Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EU age verification app not planning desktop support

github.com

Post reply on HN
Print view View original

181–190 of 437 posts

Re: EU age verification app not planning desktop support

#181

Post by jwally »

zb3 wrote: post #166
jwally wrote: post #122

Here's my crack at a good-enough solution for the U.S. It doesn't have a ton of granularity - but the concept is shovel ready now, dirt cheap, and privacy preserving. Video Demo: https://www.youtube.com/watch?v=MmcUJ5u65Q0 Actual Demo: https://app.hornpub.click How it works: 1) Go to app.horpub.click 2) Create an ephemeral passkey 3) Extract its public-key and id (this binds the credential you're creating to your dev…

But the bank and the horn content provider could collude and that would let the bank know that you're watching horn (shame, shame!). The ZKP approach aims to prevent this attack method.

Chase.com currently is using:

mPulse

Google Marketing Platform Meta

LinkedIn Ads

Trade Desk

Aggregate Knowledge (Trans Union)

Adobe Audience Manger

Can you elaborate on how the risk of ironbank and hornpub colluding by de-anonymizing you via rainbow tables or IP forensics is substantially greater than Chase and PornHub using - Google Marketing?

Re: EU age verification app not planning desktop support

#182

Post by maxfurman »

NooneAtAll3 wrote: post #168
f_devd wrote: post #164

I've posted this as a response but I'll post it again since it seems like a lot of people are confused about the project: This project is not THE digital wallet, it is an early prototype of the wallet (which can be criticized for what it is, but the issue is somewhat orthogonal). The actual infrastructure is not based on attenstation, if you read the guidelines (or the readme) they actually want to implement a double…

> This project is not THE digital wallet, it is the wallet ...what?

GP has edited the comment to make more sense

Re: EU age verification app not planning desktop support

#183

Post by kulahan »

harrisoned wrote: post #179

> At present the project is focused on mobile platforms, specifically Android and iOS, as they cover the vast majority of users and real-world use cases. (..) Desktop support is not currently within the project's scope. This is the equivalent of a "Do you guys not have phones??"[1] but on a way larger scale. At least where i live i am able to use the bare minimum of phones, even working with tech. The friction is inc…

I do find it interesting that in an attempt to bring more people into modern society (via ability to access everything from an inexpensive smartphone), we're creating a stratification in society.

My brother hates tech more than me, and only has an old flip phone. I'm always surprised by the random problems he runs into as a result. Unresponsive desktop sites that beg you to download apps are the worst.

Re: EU age verification app not planning desktop support

#184

Post by tzs »

jwally wrote: post #122

Here's my crack at a good-enough solution for the U.S. It doesn't have a ton of granularity - but the concept is shovel ready now, dirt cheap, and privacy preserving. Video Demo: https://www.youtube.com/watch?v=MmcUJ5u65Q0 Actual Demo: https://app.hornpub.click How it works: 1) Go to app.horpub.click 2) Create an ephemeral passkey 3) Extract its public-key and id (this binds the credential you're creating to your dev…

What happens if some party is able to get logs of the bank's age attestation signings and of hornpub.click's steps #2 and #6? It appears this would present some risk of matching up hornpub.click accounts with real IDs.

This is called "linkability" and ideally should be avoided so anonymous age verification can be safe.

Re: EU age verification app not planning desktop support

#185

Post by xxs »

okanat wrote: post #129
logifail wrote: post #112

Earlier quoted context omitted.

> you can't run your bank's app I can log in to my bank account using my desktop PC > government eID apps I can sign into government websites using my desktop PC and its smart card reader and my government-issued eID smartcard. No smartphone needed.

Not in EU. Many banks mandate you either have an iPhone or Google approved Android as 2FA. Those fucking idiots have killed their own competition options.

Of course in the EU - pretty much all Baltic and Nordic countries support id cards connected via usb

Re: EU age verification app not planning desktop support

#186

Post by [deleted] »

NooneAtAll3 wrote: post #168
f_devd wrote: post #164

I've posted this as a response but I'll post it again since it seems like a lot of people are confused about the project: This project is not THE digital wallet, it is an early prototype of the wallet (which can be criticized for what it is, but the issue is somewhat orthogonal). The actual infrastructure is not based on attenstation, if you read the guidelines (or the readme) they actually want to implement a double…

> This project is not THE digital wallet, it is the wallet ...what?

[deleted]

Re: EU age verification app not planning desktop support

#187

Post by gclawes »

Tin foil hat time: this is why Google is pushing to kill app sideloading.

Mobile phones are the only platform at the moment that can reasonably be used to enforce mandatory software installs and remote attestation. Removing sideloading can down the road leading to Google (or Apple for IOS) forcing all app store provided apps/browsers to support government authentication APIs like this.

Re: EU age verification app not planning desktop support

#189

Post by jwally »

f_devd wrote: post #156
SomeoneOnTheWeb wrote: post #133

Earlier quoted context omitted.

What's crazy to me is why they didn't go for that kind of implementation. This works well, ensures privacy, can be audited easily, and doesn't need a f*cking app on my phone.

If you read the guidelines they actually want to implement a double-blind approach with ZKPs, which imo is significantly better than a challenge-response pub key system in term of privacy. If you're not familiar this would mean the verifier doesn't learns anything except a statement about attributes (age, license, etc); and the EU doesn't learn what attributes have been tried to verify or by who.

Not asking to troll or be a jerk. Promise.

What would need to happen in the United States to implement a reliable ZKP age verification system - and how long would it take to roll it out?

Asking because it feels like the Titanic has sunk, and we're eschewing a floating door because the coast guard has regulation conformant life rafts that would work better.

Re: EU age verification app not planning desktop support

#190

Post by im3w1l »

pessimizer wrote: post #15
cenamus wrote: post #10

Earlier quoted context omitted.

Further forcing everybody to have their phone on person at all times

I've been saying this for years: eventually not having your phone on you and powered up at all times will not be a crime, but it will be grounds for questioning and search. One day, there will be a knock on your door. "Good morning, this is the police. Is there something wrong with your phone? Is your phone broken? Can we provide you with a charge?" "No, I must have turned it off accidentally." "Can we assist you wit…

What does seem to be happening is rather that the assumption of having a phone will be built into every little thing - in particular mobile payments are becoming mandatory in some places. Transportation including parking is sometimes locked behind an app. We could also see stuff like landlords moving to smart locks that a tenant open with their phone.

Since children are universally not considered real people with real rights schools requiring them to have the right apps to perform their schoolwork are to be expected.

Post reply on HN