3 ms·

If 99% of reason to get verified is to look at porn (and let's be honest, near 100% of those who want to be verified after midnight), then the website doing the

If 99% of reason to get verified is to look at porn (and let's be honest, near 100% of those who want to be verified after midnight), then the website doing the actual verification of identities has a list of people looking at porn. No amount of cryptography can protect against this. Now, if the French government issued tokens preemptively to everyone, that would work, but then it becomes trivial for to copy the tokens.

palata 1y ago
> If 99% of reason Sure, if you start with convenient assumptions, it's easy to prove your point :-). Now let's imagine that people don't need a token for each session but to create an account. Suddenly they are not asking for tokens after midnight, and not repeatedly, right? Let's push it as far as saying that other websites may need verification, e.g. social media. And for the sake of the argument, let's imagine that there are more than one social media. If the token issuer receives 4 requests from the same person, is it for 4 social media? 2 social media and 2 porn sites? Not so clear anymore. Finally, let's pair it with an "eID" app. So people get the app to use an electronic ID (which is presumably useful for things that are not porn). Let's say that when you install the app, it gets 5 age tokens for you. You may or may not use them, it just creates them. Now the token issuer sees that everybody gets 5 tokens. Difficult to say that they all need to access 5 porn websites, isn't it? I don't know if age verification is fundamentally a good thing. But "no amount of cryptography can protect against this"... I don't know. > that would work, but then it becomes trivial for to copy the tokens. Anyway it is trivial for a child to ask their parent to give them access to porn. The whole idea is that usually, parents won't do it.
- Aloisius 1y ago
  Sure, if you start requiring age verification for all sorts of other things, it becomes harder to infer anything except for the subset that are verifying their identity for the first time at 2 in the morning. Of course, understanding that requires a fair bit of technological knowledge. I imagine most people, when visiting a porn site for the first time and asked to verify their age, if sent to a process that asks them to upload their ID or show their face on camera will simply refuse to do so - regardless of any assurances as to privacy. This seems to have happened when Louisiana started requiring age verification - driving people, both children and adults, to sites that don't comply with the law, proxy servers, VPNs or Tor. I doubt it'll be any different in France.
  - palata 1y ago
    > if sent to a process that asks them to upload their ID or show their face on camera I think the whole point of the "eID" would be that people don't have to do that. Using Zero Knowledge Proof.
    - Aloisius 1y ago
      You generally have to do it to get an eID in the first place. In France's case though (from the article): > Instead, users must verify their age using a credit card or a government-issued ID. This check must be carried out by an external service, not the porn site itself.
      - palata 1y ago
        Presumably you have an ID issued by your government. This same government can provide an eID, it's not like they don't know who you are. The whole question is: is it possible to prove your age to a pornsite without exposing your identity to said pornsite and without telling your government that you use it? And that would be the point of Zero Knowledge Proofs. Now of course, there are infinitely many poor ways to verify the age.

palata 1y ago

> If 99% of reason Sure, if you start with convenient assumptions, it's easy to prove your point :-). Now let's imagine that people don't need a token for each session but to create an account. Suddenly they are not asking for tokens after midnight, and not repeatedly, right? Let's push it as far as saying that other websites may need verification, e.g. social media. And for the sake of the argument, let's imagine that there are more than one social media. If the token issuer receives 4 requests from the same person, is it for 4 social media? 2 social media and 2 porn sites? Not so clear anymore. Finally, let's pair it with an "eID" app. So people get the app to use an electronic ID (which is presumably useful for things that are not porn). Let's say that when you install the app, it gets 5 age tokens for you. You may or may not use them, it just creates them. Now the token issuer sees that everybody gets 5 tokens. Difficult to say that they all need to access 5 porn websites, isn't it? I don't know if age verification is fundamentally a good thing. But "no amount of cryptography can protect against this"... I don't know. > that would work, but then it becomes trivial for to copy the tokens. Anyway it is trivial for a child to ask their parent to give them access to porn. The whole idea is that usually, parents won't do it.

Aloisius 1y ago
Sure, if you start requiring age verification for all sorts of other things, it becomes harder to infer anything except for the subset that are verifying their identity for the first time at 2 in the morning. Of course, understanding that requires a fair bit of technological knowledge. I imagine most people, when visiting a porn site for the first time and asked to verify their age, if sent to a process that asks them to upload their ID or show their face on camera will simply refuse to do so - regardless of any assurances as to privacy. This seems to have happened when Louisiana started requiring age verification - driving people, both children and adults, to sites that don't comply with the law, proxy servers, VPNs or Tor. I doubt it'll be any different in France.
- palata 1y ago
  > if sent to a process that asks them to upload their ID or show their face on camera I think the whole point of the "eID" would be that people don't have to do that. Using Zero Knowledge Proof.
  - Aloisius 1y ago
    You generally have to do it to get an eID in the first place. In France's case though (from the article): > Instead, users must verify their age using a credit card or a government-issued ID. This check must be carried out by an external service, not the porn site itself.
    - palata 1y ago
      Presumably you have an ID issued by your government. This same government can provide an eID, it's not like they don't know who you are. The whole question is: is it possible to prove your age to a pornsite without exposing your identity to said pornsite and without telling your government that you use it? And that would be the point of Zero Knowledge Proofs. Now of course, there are infinitely many poor ways to verify the age.