7 ms·

You forgot one (the sane one, which is coming soon anyway): Using a government issued eID system. The EU is going to rollout eID in a way that a site can just

You forgot one (the sane one, which is coming soon anyway): Using a government issued eID system. The EU is going to rollout eID in a way that a site can just ask “is this person > age xy?”. The answer is cryptographically secure in the sense that this person really is this age, but no other information about you has to be known by the site owner. Which is the actual correct way to do it. I don’t understand why all the sites go crazy with flawed age verification schemes right now, instead of waiting a until the eID rollout is done. EDIT: I forgot to mention that it’s only the correct way if the implementation doesn’t give away to your government on which sites you browse… Which I believe is correctly done in the upcoming EU eID but I could be wrong about it.

stubish 7mo ago
Sites need to deal with Australia, which punted all responsibility to the platforms and provided no real assistance (like say the government half of the eID system that manages all the keys and metadata)
- latexr 7mo ago
  > Sites need to deal with Australia Do they? The UK’s population is more than double of Australia’s and some websites (e.g. imgur) are outright blocking the UK.
  - ChocolateGod 7mo ago
    imgur blocking the UK is not due to ID verification, but because they refused to stop making money off childrens data.
    - latexr 7mo ago
      The reason is irrelevant. The point is websites don’t need to deal with <insert country>.
      - deleted 7mo ago
        [deleted]
  - walthamstow 7mo ago
    All publicly-listed ad delivery systems like Meta do in fact need to deal with high-income countries. They can't afford to and will never strike off 100m Brits and Aussies, and that number will only rise with more high-income countries making regulation.
Orphis 7mo ago
There are also alternatives that can be good enough, such as the Swedish BankId system, which is managed by a private company owned by many banks. They provide authentication and a chain of trust for the great majority of the population on about all websites (government, healthcare, banking and other commercial services) and is also used to validate online payments (3D Secure will launch the BankId app). While it's not without faults (services do not always support alternative authentication which may support foreigners having the right to live in the country), it has been quite reliable for so many years. So just to say, you can have successful alternatives to a government controlled system as many actors may decide it is quite valuable to develop and maintain such a system and that it aligns with their interest, and then have it become a de-facto standard.
- ongy 7mo ago
  How does that prevent the ID service from discovering which services you use it for?
voxic11 7mo ago
What I don't understand about this approach is if it's truly completely privacy preserving what stops me from making a service where anyone can use my ID to verify? If the site owner really learns nothing about me except for my age then they can't tell that it's the same id being used for every account. And if the government truly knows nothing about the sites I verify on they can't tell that I'm misusing the id either. So someone must know more then you are letting on.
- taminka 7mo ago
  presumably you'd just use unique one time codes derived from the eID
  - voxic11 7mo ago
    I fail to see how that solves the problem? That's what I'm saying my service would provide. Unless the eID has some kind of client side rate limiting built in I can generate as many of them as I want. And assuming they are completely privacy preserving no one can tell they were all generated by the same ID.
    - ongy 7mo ago
      You could do some scheme that hashes a site specific identifier with an identifier on the smart element of the id. If that ever repeats, the same I'd was used twice. At the same time, the site ID would act as salt to prevent simple matching between services.
      - hparadiz 7mo ago
        People do, in fact, have multiple profiles. For very valid reasons.
        voxic11 7mo ago
        the solution to this seems to be to issue multiple "IDs". So essentially the government mints you a batch of like 30 "IDs" and you can use each of those once per service to verify an account (30 verified accounts per service). That allows for the use case of needing to verify multiple accounts without allowing you to verify unlimited accounts (and therefor run into the large scale misuse issue I pointed out). If you need to verify even more accounts the government can have some annoying process for you to request another batch of IDs.
gunapologist99 7mo ago
"Papers, please" is the fastest and slipperiest slope to authoritarianism. Europeans are ironically blasé.

stubish 7mo ago

Sites need to deal with Australia, which punted all responsibility to the platforms and provided no real assistance (like say the government half of the eID system that manages all the keys and metadata)

latexr 7mo ago
> Sites need to deal with Australia Do they? The UK’s population is more than double of Australia’s and some websites (e.g. imgur) are outright blocking the UK.
- ChocolateGod 7mo ago
  imgur blocking the UK is not due to ID verification, but because they refused to stop making money off childrens data.
  - latexr 7mo ago
    The reason is irrelevant. The point is websites don’t need to deal with <insert country>.
    - deleted 7mo ago
      [deleted]
- walthamstow 7mo ago
  All publicly-listed ad delivery systems like Meta do in fact need to deal with high-income countries. They can't afford to and will never strike off 100m Brits and Aussies, and that number will only rise with more high-income countries making regulation.

Orphis 7mo ago

There are also alternatives that can be good enough, such as the Swedish BankId system, which is managed by a private company owned by many banks. They provide authentication and a chain of trust for the great majority of the population on about all websites (government, healthcare, banking and other commercial services) and is also used to validate online payments (3D Secure will launch the BankId app). While it's not without faults (services do not always support alternative authentication which may support foreigners having the right to live in the country), it has been quite reliable for so many years. So just to say, you can have successful alternatives to a government controlled system as many actors may decide it is quite valuable to develop and maintain such a system and that it aligns with their interest, and then have it become a de-facto standard.

ongy 7mo ago
How does that prevent the ID service from discovering which services you use it for?

voxic11 7mo ago

What I don't understand about this approach is if it's truly completely privacy preserving what stops me from making a service where anyone can use my ID to verify? If the site owner really learns nothing about me except for my age then they can't tell that it's the same id being used for every account. And if the government truly knows nothing about the sites I verify on they can't tell that I'm misusing the id either. So someone must know more then you are letting on.

taminka 7mo ago
presumably you'd just use unique one time codes derived from the eID
- voxic11 7mo ago
  I fail to see how that solves the problem? That's what I'm saying my service would provide. Unless the eID has some kind of client side rate limiting built in I can generate as many of them as I want. And assuming they are completely privacy preserving no one can tell they were all generated by the same ID.
  - ongy 7mo ago
    You could do some scheme that hashes a site specific identifier with an identifier on the smart element of the id. If that ever repeats, the same I'd was used twice. At the same time, the site ID would act as salt to prevent simple matching between services.
    - hparadiz 7mo ago
      People do, in fact, have multiple profiles. For very valid reasons.
      - voxic11 7mo ago
        the solution to this seems to be to issue multiple "IDs". So essentially the government mints you a batch of like 30 "IDs" and you can use each of those once per service to verify an account (30 verified accounts per service). That allows for the use case of needing to verify multiple accounts without allowing you to verify unlimited accounts (and therefor run into the large scale misuse issue I pointed out). If you need to verify even more accounts the government can have some annoying process for you to request another batch of IDs.

gunapologist99 7mo ago

"Papers, please" is the fastest and slipperiest slope to authoritarianism. Europeans are ironically blasé.