4 ms·

> It would absolutely be possible to implement that stuff in a fully privacy-preserving way, with nothing but basic cryptography, and the government could absol

> It would absolutely be possible to implement that stuff in a fully privacy-preserving way, with nothing but basic cryptography, and the government could absolutely enforce that implementation. There are ways to do this which are less bad, but there is no way to do it "in a fully privacy-preserving way" without also making it fully ineffective, because if there is no way to prove who someone is then there is no way to catch anyone providing false age verification as a service to minors. But if there a way to prove that, you've demonstrated the existence of a privacy failure because you could then use the same mechanism to determine what someone is looking at.

consteval 2y ago
You can verify who someone is without knowing specifically who "who" refers to. We do it all the time. I give a one-time code to service X and it knows I am who I say I am, but the code I gave is virtually worthless information. All it knows is that I have credentials, and I am the authorized person to have those credentials because I have physical access to some device, unknown, which is known to belong to said person.
- AnthonyMouse 2y ago
  You're omitting the part where you have to disclose who you are to the party issuing the credential. If they issue you a unique credential while knowing your identity then they can trace back all your uses of it to your identity. When that party is the government or within the government's jurisdiction, the government has the capacity to do that even if the services where you use the credential are operated by a third party, so you very much haven't solved the privacy problem. The only way to actually solve it is to make the credential non-unique, i.e. issue the same one to everybody so they're fully indistinguishable. That does solve the privacy problem, but then you have the "who is telling the kids the secret password" problem.
  - tzs 2y ago
    The party that you must disclose your identity to doesn’t necessarily need to see the credential you will present to the party you wish to demonstrate your age to. A blind signature could be used to have the ID checking party sign the credential without seeing it.
    - AnthonyMouse 2y ago
      That's just introducing a complex new vector for compromise without getting out of the dichotomy. Option 1: Bob gets a credential that can be traced back to Bob; privacy fail. Option 2: Bob gets a credential that cannot be traced back to Bob, shares it with everyone; defeats the system. Notice also the tradeoff you're forcing for no benefit. If Bob has a unique blinded signature, even if the signer doesn't know the unblinded value, the verifier would and so Bob has to get a new signature for each use or the verifiers could correlate one use with another. But needing a new signature for each use creates a timing attack because now you can see that every time "someone" presents a signature to use a particular service, Bob had just requested a new signature. In this context blinded signatures have only costs and no benefits over universal shared passwords.
    - hellojesus 2y ago
      But can't the id checking party share info with the identity verification party to connect the dots?
      - tzs 2y ago
        Let W be a website that wants you to give evidence you are an adult. Let C be an age check service. A first stab at this would be something like this: 1. W gives you a token T 2. You show T and proof of identity/age to C 3. C signs T 4. You return the signed T to W 5. W checks the signature and sees it is from C The problem with that is what you noted. W and C could get together and then W could learn your full identity and C could learn that you use W. C had to see the token to sign it, so at that point C and W both know T, and so that enables that matching up. A blind signature addresses that by allowing C to sign with C needing to receive a copy of the token. The way a blind signature works is that when you get the token, T, from W you apply a transformation to it which produces T'. It is T' that you send to C to sign for you. That gives you T' and a signature for T'. The signature algorithm and the blinding transformation are chosen so that they have this property: • Given a document D, a blinded document D' produced by applying a blinding transformation do D, and a signature S' of the blinded document D', if you know the blinding transformation you can compute from D' and S' a signature S for D that will verify with the same key that produced S'. The blinding transformation involves a random number that you pick. Even if C and W get together and compare lists of tokens they have seen they won't see any matches because W only saw unblinded tokens and C only saw blinded tokens and without knowing the random number used for that particular blinding they can't tell which unblinded token matches which blinded token. They might try to match based on timing. If there isn't enough volume of people verifying they might be able to figure something out so care would definitely be needed especially at the start.
LorenPechtel 2y ago
I don't see how it could be fully privacy preserving. It's the government trying to get the information, the repository is not secure! However, you could come close. Sell a simple USB device that generates codes. It can only be purchased in person by showing ID--but the ID is not recorded. Down the road it can only be traced to the device, not to the purchaser. But you would no doubt see them for sale by unscrupulous individuals reselling them.
- AnthonyMouse 2y ago
  Why does everyone want to make it complicated? You don't need hardware. You don't need cryptography. You show your ID and you get a password. The password is the same for everyone so it can't be correlated with anyone. Will people share the password? Of course, and they would also share the signatures or devices or whatever else, because you can't prevent that while also preserving privacy.

consteval 2y ago

You can verify who someone is without knowing specifically who "who" refers to. We do it all the time. I give a one-time code to service X and it knows I am who I say I am, but the code I gave is virtually worthless information. All it knows is that I have credentials, and I am the authorized person to have those credentials because I have physical access to some device, unknown, which is known to belong to said person.

AnthonyMouse 2y ago
You're omitting the part where you have to disclose who you are to the party issuing the credential. If they issue you a unique credential while knowing your identity then they can trace back all your uses of it to your identity. When that party is the government or within the government's jurisdiction, the government has the capacity to do that even if the services where you use the credential are operated by a third party, so you very much haven't solved the privacy problem. The only way to actually solve it is to make the credential non-unique, i.e. issue the same one to everybody so they're fully indistinguishable. That does solve the privacy problem, but then you have the "who is telling the kids the secret password" problem.
- tzs 2y ago
  The party that you must disclose your identity to doesn’t necessarily need to see the credential you will present to the party you wish to demonstrate your age to. A blind signature could be used to have the ID checking party sign the credential without seeing it.
  - AnthonyMouse 2y ago
    That's just introducing a complex new vector for compromise without getting out of the dichotomy. Option 1: Bob gets a credential that can be traced back to Bob; privacy fail. Option 2: Bob gets a credential that cannot be traced back to Bob, shares it with everyone; defeats the system. Notice also the tradeoff you're forcing for no benefit. If Bob has a unique blinded signature, even if the signer doesn't know the unblinded value, the verifier would and so Bob has to get a new signature for each use or the verifiers could correlate one use with another. But needing a new signature for each use creates a timing attack because now you can see that every time "someone" presents a signature to use a particular service, Bob had just requested a new signature. In this context blinded signatures have only costs and no benefits over universal shared passwords.
  - hellojesus 2y ago
    But can't the id checking party share info with the identity verification party to connect the dots?
    - tzs 2y ago
      Let W be a website that wants you to give evidence you are an adult. Let C be an age check service. A first stab at this would be something like this: 1. W gives you a token T 2. You show T and proof of identity/age to C 3. C signs T 4. You return the signed T to W 5. W checks the signature and sees it is from C The problem with that is what you noted. W and C could get together and then W could learn your full identity and C could learn that you use W. C had to see the token to sign it, so at that point C and W both know T, and so that enables that matching up. A blind signature addresses that by allowing C to sign with C needing to receive a copy of the token. The way a blind signature works is that when you get the token, T, from W you apply a transformation to it which produces T'. It is T' that you send to C to sign for you. That gives you T' and a signature for T'. The signature algorithm and the blinding transformation are chosen so that they have this property: • Given a document D, a blinded document D' produced by applying a blinding transformation do D, and a signature S' of the blinded document D', if you know the blinding transformation you can compute from D' and S' a signature S for D that will verify with the same key that produced S'. The blinding transformation involves a random number that you pick. Even if C and W get together and compare lists of tokens they have seen they won't see any matches because W only saw unblinded tokens and C only saw blinded tokens and without knowing the random number used for that particular blinding they can't tell which unblinded token matches which blinded token. They might try to match based on timing. If there isn't enough volume of people verifying they might be able to figure something out so care would definitely be needed especially at the start.

LorenPechtel 2y ago

I don't see how it could be fully privacy preserving. It's the government trying to get the information, the repository is not secure! However, you could come close. Sell a simple USB device that generates codes. It can only be purchased in person by showing ID--but the ID is not recorded. Down the road it can only be traced to the device, not to the purchaser. But you would no doubt see them for sale by unscrupulous individuals reselling them.

AnthonyMouse 2y ago
Why does everyone want to make it complicated? You don't need hardware. You don't need cryptography. You show your ID and you get a password. The password is the same for everyone so it can't be correlated with anyone. Will people share the password? Of course, and they would also share the signatures or devices or whatever else, because you can't prevent that while also preserving privacy.