10 ms·
The holder of the credential would have to present it log(N) times. If someone asks to scan your id a bunch of times, wouldn't you find it suspicious?
by rvrs 2y ago
The holder of the credential would have to present it log(N) times. If someone asks to scan your id a bunch of times, wouldn't you find it suspicious?
- LegionMammal978 2y agoDifferent 'someone's could conceivably collude to whittle down the result of the search, fingerprinting users via separate means to align the results. Or, less conspiratorially, one could present an apparently-poorly-designed interface where the credential is only valid for the current login session, then wait for a few cycles of the user clearing their browser cookies. Perhaps a very explicit prompt "This service wants to know if you're > X years old!" might give up the trick, but then users would have to be trained not to click through it within milliseconds, which is never the most viable solution.