3 ms·
Can attestations be rate-limited or is that the timing side-channel you are talking about?
by actionfromafar 6mo ago
Can attestations be rate-limited or is that the timing side-channel you are talking about?
- snackbroken 6mo agoPrecisely. To rate-limit attestations you either need government somewhere in the loop so that they get notified and can revoke certificates when they detect abuse (but then they can correlate requests to prove adulthood with the service provider), or you need the proof of adulthood to be tied to the certificate in some way that the service provider can tell if a certificate is being re-used. But then anyone with a copy of all the certificates (read: the government) can re-run the proof on their end and figure out who is who.
- atanasi 6mo agoThe app would be restricted to environments certified by Apple or Google. Then the app can apply features like trusted time to implement client-side rate limiting.