4 ms·

The point they are making is the privacy protection doesn't extend both ways. There are two ways the information can leak: - from the IDP to a port side, so th

The point they are making is the privacy protection doesn't extend both ways. There are two ways the information can leak: - from the IDP to a port side, so the porn site will know what's your name (what a shame, how would I pretend it didn't happen after I close the tab); - from the porn site to the IDP -- now your government knows that you watch porn and maybe the exact type of porn, so they can charge you a different tax rate for being straight. Then of course, just by correlating ip addresses and timestamps in logs of the IDP and the porn site one can deanonimyze the visitors. Or just by ip in the logs itself because you don't pay your ISP in bitcoins.

tzs 1y ago
Neither of those ways works in ZKP systems like the EU is in the process of doing or the one Google recently released open source libraries for. The way these work is that the IDP issues a signed digital ID that is stored in a hardware security module tied to you. Typically this would be in your smartphone but could be something else like a smart card. Let's go with a smartphone for the rest of this comment. Later, when you want to prove to a porn site that you are 18+ your smartphone can use a zero knowledge proof (ZKP) protocol to prove the porn site that your phone contains a signed ID from your IDP that shows your age is 18+. The ZKP proof reveals nothing else from your digital ID other than that the date of birth field is at least 18 years in the past. All the porn site finds out is that someone who has an ID from your IDP that says they are 18+ is trying to use the porn site. The IDP doesn't learn anything because they aren't involved in the age verification.
- Muromec 1y ago
  That assumes 1) the proof material in question is not fingerprintable and 2) both sides of the equation aren't doing something behind your back to connect the dots.

tzs 1y ago

Neither of those ways works in ZKP systems like the EU is in the process of doing or the one Google recently released open source libraries for. The way these work is that the IDP issues a signed digital ID that is stored in a hardware security module tied to you. Typically this would be in your smartphone but could be something else like a smart card. Let's go with a smartphone for the rest of this comment. Later, when you want to prove to a porn site that you are 18+ your smartphone can use a zero knowledge proof (ZKP) protocol to prove the porn site that your phone contains a signed ID from your IDP that shows your age is 18+. The ZKP proof reveals nothing else from your digital ID other than that the date of birth field is at least 18 years in the past. All the porn site finds out is that someone who has an ID from your IDP that says they are 18+ is trying to use the porn site. The IDP doesn't learn anything because they aren't involved in the age verification.

Muromec 1y ago
That assumes 1) the proof material in question is not fingerprintable and 2) both sides of the equation aren't doing something behind your back to connect the dots.