2 ms·

Can the gov site see who requests age verification? They already have to know who they're verifying because how else would they verify age?

Izkata 2y ago
Yes, but the idea is they wouldn't know why or for what site. In the JWT version I'm imagining, the porn site would say "go to your government website, generate this token, then copy/paste it here". There's no connection between the porn site and government site, and if the public key was retrieved and cached earlier there isn't even a timing-based way to connect them.
- some_furry 2y ago
  (JWT in general is a bad solution, but let's ignore that for the sake of discussion.) I think you're severely underestimating the efficacy of traffic analysis and correlation efforts. PrivacyPass is a better starting point, IMHO. The Cwtch developers (Open Privacy) even implemented PrivPass over Ristretto255, which is objectively awesome.
  - stvltvs 2y ago
    Didn't find many details, so please excuse the questions. So the user would get a number of signed tokens from the gov to prove age, then a token could be shared with a site that verifies age without connecting to gov, assuming it's already aware of the gov's public key? What prevents the same token from being used by more than one person? How can the site prove compliance with the law? Will they need to store the tokens for each user? Can the gov tie a stored token back to a particular person that that verified?
  - Izkata 2y ago
    Yeah, I was assuming the JWT might not be the best, but my point was that it's a simple example that doesn't require someone to read a math-heavy page. > I think you're severely underestimating the efficacy of traffic analysis and correlation efforts. The porn site would have the public key already stored/cached, so there isn't any traffic to correlate. There's still an issue with the first request, but like I said, this is a simple example that's easy to understand without getting into anything math-heavy.

Izkata 2y ago

Yes, but the idea is they wouldn't know why or for what site. In the JWT version I'm imagining, the porn site would say "go to your government website, generate this token, then copy/paste it here". There's no connection between the porn site and government site, and if the public key was retrieved and cached earlier there isn't even a timing-based way to connect them.

some_furry 2y ago
(JWT in general is a bad solution, but let's ignore that for the sake of discussion.) I think you're severely underestimating the efficacy of traffic analysis and correlation efforts. PrivacyPass is a better starting point, IMHO. The Cwtch developers (Open Privacy) even implemented PrivPass over Ristretto255, which is objectively awesome.
- stvltvs 2y ago
  Didn't find many details, so please excuse the questions. So the user would get a number of signed tokens from the gov to prove age, then a token could be shared with a site that verifies age without connecting to gov, assuming it's already aware of the gov's public key? What prevents the same token from being used by more than one person? How can the site prove compliance with the law? Will they need to store the tokens for each user? Can the gov tie a stored token back to a particular person that that verified?
- Izkata 2y ago
  Yeah, I was assuming the JWT might not be the best, but my point was that it's a simple example that doesn't require someone to read a math-heavy page. > I think you're severely underestimating the efficacy of traffic analysis and correlation efforts. The porn site would have the public key already stored/cached, so there isn't any traffic to correlate. There's still an issue with the first request, but like I said, this is a simple example that's easy to understand without getting into anything math-heavy.