3 ms·

It actually is, there were long and debates and safeguards against misuse. E.g. if you have to verify you age, the service online gets a True or a False. Ther

It actually is, there were long and debates and safeguards against misuse. E.g. if you have to verify you age, the service online gets a True or a False. There is no identifiers for transactions and so on

AnthonyMouse 3y ago
This doesn't actually fix it. Suppose there is a some age-gated content you want to access. It's age-gated because it's controversial and politically sensitive. You now have to give your identity to a third party each time you access it, which they can use to correlate what you read with who you are if they collude with the service provider or either of them is compromised and the intruders record the data and either publish it or are themselves a government intelligence service that directly uses it for oppression. It also does nothing about the concern with turnkey authoritarianism. Once the infrastructure is in place, shouldn't we have a way to unmask these people? What if they're child abusers? Or the profane religious minority? The minor advantage of building something like this is vastly outweighed by its potential for use by governments in order to do things that Must Never Happen Again.
- number6 3y ago
  > You now have to give your identity to a third party each time you access it No. This is one of the safeguards. The ID just tells you if you are above the age or not. Nothing more. Your scenario is something that is explicitly considered and guarded against.
  - AnthonyMouse 3y ago
    > The ID just tells you if you are above the age or not. Nothing more. The ID has your name attached to it. The ID provider has to know who you are in order to know your age -- or the system would be worthless because all you would need is access to one adult ID which could be shared by everyone underaged in the world.
    - PrimeMcFly 3y ago
      The website queries the ID provider about the age of the person in question getting a yes or no response and no other information, and ideally the ID provider doesn't keep information on which sites were querying which people.
      - AnthonyMouse 3y ago
        "Ideally" being the problem, since the client has no way of verifying this, and the ID provider could be adversarial or compromised. Which you'd have no way of knowing until it was too late, which is why it's necessary to avoid systems that require anyone to give their name just to prove their age.
        PrimeMcFly 3y ago
        Well, the client doesn't have to verify anything. They just need the yes/no response. The ID provider is the government in this case, so hopefully there would be laws and oversight to closely regulate their behavior in this context. I'd probably opt out though, due to a lack of trust in government competency and motivation. Australia has a similar eID thing and I've avoided it completely, and will until it's mandatory. > why it's necessary to avoid systems that require anyone to give their name just to prove their age. Well, in this case the name is never given to the third party site.
        AnthonyMouse 3y ago
        > Well, the client doesn't have to verify anything. They just need the yes/no response. The client meaning the user. They have no way to verify that the server isn't associating their name with the response. > The ID provider is the government in this case, so hopefully there would be laws and oversight to closely regulate their behavior in this context. The government is the thing that enforces the law. It has a tendency of not enforcing the law against itself. Criminals who compromise government servers are already breaking the law. A foreign intelligence service or drug cartel is not going to adhere to your country's laws. > Well, in this case the name is never given to the third party site. You have to give your name to someone in order to access the site. It doesn't matter who the someone is, that's enough to deter people who can't have their name associated with the site, because they have no way to prove that the system is trustworthy and competently secured, these kinds of things commonly aren't, and can't they take the risk. Classic chilling effects.

AnthonyMouse 3y ago

This doesn't actually fix it. Suppose there is a some age-gated content you want to access. It's age-gated because it's controversial and politically sensitive. You now have to give your identity to a third party each time you access it, which they can use to correlate what you read with who you are if they collude with the service provider or either of them is compromised and the intruders record the data and either publish it or are themselves a government intelligence service that directly uses it for oppression. It also does nothing about the concern with turnkey authoritarianism. Once the infrastructure is in place, shouldn't we have a way to unmask these people? What if they're child abusers? Or the profane religious minority? The minor advantage of building something like this is vastly outweighed by its potential for use by governments in order to do things that Must Never Happen Again.

number6 3y ago
> You now have to give your identity to a third party each time you access it No. This is one of the safeguards. The ID just tells you if you are above the age or not. Nothing more. Your scenario is something that is explicitly considered and guarded against.
- AnthonyMouse 3y ago
  > The ID just tells you if you are above the age or not. Nothing more. The ID has your name attached to it. The ID provider has to know who you are in order to know your age -- or the system would be worthless because all you would need is access to one adult ID which could be shared by everyone underaged in the world.
  - PrimeMcFly 3y ago
    The website queries the ID provider about the age of the person in question getting a yes or no response and no other information, and ideally the ID provider doesn't keep information on which sites were querying which people.
    - AnthonyMouse 3y ago
      "Ideally" being the problem, since the client has no way of verifying this, and the ID provider could be adversarial or compromised. Which you'd have no way of knowing until it was too late, which is why it's necessary to avoid systems that require anyone to give their name just to prove their age.
      - PrimeMcFly 3y ago
        Well, the client doesn't have to verify anything. They just need the yes/no response. The ID provider is the government in this case, so hopefully there would be laws and oversight to closely regulate their behavior in this context. I'd probably opt out though, due to a lack of trust in government competency and motivation. Australia has a similar eID thing and I've avoided it completely, and will until it's mandatory. > why it's necessary to avoid systems that require anyone to give their name just to prove their age. Well, in this case the name is never given to the third party site.
        AnthonyMouse 3y ago
        > Well, the client doesn't have to verify anything. They just need the yes/no response. The client meaning the user. They have no way to verify that the server isn't associating their name with the response. > The ID provider is the government in this case, so hopefully there would be laws and oversight to closely regulate their behavior in this context. The government is the thing that enforces the law. It has a tendency of not enforcing the law against itself. Criminals who compromise government servers are already breaking the law. A foreign intelligence service or drug cartel is not going to adhere to your country's laws. > Well, in this case the name is never given to the third party site. You have to give your name to someone in order to access the site. It doesn't matter who the someone is, that's enough to deter people who can't have their name associated with the site, because they have no way to prove that the system is trustworthy and competently secured, these kinds of things commonly aren't, and can't they take the risk. Classic chilling effects.