7 ms·

I'm still on the fence about government doing a parent's job here, especially for kids under 13, but I can't stand that no one pushing these bills has come up w

I'm still on the fence about government doing a parent's job here, especially for kids under 13, but I can't stand that no one pushing these bills has come up with an actually reasonable age verification method. How do you anonymously verify someone's age?

ip26 3y ago
Third party, perhaps. You sign up for service A. Service A queries service B, which knows who you are and provides a one-time ack of your age.
- tnbp 3y ago
  That sounds nightmarish. I don't want the verifier to know what porn sites I visit. Someone else proposed the following system to me: a third party authority issues a certificate which I can then use to prove I'm 18. The CA cannot see where I use the certificate, though.
  - Tadpole9181 3y ago
    Er... The CA needs to be used to verify the certificate by the third party, ergo it will know the websites. It's virtually impossible to make a verification system that's anonymous. Somewhere the third party and authenticator will need to share a secret that you cannot touch. Furthermore, you would need the government to agree to this system and mandate this system universally and pay for the authentication services to exist. That's not what Florida is doing.
    - tnbp 3y ago
      I can show my government-issued ID to any third party without the government knowing about whom I've shown this ID to. The third party needs to trust the government and the authenticity of the ID. The problem is that my ID contains too much information; I would prefer a document (i.e. digital certificate) that only certifies my age, not my name, address etc.
      - Tadpole9181 3y ago
        Any such ID would need to be validated by the service. Therefore the service and the authenticator would need to speak. And in doing so, the authenticator will be able to see that an ID issued to you is being used for that service. You cannot get around this. The service must confirm with the authenticator. The authenticator must know you are authenticated, and be extension, who you are.
        tnbp 3y ago
        Your comment is incompatible with mine, so one of us must be incorrect; I will leave it at that.
goda90 3y ago
Anonymous credentials. A central authority with verified age information of each person grants credentials that verify the age to third parties, but the authentication tokens used with the third party can't be used by the third party nor the central authority to identify anything else about the credential holder.
- bonton89 3y ago
  This is technically possible but politically impossible. Any system you make like this will get special government peaking exceptions added making it non-anonymous and probably rank corruption from industry lobbying will add some sort of user tracking for sale with data that is poorly anonymized. Once the sham system is in place they'll probably expand the requirement to other things.
- thomastjeffery 3y ago
  Then there is a data breach, and every person in the country is de-anonymized. No thank you.
  - tzs 3y ago
    A data breach where? The central authority should be someplace that already has your non-anonymous ID data, so using your ID for age verification doesn't give them any new ID information. The only new thing that them doing age verification adds is that they might keep a list of verification tokens they have issued. Someone who obtained copies of the verification tokens you requested might go to various social media sites and ask them who used those tokens, allowing matching up your social media identities with your real identity. That's fixed by making it so the token that is given to the social media site is not the token that came from site that checked your ID. You give the social media site a transformed token that you transform in such a way that the social media site can recognize that it was made from a legitimate token from the ID checker but does not match anything on the list of tokens that the ID checker has for you.
    - thomastjeffery 3y ago

ip26 3y ago

Third party, perhaps. You sign up for service A. Service A queries service B, which knows who you are and provides a one-time ack of your age.

tnbp 3y ago
That sounds nightmarish. I don't want the verifier to know what porn sites I visit. Someone else proposed the following system to me: a third party authority issues a certificate which I can then use to prove I'm 18. The CA cannot see where I use the certificate, though.
- Tadpole9181 3y ago
  Er... The CA needs to be used to verify the certificate by the third party, ergo it will know the websites. It's virtually impossible to make a verification system that's anonymous. Somewhere the third party and authenticator will need to share a secret that you cannot touch. Furthermore, you would need the government to agree to this system and mandate this system universally and pay for the authentication services to exist. That's not what Florida is doing.
  - tnbp 3y ago
    I can show my government-issued ID to any third party without the government knowing about whom I've shown this ID to. The third party needs to trust the government and the authenticity of the ID. The problem is that my ID contains too much information; I would prefer a document (i.e. digital certificate) that only certifies my age, not my name, address etc.
    - Tadpole9181 3y ago
      Any such ID would need to be validated by the service. Therefore the service and the authenticator would need to speak. And in doing so, the authenticator will be able to see that an ID issued to you is being used for that service. You cannot get around this. The service must confirm with the authenticator. The authenticator must know you are authenticated, and be extension, who you are.
      - tnbp 3y ago
        Your comment is incompatible with mine, so one of us must be incorrect; I will leave it at that.

goda90 3y ago

Anonymous credentials. A central authority with verified age information of each person grants credentials that verify the age to third parties, but the authentication tokens used with the third party can't be used by the third party nor the central authority to identify anything else about the credential holder.

bonton89 3y ago
This is technically possible but politically impossible. Any system you make like this will get special government peaking exceptions added making it non-anonymous and probably rank corruption from industry lobbying will add some sort of user tracking for sale with data that is poorly anonymized. Once the sham system is in place they'll probably expand the requirement to other things.
thomastjeffery 3y ago
Then there is a data breach, and every person in the country is de-anonymized. No thank you.
- tzs 3y ago
  A data breach where? The central authority should be someplace that already has your non-anonymous ID data, so using your ID for age verification doesn't give them any new ID information. The only new thing that them doing age verification adds is that they might keep a list of verification tokens they have issued. Someone who obtained copies of the verification tokens you requested might go to various social media sites and ask them who used those tokens, allowing matching up your social media identities with your real identity. That's fixed by making it so the token that is given to the social media site is not the token that came from site that checked your ID. You give the social media site a transformed token that you transform in such a way that the social media site can recognize that it was made from a legitimate token from the ID checker but does not match anything on the list of tokens that the ID checker has for you.
  - thomastjeffery 3y ago