3 ms·

It does not inherently require the network to know anything more than "over 18". It does not require an age verification oracle to know anything other than "req

It does not inherently require the network to know anything more than "over 18". It does not require an age verification oracle to know anything other than "requested verification", and even that can be done only once so the oracle doesn't know how many times you provided that verification to someone. See e.g. digital IDs/driver's licenses.

saurik 2y ago
Sure: if we believe that having a giant third-party in the sky that does verification of users itself a giant privacy violation that the web currently doesn't require us to subject ourselves to--and if we also believe that the information they collect won't be invasive, particularly when dealing with an international context--I absolutely agree that we can then use various cryptographic schemes to protect our information from the provider. However, I certainly don't believe that: I believe that having a giant centralized verification service is inherently dangerous in a world where we are apparently reliant on inanity like CrowdStrike to feel a sense of security; and, in fact, there was even just recently a big hack of an identity provider company. https://www.eff.org/deeplinks/2024/06/hack-age-verification-company-shows-privacy-danger-social-media-laws https://www.eff.org/deeplinks/2024/06/hack-age-verification-...
- ndriscoll 2y ago
  You don't need a centralized service. In the US, individual states are adopting[0] the ISO 18013-5 mDL standard, for example, which allows each state to be authoritative on identity information for its residents (or, if I understand it correctly, something like "isOver18" signed attributes). [0] https://www.mdlconnection.com/implementation-tracker-map/ https://www.mdlconnection.com/implementation-tracker-map/
- tzs 2y ago
  The "giant centralized verification service" can be some entity that already has your information such as your government.

saurik 2y ago

Sure: if we believe that having a giant third-party in the sky that does verification of users itself a giant privacy violation that the web currently doesn't require us to subject ourselves to--and if we also believe that the information they collect won't be invasive, particularly when dealing with an international context--I absolutely agree that we can then use various cryptographic schemes to protect our information from the provider. However, I certainly don't believe that: I believe that having a giant centralized verification service is inherently dangerous in a world where we are apparently reliant on inanity like CrowdStrike to feel a sense of security; and, in fact, there was even just recently a big hack of an identity provider company. https://www.eff.org/deeplinks/2024/06/hack-age-verification-company-shows-privacy-danger-social-media-laws https://www.eff.org/deeplinks/2024/06/hack-age-verification-...

ndriscoll 2y ago
You don't need a centralized service. In the US, individual states are adopting[0] the ISO 18013-5 mDL standard, for example, which allows each state to be authoritative on identity information for its residents (or, if I understand it correctly, something like "isOver18" signed attributes). [0] https://www.mdlconnection.com/implementation-tracker-map/ https://www.mdlconnection.com/implementation-tracker-map/
tzs 2y ago
The "giant centralized verification service" can be some entity that already has your information such as your government.