4 ms·

This is interesting, but I’d like to go a step further. I watched the first quarter of the video on where they go over how it works. The site requests data from

This is interesting, but I’d like to go a step further. I watched the first quarter of the video on where they go over how it works. The site requests data from your ID and they get that data. The site chooses which data it needs and if it will store it or it or not. Sites these days have a tendency to ask for more than what they need, and to store it for profiling purposes. The user can deny the request, but then can’t use the site. They are then left with a dilemma. Give up this personal information or not have access at all? Companies are betting on users giving up privacy in exchange for access. What I’d like to see is for the site’s request to contain their access rules. Must be over 18, must be in country X, etc. Then on-device it checks my ID against that rule set, and simply returns a pass/fail result from those checks. This way the site would know if I’m allowed to be there, but they don’t get any specific or identifiable information about me. Maybe I’m 18, maybe I’m 56… they don’t know, they both simply send a pass. For a simple age check, a user’s exact birthday, name, address, etc are irrelevant, but I bet companies will get greedy and try to pull it anyway. I see the monkey paw of the ID spec as leading to more companies seeking to get all our data, when they really don’t need it, and have shown they can’t be trusted with it. I already see this with Apple Pay. When buying a digital item, some companies are awesome and simply take the payment with no other data. Others pull name, address, email, etc to make a payment when none of that is required.

conradev 1y ago
The spec is being implemented by Apple, who is sensitive to privacy issues. The intent of the ISO spec is to allow you to request fine-grained data, like birth year only, but if you read the W3C standard, they explicitly call out privacy as a complex thing that maybe should be regulated. The spec spells out the complexity: some ID verification processes actually need a lot of info! But some, like an alcohol age check, do not. The spec can do both, but it’s hard to differentiate these technically. The spec does lay out what user agents should do to make it clear which information is going where. A bad scenario would be designing an API that is too hobbled to replace the invasive “photo of an ID” companies, which this spec seeks to do. I’d prefer an open web standard that can be abused (with user consent) to a closed App Store-only API or the status quo
- AnthonyMouse 1y ago
  > The intent of the ISO spec is to allow you to request fine-grained data, like birth year only, but if you read the W3C standard, they explicitly call out privacy as a complex thing that maybe should be regulated. Aren't the regulations the problem here? If not for that nobody would be getting pressured to divulge this personal information to every shady app and website in the first place. Suppose I want to make a service that verifies your age by asking you questions about what life was like before 9/11. Can I do that? And if I can't, is the problem the standards, or the law?
  - mlyle 1y ago
    I think most age verification ranges from silly to chilling to speech. But I don’t think we can somehow punt these problems to the quiz from the beginning of Leisure Suit Larry (which never stopped 10 year old me).
    - AnthonyMouse 1y ago
      Requiring someone to have a government ID isn't anywhere near 100% effective because people will just borrow one from dad's wallet while he's not looking or use a device already signed in as someone else or the high school freshmen will get one from the high school seniors etc. If we're admitting solutions that aren't 100% effective, why can't we admit solutions that aren't 100% effective but are much better at preserving privacy?
      - dcow 1y ago
        Well this time around the phone will ask the person presenting an ID for biometrics before allowing them to use Dad’s ID. We are improving. There is no perfect solution; we don’t live in a perfect world. Surely we shouldn’t give up and regulate nothing…
        AnthonyMouse 1y ago
        > Well this time around the phone will ask the person presenting an ID for biometrics before allowing them to use Dad’s ID. We are improving. How is this improving? It's the most invasive proposal yet, serves to prohibit devices that are controlled by their owners and still doesn't actually work because a) there are still a zillion devices with security vulnerabilities and b) none of this applies to websites hosted in other jurisdictions, so you're not actually limiting the access of minors to anything, you're only inconveniencing anyone who does have servers in the US or interacts with any that are. Which is an extremely large number of people to trouble for a benefit that rounds to zero. > Surely we shouldn’t give up and regulate nothing... When we're in the category of speech, let's go with this option all the way to the wall.
rocqua 1y ago
Zero knowledge proofs are the solution. The website sends the verification function to the user device. The user device then returns a proof that it knows an input that the verification function accepts. The verification function should include a digital signature check. This is generally possible already with SSI based credentials, including standards created by W3C.
- tanewishly 1y ago
  Or attribute-based credentials. Basically, you're challenged and get a one-time, challenger-specific credential for exactly the requested attribute(s) from a credential provider. Eg. government (municipality, province, national) can become a credential provider. Eg. Yivy: https://docs.yivi.app/technical-overview/ https://docs.yivi.app/technical-overview/
  - ac50hz 1y ago
    Exactly. Yivi isn’t new having been renamed from IRMA (https://privacybydesign.foundation/en/ https://privacybydesign.foundation/en/). Nevertheless, adoption outside the Netherlands remains almost non-existent. Except for the additional download requirement for a user, the friction is pretty low once it’s setup and you have created some attributes. The project would benefit from a rebranding review, standardization, an enterprise-capable infrastructure to promote and support alternative service providers, and a review of clients. The current Yivi mobile app hasn’t changed much over the years and when I last used it I still needed a PIN instead Face ID.
OldfieldFund 1y ago
Those $99 fake driver's license sites are going to make a killing

conradev 1y ago

The spec is being implemented by Apple, who is sensitive to privacy issues. The intent of the ISO spec is to allow you to request fine-grained data, like birth year only, but if you read the W3C standard, they explicitly call out privacy as a complex thing that maybe should be regulated. The spec spells out the complexity: some ID verification processes actually need a lot of info! But some, like an alcohol age check, do not. The spec can do both, but it’s hard to differentiate these technically. The spec does lay out what user agents should do to make it clear which information is going where. A bad scenario would be designing an API that is too hobbled to replace the invasive “photo of an ID” companies, which this spec seeks to do. I’d prefer an open web standard that can be abused (with user consent) to a closed App Store-only API or the status quo

AnthonyMouse 1y ago
> The intent of the ISO spec is to allow you to request fine-grained data, like birth year only, but if you read the W3C standard, they explicitly call out privacy as a complex thing that maybe should be regulated. Aren't the regulations the problem here? If not for that nobody would be getting pressured to divulge this personal information to every shady app and website in the first place. Suppose I want to make a service that verifies your age by asking you questions about what life was like before 9/11. Can I do that? And if I can't, is the problem the standards, or the law?
- mlyle 1y ago
  I think most age verification ranges from silly to chilling to speech. But I don’t think we can somehow punt these problems to the quiz from the beginning of Leisure Suit Larry (which never stopped 10 year old me).
  - AnthonyMouse 1y ago
    Requiring someone to have a government ID isn't anywhere near 100% effective because people will just borrow one from dad's wallet while he's not looking or use a device already signed in as someone else or the high school freshmen will get one from the high school seniors etc. If we're admitting solutions that aren't 100% effective, why can't we admit solutions that aren't 100% effective but are much better at preserving privacy?
    - dcow 1y ago
      Well this time around the phone will ask the person presenting an ID for biometrics before allowing them to use Dad’s ID. We are improving. There is no perfect solution; we don’t live in a perfect world. Surely we shouldn’t give up and regulate nothing…
      - AnthonyMouse 1y ago
        > Well this time around the phone will ask the person presenting an ID for biometrics before allowing them to use Dad’s ID. We are improving. How is this improving? It's the most invasive proposal yet, serves to prohibit devices that are controlled by their owners and still doesn't actually work because a) there are still a zillion devices with security vulnerabilities and b) none of this applies to websites hosted in other jurisdictions, so you're not actually limiting the access of minors to anything, you're only inconveniencing anyone who does have servers in the US or interacts with any that are. Which is an extremely large number of people to trouble for a benefit that rounds to zero. > Surely we shouldn’t give up and regulate nothing... When we're in the category of speech, let's go with this option all the way to the wall.

rocqua 1y ago

Zero knowledge proofs are the solution. The website sends the verification function to the user device. The user device then returns a proof that it knows an input that the verification function accepts. The verification function should include a digital signature check. This is generally possible already with SSI based credentials, including standards created by W3C.

tanewishly 1y ago
Or attribute-based credentials. Basically, you're challenged and get a one-time, challenger-specific credential for exactly the requested attribute(s) from a credential provider. Eg. government (municipality, province, national) can become a credential provider. Eg. Yivy: https://docs.yivi.app/technical-overview/ https://docs.yivi.app/technical-overview/
- ac50hz 1y ago
  Exactly. Yivi isn’t new having been renamed from IRMA (https://privacybydesign.foundation/en/ https://privacybydesign.foundation/en/). Nevertheless, adoption outside the Netherlands remains almost non-existent. Except for the additional download requirement for a user, the friction is pretty low once it’s setup and you have created some attributes. The project would benefit from a rebranding review, standardization, an enterprise-capable infrastructure to promote and support alternative service providers, and a review of clients. The current Yivi mobile app hasn’t changed much over the years and when I last used it I still needed a PIN instead Face ID.

OldfieldFund 1y ago

Those $99 fake driver's license sites are going to make a killing