Re:"Privacy preserving age verification" is bullshit
by Seattle3503 on Thursday August 14, 2025 @08:41PM
(#44907419)
It would probably be enough to stop an unsophisticated eight year old from seeing porn.
If it turns out to be a real issue, we could figure out a way to implement pairwise pseudonyms, so that each ID has a pseudonym with each service that is unlinkable to other services. If you see a million requests from a pseudonym, that pseudonym probably an ID being abused and you can block it.
Re:"Privacy preserving age verification" is bullshit
by ivan_gammel on Friday August 15, 2025 @03:46AM
(#44909645)
>But even then, I can volunteer my ID, keep it permanently attached to a computer running a server that allows certain requests (like the boolean age check), and then provide an API / client that allows anyone anywhere to use it to pass.
That’s not technical problem and it doesn’t have to be a technical solution to it. You will be committing fraud and maybe a few other crimes if underage users are involved. As soon as you will start advertising the service, you will be on law enforcement radar. Or maybe you don’t advertise it, but one of the boys using it will brag at school and get someone’s attention…
Re:"Privacy preserving age verification" is bullshit
by progbits on Friday August 15, 2025 @05:21AM
(#44910230)
Yes and access to porn is not a technical problem. I don't see why my privacy is to be compromised because of incompetent parents.
Re:"Privacy preserving age verification" is bullshit
by ivan_gammel on Friday August 15, 2025 @05:27AM
(#44910259)
You are not entitled to unrestricted access to any online services on condition of anonymity neither it is even possible in real world. 1) There’s always someone who knows and whom you implicitly trust. 2) trusting some random ISP or VPN provider but not IdP or specialized verification proxy is rather irrational.
But even then, I can volunteer my ID, keep it permanently attached to a computer running a server that allows certain requests (like the boolean age check), and then provide an API / client that allows anyone anywhere to use it to pass.
No risk to me (none of my data leaks), presumably no rate limits (the card has no way to track time; at best it could store recent request timestamps but I doubt it does).
In fact even better, use stolen or lost cards. Owner will get a new one, but the old one has no way of knowing it's voided. We can build a network that is able to sign whatever info (age, gender, city, name) you want, as long as we have one ID with such info.