3 ms·
Presumably the request contains some nonce, otherwise this is trivial to replay? But even then, I can volunteer my ID, keep it permanently attached to a comput
by progbits 1y ago
Presumably the request contains some nonce, otherwise this is trivial to replay?
But even then, I can volunteer my ID, keep it permanently attached to a computer running a server that allows certain requests (like the boolean age check), and then provide an API / client that allows anyone anywhere to use it to pass.
No risk to me (none of my data leaks), presumably no rate limits (the card has no way to track time; at best it could store recent request timestamps but I doubt it does).
In fact even better, use stolen or lost cards. Owner will get a new one, but the old one has no way of knowing it's voided. We can build a network that is able to sign whatever info (age, gender, city, name) you want, as long as we have one ID with such info.
- deleted 1y ago[deleted]
- Seattle3503 1y agoIt would probably be enough to stop an unsophisticated eight year old from seeing porn. If it turns out to be a real issue, we could figure out a way to implement pairwise pseudonyms, so that each ID has a pseudonym with each service that is unlinkable to other services. If you see a million requests from a pseudonym, that pseudonym probably an ID being abused and you can block it.
- ivan_gammel 1y ago>But even then, I can volunteer my ID, keep it permanently attached to a computer running a server that allows certain requests (like the boolean age check), and then provide an API / client that allows anyone anywhere to use it to pass. That’s not technical problem and it doesn’t have to be a technical solution to it. You will be committing fraud and maybe a few other crimes if underage users are involved. As soon as you will start advertising the service, you will be on law enforcement radar. Or maybe you don’t advertise it, but one of the boys using it will brag at school and get someone’s attention…
- progbits 1y agoYes and access to porn is not a technical problem. I don't see why my privacy is to be compromised because of incompetent parents.
- ivan_gammel 1y agoYou are not entitled to unrestricted access to any online services on condition of anonymity neither it is even possible in real world. 1) There’s always someone who knows and whom you implicitly trust. 2) trusting some random ISP or VPN provider but not IdP or specialized verification proxy is rather irrational.
- mzhaase 1y agoYou need a PIN.