471–480 of 520 posts
The main concern with age/identity verification tools seems to be the concern with storing your personal data for mass surveillance. Yet, their privacy policies say they'll remove it soon after the verification. Is the main pessimistic concern that they will not do that? And that it could be proved they do, age/identity verification wouldn't be an issue?
Earlier quoted context omitted.
> buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is non-identifying. It can be implemented in a privacy-preserving way online: your government gives you tokens that prove that you are above age and that they provably cannot track. That's the exact equivalent. I believe that the other…
> and that they provably cannot track. That's not easily provable though. Any token given that way contains some amount of encrypted payload. That secret payload may contain uniquely tracking numbers. Even the encrypted payload itself, if treated as an opaque string, can be used for tracking if they decide to log it when they deliver it to you, and when the website where you use the token passes it back to the govern…
It is, with zero-knowledge proofs.
> That's not easily provable though.
It's exactly like end-to-end encryption: normal people cannot verify that it works, but they can use an open source implementation that is audited by independent cryptographers.
Not sure what you mean by "easily". It's totally possible in practice.
Earlier quoted context omitted.
> Which part of that is avoiding the distopian control? Your ID is already controlled by your government, and we don't call that dystopian control. With privacy-preserving age verification online, the government doesn't learn what you do with the cryptographic token that proves that you are old enough, and the website doesn't learn who you are. So it's exactly the same situation as today, except that now there is age…
> Your ID is already controlled by your government, and we don't call that dystopian control. The expression "papers, please", a classic exemplar of dystopian control, is referring to what? > First, it can be open source and have DRM and attestation. Android is open source, for instance. When people say "open source" in this context they mean that the user or third parties can make changes to the system, not that the…
Do they? My experience is that often they don't know what "open source" means in the context of software or that they don't know that the system they were criticising is actually open source.
Earlier quoted context omitted.
> Which part of that is avoiding the distopian control? Your ID is already controlled by your government, and we don't call that dystopian control. With privacy-preserving age verification online, the government doesn't learn what you do with the cryptographic token that proves that you are old enough, and the website doesn't learn who you are. So it's exactly the same situation as today, except that now there is age…
there is no single government id in the UK at the moment, they currently do not control my identity you specifically talked about an OS without user changeable software, thats the definition of open source
Wait, so you live in a country where there is no government that can provide an ID? How does it work when you travel abroad? Do you have multiple legal identities, with different names and nationalities, that cannot be individually tracked back to one government?
> you specifically talked about an OS without user changeable software, thats the definition of open source
No? Open source is about your ability to reuse the code. You can modify and install Android (or let's say AOSP) on most Android devices (look at the list of devices supported by LineageOS for instance).
The one thing you cannot do is modify it and get your changes signed by Google.
Remote attestation is about preventing you from leveraging open source software, but the software is still open source.
Earlier quoted context omitted.
> Which part of that is avoiding the distopian control? Your ID is already controlled by your government, and we don't call that dystopian control. With privacy-preserving age verification online, the government doesn't learn what you do with the cryptographic token that proves that you are old enough, and the website doesn't learn who you are. So it's exactly the same situation as today, except that now there is age…
> Your ID is already controlled by your government In the US, there are no national IDs, each state is responsible for their own. Transitioning to a national ID is not even legal currently, it would require a constitutional amendment... and I think most people do not want that for multiple reasons.
In the EU, there is no concept of EU ID, each country is responsible for their own.
Still, there is a governing entity that is responsible for your ID and controls it. Unless a US state is not a "governing entity"? Though the head of a US state is called a "governor", right?
Earlier quoted context omitted.
Nope they don't. That's the whole point of privacy-preserving age verification. Technically it is possible. The complaint that people have is that they don't trust that any government will get it right. But it is technically possible with known cryptography.
No, it isn't technically possible. With true anonymity you can also re-sell tokens making them meaningless. If you prevent token sharing then you cannot have real anonymity. You can't have your cake and eat it too. And if you have to trust the government to get it right then you have already lost because they are definitely motivated to NOT get it right because they WANT to track you.
Of course it is. Read the sentence again:
> The government still gets to know what you're doing online. How is that privacy?
It is technically possible to achieve that without the government knowing what you are doing online.
> With true anonymity you can also re-sell tokens making them meaningless.
You can re-sell tokens, just like you can re-sell cigarettes. Does that make the system meaningless? Harder to prove.
> And if you have to trust the government to get it right
The whole point is that you don't have to trust; you can verify. The system has to be open source of course.
It doesn't mean that they will do it right, but it is technically possible.
Earlier quoted context omitted.
Nope they don't. That's the whole point of privacy-preserving age verification. Technically it is possible. The complaint that people have is that they don't trust that any government will get it right. But it is technically possible with known cryptography.
Ah ok. I understand now. The website isn't making an additional request to the government to verify that the credentials you gave are real. The authenticity is built into the signature.
But if you accept the caveat (like we do for cigarettes, where an adult can buy cigarettes and then give them to a kid), you don't need to remote attestation part.
Earlier quoted context omitted.
Why does the government need to know what pages you visit? It could just encode a string representing the date and 'above 18' and sign it with its private key. PH then just needs to verify it using the public key.
Actually, thinking about it some more - it has one major downside. You can't have a single use key this way.
Earlier quoted context omitted.
there is no single government id in the UK at the moment, they currently do not control my identity you specifically talked about an OS without user changeable software, thats the definition of open source
> there is no single government id in the UK at the moment, they currently do not control my identity Wait, so you live in a country where there is no government that can provide an ID? How does it work when you travel abroad? Do you have multiple legal identities, with different names and nationalities, that cannot be individually tracked back to one government? > you specifically talked about an OS without user cha…
there is no point in it being open source if i cannot modify and run it
Earlier quoted context omitted.
So I don’t have kids, and I have worked in trust and safety. As stated, society is finding a sub optimal solution for a person in a narrow read of my situation. I (and you) are impacted by the second order effects of the decision to do something or to do nothing. Our freedoms do not exist in a vacuum, or as platonic ideals. They must be enacted through some actions or rulings. I have a longer spiel on how social medi…
>One wrinkle in your argument - If the costs could be taken from parents, that would be great, however one group of bad actors in these situations is adults. So as a class, there is some case that could conceivably be made for adults to bear that cost. "Bad actors"? I see three separate subsets of people, different unions of which would yield possible interpretations of "bad actors": * Adults targeting children with…
The larger point you are asking to be established is how you as a class of members in shared society should have costs added to them which.
I attempted to make the case for you; in general you are already paying costs. The maladies from the current state of social media and the Internet mean that you are impacted already, even if you don’t have kids.
The scale of the “pollution” so to speak, from other parties, is not addressable by independent action.