It's another "we got rid of families and nations so we need administrative policy to fix the problems" episode.
The UK’s new age-gating rules are easy to bypass
61–70 of 191 posts
Re: The UK’s new age-gating rules are easy to bypass
#62Wouldn't age verification without revealing identity be solved with a service that acts as an identity authority? 1) Site that needs to verify age generates a globally unique id, creates requested data array ["is_over_18"], valid_until property and hmac signature of this message. 2) Client forwards just the id and requested data array to identity authority. Identity authority returns the id, map of data {"is_over_18"…
You're making this far more complicated than it needs to be. It requires no cryptography more than a random number generator. Create a service that generates a random token and then gives it to anyone who is over 18. Any service with any employee who is over 18 can get the token and then compare it to the one submitted by the client. Everyone uses the same token across every service and the token is only available to…
Same token for multiple people would improve anonymity for sure.
But someone could share this token publicly and then everyone could have it.
Re: The UK’s new age-gating rules are easy to bypass
#63The most disturbing thing about this saga is that websites that have no physical/legal/business presence in the UK are proactively geoblocking UK-origin IPs. Censorious governments have always been a thing since the beginning of the internet. Websites (especially non-corporate ones like 4chan or R34) preemptively surrendering to a foreign government that has no jurisdiction over them is what's new.
You don’t get to sidestep a country’s laws just because you happen to sit outside of the country. If you want to provide services to people within any country then you must obey their laws.
If you’re unwilling to accept this, then you must be extremely careful when you travel internationally or turn off access to that country altogether.
This is true for every country on Earth. This is the price of doing business internationally.
Re: The UK’s new age-gating rules are easy to bypass
#64Earlier quoted context omitted.
You're making this far more complicated than it needs to be. It requires no cryptography more than a random number generator. Create a service that generates a random token and then gives it to anyone who is over 18. Any service with any employee who is over 18 can get the token and then compare it to the one submitted by the client. Everyone uses the same token across every service and the token is only available to…
Same token for multiple people would improve anonymity for sure. But someone could share this token publicly and then everyone could have it.
> But someone could share this token publicly and then everyone could have it.
How is this any different than using any other way of doing it? It's always the case that someone can provide their ID and let someone else use it.
Re: The UK’s new age-gating rules are easy to bypass
#65Earlier quoted context omitted.
You're making this far more complicated than it needs to be. It requires no cryptography more than a random number generator. Create a service that generates a random token and then gives it to anyone who is over 18. Any service with any employee who is over 18 can get the token and then compare it to the one submitted by the client. Everyone uses the same token across every service and the token is only available to…
There's still privacy issues here: e.g. the service is generally still aware of what services the user is using that require verification. ZKP can eliminate this hole.
> e.g. the service is generally still aware of what services the user is using that require verification
How? The token isn't specific to any user or service. The only information the ID provider gets is that you requested the token and the only thing the service verifying your age gets is the same token shared by everyone over 18.
Re: The UK’s new age-gating rules are easy to bypass
#66Earlier quoted context omitted.
They know what they doing exactly. But they now have a reason to require age and ID checks to buy VPN. Then ban payments to VPNs that don't follow said regulation. You'll see.
> They know what they doing exactly. They're already using the "online safety act" to silence people online. They're super scared because a great many people have had enough. Crimes numbers, including rapes, are through the roof in the UK. And they want to silence anyone who wants to talk about criminality on the ultra rise. The UK is on a very dark path. It's the country in the world with the most millionaires fleei…
This is far right fear-mongering rhetoric. It’s the standard hatred of ethnic minorities whipped up by bigots. The UK is not on a “dark path”, that’s absolute nonsense. Nor do people live in fear. I assume you don’t actually live in the UK. Because none of your description is the UK I live in.
> “People are scared of what's going on. Both criminality and religious extremism are rising at a more than alarming rate.”
Crime is down and has been going down for 10 years. For “religious extremism” I’ll just read “I don’t like brown people”, because extremism is only really growing due to white supremacy groups.
> “they're going after those denouncing the crimes.”
No, they are not, they are going after those fomenting violence (literal riots). In one case leading to white supremacists trying to burn down a hotel with refugees in it.
Crime happens. It doesn’t mean one crime is a symptom of a wider problem. And breaking news: crime is committed by white people too. RE: the Rolex watch crime — I walk through East London with a Patek Philippe on my arm and have zero concerns, I’m not scared, nor do I live in fear. Nobody I know in the UK is scared or living in fear — that’s just agenda driven rhetoric.
Maybe get off twitter and/or the far-right manosphere and try changing your news sources for something more balanced.
Re: The UK’s new age-gating rules are easy to bypass
#67Age limits on buying cigarettes are easily thwarted by finding a corner shop that needs the sale and will sell to kids. Height restrictions on fairground rides are easily thwarted by putting bits of wood in your shoes. None of this matters. The point is that this kind of control will drastically reduce under 18s consuming content that they shouldn't. We don't need the all of society's controls to be flawless.
A VPN is a hell of a lot easier to access then a corner shop that's willing to break the rules, and such rules on corner shops didn't exactly stop teenagers from finding porn before the internet
Re: The UK’s new age-gating rules are easy to bypass
#68Earlier quoted context omitted.
Same token for multiple people would improve anonymity for sure. But someone could share this token publicly and then everyone could have it.
> But someone could share this token publicly and then everyone could have it. How is this any different than using any other way of doing it? It's always the case that someone can provide their ID and let someone else use it.
If someone shares their ID publicly, that person could be identified and blocked, so this would probably be limited to sharing of ID to the people in person's social circle.
If someone uploads shared token publicly, it's hard to identify who did it and anyone can use it until you rotate the token for everybody.
Re: The UK’s new age-gating rules are easy to bypass
#69Earlier quoted context omitted.
There's still privacy issues here: e.g. the service is generally still aware of what services the user is using that require verification. ZKP can eliminate this hole.
> e.g. the service is generally still aware of what services the user is using that require verification How? The token isn't specific to any user or service. The only information the ID provider gets is that you requested the token and the only thing the service verifying your age gets is the same token shared by everyone over 18.
Ahh, I see what you mean. Yeah, that works if you're gonna completely give up on the whole 'making it hard for someone to share the codes' thing
Re: The UK’s new age-gating rules are easy to bypass
#70Wouldn't age verification without revealing identity be solved with a service that acts as an identity authority? 1) Site that needs to verify age generates a globally unique id, creates requested data array ["is_over_18"], valid_until property and hmac signature of this message. 2) Client forwards just the id and requested data array to identity authority. Identity authority returns the id, map of data {"is_over_18"…
EU is working on something like this[1] (got limited discussion here[2]). I haven't looked into it very much, but at a glance it doesn't sound terrible. Here's the basic flow[3]: - The User initiates an age verification process by enrolling with an Attestation Provider (AP), which collects the necessary evidence from authentic sources or trusted 3rd party private data sources. - The AP generates a Proof of Age attest…
Yeah, something like that. I wonder, if their zero-knowledge proof version prevents leaking of identity, if any service is sharing data with the other.