3 ms·

But it is. In those European countries, IDPs and certification authorities are one and the same entity. So the technical requirement of privacy evaporates, the

But it is. In those European countries, IDPs and certification authorities are one and the same entity. So the technical requirement of privacy evaporates, the government will always know who is proving their age to which porn site.

therein 1y ago
I don't know why you are downvoted. And even more disappointingly, it is interesting how easily people overlook the fact that this is happening in lockstep across the globe, obviously the goal is to deanonymize the internet. I can't wait for the next generation that will enjoy "nerding out" on how to best patrol every neighborhood with drones. Let's put NFC tags on everyone at birth, we can then nerd out harder.
ivan_gammel 1y ago
That’s easy to fix. The IdP and the checking service do not have to be the same. The checking service can be a 3rd party that works with IdP verifying facts on behalf of regulated services like porn sites. The job of IdP is to certify the facts and do KYC for checkers to ensure they don’t cheat. The regulated service can ask customer which checker do they use and then ask the checker. The customer may have a long term relationship with preferred checker on a market where multiple checkers exist and reputation matters for being competitive. This way checker is incentivized to maintain privacy and does not have conflicts of interest like the government. Government agencies can still investigate customers but they will need a court order to get the data from checkers.
- raxxorraxor 1y ago
  In Germany police illegally accessed contact list from apps verifying your vaccination status for corona. I don't see it differently here and it is no use for victims if the courts are included later. The simple reality is that no state is adult enough to handle this responsibility. Why should I accept the berlin internet wall anywhere? Any ecosystem should fight back against such ambitions. If it really is about protecting kids, there could be some easy laws improving their privacy. These are not wanted. As well as there is no political will to restrict tracking for advertising and gambling.
- crote 1y ago
  And how is the general public supposed to verify that the IdP and checking service aren't collaborating? If it is possible for a checking service to create a log, given how Big Tech has been treating user data, how can we ever trust that they aren't logging everyone's data? Reputation is irrelevant. Everyone is trustworthy - until they are not. The dark web is filled with data leaks from reputable parties.
  - ivan_gammel 1y ago
    How general public is supposed to believe that lawyers do not collaborate with prosecutors? The trust has to be somewhere, so it seems quite natural that the most trustworthy entity is the one whose sole reason to exist is to protect your data.
tzs 1y ago
IDPs and certificate authorities can be the same with no problem if you design your protocol so that the porn sites do not see your certificates. E.g., IDP issues you signed identity credentials. To prove age to the porn site a ZKP is used to prove to the porn site that you have signed credentials that give you age as 18+ but without giving the porn site any information other than that. The ZKP approach is what the EU is doing. Note that in the article the objection to ZKP systems is not that they don't work correctly (because they do work). It is that it can be hard for some people to obtain IDs, it may cost to much for some sites, it could be hard to regulate IDPs effectively, and things like that.
- Muromec 1y ago
  The point they are making is the privacy protection doesn't extend both ways. There are two ways the information can leak: - from the IDP to a port side, so the porn site will know what's your name (what a shame, how would I pretend it didn't happen after I close the tab); - from the porn site to the IDP -- now your government knows that you watch porn and maybe the exact type of porn, so they can charge you a different tax rate for being straight. Then of course, just by correlating ip addresses and timestamps in logs of the IDP and the porn site one can deanonimyze the visitors. Or just by ip in the logs itself because you don't pay your ISP in bitcoins.
  - tzs 1y ago
    Neither of those ways works in ZKP systems like the EU is in the process of doing or the one Google recently released open source libraries for. The way these work is that the IDP issues a signed digital ID that is stored in a hardware security module tied to you. Typically this would be in your smartphone but could be something else like a smart card. Let's go with a smartphone for the rest of this comment. Later, when you want to prove to a porn site that you are 18+ your smartphone can use a zero knowledge proof (ZKP) protocol to prove the porn site that your phone contains a signed ID from your IDP that shows your age is 18+. The ZKP proof reveals nothing else from your digital ID other than that the date of birth field is at least 18 years in the past. All the porn site finds out is that someone who has an ID from your IDP that says they are 18+ is trying to use the porn site. The IDP doesn't learn anything because they aren't involved in the age verification.

therein 1y ago

I don't know why you are downvoted. And even more disappointingly, it is interesting how easily people overlook the fact that this is happening in lockstep across the globe, obviously the goal is to deanonymize the internet. I can't wait for the next generation that will enjoy "nerding out" on how to best patrol every neighborhood with drones. Let's put NFC tags on everyone at birth, we can then nerd out harder.

ivan_gammel 1y ago

That’s easy to fix. The IdP and the checking service do not have to be the same. The checking service can be a 3rd party that works with IdP verifying facts on behalf of regulated services like porn sites. The job of IdP is to certify the facts and do KYC for checkers to ensure they don’t cheat. The regulated service can ask customer which checker do they use and then ask the checker. The customer may have a long term relationship with preferred checker on a market where multiple checkers exist and reputation matters for being competitive. This way checker is incentivized to maintain privacy and does not have conflicts of interest like the government. Government agencies can still investigate customers but they will need a court order to get the data from checkers.

raxxorraxor 1y ago
In Germany police illegally accessed contact list from apps verifying your vaccination status for corona. I don't see it differently here and it is no use for victims if the courts are included later. The simple reality is that no state is adult enough to handle this responsibility. Why should I accept the berlin internet wall anywhere? Any ecosystem should fight back against such ambitions. If it really is about protecting kids, there could be some easy laws improving their privacy. These are not wanted. As well as there is no political will to restrict tracking for advertising and gambling.
crote 1y ago
And how is the general public supposed to verify that the IdP and checking service aren't collaborating? If it is possible for a checking service to create a log, given how Big Tech has been treating user data, how can we ever trust that they aren't logging everyone's data? Reputation is irrelevant. Everyone is trustworthy - until they are not. The dark web is filled with data leaks from reputable parties.
- ivan_gammel 1y ago
  How general public is supposed to believe that lawyers do not collaborate with prosecutors? The trust has to be somewhere, so it seems quite natural that the most trustworthy entity is the one whose sole reason to exist is to protect your data.

tzs 1y ago

IDPs and certificate authorities can be the same with no problem if you design your protocol so that the porn sites do not see your certificates. E.g., IDP issues you signed identity credentials. To prove age to the porn site a ZKP is used to prove to the porn site that you have signed credentials that give you age as 18+ but without giving the porn site any information other than that. The ZKP approach is what the EU is doing. Note that in the article the objection to ZKP systems is not that they don't work correctly (because they do work). It is that it can be hard for some people to obtain IDs, it may cost to much for some sites, it could be hard to regulate IDPs effectively, and things like that.

Muromec 1y ago
The point they are making is the privacy protection doesn't extend both ways. There are two ways the information can leak: - from the IDP to a port side, so the porn site will know what's your name (what a shame, how would I pretend it didn't happen after I close the tab); - from the porn site to the IDP -- now your government knows that you watch porn and maybe the exact type of porn, so they can charge you a different tax rate for being straight. Then of course, just by correlating ip addresses and timestamps in logs of the IDP and the porn site one can deanonimyze the visitors. Or just by ip in the logs itself because you don't pay your ISP in bitcoins.
- tzs 1y ago
  Neither of those ways works in ZKP systems like the EU is in the process of doing or the one Google recently released open source libraries for. The way these work is that the IDP issues a signed digital ID that is stored in a hardware security module tied to you. Typically this would be in your smartphone but could be something else like a smart card. Let's go with a smartphone for the rest of this comment. Later, when you want to prove to a porn site that you are 18+ your smartphone can use a zero knowledge proof (ZKP) protocol to prove the porn site that your phone contains a signed ID from your IDP that shows your age is 18+. The ZKP proof reveals nothing else from your digital ID other than that the date of birth field is at least 18 years in the past. All the porn site finds out is that someone who has an ID from your IDP that says they are 18+ is trying to use the porn site. The IDP doesn't learn anything because they aren't involved in the age verification.