4 ms·

To build a verified 18+ network inherently requires undermining some privacy to determine, as you are now collecting ID from all of the users of your (e.g.) fet

by saurik 2y ago

To build a verified 18+ network inherently requires undermining some privacy to determine, as you are now collecting ID from all of the users of your (e.g.) fetlife platform. The responsibility and liability should be with parents to prevent their kids from using platforms for which they are not legally old enough, not with the service provider. (Note that I'm not saying this bill requires age verification, nor that it doesn't: I am merely responding to the suggestion to build "verified 18+ networks" as a way of easily being compliant.)

ndriscoll 2y ago
It does not inherently require the network to know anything more than "over 18". It does not require an age verification oracle to know anything other than "requested verification", and even that can be done only once so the oracle doesn't know how many times you provided that verification to someone. See e.g. digital IDs/driver's licenses.
- saurik 2y ago
  Sure: if we believe that having a giant third-party in the sky that does verification of users itself a giant privacy violation that the web currently doesn't require us to subject ourselves to--and if we also believe that the information they collect won't be invasive, particularly when dealing with an international context--I absolutely agree that we can then use various cryptographic schemes to protect our information from the provider. However, I certainly don't believe that: I believe that having a giant centralized verification service is inherently dangerous in a world where we are apparently reliant on inanity like CrowdStrike to feel a sense of security; and, in fact, there was even just recently a big hack of an identity provider company. https://www.eff.org/deeplinks/2024/06/hack-age-verification-company-shows-privacy-danger-social-media-laws https://www.eff.org/deeplinks/2024/06/hack-age-verification-...
  - ndriscoll 2y ago
    You don't need a centralized service. In the US, individual states are adopting[0] the ISO 18013-5 mDL standard, for example, which allows each state to be authoritative on identity information for its residents (or, if I understand it correctly, something like "isOver18" signed attributes). [0] https://www.mdlconnection.com/implementation-tracker-map/ https://www.mdlconnection.com/implementation-tracker-map/
  - tzs 2y ago
    The "giant centralized verification service" can be some entity that already has your information such as your government.
red_admiral 2y ago
You will always give up some privacy this way, but there are better and worse ways of doing this with some combination of cryptography and trusted third parties. There are already online ID verification services for all kinds of apps. Most of the EU's EIDAS proposal - apart from the "we control your TLS certificates" paragraph - is about building a reliable online identification service that preserves as much privacy as possible. I think one of the ideas is to be able to prove you are (or at least hold the ID card and PIN of) an 18+ EU citizen, without divulging your identity. Part of the bill is then to make it mandatory for businesses that want to do citizenship/age verification to accept this method unless they have a really good reason not to. Once you've verified someone's ID, if the law doesn't require this then you don't have to save it in any form, so all a hacker would get if they break in to the database later is that the boolean flag is_verified is set on a particular account (along with the usual things such as the password hash and the email address). For comparison, I'm always a bit uneasy when a site needs my mobile number "to verify you're a human and prevent spam" but they definitely won't save it or use it for marketing purposes - I don't trust everyone. But I would trust a properly designed and audited privacy-preserving ID protocol, just like I trust using the same yubikey across different sites.
deleted 2y ago
[deleted]

by saurik 2y ago

ndriscoll 2y ago

It does not inherently require the network to know anything more than "over 18". It does not require an age verification oracle to know anything other than "requested verification", and even that can be done only once so the oracle doesn't know how many times you provided that verification to someone. See e.g. digital IDs/driver's licenses.

saurik 2y ago
Sure: if we believe that having a giant third-party in the sky that does verification of users itself a giant privacy violation that the web currently doesn't require us to subject ourselves to--and if we also believe that the information they collect won't be invasive, particularly when dealing with an international context--I absolutely agree that we can then use various cryptographic schemes to protect our information from the provider. However, I certainly don't believe that: I believe that having a giant centralized verification service is inherently dangerous in a world where we are apparently reliant on inanity like CrowdStrike to feel a sense of security; and, in fact, there was even just recently a big hack of an identity provider company. https://www.eff.org/deeplinks/2024/06/hack-age-verification-company-shows-privacy-danger-social-media-laws https://www.eff.org/deeplinks/2024/06/hack-age-verification-...
- ndriscoll 2y ago
  You don't need a centralized service. In the US, individual states are adopting[0] the ISO 18013-5 mDL standard, for example, which allows each state to be authoritative on identity information for its residents (or, if I understand it correctly, something like "isOver18" signed attributes). [0] https://www.mdlconnection.com/implementation-tracker-map/ https://www.mdlconnection.com/implementation-tracker-map/
- tzs 2y ago
  The "giant centralized verification service" can be some entity that already has your information such as your government.

red_admiral 2y ago

You will always give up some privacy this way, but there are better and worse ways of doing this with some combination of cryptography and trusted third parties. There are already online ID verification services for all kinds of apps. Most of the EU's EIDAS proposal - apart from the "we control your TLS certificates" paragraph - is about building a reliable online identification service that preserves as much privacy as possible. I think one of the ideas is to be able to prove you are (or at least hold the ID card and PIN of) an 18+ EU citizen, without divulging your identity. Part of the bill is then to make it mandatory for businesses that want to do citizenship/age verification to accept this method unless they have a really good reason not to. Once you've verified someone's ID, if the law doesn't require this then you don't have to save it in any form, so all a hacker would get if they break in to the database later is that the boolean flag is_verified is set on a particular account (along with the usual things such as the password hash and the email address). For comparison, I'm always a bit uneasy when a site needs my mobile number "to verify you're a human and prevent spam" but they definitely won't save it or use it for marketing purposes - I don't trust everyone. But I would trust a properly designed and audited privacy-preserving ID protocol, just like I trust using the same yubikey across different sites.

deleted 2y ago

[deleted]