421–430 of 447 posts
Where there is smoke, there is a fire. Wait for more and wait for people to learn how identity theft is the worst problem you can have.
Imagine you trying to prove that you are you, while somebody else with your passport details, driver license, address, DOB, phone SIM swap, etc, is acting like you causing all sort of financial disaster???
1995 The Net movie, people in 2025 will learn the hard way that was not just a movie.
Earlier quoted context omitted.
I address all of that in my comment? I'm not sure if you even read it at this point.
No, you didn't?
> You don't have to reuse the same certificate for several requests. You can get a new one for every request, for every person who is asked to verify their age and pays you $2, and if they're actually anonymous, there's no way to know you did this. Is a rate limit part of the proposal? Can I only sign up to one adult service per week?
This is trivially easy to detect at the attestation service. If someone is trying to repeatedly (and programmatically) use the same personal ID to generate attestations for different request IDs in a short time frame, you can throttle them, flag them, revoke their cert, whatever.
Earlier quoted context omitted.
The third party company shouldn't ever need to see the IDs, either. Same issue.
When governments do things the wrong way around, like mandating age control before they have a method for doing that in a secure manner, what's a company to do?
Tangent: I've regularly been required to provide copies of my ID to all kinds of businesses simply to function in society — i.e. in practice there is no realistic option to opt out. Want to rent a house? X points of ID. Want a phone? X points of ID. Pretty much every real estate agency in town has copies of at least my driver licence. And they in turn share my details with tenant database companies, credit reporting agencies and so on. Do you think many of these businesses have good data handling practices? Of course they don't. And so all my details are available for purchase in bulk data sets on the dark web, and get refreshed by new data breaches every few years. And yet government still treats it as somehow unexpected each time this happens, or wags its finger and bemoans those naughty criminals, instead of developing any kind of policy that would start to address the underlying issue... which is that our personal details are spread so far and wide in the first place.
Earlier quoted context omitted.
No, you didn't?
I did, except for this bit that you added in an edit: > You don't have to reuse the same certificate for several requests. You can get a new one for every request, for every person who is asked to verify their age and pays you $2, and if they're actually anonymous, there's no way to know you did this. Is a rate limit part of the proposal? Can I only sign up to one adult service per week? This is trivially easy to det…
What if I'm checking out all the online casinos and each one wants an age token?
Earlier quoted context omitted.
Did they accept the edited ID with a DoB matching the account data or how did you solve that?
I just... sent a scan of my passport. I mean, they promised to delete it right? Nothing could go wrong?
Earlier quoted context omitted.
Fun fact: Discord called them guilds before realising that they could compete with paid services that set up actual (e.g. Mumble) servers for you by pretending this is equivalent and free I also have trouble going along with the doublespeak. If a supermarket called their beer apple juice, I'd also not be offering my friends "apple juice", I'd call it what it is Guild is innocuous enough and since the API docs still c…
This seems like a distinction without a difference. If you used a paid service offering Mumble servers that used some custom software that allowed them to offer multiple ... "servers" on different ports/IP addresses from a single daemon, would you really care? Focusing on the fact that it's not really a "server" because they aren't running as separate processes seems like utterly silly pedantry, and we probably don't…
It's like pretending a taxi is the same as owning a vehicle, even if the taxi company was your neighbor and there's always someone available. The result is the same but the distinction couldn't be clearer. To me it's similarly misrepresentative to say you own a car when you live next to a big taxi station, as to say the SaaS web front-end you get on Discord is a rented server
Earlier quoted context omitted.
I did, except for this bit that you added in an edit: > You don't have to reuse the same certificate for several requests. You can get a new one for every request, for every person who is asked to verify their age and pays you $2, and if they're actually anonymous, there's no way to know you did this. Is a rate limit part of the proposal? Can I only sign up to one adult service per week? This is trivially easy to det…
So you can only sign up for how many adult services per week before you get banned from signing up for any more? What if I'm checking out all the online casinos and each one wants an age token?
Earlier quoted context omitted.
neat, but how do users appeal a false positive? Do companies just trust the users or should the company retain the original information so they can manually verify?
Fair point, but how does the appeal process work today? Even if the company stores someone else's ID in JPEG format, and the customer service claims that the photo on that ID looks very similar to my photo, is it sufficient proof? Should the company trust me, or should I trust the company? I don't think storing hashes makes it more complex.
Either the fraudster or the true human can request an appeal and the support staff could easily tell which one is tricking the AI and which one is not.
You can see all the videos of people trying to trick the Apple face lock. To a human, it was obvious they are wearing a mask. To the device, its the same person.
Earlier quoted context omitted.
Do you understand how image hashing works? You don't need machine learning just to check if two images are potentially identical.
Face hashing is different than generic image hashing. Methods like dividing the photo into smaller rectangles and storing the average colour for each rectangle won't work. It should be able to detect and hash facial features so that it can compare it to a future (potentially taken from a different angle) photo of the same person. You need some type of machine learning algorithm.