3 ms·

> You now have to give your identity to a third party each time you access it No. This is one of the safeguards. The ID just tells you if you are above the age

> You now have to give your identity to a third party each time you access it No. This is one of the safeguards. The ID just tells you if you are above the age or not. Nothing more. Your scenario is something that is explicitly considered and guarded against.

AnthonyMouse 3y ago
> The ID just tells you if you are above the age or not. Nothing more. The ID has your name attached to it. The ID provider has to know who you are in order to know your age -- or the system would be worthless because all you would need is access to one adult ID which could be shared by everyone underaged in the world.
- PrimeMcFly 3y ago
  The website queries the ID provider about the age of the person in question getting a yes or no response and no other information, and ideally the ID provider doesn't keep information on which sites were querying which people.
  - AnthonyMouse 3y ago
    "Ideally" being the problem, since the client has no way of verifying this, and the ID provider could be adversarial or compromised. Which you'd have no way of knowing until it was too late, which is why it's necessary to avoid systems that require anyone to give their name just to prove their age.
    - PrimeMcFly 3y ago
      Well, the client doesn't have to verify anything. They just need the yes/no response. The ID provider is the government in this case, so hopefully there would be laws and oversight to closely regulate their behavior in this context. I'd probably opt out though, due to a lack of trust in government competency and motivation. Australia has a similar eID thing and I've avoided it completely, and will until it's mandatory. > why it's necessary to avoid systems that require anyone to give their name just to prove their age. Well, in this case the name is never given to the third party site.
      - AnthonyMouse 3y ago
        > Well, the client doesn't have to verify anything. They just need the yes/no response. The client meaning the user. They have no way to verify that the server isn't associating their name with the response. > The ID provider is the government in this case, so hopefully there would be laws and oversight to closely regulate their behavior in this context. The government is the thing that enforces the law. It has a tendency of not enforcing the law against itself. Criminals who compromise government servers are already breaking the law. A foreign intelligence service or drug cartel is not going to adhere to your country's laws. > Well, in this case the name is never given to the third party site. You have to give your name to someone in order to access the site. It doesn't matter who the someone is, that's enough to deter people who can't have their name associated with the site, because they have no way to prove that the system is trustworthy and competently secured, these kinds of things commonly aren't, and can't they take the risk. Classic chilling effects.
        PrimeMcFly 3y ago
        > They have no way to verify that the server isn't associating their name with the response. That's where laws and overwatch come in. > The government is the thing that enforces the law. It has a tendency of not enforcing the law against itself. That's where separation of powers and checks and balances come in. > Criminals who compromise government servers are already breaking the law. A foreign intelligence service or drug cartel is not going to adhere to your country's laws. That's where taking security seriously comes in. > You have to give your name to someone in order to access the site. No, you don't. You click that you want to access, site redirects you to a government portal, you authenticate, government portal sends back a token and no personal information. This has been a solved problem for some time.
        AnthonyMouse 3y ago
        > That's where laws and overwatch come in. When someone breaks the law and you get killed as a result, you don't come back to life even if the perpetrators get arrested. > That's where separation of powers and checks and balances come in. That has a history of not working in this context. > That's where taking security seriously comes in. It's not your security which is the problem, it's their security, which you have no control over. > No, you don't. You click that you want to access, site redirects you to a government portal, you authenticate, government portal sends back a token and no personal information. You just described "giving your name to someone in order to access the site." The someone is the government portal. In many cases the government is the entity you need to have your privacy protected against. In other cases the government is innocent but incompetent and the portal gets compromised by someone malicious. This is not a solved problem; it keeps happening.

AnthonyMouse 3y ago

> The ID just tells you if you are above the age or not. Nothing more. The ID has your name attached to it. The ID provider has to know who you are in order to know your age -- or the system would be worthless because all you would need is access to one adult ID which could be shared by everyone underaged in the world.

PrimeMcFly 3y ago
The website queries the ID provider about the age of the person in question getting a yes or no response and no other information, and ideally the ID provider doesn't keep information on which sites were querying which people.
- AnthonyMouse 3y ago
  "Ideally" being the problem, since the client has no way of verifying this, and the ID provider could be adversarial or compromised. Which you'd have no way of knowing until it was too late, which is why it's necessary to avoid systems that require anyone to give their name just to prove their age.
  - PrimeMcFly 3y ago
    Well, the client doesn't have to verify anything. They just need the yes/no response. The ID provider is the government in this case, so hopefully there would be laws and oversight to closely regulate their behavior in this context. I'd probably opt out though, due to a lack of trust in government competency and motivation. Australia has a similar eID thing and I've avoided it completely, and will until it's mandatory. > why it's necessary to avoid systems that require anyone to give their name just to prove their age. Well, in this case the name is never given to the third party site.
    - AnthonyMouse 3y ago
      > Well, the client doesn't have to verify anything. They just need the yes/no response. The client meaning the user. They have no way to verify that the server isn't associating their name with the response. > The ID provider is the government in this case, so hopefully there would be laws and oversight to closely regulate their behavior in this context. The government is the thing that enforces the law. It has a tendency of not enforcing the law against itself. Criminals who compromise government servers are already breaking the law. A foreign intelligence service or drug cartel is not going to adhere to your country's laws. > Well, in this case the name is never given to the third party site. You have to give your name to someone in order to access the site. It doesn't matter who the someone is, that's enough to deter people who can't have their name associated with the site, because they have no way to prove that the system is trustworthy and competently secured, these kinds of things commonly aren't, and can't they take the risk. Classic chilling effects.
      - PrimeMcFly 3y ago
        > They have no way to verify that the server isn't associating their name with the response. That's where laws and overwatch come in. > The government is the thing that enforces the law. It has a tendency of not enforcing the law against itself. That's where separation of powers and checks and balances come in. > Criminals who compromise government servers are already breaking the law. A foreign intelligence service or drug cartel is not going to adhere to your country's laws. That's where taking security seriously comes in. > You have to give your name to someone in order to access the site. No, you don't. You click that you want to access, site redirects you to a government portal, you authenticate, government portal sends back a token and no personal information. This has been a solved problem for some time.
        AnthonyMouse 3y ago
        > That's where laws and overwatch come in. When someone breaks the law and you get killed as a result, you don't come back to life even if the perpetrators get arrested. > That's where separation of powers and checks and balances come in. That has a history of not working in this context. > That's where taking security seriously comes in. It's not your security which is the problem, it's their security, which you have no control over. > No, you don't. You click that you want to access, site redirects you to a government portal, you authenticate, government portal sends back a token and no personal information. You just described "giving your name to someone in order to access the site." The someone is the government portal. In many cases the government is the entity you need to have your privacy protected against. In other cases the government is innocent but incompetent and the portal gets compromised by someone malicious. This is not a solved problem; it keeps happening.