2 ms·

Bank? So now you know what bank they use?

miki123211 15d ago
This is why you have a relay in the middle. Then, Chase knows you've verified your ID somewhere, the relay knows that some Chase user verified themselves at Pornhub, and Pornhub knows that the user is over 18, without knowing their identity or what bank they're using. You could also do this with ZKPs and device integrity protection. The latter is more secure but more complex, the former is much simpler and openness friendly.
- deaton 15d ago
  Or we could use multiple relays so nobody knows both the bank and the purpose, or even who would know the other piece of data... and now thats just Tor but for identity verification. Might be a good idea actually, except the whole point is Anthropic wants to know who you are.
- AnthonyMouse 15d ago
  > You could also do this with ZKPs and device integrity protection. How has the anti-competitive lock-in scam of "device integrity protection" entered the discussion? Using ZK proofs without it has exactly the same effect. There are far too many attestation-passing insecure devices to expect attestation to have any security value against attackers who can choose any of those devices on purpose.
- piaste 11d ago
  No. The simple relay thing only works if you can trust that they aren't comparing notes. But if I could trust them not to do so, I would already trust them when they say that they do not log your identity. ZKPs allow you to be the relay between Chase and Pornhub, and you know exactly which data is shared between the two. Chase would obviously have no idea whether you used the certificate for Pornhub or anything else; and Pornhub will know that their request was validated by _a_ trusted ID provider, but not necessarily which particular one out of a group (issuer-hidden ZKPs).
bitmasher9 15d ago
I think the key here is “a trusted third party” more than “bank”. Also, I’d rather a company know “he has an account at Bank of America” than “His full government name is Bit Masher and his driving license number is 9”
brainwad 15d ago
Well, they already know your credit card issuer, it's not that wild. Really Visa/MasterCard should offer age verification on their network... They have all the necessary components.

This is why you have a relay in the middle. Then, Chase knows you've verified your ID somewhere, the relay knows that some Chase user verified themselves at Pornhub, and Pornhub knows that the user is over 18, without knowing their identity or what bank they're using. You could also do this with ZKPs and device integrity protection. The latter is more secure but more complex, the former is much simpler and openness friendly.

deaton 15d ago
Or we could use multiple relays so nobody knows both the bank and the purpose, or even who would know the other piece of data... and now thats just Tor but for identity verification. Might be a good idea actually, except the whole point is Anthropic wants to know who you are.
AnthonyMouse 15d ago
> You could also do this with ZKPs and device integrity protection. How has the anti-competitive lock-in scam of "device integrity protection" entered the discussion? Using ZK proofs without it has exactly the same effect. There are far too many attestation-passing insecure devices to expect attestation to have any security value against attackers who can choose any of those devices on purpose.
piaste 11d ago
No. The simple relay thing only works if you can trust that they aren't comparing notes. But if I could trust them not to do so, I would already trust them when they say that they do not log your identity. ZKPs allow you to be the relay between Chase and Pornhub, and you know exactly which data is shared between the two. Chase would obviously have no idea whether you used the certificate for Pornhub or anything else; and Pornhub will know that their request was validated by _a_ trusted ID provider, but not necessarily which particular one out of a group (issuer-hidden ZKPs).

bitmasher9 15d ago

I think the key here is “a trusted third party” more than “bank”. Also, I’d rather a company know “he has an account at Bank of America” than “His full government name is Bit Masher and his driving license number is 9”

brainwad 15d ago

Well, they already know your credit card issuer, it's not that wild. Really Visa/MasterCard should offer age verification on their network... They have all the necessary components.