4 ms·

Requiring an onerous age verification scheme provided by government approved vendors is a lot closer to censorship than it isn't. Say you post stuff to your ow

Requiring an onerous age verification scheme provided by government approved vendors is a lot closer to censorship than it isn't. Say you post stuff to your own blog, and sometimes use colorful language. A parent decides to report you to the regulatory agency, and now you have 20 days to do whatever they demand you do to remediate, or else your site will be blocked at the ISP level.

AnthonyMouse 3y ago
That's not even the half of it. In order to have age verification, you need identity verification, i.e. tying your identity to your activity. Classic chilling effects. If you're in the closet because you come from a religious family or have a religious boss, can you risk some random site or government bureaucracy getting hacked and outing you? Strong anonymity is essential for free expression. Then the requirement to identify yourself is friction, so sites will want to avoid it, which can only be accomplished through censorship. Ordinary sites not solely focused on X-rated content will be "moderated" down to the level of children, even when they have adult audiences, because they don't want to be locked behind the porn filter. Instead of having diverse communities tailored to all different kinds of people and ideas, you bifurcate the world into nerfed risk-averse corporate censorship and explicit smut. The only place you're allowed to have an adult conversation is Pornhub, which is not exactly known for quality intellectual discourse.
- tzs 3y ago
  > In order to have age verification, you need identity verification, i.e. tying your identity to your activity I don't see any reason age verification has to tie your identity to your activity. It should be possible with modern cryptographic techniques to make a system whereby the service that checks your age doesn't find out what site the check is for, and that site doesn't find out who you are.
  - AnthonyMouse 3y ago
    There are two possibilities. One is you get a unique token which can be tied back to your identity by someone who compromises the issuing service, so if they get compromised you're screwed. The other is you get a generic token or one that otherwise can't be tied back to a specific identity, in which case the token leaks and there is no way to trace back who is leaking it, creating a generic bypass of the whole system.
    - tzs 3y ago
      Porn site issues you a unique token. You have an age verification service sign that token using a blind signature. You return the signed token to the porn site. The porn site can verify the signature using the public key of the verification service.
      - AnthonyMouse 3y ago
        Verification service gets compromised, attackers record and eventually publish mapping between unique verification tokens and users, now all the porn sites or anyone who has compromised any of them can have stored its verification tokens and know who all the users are.
        tzs 3y ago
        The verification service doesn't see the token from the porn site. The user takes the token from the porn site and from that generates a blinded token. The blinded token is what is sent to verification service. They sign it and return it. It is the user that then generates the signed porn token, by applying the unblinding function to the signed blinded token. If the blinded tokens leak the porn sites cannot match them up with the tokens they issued because they don't have the parameters to unblind them.
        AnthonyMouse 3y ago
        I don't see how it gets you out of the dichotomy. If you can't trace the tokens back to the user then somebody can set up a service that will proxy sign for anyone and you have no way to know who they are. If you can, attackers can unmask legitimate users. You're also describing a real-time system, which is subject to timing attacks. Even if you couldn't compare the tokens with each other, you could see that each time User 32323 logged in, John Smith requested a token.
  - Loggias 3y ago
    [dead]

AnthonyMouse 3y ago

That's not even the half of it. In order to have age verification, you need identity verification, i.e. tying your identity to your activity. Classic chilling effects. If you're in the closet because you come from a religious family or have a religious boss, can you risk some random site or government bureaucracy getting hacked and outing you? Strong anonymity is essential for free expression. Then the requirement to identify yourself is friction, so sites will want to avoid it, which can only be accomplished through censorship. Ordinary sites not solely focused on X-rated content will be "moderated" down to the level of children, even when they have adult audiences, because they don't want to be locked behind the porn filter. Instead of having diverse communities tailored to all different kinds of people and ideas, you bifurcate the world into nerfed risk-averse corporate censorship and explicit smut. The only place you're allowed to have an adult conversation is Pornhub, which is not exactly known for quality intellectual discourse.

tzs 3y ago
> In order to have age verification, you need identity verification, i.e. tying your identity to your activity I don't see any reason age verification has to tie your identity to your activity. It should be possible with modern cryptographic techniques to make a system whereby the service that checks your age doesn't find out what site the check is for, and that site doesn't find out who you are.
- AnthonyMouse 3y ago
  There are two possibilities. One is you get a unique token which can be tied back to your identity by someone who compromises the issuing service, so if they get compromised you're screwed. The other is you get a generic token or one that otherwise can't be tied back to a specific identity, in which case the token leaks and there is no way to trace back who is leaking it, creating a generic bypass of the whole system.
  - tzs 3y ago
    Porn site issues you a unique token. You have an age verification service sign that token using a blind signature. You return the signed token to the porn site. The porn site can verify the signature using the public key of the verification service.
    - AnthonyMouse 3y ago
      Verification service gets compromised, attackers record and eventually publish mapping between unique verification tokens and users, now all the porn sites or anyone who has compromised any of them can have stored its verification tokens and know who all the users are.
      - tzs 3y ago
        The verification service doesn't see the token from the porn site. The user takes the token from the porn site and from that generates a blinded token. The blinded token is what is sent to verification service. They sign it and return it. It is the user that then generates the signed porn token, by applying the unblinding function to the signed blinded token. If the blinded tokens leak the porn sites cannot match them up with the tokens they issued because they don't have the parameters to unblind them.
        AnthonyMouse 3y ago
        I don't see how it gets you out of the dichotomy. If you can't trace the tokens back to the user then somebody can set up a service that will proxy sign for anyone and you have no way to know who they are. If you can, attackers can unmask legitimate users. You're also describing a real-time system, which is subject to timing attacks. Even if you couldn't compare the tokens with each other, you could see that each time User 32323 logged in, John Smith requested a token.
- Loggias 3y ago
  [dead]