3 ms·

I don't see why you need the first step. What you need[0] is a certificate, signed by a recognised provider[1], asserting that email address X is associated wi

I don't see why you need the first step. What you need[0] is a certificate, signed by a recognised provider[1], asserting that email address X is associated with a person aged over 18. Once you have that, you can then provide it to anyone who asks for it. The certificate provider doesn't need to know who you're proving it to. Literally all they have to do is check whatever information they need to[2] to be happy asserting "Oh yeah, that's an adult". If your browser (or an add-on for it) wanted to make this easy by storing the certificate for you securely, then that would be awesome, obviously. But there's no reason why the certification provider needs to know who they're certifying your adulthood to. [0]Assuming that you want a way to prove you're an adult. [1]That could be a bank, a government, or anyone else who has sufficient levels of societal trust. [2]Photo of you, use of a credit card, records of you using that email address for more than 18 years. Whatever makes them happy making that assertion, that they'd be willing to stand up in court and defend their processes if one of their certificates was issued wrongly.

ajsnigrutin 1y ago
But that requires sharing your email every time you want to open pornhub.
- AndrewDucker 1y ago
  I would absolutely set up an alternate email address for use with things I didn't want my identity to be associated with. Possibly several of them. The alternative is something like the Zero Knowledge Proofs that Google recently open sourced: https://blog.google/technology/safety-security/opening-up-zero-knowledge-proof-technology-to-promote-privacy-in-age-assurance/ https://blog.google/technology/safety-security/opening-up-ze... This would allow you to prove that you have the certificate that was issued to you, without giving up more detail than that. I think that building that into things is a ways off though.
  - ajsnigrutin 1y ago
    I mean, the alternative is parents parenting their kids and installing parental control on their phones, and well.. pornhub without providing your email. Kids will still be able to torrent porn, but the end goal of having to use real ID with social networks will prevent any free speech still left and kill online anonymity.
    - GoblinSlayer 1y ago
      Don't they require phone number already? Also messengers.
jeroenhd 1y ago
Why would you need to include the email address? Just the token should be enough, shouldn't it? Handing out a valid certificate is proof already, you can leave the common name empty as long as it's signed by the right authority. This approach does make it rather trivial to clone certificates and spread them, though. All it takes is one kid on their parents' computer dumping a p12 file and the entire school is suddenly bypassing age filters. Another problem is that colluding websites/trackers (i.e. those "first party" trackers that will use things like CNAMEs to trick browsers into executing their tracker code) can use the public key you use to authenticate your age to track you across websites. Your public key will also be non-repudiable unless your CA often makes you reauthenticate and publishes your private key after expiry (similar to how Signal does this, except less secure).

ajsnigrutin 1y ago

But that requires sharing your email every time you want to open pornhub.

AndrewDucker 1y ago
I would absolutely set up an alternate email address for use with things I didn't want my identity to be associated with. Possibly several of them. The alternative is something like the Zero Knowledge Proofs that Google recently open sourced: https://blog.google/technology/safety-security/opening-up-zero-knowledge-proof-technology-to-promote-privacy-in-age-assurance/ https://blog.google/technology/safety-security/opening-up-ze... This would allow you to prove that you have the certificate that was issued to you, without giving up more detail than that. I think that building that into things is a ways off though.
- ajsnigrutin 1y ago
  I mean, the alternative is parents parenting their kids and installing parental control on their phones, and well.. pornhub without providing your email. Kids will still be able to torrent porn, but the end goal of having to use real ID with social networks will prevent any free speech still left and kill online anonymity.
  - GoblinSlayer 1y ago
    Don't they require phone number already? Also messengers.

jeroenhd 1y ago

Why would you need to include the email address? Just the token should be enough, shouldn't it? Handing out a valid certificate is proof already, you can leave the common name empty as long as it's signed by the right authority. This approach does make it rather trivial to clone certificates and spread them, though. All it takes is one kid on their parents' computer dumping a p12 file and the entire school is suddenly bypassing age filters. Another problem is that colluding websites/trackers (i.e. those "first party" trackers that will use things like CNAMEs to trick browsers into executing their tracker code) can use the public key you use to authenticate your age to track you across websites. Your public key will also be non-repudiable unless your CA often makes you reauthenticate and publishes your private key after expiry (similar to how Signal does this, except less secure).