to hand over their data is within the threat model, the government could inspect any cached temporary tokens to deanonymize the users. This could perhaps be mitigated with some way for users to irreversibly transform the temporary tokens given by the government, but I'm not sure if that's possible while retaining the ability for endpoints to verify the tokens. Overall, though, the sharing problem seems to me to be the biggest issue by far with this scheme. What makes a user an individual human? In current implementations, their unique government ID (perhaps made illegal to falsify) is used for this. But I can't see how individual humans can be distinguished in a privacy-preserving way.
      - O__________O 4y ago
        My memory was that the tokens enter a pool of tokens and that neither government or endpoint is able to trace which user used which token and they’re one-time use tokens, so users are unable to share them. Never really gave system much thought at the time, since governments rarely want less data or to provide anonymous access — and average person does not care about anonymous access, in fact, in my experience they want everything logged. Same topic could easily be applied to numerous functions such as border crossings, but governments want to track who is crossing instead of just checking individual authorization to enter.
    - IX-103 4y ago
      Unless it's a blinded token. In which case the endpoint cannot match the token that was issued to the token that was spent. They can only verify that the token is valid. I first saw them used with Clouflare's Privacy Pass https://www.hcaptcha.com/privacy-pass https://www.hcaptcha.com/privacy-pass, they've also been used with Google's trust token proposal.
      - O__________O 4y ago
rkagerer 4y ago
No matter how you design this, at some point it involves trusting a third party who views your ID doesn't leak PII to other parties. This problem doesn't exist with today's simple prompts that just ask for your birthday and blindly trust the end user.
- LegionMammal978 4y ago
  Indeed. It seems like most proposals delegate this role to the government, since they already have your basic ID anyway. The question is, how can the website operators interact with the government in such a way that the websites don't learn which government ID you have, and the government doesn't learn which websites you're visiting? Surprisingly (to me at least), certain cryptographic tricks can do a pretty big chunk of that, by having the website/government and user/government interactions occur ahead of time. But as far as I can see, there's still the issue with these tricks that 18+ people could share their access with under-18 people, which the government would want to prevent.
  - O__________O 4y ago
    I actually do have an economic technical solution to the issue of remote authentication of user’s physical presence using zero-trust systems that makes sharing a one-time token impossible, but currently not motivated to share it, since it’s possible I might want to use it myself formally; super simple, very possible someone else has already used it before. Realize you have to take my word for it, but to me, that’s non-issue. Also, does appear Privacy Pass covers the other aspects, which is covered on this page, but still trying to work through if it covers all aspects of a system that at least for myself I would be agreeable to use for things like: age verification, citizenship, captchas, etc — basically anonymous verification of identity attributes.
    - LegionMammal978 4y ago
      Huh, I read up on Privacy Pass, and it really does seem to have the properties I'm looking for. Taking the government as the issuer/attester, it seems like the endpoint (origin) gives a challenge to the user (client), the user requests a token from the government (which, critically, the government can verify without knowing the user's ID), and uses this token to respond to the endpoint's challenge. Thus, the government might learn that some user accessed that particular endpoint (depending on the exact setup used), but cannot learn who it was. And since it does not know the user's identity, it cannot censor a particular user, only potentially a particular endpoint. I also don't really see how present physical identity could be proven in a privacy-preserving manner, if you don't trust the government or endpoints not to abuse that physical data. Alas, even if I take your word for it, I doubt that governments would implement such an indirect system for age verification in practice, especially since they might want to revoke any erroneously-issued tokens. (And even if anonymous non-circumventable age gating were to become a reality, I still wouldn't be a fan of differential privacy regulations for minors, since many ordinary sites would become inaccessible to teenagers from following the path of least resistance. Either impose the regulations on all users, impose them gradually depending on age, or don't impose them at all.)

O__________O 4y ago

I have seen it explained before, believe it was done using a combination of combination of differential privacy and zero knowledge proofs, but might wrong. Currently trying to find a detailed explanation of how to implement such a system using existing technology. In mean time, if anyone else is aware of such a system, please post a link. EDIT: This appears to cover some aspects, still reviewing it and to confirm it covers all the system attributes I described: https://crypto.stackexchange.com/questions/96232/zkp-prove-that-18-while-hiding-age https://crypto.stackexchange.com/questions/96232/zkp-prove-t...

LegionMammal978 4y ago
Hmm, I don't think that protocol as described would be sufficient for the government. What would prevent Alice (age 18) from sharing her signed age statement with her friend Charlie (age 17), who passes it to Bob to falsify his age? The government would not want underage users to collude with 18+ users to gain access to age-gated endpoints.
- O__________O 4y ago
  Agree, still trying to find full explanation, seen it described before. Aside from sharing the token, other issue is if the endpoint cached the token, it’s unique and could be cross-referenced to deanonymize the user if 3rd-party or government gained access to list of tokens an endpoint collected. Obviously looking for example, but if you’re able to think of an additional issues that need to be accounted for, let me know.
  - LegionMammal978 4y ago
    Yep, that's another thing I was thinking of: if Alice uses the same token all the time for every endpoint, then the endpoints could trivially use that as a unique identifier to track Alice. Perhaps the government could create a service for Alice to create new age tokens whenever she wants. Even then, if the government actively compelling endpoints to hand over their data is within the threat model, the government could inspect any cached temporary tokens to deanonymize the users. This could perhaps be mitigated with some way for users to irreversibly transform the temporary tokens given by the government, but I'm not sure if that's possible while retaining the ability for endpoints to verify the tokens. Overall, though, the sharing problem seems to me to be the biggest issue by far with this scheme. What makes a user an individual human? In current implementations, their unique government ID (perhaps made illegal to falsify) is used for this. But I can't see how individual humans can be distinguished in a privacy-preserving way.
    - O__________O 4y ago
      My memory was that the tokens enter a pool of tokens and that neither government or endpoint is able to trace which user used which token and they’re one-time use tokens, so users are unable to share them. Never really gave system much thought at the time, since governments rarely want less data or to provide anonymous access — and average person does not care about anonymous access, in fact, in my experience they want everything logged. Same topic could easily be applied to numerous functions such as border crossings, but governments want to track who is crossing instead of just checking individual authorization to enter.
  - IX-103 4y ago
    Unless it's a blinded token. In which case the endpoint cannot match the token that was issued to the token that was spent. They can only verify that the token is valid. I first saw them used with Clouflare's Privacy Pass https://www.hcaptcha.com/privacy-pass https://www.hcaptcha.com/privacy-pass, they've also been used with Google's trust token proposal.
    - O__________O 4y ago

rkagerer 4y ago

No matter how you design this, at some point it involves trusting a third party who views your ID doesn't leak PII to other parties. This problem doesn't exist with today's simple prompts that just ask for your birthday and blindly trust the end user.

LegionMammal978 4y ago
Indeed. It seems like most proposals delegate this role to the government, since they already have your basic ID anyway. The question is, how can the website operators interact with the government in such a way that the websites don't learn which government ID you have, and the government doesn't learn which websites you're visiting? Surprisingly (to me at least), certain cryptographic tricks can do a pretty big chunk of that, by having the website/government and user/government interactions occur ahead of time. But as far as I can see, there's still the issue with these tricks that 18+ people could share their access with under-18 people, which the government would want to prevent.
- O__________O 4y ago
  I actually do have an economic technical solution to the issue of remote authentication of user’s physical presence using zero-trust systems that makes sharing a one-time token impossible, but currently not motivated to share it, since it’s possible I might want to use it myself formally; super simple, very possible someone else has already used it before. Realize you have to take my word for it, but to me, that’s non-issue. Also, does appear Privacy Pass covers the other aspects, which is covered on this page, but still trying to work through if it covers all aspects of a system that at least for myself I would be agreeable to use for things like: age verification, citizenship, captchas, etc — basically anonymous verification of identity attributes.
  - LegionMammal978 4y ago
    Huh, I read up on Privacy Pass, and it really does seem to have the properties I'm looking for. Taking the government as the issuer/attester, it seems like the endpoint (origin) gives a challenge to the user (client), the user requests a token from the government (which, critically, the government can verify without knowing the user's ID), and uses this token to respond to the endpoint's challenge. Thus, the government might learn that some user accessed that particular endpoint (depending on the exact setup used), but cannot learn who it was. And since it does not know the user's identity, it cannot censor a particular user, only potentially a particular endpoint. I also don't really see how present physical identity could be proven in a privacy-preserving manner, if you don't trust the government or endpoints not to abuse that physical data. Alas, even if I take your word for it, I doubt that governments would implement such an indirect system for age verification in practice, especially since they might want to revoke any erroneously-issued tokens. (And even if anonymous non-circumventable age gating were to become a reality, I still wouldn't be a fan of differential privacy regulations for minors, since many ordinary sites would become inaccessible to teenagers from following the path of least resistance. Either impose the regulations on all users, impose them gradually depending on age, or don't impose them at all.)