4 ms·

> This check must be carried out by an external service, not the porn site itself > the porn site receives only a yes-or-no confirmation that the user is of le

> This check must be carried out by an external service, not the porn site itself > the porn site receives only a yes-or-no confirmation that the user is of legal age What does the external service receive?

palata 1y ago
There are cryptographic ways to do that (e.g. [1]), making sure (or at least "difficult") that the external website cannot track you. [1]: https://privacypass.github.io https://privacypass.github.io
- close04 1y ago
  There are always ways. But I asked what is that external provider actually receiving. Or to put it differently, what is it allowed to receive. If the law forces down people's throats an intermediary between them and a porn site, then it better also force the intermediary to guarantee anonymity.
  - palata 1y ago
    > There are always ways. Hmm... > But I asked what is that external provider actually receiving. Sure, I don't know. What I'm saying is that at least it seems possible to make is reasonably private. That's better than if it was impossible, e.g. putting a backdoor in E2EE "only for the good guys". But then I would be contradicting your statement that "there are always ways", so... well.
- Aloisius 1y ago
  If 99% of reason to get verified is to look at porn (and let's be honest, near 100% of those who want to be verified after midnight), then the website doing the actual verification of identities has a list of people looking at porn. No amount of cryptography can protect against this. Now, if the French government issued tokens preemptively to everyone, that would work, but then it becomes trivial for to copy the tokens.
  - palata 1y ago
    > If 99% of reason Sure, if you start with convenient assumptions, it's easy to prove your point :-). Now let's imagine that people don't need a token for each session but to create an account. Suddenly they are not asking for tokens after midnight, and not repeatedly, right? Let's push it as far as saying that other websites may need verification, e.g. social media. And for the sake of the argument, let's imagine that there are more than one social media. If the token issuer receives 4 requests from the same person, is it for 4 social media? 2 social media and 2 porn sites? Not so clear anymore. Finally, let's pair it with an "eID" app. So people get the app to use an electronic ID (which is presumably useful for things that are not porn). Let's say that when you install the app, it gets 5 age tokens for you. You may or may not use them, it just creates them. Now the token issuer sees that everybody gets 5 tokens. Difficult to say that they all need to access 5 porn websites, isn't it? I don't know if age verification is fundamentally a good thing. But "no amount of cryptography can protect against this"... I don't know. > that would work, but then it becomes trivial for to copy the tokens. Anyway it is trivial for a child to ask their parent to give them access to porn. The whole idea is that usually, parents won't do it.
    - Aloisius 1y ago
      Sure, if you start requiring age verification for all sorts of other things, it becomes harder to infer anything except for the subset that are verifying their identity for the first time at 2 in the morning. Of course, understanding that requires a fair bit of technological knowledge. I imagine most people, when visiting a porn site for the first time and asked to verify their age, if sent to a process that asks them to upload their ID or show their face on camera will simply refuse to do so - regardless of any assurances as to privacy. This seems to have happened when Louisiana started requiring age verification - driving people, both children and adults, to sites that don't comply with the law, proxy servers, VPNs or Tor. I doubt it'll be any different in France.
      - palata 1y ago
        > if sent to a process that asks them to upload their ID or show their face on camera I think the whole point of the "eID" would be that people don't have to do that. Using Zero Knowledge Proof.

palata 1y ago

There are cryptographic ways to do that (e.g. [1]), making sure (or at least "difficult") that the external website cannot track you. [1]: https://privacypass.github.io https://privacypass.github.io

close04 1y ago
There are always ways. But I asked what is that external provider actually receiving. Or to put it differently, what is it allowed to receive. If the law forces down people's throats an intermediary between them and a porn site, then it better also force the intermediary to guarantee anonymity.
- palata 1y ago
  > There are always ways. Hmm... > But I asked what is that external provider actually receiving. Sure, I don't know. What I'm saying is that at least it seems possible to make is reasonably private. That's better than if it was impossible, e.g. putting a backdoor in E2EE "only for the good guys". But then I would be contradicting your statement that "there are always ways", so... well.
Aloisius 1y ago
If 99% of reason to get verified is to look at porn (and let's be honest, near 100% of those who want to be verified after midnight), then the website doing the actual verification of identities has a list of people looking at porn. No amount of cryptography can protect against this. Now, if the French government issued tokens preemptively to everyone, that would work, but then it becomes trivial for to copy the tokens.
- palata 1y ago
  > If 99% of reason Sure, if you start with convenient assumptions, it's easy to prove your point :-). Now let's imagine that people don't need a token for each session but to create an account. Suddenly they are not asking for tokens after midnight, and not repeatedly, right? Let's push it as far as saying that other websites may need verification, e.g. social media. And for the sake of the argument, let's imagine that there are more than one social media. If the token issuer receives 4 requests from the same person, is it for 4 social media? 2 social media and 2 porn sites? Not so clear anymore. Finally, let's pair it with an "eID" app. So people get the app to use an electronic ID (which is presumably useful for things that are not porn). Let's say that when you install the app, it gets 5 age tokens for you. You may or may not use them, it just creates them. Now the token issuer sees that everybody gets 5 tokens. Difficult to say that they all need to access 5 porn websites, isn't it? I don't know if age verification is fundamentally a good thing. But "no amount of cryptography can protect against this"... I don't know. > that would work, but then it becomes trivial for to copy the tokens. Anyway it is trivial for a child to ask their parent to give them access to porn. The whole idea is that usually, parents won't do it.
  - Aloisius 1y ago
    Sure, if you start requiring age verification for all sorts of other things, it becomes harder to infer anything except for the subset that are verifying their identity for the first time at 2 in the morning. Of course, understanding that requires a fair bit of technological knowledge. I imagine most people, when visiting a porn site for the first time and asked to verify their age, if sent to a process that asks them to upload their ID or show their face on camera will simply refuse to do so - regardless of any assurances as to privacy. This seems to have happened when Louisiana started requiring age verification - driving people, both children and adults, to sites that don't comply with the law, proxy servers, VPNs or Tor. I doubt it'll be any different in France.
    - palata 1y ago
      > if sent to a process that asks them to upload their ID or show their face on camera I think the whole point of the "eID" would be that people don't have to do that. Using Zero Knowledge Proof.