7 ms·
Site generates random key Key and verification passed to verifier Verified list is published Site pulls list and checks its number has been verified Site do
by chgs 1y ago
Site generates random key
Key and verification passed to verifier
Verified list is published
Site pulls list and checks its number has been verified
Site doesn’t know who it is, and verifier doesn’t know which site was verified against
- _Algernon_ 1y agoHow do you prove that the generated key by the site is actually randomly generated? I certainly don't trust a random porn site to do this right. If the verified list is tied against identity, there is only a simple law change required to de-anonymize everything.
- chgs 1y agoDoesn’t really matter surely, you only need to trust the identity provider not to leak your identity and your porn provider not to have a key that your identity provider can link to.
- thinkharderdev 1y agoYou don't trust people who run a massive-scale streaming video platform to have the technical chops to generate random numbers?
- _Algernon_ 1y agoI trust them to have the capability to do it. I don't trust them to be willing to do it despite legal duress (which is only ever a law-change away).
- sigwinch 1y agoBreak the key in half. Otherwise, why wouldn’t I just try the last entries from that list?
- chgs 1y agoThey key would be hashed with the user’s details (ip address, value in a session cookie etc) so someone else can’t reuse it. Hell there are things like elliptic curves and DH which still seem magic to me. Now sure if the identity provider and the site work together they could negate the anonymity, but given that for the identity provider anonymisation would be the key selling feature they wouldn’t want to risk that. Mullvad I’m sure would be trustworthy enough.