3 ms·

Don't worry, we'll all fight tooth and nail against any sort of compromise we can live with [1], until compromise if off the table and the worst case scenario i

Don't worry, we'll all fight tooth and nail against any sort of compromise we can live with [1], until compromise if off the table and the worst case scenario is shoved down our throats. [1] Anonymous attestations by trusted authorities. IE a Login.gov service that returns a token indicating that the user is an adult without providing identification details about that user.

bad_haircut72 2y ago
This is a great way to tackle the problem! It also would go a long way to fighting bots, and the government has no way of directly linking identity with the online activity.
- salawat 2y ago
  >the government has no way of directly linking identity with the online activity. I am so tired of the naivete that just because something isn't direct somehow translated to "we're safe from the possibility of". Especially from amongst an audience presumably composed of people who deal with manufacturing layers of indirection on a day-to-day basis. Lets just do a thing that leads to a bad outcome. Don't worry, it doesn't directly lead to a bad outcome. You just need to aggregate a few other things first! 2 years later Oh my goodness, how could anyone have forseen someone would implement the requisite integrations with the right channels of indirection to cause the bad thing to happen! Besides which, the described service, (provisioning a token signifying that the bearer is... Well... Anything really) without at some point on the backend having sufficient connection to a person in the data with whom you are claiming the assertion represented by your is true, and by extension, is capable of associating online traffic utilizing said token with a bearer identity is no different than just believing when the client clicks a button saying "yup, totes that". It is a non-solution. It does not solve the actual problem. You can't and nor should you even attempt to solve the stated problem. You're just mild inconveniences for the chance at creating slightly more remote, but far more severe problems.
marcuskane2 2y ago
I absolutely cannot "live with" any system where I have to provide my identity to a government service in order to receive a token that lets me access websites, or to live in a world where publishers need to integrate with such a government service. Your compromise sounds far worse to me than all the bots, extremists, vulgarity or whatever other problem it's supposed to solve.
- tzs 2y ago
  Done correctly, the government entity would be one that already knows your identity and age, and the website would not interact directly with that government entity. They would only interact with you, when you give them the thing you got from the government entity that certifies your age. Again, if done correctly, the thing you give them is not the actual thing you got from the government but rather the result of running that through a transformation. The transformed token can still be recognized as certifying your age, but if given to the government entity they would not be able to tell which token they issued it is based on.
  - M95D 2y ago
    If you were a web admin, or governemnt official with decision power in your hands, would you really choose to implement it like that instead of a direct communication between site and government server?
- nucleardog 2y ago
  > Your compromise sounds far worse to me than all the bots, extremists, vulgarity or whatever other problem it's supposed to solve. Yeah, but in all likelihood _that isn't one of the options_. The moral panics and "think of the children" and general ignorance around these things is going to drive action at some point. The options are "implement the least bad thing we can" or "wait for legislators and regulators to dictate how it will work". I'd rather see Apple (who already has some semblance of ability to verify your age as you usually have payment methods and things tied to your account) come in and implement some protocol involving a bunch of cryptography I can't even begin to understand that preserves privacy and anonymity, have that gain a foothold, and have eventual regulations either seen as unnecessary or effectively having to support this sort of workflow. The alternative I see is at some point we're going to get a regulation that involves everyone having to send a photo of themselves holding up their driver's license all over the place in order to access half the internet.
soco 2y ago
Based on the answers below I think yes you are perfectly right: we will be forced with the absolutely worst solution ever because apparently no smart engineer will want to invest into anything less that the perfect anonymization solution. So the leadership will say "ok fine then ID it is" and that's that. Thanks to everybody for their moral high ground, it always helped.

bad_haircut72 2y ago

This is a great way to tackle the problem! It also would go a long way to fighting bots, and the government has no way of directly linking identity with the online activity.

salawat 2y ago
>the government has no way of directly linking identity with the online activity. I am so tired of the naivete that just because something isn't direct somehow translated to "we're safe from the possibility of". Especially from amongst an audience presumably composed of people who deal with manufacturing layers of indirection on a day-to-day basis. Lets just do a thing that leads to a bad outcome. Don't worry, it doesn't directly lead to a bad outcome. You just need to aggregate a few other things first! 2 years later Oh my goodness, how could anyone have forseen someone would implement the requisite integrations with the right channels of indirection to cause the bad thing to happen! Besides which, the described service, (provisioning a token signifying that the bearer is... Well... Anything really) without at some point on the backend having sufficient connection to a person in the data with whom you are claiming the assertion represented by your is true, and by extension, is capable of associating online traffic utilizing said token with a bearer identity is no different than just believing when the client clicks a button saying "yup, totes that". It is a non-solution. It does not solve the actual problem. You can't and nor should you even attempt to solve the stated problem. You're just mild inconveniences for the chance at creating slightly more remote, but far more severe problems.

marcuskane2 2y ago

I absolutely cannot "live with" any system where I have to provide my identity to a government service in order to receive a token that lets me access websites, or to live in a world where publishers need to integrate with such a government service. Your compromise sounds far worse to me than all the bots, extremists, vulgarity or whatever other problem it's supposed to solve.

tzs 2y ago
Done correctly, the government entity would be one that already knows your identity and age, and the website would not interact directly with that government entity. They would only interact with you, when you give them the thing you got from the government entity that certifies your age. Again, if done correctly, the thing you give them is not the actual thing you got from the government but rather the result of running that through a transformation. The transformed token can still be recognized as certifying your age, but if given to the government entity they would not be able to tell which token they issued it is based on.
- M95D 2y ago
  If you were a web admin, or governemnt official with decision power in your hands, would you really choose to implement it like that instead of a direct communication between site and government server?
nucleardog 2y ago
> Your compromise sounds far worse to me than all the bots, extremists, vulgarity or whatever other problem it's supposed to solve. Yeah, but in all likelihood _that isn't one of the options_. The moral panics and "think of the children" and general ignorance around these things is going to drive action at some point. The options are "implement the least bad thing we can" or "wait for legislators and regulators to dictate how it will work". I'd rather see Apple (who already has some semblance of ability to verify your age as you usually have payment methods and things tied to your account) come in and implement some protocol involving a bunch of cryptography I can't even begin to understand that preserves privacy and anonymity, have that gain a foothold, and have eventual regulations either seen as unnecessary or effectively having to support this sort of workflow. The alternative I see is at some point we're going to get a regulation that involves everyone having to send a photo of themselves holding up their driver's license all over the place in order to access half the internet.

soco 2y ago

Based on the answers below I think yes you are perfectly right: we will be forced with the absolutely worst solution ever because apparently no smart engineer will want to invest into anything less that the perfect anonymization solution. So the leadership will say "ok fine then ID it is" and that's that. Thanks to everybody for their moral high ground, it always helped.