3 ms·

That service would need to be run by a third party, which would know your id and the fact that you are trying to access pornhub, wouldn't it?

by aflag 3y ago

xyzzy4747 3y ago
Yes, something that has access to your actual ID.
CubsFan1060 3y ago
To be clear, I hate all of these ideas. But, I think Apple already does this. https://developer.apple.com/wallet/get-started-with-verify-with-wallet/ https://developer.apple.com/wallet/get-started-with-verify-w... "Information about past presentments — including where, when, and what personal information you share — is encrypted and stored only on your device. Neither the state issuing authority nor Apple can see your presentment history." https://support.apple.com/en-us/HT213046 https://support.apple.com/en-us/HT213046
- aflag 3y ago
  I see. My understanding of it is that apple gives you a signed letter saying that you're verified to be over 18. While it's possible to verify that the signed document is legitimate, if it's in any way tied to the person presenting it, you just created an id, no?
madeofpalk 3y ago
Eventually, but part of this could be delegated to someone who probably already knows your identity.
tzs 3y ago
It would be possible to design a protocol that allows you, a website that needs to know your age but not anything else about you, and a third party verification service that knows who you are to verify your age to the website without the verification service knowing who you are verifying your age to, and without a fourth party such as a government with a subpoena that lets them get the records of the web site and the verification service figure out that you have used the latter to prove your age to the former.
belorn 3y ago
No, there are fairly well established technologies to do this without giving the third-party any information about which site is asking for authentication. The most famous that comes first to mind is the Kerberos protocol. An simplified example could be that I ask the third-party to sign a package that include my current IP address, a message that say "I am over 18", and a validity period. They sign it (after I identify myself to the third-party), and give me the requested signature. I then give this to the website and the website can verify the signature of the third-party. The website only know my IP address, the time, and what third-party service I use to verify my age. Third-party only know my ip address, the time, and that I requested a token for "I am over 18". A major drawback occur if this is only used for porn. In that case, the message "I am over 18" will be synonymous with porn use and thus giving the third-party information that they should not have.
dragonwriter 3y ago
You could have a design where encrypted requests and responses were routed so that the relying party (PornHub) new who the responding party (third party verifier) was, but the responding party only knew who the requesting party (user) was, and then only at the level of “the same party making the request to view”, not their actual identity.

That service would need to be run by a third party, which would know your id and the fact that you are trying to access pornhub, wouldn't it?

by aflag 3y ago

That service would need to be run by a third party, which would know your id and the fact that you are trying to access pornhub, wouldn't it?

xyzzy4747 3y ago

Yes, something that has access to your actual ID.

CubsFan1060 3y ago

To be clear, I hate all of these ideas. But, I think Apple already does this. https://developer.apple.com/wallet/get-started-with-verify-with-wallet/ https://developer.apple.com/wallet/get-started-with-verify-w... "Information about past presentments — including where, when, and what personal information you share — is encrypted and stored only on your device. Neither the state issuing authority nor Apple can see your presentment history." https://support.apple.com/en-us/HT213046 https://support.apple.com/en-us/HT213046

aflag 3y ago
I see. My understanding of it is that apple gives you a signed letter saying that you're verified to be over 18. While it's possible to verify that the signed document is legitimate, if it's in any way tied to the person presenting it, you just created an id, no?

madeofpalk 3y ago

Eventually, but part of this could be delegated to someone who probably already knows your identity.

tzs 3y ago

It would be possible to design a protocol that allows you, a website that needs to know your age but not anything else about you, and a third party verification service that knows who you are to verify your age to the website without the verification service knowing who you are verifying your age to, and without a fourth party such as a government with a subpoena that lets them get the records of the web site and the verification service figure out that you have used the latter to prove your age to the former.

belorn 3y ago

No, there are fairly well established technologies to do this without giving the third-party any information about which site is asking for authentication. The most famous that comes first to mind is the Kerberos protocol. An simplified example could be that I ask the third-party to sign a package that include my current IP address, a message that say "I am over 18", and a validity period. They sign it (after I identify myself to the third-party), and give me the requested signature. I then give this to the website and the website can verify the signature of the third-party. The website only know my IP address, the time, and what third-party service I use to verify my age. Third-party only know my ip address, the time, and that I requested a token for "I am over 18". A major drawback occur if this is only used for porn. In that case, the message "I am over 18" will be synonymous with porn use and thus giving the third-party information that they should not have.

dragonwriter 3y ago

You could have a design where encrypted requests and responses were routed so that the relying party (PornHub) new who the responding party (third party verifier) was, but the responding party only knew who the requesting party (user) was, and then only at the level of “the same party making the request to view”, not their actual identity.