3 ms·

IDPs and certificate authorities can be the same with no problem if you design your protocol so that the porn sites do not see your certificates. E.g., IDP issu

by tzs 1y ago

IDPs and certificate authorities can be the same with no problem if you design your protocol so that the porn sites do not see your certificates. E.g., IDP issues you signed identity credentials. To prove age to the porn site a ZKP is used to prove to the porn site that you have signed credentials that give you age as 18+ but without giving the porn site any information other than that. The ZKP approach is what the EU is doing. Note that in the article the objection to ZKP systems is not that they don't work correctly (because they do work). It is that it can be hard for some people to obtain IDs, it may cost to much for some sites, it could be hard to regulate IDPs effectively, and things like that.

Muromec 1y ago
The point they are making is the privacy protection doesn't extend both ways. There are two ways the information can leak: - from the IDP to a port side, so the porn site will know what's your name (what a shame, how would I pretend it didn't happen after I close the tab); - from the porn site to the IDP -- now your government knows that you watch porn and maybe the exact type of porn, so they can charge you a different tax rate for being straight. Then of course, just by correlating ip addresses and timestamps in logs of the IDP and the porn site one can deanonimyze the visitors. Or just by ip in the logs itself because you don't pay your ISP in bitcoins.
- tzs 1y ago
  Neither of those ways works in ZKP systems like the EU is in the process of doing or the one Google recently released open source libraries for. The way these work is that the IDP issues a signed digital ID that is stored in a hardware security module tied to you. Typically this would be in your smartphone but could be something else like a smart card. Let's go with a smartphone for the rest of this comment. Later, when you want to prove to a porn site that you are 18+ your smartphone can use a zero knowledge proof (ZKP) protocol to prove the porn site that your phone contains a signed ID from your IDP that shows your age is 18+. The ZKP proof reveals nothing else from your digital ID other than that the date of birth field is at least 18 years in the past. All the porn site finds out is that someone who has an ID from your IDP that says they are 18+ is trying to use the porn site. The IDP doesn't learn anything because they aren't involved in the age verification.
  - Muromec 1y ago
    That assumes 1) the proof material in question is not fingerprintable and 2) both sides of the equation aren't doing something behind your back to connect the dots.

by tzs 1y ago

Muromec 1y ago

The point they are making is the privacy protection doesn't extend both ways. There are two ways the information can leak: - from the IDP to a port side, so the porn site will know what's your name (what a shame, how would I pretend it didn't happen after I close the tab); - from the porn site to the IDP -- now your government knows that you watch porn and maybe the exact type of porn, so they can charge you a different tax rate for being straight. Then of course, just by correlating ip addresses and timestamps in logs of the IDP and the porn site one can deanonimyze the visitors. Or just by ip in the logs itself because you don't pay your ISP in bitcoins.

tzs 1y ago
Neither of those ways works in ZKP systems like the EU is in the process of doing or the one Google recently released open source libraries for. The way these work is that the IDP issues a signed digital ID that is stored in a hardware security module tied to you. Typically this would be in your smartphone but could be something else like a smart card. Let's go with a smartphone for the rest of this comment. Later, when you want to prove to a porn site that you are 18+ your smartphone can use a zero knowledge proof (ZKP) protocol to prove the porn site that your phone contains a signed ID from your IDP that shows your age is 18+. The ZKP proof reveals nothing else from your digital ID other than that the date of birth field is at least 18 years in the past. All the porn site finds out is that someone who has an ID from your IDP that says they are 18+ is trying to use the porn site. The IDP doesn't learn anything because they aren't involved in the age verification.
- Muromec 1y ago
  That assumes 1) the proof material in question is not fingerprintable and 2) both sides of the equation aren't doing something behind your back to connect the dots.