3 ms·

Well, the client doesn't have to verify anything. They just need the yes/no response. The ID provider is the government in this case, so hopefully there would

Well, the client doesn't have to verify anything. They just need the yes/no response. The ID provider is the government in this case, so hopefully there would be laws and oversight to closely regulate their behavior in this context. I'd probably opt out though, due to a lack of trust in government competency and motivation. Australia has a similar eID thing and I've avoided it completely, and will until it's mandatory. > why it's necessary to avoid systems that require anyone to give their name just to prove their age. Well, in this case the name is never given to the third party site.

AnthonyMouse 3y ago
> Well, the client doesn't have to verify anything. They just need the yes/no response. The client meaning the user. They have no way to verify that the server isn't associating their name with the response. > The ID provider is the government in this case, so hopefully there would be laws and oversight to closely regulate their behavior in this context. The government is the thing that enforces the law. It has a tendency of not enforcing the law against itself. Criminals who compromise government servers are already breaking the law. A foreign intelligence service or drug cartel is not going to adhere to your country's laws. > Well, in this case the name is never given to the third party site. You have to give your name to someone in order to access the site. It doesn't matter who the someone is, that's enough to deter people who can't have their name associated with the site, because they have no way to prove that the system is trustworthy and competently secured, these kinds of things commonly aren't, and can't they take the risk. Classic chilling effects.
- PrimeMcFly 3y ago
  > They have no way to verify that the server isn't associating their name with the response. That's where laws and overwatch come in. > The government is the thing that enforces the law. It has a tendency of not enforcing the law against itself. That's where separation of powers and checks and balances come in. > Criminals who compromise government servers are already breaking the law. A foreign intelligence service or drug cartel is not going to adhere to your country's laws. That's where taking security seriously comes in. > You have to give your name to someone in order to access the site. No, you don't. You click that you want to access, site redirects you to a government portal, you authenticate, government portal sends back a token and no personal information. This has been a solved problem for some time.
  - AnthonyMouse 3y ago
    > That's where laws and overwatch come in. When someone breaks the law and you get killed as a result, you don't come back to life even if the perpetrators get arrested. > That's where separation of powers and checks and balances come in. That has a history of not working in this context. > That's where taking security seriously comes in. It's not your security which is the problem, it's their security, which you have no control over. > No, you don't. You click that you want to access, site redirects you to a government portal, you authenticate, government portal sends back a token and no personal information. You just described "giving your name to someone in order to access the site." The someone is the government portal. In many cases the government is the entity you need to have your privacy protected against. In other cases the government is innocent but incompetent and the portal gets compromised by someone malicious. This is not a solved problem; it keeps happening.
    - PrimeMcFly 3y ago
      > When someone breaks the law and you get killed as a result, you don't come back to life even if the perpetrators get arrested. lol, well sure. By your reasoning we shouldn't have any laws against murder then. > That has a history of not working in this context. This is a brand new context, so not sure how you can say that. Still, got some examples? > It's not your security which is the problem, it's their security, which you have no control over. I never implied otherwise. > You just described "giving your name to someone in order to access the site." The point is you don't give the name to the party seeking to verify. > In many cases the government is the entity you need to have your privacy protected against. Which is where laws and overwatch come in. > This is not a solved problem; it keeps happening. The solved problem is being able to verify age to a non government site without revealing any personal information. Sure, the government could screw stuff up, but then you have an incentive as a voter to prevent that from happening. I understand being skeptical of government competency, but EU governments tend to be better than most in this regard. Besides, far as I can see the eID is not mandatory to use, so just don't.
      - AnthonyMouse 3y ago

AnthonyMouse 3y ago

> Well, the client doesn't have to verify anything. They just need the yes/no response. The client meaning the user. They have no way to verify that the server isn't associating their name with the response. > The ID provider is the government in this case, so hopefully there would be laws and oversight to closely regulate their behavior in this context. The government is the thing that enforces the law. It has a tendency of not enforcing the law against itself. Criminals who compromise government servers are already breaking the law. A foreign intelligence service or drug cartel is not going to adhere to your country's laws. > Well, in this case the name is never given to the third party site. You have to give your name to someone in order to access the site. It doesn't matter who the someone is, that's enough to deter people who can't have their name associated with the site, because they have no way to prove that the system is trustworthy and competently secured, these kinds of things commonly aren't, and can't they take the risk. Classic chilling effects.

PrimeMcFly 3y ago
> They have no way to verify that the server isn't associating their name with the response. That's where laws and overwatch come in. > The government is the thing that enforces the law. It has a tendency of not enforcing the law against itself. That's where separation of powers and checks and balances come in. > Criminals who compromise government servers are already breaking the law. A foreign intelligence service or drug cartel is not going to adhere to your country's laws. That's where taking security seriously comes in. > You have to give your name to someone in order to access the site. No, you don't. You click that you want to access, site redirects you to a government portal, you authenticate, government portal sends back a token and no personal information. This has been a solved problem for some time.
- AnthonyMouse 3y ago
  > That's where laws and overwatch come in. When someone breaks the law and you get killed as a result, you don't come back to life even if the perpetrators get arrested. > That's where separation of powers and checks and balances come in. That has a history of not working in this context. > That's where taking security seriously comes in. It's not your security which is the problem, it's their security, which you have no control over. > No, you don't. You click that you want to access, site redirects you to a government portal, you authenticate, government portal sends back a token and no personal information. You just described "giving your name to someone in order to access the site." The someone is the government portal. In many cases the government is the entity you need to have your privacy protected against. In other cases the government is innocent but incompetent and the portal gets compromised by someone malicious. This is not a solved problem; it keeps happening.
  - PrimeMcFly 3y ago
    > When someone breaks the law and you get killed as a result, you don't come back to life even if the perpetrators get arrested. lol, well sure. By your reasoning we shouldn't have any laws against murder then. > That has a history of not working in this context. This is a brand new context, so not sure how you can say that. Still, got some examples? > It's not your security which is the problem, it's their security, which you have no control over. I never implied otherwise. > You just described "giving your name to someone in order to access the site." The point is you don't give the name to the party seeking to verify. > In many cases the government is the entity you need to have your privacy protected against. Which is where laws and overwatch come in. > This is not a solved problem; it keeps happening. The solved problem is being able to verify age to a non government site without revealing any personal information. Sure, the government could screw stuff up, but then you have an incentive as a voter to prevent that from happening. I understand being skeptical of government competency, but EU governments tend to be better than most in this regard. Besides, far as I can see the eID is not mandatory to use, so just don't.
    - AnthonyMouse 3y ago