←back to thread

693 points macawfish | 1 comments | | HN request time: 0.206s | source
Show context
al_borland ◴[] No.44544145[source]
All these ID check laws are out of hand. Parents are expecting the government, and random websites, to raise their kids. Why would anyone trust some random blog with their ID?

If these laws move forward (and I don’t think they should), there needs to be a way to authenticate as over 18 without sending picture of your ID off to random 3rd parties, or giving actual personal details. I don’t want to give this data, and websites shouldn’t want to shoulder the responsibility for it.

It seems like this could work much like Apple Pay, just without the payment. A prompt comes up, I use some biometric authentication on my phone, and it sends a signal to the browser that I’m 18+. Apple has been adding state IDs into the Wallet, this seems like it could fall right in line. The same thing could be used for buying alcohol at U-Scan checkout.

People should also be able to set their browser/computer to auto-send this for single-user devices, where it is all transparent to the user. I don’t have kids and no one else’s uses my devices. Why should I need to jump through hoops?

replies(36): >>44544207 #>>44544209 #>>44544223 #>>44544253 #>>44544375 #>>44544403 #>>44544619 #>>44544667 #>>44544797 #>>44544809 #>>44544821 #>>44544865 #>>44544875 #>>44544926 #>>44545322 #>>44545574 #>>44545686 #>>44545750 #>>44545798 #>>44545986 #>>44546467 #>>44546488 #>>44546759 #>>44546827 #>>44547088 #>>44547591 #>>44547777 #>>44547788 #>>44547799 #>>44547881 #>>44548019 #>>44548400 #>>44548482 #>>44548740 #>>44549467 #>>44560104 #
alwa ◴[] No.44544207[source]
And we could call this way… zero-knowledge proof! :)

https://en.m.wikipedia.org/wiki/Zero-knowledge_proof

I bet we could even get a major phone OS vendor to support such a thing…

https://blog.google/products/google-pay/google-wallet-age-id...

replies(7): >>44544256 #>>44544433 #>>44544457 #>>44545411 #>>44545492 #>>44545617 #>>44547292 #
Aerroon ◴[] No.44545617[source]
I bet that in practice, at scale, these zero knowledge proofs end up being a lot more than zero.

Not to mention that you're almost certainly going to have to tie this stuff to specific accounts that will then forever and ever keep your habits collected. One day somebody enterprising is going to add all that data together too.

replies(2): >>44546306 #>>44546565 #
Tadpole9181 ◴[] No.44546306[source]
VPNs and zero knowledge proof systems are vulnerable to traffic analysis (based on packet size and timestamps) and there's almost no cure.

Mullvad is the only VPN I know of that has a mode that normalizes all packets to the same size (going into the VPN) and sends fake packets that don't get sent as real traffic. But that's only obfuscation and, at low traffic or high bandwidth (videos) or with sufficient heuristics, it can be beaten.

The US has basically zero regulation on selling this data. I can imagine a world where within a couple decades the US has one of the largest blackmail crisis ever seen, as foreign governments target civil workers. Or, I guess, at this point, the US government against the "undesirable" party within this administration.

replies(2): >>44546585 #>>44547129 #
1. cryptonector ◴[] No.44547129[source]
> VPNs and zero knowledge proof systems are vulnerable to traffic analysis (based on packet size and timestamps) and there's almost no cure.

All comms are subject to traffic analysis except surreptitious, covert channels (which can't be covert if the implementations are widely available).