3 ms·
Age verification is easy. Age verification that leaves no record, is anonymous, and not circumvent-able is difficult. In the physical world it relies on the fal
by _Algernon_ 1y ago
Age verification is easy. Age verification that leaves no record, is anonymous, and not circumvent-able is difficult. In the physical world it relies on the fallibility of human memory. No such luck with replicated databases.
- chgs 1y agoSite generates random key Key and verification passed to verifier Verified list is published Site pulls list and checks its number has been verified Site doesn’t know who it is, and verifier doesn’t know which site was verified against
- _Algernon_ 1y agoHow do you prove that the generated key by the site is actually randomly generated? I certainly don't trust a random porn site to do this right. If the verified list is tied against identity, there is only a simple law change required to de-anonymize everything.
- chgs 1y agoDoesn’t really matter surely, you only need to trust the identity provider not to leak your identity and your porn provider not to have a key that your identity provider can link to.
- thinkharderdev 1y agoYou don't trust people who run a massive-scale streaming video platform to have the technical chops to generate random numbers?
- _Algernon_ 1y agoI trust them to have the capability to do it. I don't trust them to be willing to do it despite legal duress (which is only ever a law-change away).
- sigwinch 1y agoBreak the key in half. Otherwise, why wouldn’t I just try the last entries from that list?
- chgs 1y agoThey key would be hashed with the user’s details (ip address, value in a session cookie etc) so someone else can’t reuse it. Hell there are things like elliptic curves and DH which still seem magic to me. Now sure if the identity provider and the site work together they could negate the anonymity, but given that for the identity provider anonymisation would be the key selling feature they wouldn’t want to risk that. Mullvad I’m sure would be trustworthy enough.
- baq 1y agoAn id card is a bearer token. You can get an anonymous, cryptographically signed, certified legal bearer token confirming your age only, or identity or whatever by a centralized service, be it government or high trust private organizations who need to verify your identity anyway like banks. With some smarts you can probably make such a token yourself so the root bearer token issuer doesn’t have the one you use to browse pornhub.
- _Algernon_ 1y agoWhich inevitably can be deanonymized after a simple law change, mandating the required data to be reported.
- techjamie 1y agohttps://datatracker.ietf.org/wg/privacypass/about/ https://datatracker.ietf.org/wg/privacypass/about/ Perhaps a system like Privacy Pass would be ideal. Where a verifier generates a verified client a number of redeemable signed tokens for a session, but when presented by a client, the site doesn't know who that token was issued to, but they know they authenticated this person and can verify they made the token. Therefore they get access.
- heavyset_go 1y agoYou're looking for a technical solution to a political problem. This tech is useless the second a law is passed that identities have to be logged. It's also useless if implementers decide to collect identifying information without telling you.
- _Algernon_ 1y agoThat also weakens circumventability. What's stopping me to sell my signed tokens to the highest bidder on ebay?
- 2OEH8eoCRo0 1y agoThat verification doesn't even exist in meatspace though. We are setting an impossibly high bar to try to weasel out of implementing anything.