3 ms·
Yep, that's another thing I was thinking of: if Alice uses the same token all the time for every endpoint, then the endpoints could trivially use that as a uniq
by LegionMammal978 4y ago
Yep, that's another thing I was thinking of: if Alice uses the same token all the time for every endpoint, then the endpoints could trivially use that as a unique identifier to track Alice. Perhaps the government could create a service for Alice to create new age tokens whenever she wants.
Even then, if the government actively compelling endpoints to hand over their data is within the threat model, the government could inspect any cached temporary tokens to deanonymize the users. This could perhaps be mitigated with some way for users to irreversibly transform the temporary tokens given by the government, but I'm not sure if that's possible while retaining the ability for endpoints to verify the tokens.
Overall, though, the sharing problem seems to me to be the biggest issue by far with this scheme. What makes a user an individual human? In current implementations, their unique government ID (perhaps made illegal to falsify) is used for this. But I can't see how individual humans can be distinguished in a privacy-preserving way.
- O__________O 4y agoMy memory was that the tokens enter a pool of tokens and that neither government or endpoint is able to trace which user used which token and they’re one-time use tokens, so users are unable to share them. Never really gave system much thought at the time, since governments rarely want less data or to provide anonymous access — and average person does not care about anonymous access, in fact, in my experience they want everything logged. Same topic could easily be applied to numerous functions such as border crossings, but governments want to track who is crossing instead of just checking individual authorization to enter.