3 ms·
There's a lot of trust in that model. I would have to trust that the web server isn't passing extra information like the page I visited, that the government isn
by flagrant_taco 3y ago
There's a lot of trust in that model. I would have to trust that the web server isn't passing extra information like the page I visited, that the government isn't passing back extra info like a unique identifier, and that the scripted strong is completely anonymous and single use.
If any of that trust is broken my privacy is at risk.
> And before someone talks about the state knowing your browser history: they already can by calling up your ISP, and they would get a lot more information than this mechanism would provide.
That depends on how you browse the internet today, and how the ISP tracks it. Simply using a different DNS service goes a long way, and using a VPN or the tor network may not be totally fool proof but should get around the basic drag nets am ISP is likely to use.
- solatic 3y ago> there's a lot of trust in that model No, there isn't. It's basically an OAuth login flow. The spec is publicly documented, anyone can register applications and check if the government is responding as desired, both by correctly requesting auth for the correct scopes in the government-hosted auth page, and by checking that the data returned from the gov matches what the spec promises.
- deleted 3y ago[deleted]
- AnthonyMouse 3y agoOAuth isn't designed to be secure against token issuers conspiring with services to deanonymize users.