Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The 'papers, please' era of the internet will decimate your privacy

expression.fire.org

Post reply on HN
Print view View original

131–140 of 655 posts

Re: The 'papers, please' era of the internet will decimate your privacy

#131

Post by Aurornis »

andrewla wrote: post #68
j2kun wrote: post #21

There are at least some technological solutions here, such as anonymous credentials. [1] Modern versions of this technique allow one to associate metadata (like a proof of age exceeding a threshold) in such a way that the verifier can't even correlate repeated requests across users. Governments that are serious about age verification and individual privacy (which, doubtful they truly are) should agree on a protocol a…

The article talks about the possibilities of malicious cloning of these tokens by third parties, but fails to identify the much more common use case, and one that makes this scheme useless for age verification. It's one thing to be concerned about someone stealing my credential, but another to prevent the transfer of these credentials, especially if they are limited use credentials. The entire point of age verificati…

Yes, this is the part of the issue that is so frequently ignored: Anonymous age verification schemes are easily defeated through proxying because there wouldn't be any consequences for selling your tokens. "Install this app on your phone and we'll pay you $1 per day" and it will mint your anonymous identity tokens and send them off to kids who want to buy them. If there's no way to track the tokens, there is no possibility of negative consequences.

So the schemes always start introducing features to reduce the anonymity of the tokens or make them more trackable in some way:

> The highest friction version of this is that the credential ties to a real world identity somehow; maybe locked behind legal barriers, etc., but if a minor is caught using someone's credential, then the person whose credential they are using can be investigated, and, if necessary, charged with a crime

Which requires that these identity tokens not be anonymous age-verification credentials. They become a traceable identity token tied to your government-issued ID.

Re: The 'papers, please' era of the internet will decimate your privacy

#132

Post by intrasight »

dylan604 wrote: post #104
zaptheimpaler wrote: post #59

This seems more like a technical problem that we could actually solve well if we wanted to and had competent people advising the governments. You go to DMV and they generate a keypair and an entry in a DB. App looks up your age with your public key + signed private key authorization from you. Apps can ask for specific checks like is_over_21, is_citizen or whatever without any more data. Something like that, details a…

why would any site on the internet need to give a damn about is_citizen? That's just gross to me at the mere suggestion. If it's a government service site, then they already know that information. If you're trying to use something like social media, then it couldn't possibly matter less.

To use frontier AI

Re: The 'papers, please' era of the internet will decimate your privacy

#133

Post by Geezus_42 »

gchamonlive wrote: post #39
Ifkaluva wrote: post #23

Earlier quoted context omitted.

In the US? I think you most likely need to provide proof of an address

What if you are homeless? Can you at least sit and read there?

You can. You just have to ignore all the privileged people being annoyed that they have to see you. They love posting on Nextdoor about how much they hate homeless people.

Re: The 'papers, please' era of the internet will decimate your privacy

#134

Post by Jtarii »

echohack5 wrote: post #52
HoldOnAMinute wrote: post #42

Assuming no revolutionary changes are coming to the USA, I am planning to opt out of the digital world when I retire. Physical media only. No subscriptions. Spend lots of time in the library. Find like-minded people and meet in person. Will only keep the bare minimum for survival, like banking.

Which is precisely why powers will try to make all these illegal

I don't think they are going to make libraries illegal mate.

Re: The 'papers, please' era of the internet will decimate your privacy

#135

Post by teravor »

rockskon wrote: post #121
teravor wrote: post #103

Earlier quoted context omitted.

multiple use of the same token on multiple accounts...? tying multiple accounts and services together isn't ideal but its inarguably better than tying your real world identity to every single service.

Wait - so you're advocating for use of a persistent identifier tied to a person? How is that any different than what advertising networks do right now beyond giving them additional guaranteed information of your age bracket? To clarify - it's not cryptographically necessary to present the same token for each and every transaction and serves to categorically defeat the entire privacy guarantee of ZKP. It also makes it…

    > use of a persistent identifier
at the terminus, yes. there is no other way to avoid the homeless problem you listed. by terminus I am referring to where a central authority vouches for unforgability. this does not mean advertisers will have a token they can use (see remote attestation infrastructure).

    > tied to a person
whether or not the terminus can tie a token to a real world identity will depend on how careless the user was and how much collusion there is between the terminus and the services. at the very least it will impose an investigation cost.

contrast this with the situation as it currently is (under ideal assumptions) where a central authority verifies your real identity and issues temporary rate limited tokens which are then saved by each service and can at any time be linked to you whenever the central authority can get the service to disclose the database entry. the nullifier will force the central authority to do an investigation about who the nullifier actually belongs to which may actually fail.

realistically I expect VPNs and Tor to just become more popular in response to such nonsense. I wouldn't be using government issued tokens for anything that isn't trivial to tie to your identity already: such as a personal bank access.

Re: The 'papers, please' era of the internet will decimate your privacy

#136

Post by simoncion »

vkou wrote: post #94
_heimdall wrote: post #66

Earlier quoted context omitted.

I wouldn't trust governments, today or in the future, to keep such a system private and I don't see a foolproof way of building some kind of audit mechanism into it to make sure the data is always truely private. I've also always been curious how a truely anonymous identity verification could possibly work. At best for age verification, I could be given some kind of token that would still have to verify my age and be…

> I've also always been curious how a truely anonymous identity verification could possibly work. You go to a store. You show the clerk your id and give him a quarter. The clerk pulls a scratch-off ticket from the front of a ticket tape. The ticket contains a token identifier. It's anonymous. The clerk or his POS system knows your name and age, but doesn't know your number. The vendor providing the tape doesn't know…

> It's anonymous. The clerk or his POS system knows your name and age, but doesn't know your number.

What prevents a commercial "AI" security camera analysis firm from doing a decent job of linking footage of a store's customers to a likely subset of tokens, based on the knowledge of which tokens are sent to which store and how many tokens have been pulled off of the roll so far? Remember that you can design the token roll packaging so the easiest thing for a clerk to do is to pull off the rolls in the order in which they were shipped. Or -hell- you can design the token dispenser so that it phones home to the oracle that sent the roll to the store with the range of tokens in the roll when the roll is loaded into the dispenser (for "security purposes").

> It's the exact same process by which you buy lottery tickets in a world where they don't need to verify your identity when you redeem them.

I've seen many people buy lotto tickets. I've never seen anyone asked for ID. Perhaps the merchant is supposed to check for ID, but they don't. Relatedly:

> The clerk pulls a scratch-off ticket from the front of a ticket tape. The ticket contains a token identifier.

What prevents rolls of those tickets from falling off of a truck and either being handed out for free or at a substantial markup, no questions asked? [0]

In the real world, the system you propose absolutely will not function to the standards required by the people agitating for these systems. You can't "protect the children" if "children" can easily get their hands on anonymous access-granting tokens.

[0] The fact that this doesn't happen with lotto tickets often enough to be newsworthy is not a compelling counterexample. Stores make a decent amount of money selling those, and wouldn't want to get cut off from that revenue source by regularly "losing" shipments of tickets. What you propose doesn't make stores any money, so either you have to spend a bunch of money to induce them to carry the tokens [1], or you have to have harsh penalties for "losing" shipments of tokens. If you risk harsh penalties for choosing to sell the tokens, why even bother? Stores put up with the risk of selling booze because it's quite profitable... selling 5c or 0c tokens absolutely is not.

[1] Where does that money come from? From you and me, of course!

Re: The 'papers, please' era of the internet will decimate your privacy

#137

Post by dools »

StanislavPetrov wrote: post #99
dools wrote: post #32

How is it any different from being required to identify yourself to get a phone or electricity account? Identifying yourself on the internet is long overdue.

You aren't required to identify yourself to get a phone. You can get a prepaid phone with no ID. You are required to identify yourself for an electricity account because it is essentially extending you credit. You use the electricity first, and then they bill you for it later. They also only identify the person who is receiving the bill. You could have a house with a dozen people in it but the electric company only k…

> You aren't required to identify yourself to get a phone. You can get a prepaid phone with no ID.

Not in Australia

Re: The 'papers, please' era of the internet will decimate your privacy

#138

Post by Terr_ »

ricree wrote: post #57
miiiiiike wrote: post #41

Earlier quoted context omitted.

> Even on Hacker News the consensus is mostly in favor of anything from age restriction to making all social media illegal. That doesn't sound right. Put up a poll. I'd put money on 90%+ choosing some flavor privacy/anonymity on the internet.

The main issue is that they are very careful not to frame it like that. In broader contexts, it's always framed as something like "do you favor limiting children's access to social media" without a word on what it would cost to actually institute such a ban.

Relevant British comedy clip (Yes, [Prime] Minister) on such polls:

https://m.youtube.com/watch?v=ahgjEjJkZks

Re: The 'papers, please' era of the internet will decimate your privacy

#139

Post by ajb »

AJRF wrote: post #56

The path ahead in the next few years (at least for the UK) 1. Age gating + VPN ban under the guise of protecting children from social media 2. Few years pass, Identity Passport gets ushered in under guise of convenience of not having to repeat those pesky age verification checks. 3. Utilities start to require ID Passport. Including signing up with an ISP. 4. Renting starts to require ID Passport. 5. Work requires ID…

Renting and work already require ID in the UK. Every landlord and employer is supposed to take a copy of original documents proving the right to rent/work in the UK. Technically you can do that without handing the docs to the government, but there's less potential liability to do so via the Home Office website.

Re: The 'papers, please' era of the internet will decimate your privacy

#140

Post by Jtarii »

iamnothere wrote: post #80
kelseyfrog wrote: post #46

Earlier quoted context omitted.

So what happens when parents don't? Too bad?

What happens when parents don’t lock the liquor cabinet? When they smoke in front of their kids? When they leave porn laying on the table? Too bad!

>What happens when parents don’t lock the liquor cabinet? When they smoke in front of their kids? When they leave porn laying on the table?

The state can't control those things, it can control putting an age restriction on certain websites. Unless you are advocating for the complete abolition of all age restrictions throughout society.

Post reply on HN