4 ms·

Now do need an abortion or sought out gender affirming care. Today’s “no big deal” can become tomorrow’s privacy nightmare.

• ndriscoll 3y ago
  You missed the either in GP's comment. i.e. they know you did one of those things because you requested an over-18 token, but not which one. The more covered activities there are, the more uncertainty they have about why you might have asked for a token.
  • harimau777 3y ago
    This isn't really my area of expertise, is there a way to know for sure that those are all the same token? Or could the government just lie and say they are all the same when in reality they can really differentiate.
    • ndriscoll 3y ago
      The government would have to document the API for requesting tokens for anyone to use it. I suggested a scheme here[0] where it's clear that the government doesn't get any information about the service (unless the service re-uses AES keys) and the service doesn't get any information about the user other than whether they're in the appropriate age group. Potentially there could be coordination between .gov and the service to track users by having each side store the temporary AES key and reconcile out-of-band. But .gov has other ways they could get that information anyway if they have cooperation from businesses (e.g. asking your ISP for your IP address, and asking the service provider for a list of user IPs). [0] https://news.ycombinator.com/item?id=39183486 https://news.ycombinator.com/item?id=39183486