4 ms·

I'm not sure if you work in software or not, but it's definitely possible to come up with a schema where you could verify people's age in order to use a platfor

I'm not sure if you work in software or not, but it's definitely possible to come up with a schema where you could verify people's age in order to use a platform, without exposing your entire identity to said platform, with a combination of signatures and other cryptographic basics. Say you have a digital certificate from the government or similar that you use to do your taxes online or whatever, the government could have endpoints where you could use that certificate for signing a proof, that you then hand over to the platform you want to verify your age with. The platform can then confirm it's valid, and that $AGE>X, but they get no other details. You can even go a bit fancier/more complicated, and the government endpoints wouldn't know what platform you're trying to verify.

sleepychu 1y ago
How do I prevent my citizens from sharing their certificates in order to bypass the block?
- CaptainOfCoit 1y ago
  You don't, it's up to citizens to make sure whatever authentication they use can only be used by them, just like how it works for other services today where you authenticate online somehow and the government service assumes you're you since you were able to authenticate.
  - sleepychu 1y ago
    My point is that this is either a bearer token (in which case it will be obtainable by proxy) or tied to your identity. What is the incentive for the citizen to make sure their authentication isn't shared?
    - owisd 1y ago
      > obtainable by proxy So no different to the rules around buying an 18+ DVD.
    - CaptainOfCoit 1y ago
      On the government endpoint, which returns X that the platform uses as "evidence" for you being an adult, yes, that's tied to your identity, as the certificate/whatever is tied to your identity. But as long as the platform who need to validate that you're an adult don't get your identity, but just the proof, I don't see what the problem is? > What is the incentive for the citizen to make sure their authentication isn't shared? What incentives do people today have for keeping their identifications to themselves? Why aren't we all sharing CC numbers? Because we realize some data is "personal" and isn't to be used by others, like our username+passwords or whatever. This isn't exactly a new concept, just look at how it works for anything else that is tied to you.
      - mrmanner 1y ago
        > On the government endpoint, which returns X that the platform uses as "evidence" for you being an adult, yes, that's tied to your identity, as the certificate/whatever is tied to your identity. In this scenario the government knows all the age-restricted sites I've visited. I'd argue that is worse than if all the age-restricted sites I've visited know who I am... (FTR I don't know what I think about age restrictions in general, but I'm pretty sure there's no implementation that comes without negative side effects)
        Ajedi32 1y ago
        Not necessarily. The age verification proof doesn't need to be site-specific. But again, that reduces the incentive "for the citizen to make sure their authentication isn't shared" because there's nothing tying it to them. I also kinda hate the whole idea of needing explicit permission from the government to access the open web, regardless of whether or not they know which specific sites they're giving me permission to access.
        immibis 1y ago
        There's actually a much better idea that's been floating around. Require over-18 sites to set a certain header. Then anyone who wants to can install a browser on their kid's device that will block pages with the header. There's no privacy implications, no surveillance implications, no need to make VPNs illegal as long as they pass it through; it's just a plain old parental block with a regulation keeping it always up to date. Yes, you may have to stop your kid installing random software on the device to bypass whatever blocking you set up, but you had to do that anyway. If it's Apple or Google they could easily enough require everything in the app store to respect the flag when the device is set to kid mode. (If the government does the incredibly overbearing thing and does not do the simple and effective and unintrusive thing, it proves their motivations are surveillance)
    - ashdksnndck 1y ago
      How do they solve this for e-voting?
- magicalhippo 1y ago
  From what I can gather from the EU proposal[1], they rely on such details to be stored in a hardware crypto module on a phone or similar. Thus the user never has direct access, yet can use it to issue proof of age. [1]: https://ageverification.dev/av-doc-technical-specification/docs/architecture-and-technical-specifications/ https://ageverification.dev/av-doc-technical-specification/d...
  - wkat4242 1y ago
    This is even more Draconian because it demands that citizens rely on manufacturers. After all the government itself doesn't make phones or hardware crypto modules.
maybewhenthesun 1y ago
At a certain point you need to identify yourself somewhere. If I need to identify myself using a governmental certificate, that still means there's a database somewhere (which can be leaked/abused) coupling my cert to me personally. I work in software (for way too long, since the 90s) and as far as i can tell any system which can prove your age is at best pseudonymous and needs 3d parties to verify. Sure, you could create a scheme where only a 'trusted' 3d party has the link between you and your cert. But these days 'trusted' and government is not really a given, sadly. See trump.

sleepychu 1y ago

How do I prevent my citizens from sharing their certificates in order to bypass the block?

CaptainOfCoit 1y ago
You don't, it's up to citizens to make sure whatever authentication they use can only be used by them, just like how it works for other services today where you authenticate online somehow and the government service assumes you're you since you were able to authenticate.
- sleepychu 1y ago
  My point is that this is either a bearer token (in which case it will be obtainable by proxy) or tied to your identity. What is the incentive for the citizen to make sure their authentication isn't shared?
  - owisd 1y ago
    > obtainable by proxy So no different to the rules around buying an 18+ DVD.
  - CaptainOfCoit 1y ago
    On the government endpoint, which returns X that the platform uses as "evidence" for you being an adult, yes, that's tied to your identity, as the certificate/whatever is tied to your identity. But as long as the platform who need to validate that you're an adult don't get your identity, but just the proof, I don't see what the problem is? > What is the incentive for the citizen to make sure their authentication isn't shared? What incentives do people today have for keeping their identifications to themselves? Why aren't we all sharing CC numbers? Because we realize some data is "personal" and isn't to be used by others, like our username+passwords or whatever. This isn't exactly a new concept, just look at how it works for anything else that is tied to you.
    - mrmanner 1y ago
      > On the government endpoint, which returns X that the platform uses as "evidence" for you being an adult, yes, that's tied to your identity, as the certificate/whatever is tied to your identity. In this scenario the government knows all the age-restricted sites I've visited. I'd argue that is worse than if all the age-restricted sites I've visited know who I am... (FTR I don't know what I think about age restrictions in general, but I'm pretty sure there's no implementation that comes without negative side effects)
      - Ajedi32 1y ago
        Not necessarily. The age verification proof doesn't need to be site-specific. But again, that reduces the incentive "for the citizen to make sure their authentication isn't shared" because there's nothing tying it to them. I also kinda hate the whole idea of needing explicit permission from the government to access the open web, regardless of whether or not they know which specific sites they're giving me permission to access.
        immibis 1y ago
        There's actually a much better idea that's been floating around. Require over-18 sites to set a certain header. Then anyone who wants to can install a browser on their kid's device that will block pages with the header. There's no privacy implications, no surveillance implications, no need to make VPNs illegal as long as they pass it through; it's just a plain old parental block with a regulation keeping it always up to date. Yes, you may have to stop your kid installing random software on the device to bypass whatever blocking you set up, but you had to do that anyway. If it's Apple or Google they could easily enough require everything in the app store to respect the flag when the device is set to kid mode. (If the government does the incredibly overbearing thing and does not do the simple and effective and unintrusive thing, it proves their motivations are surveillance)
  - ashdksnndck 1y ago
    How do they solve this for e-voting?
magicalhippo 1y ago
From what I can gather from the EU proposal[1], they rely on such details to be stored in a hardware crypto module on a phone or similar. Thus the user never has direct access, yet can use it to issue proof of age. [1]: https://ageverification.dev/av-doc-technical-specification/docs/architecture-and-technical-specifications/ https://ageverification.dev/av-doc-technical-specification/d...
- wkat4242 1y ago
  This is even more Draconian because it demands that citizens rely on manufacturers. After all the government itself doesn't make phones or hardware crypto modules.

maybewhenthesun 1y ago

At a certain point you need to identify yourself somewhere. If I need to identify myself using a governmental certificate, that still means there's a database somewhere (which can be leaked/abused) coupling my cert to me personally. I work in software (for way too long, since the 90s) and as far as i can tell any system which can prove your age is at best pseudonymous and needs 3d parties to verify. Sure, you could create a scheme where only a 'trusted' 3d party has the link between you and your cert. But these days 'trusted' and government is not really a given, sadly. See trump.