There are a lot of GOP-controller legislatures in the USA pushing through so-called “child protection” laws, but there’s a toll in the form of impacting people’s rights and data privacy. Most of these bills involve requiring adults to upload a copy of their photo ID.

    • Rikudou_Sage
      link
      fedilink
      -21 year ago

      I thought it was obvious, but I guess I’m gonna go step-by-step. So, what’s needed to verify if you’re 18? Exactly one thing - a flag telling the other system yes/no! Very privacy friendly, porn site doesn’t know anything else about you. And obviously the auth system shouldn’t log that you verified for a porn site. That’s why it should be open source, so you can trust it.

      • @buckykat@lemmy.blahaj.zone
        link
        fedilink
        5
        edit-2
        1 year ago

        The auth system knows you verified for something. The only way to actually preserve privacy is total anonymity to everyone.

        • Rikudou_Sage
          link
          fedilink
          11 year ago

          Nope, it doesn’t. Did you read what I wrote or did you just have a knee-jerk reaction?

          • @jet@hackertalks.com
            link
            fedilink
            English
            31 year ago

            Please explain it to me like I’m five. How can the authentication service not know what your authenticating against? How can it provide you a token that you can’t use over and over again, or past other people?

            OAuth specifically wants to know what you’re using your tokens for.

            In principle if you insert a middleman into a transaction the middleman knows about the transaction. Thus it’s violates privacy

            • Rikudou_Sage
              link
              fedilink
              11 year ago

              What good is it for the system to know, if the system disregards that information right after auth? Effectively it’s like no one ever knew.

              • @jet@hackertalks.com
                link
                fedilink
                English
                1
                edit-2
                1 year ago

                You’re confusing intents and capabilities. When we’re talking about security and privacy we have to talk about capabilities. Not intents.

                Somebody could have the best intentions, but you don’t want to give them the capability to hurt you. If it’s not necessary. So does a daycare need a volunteer militia to hang out all day cleaning their weapons? Probably not, the capability even if well intended is antithetical to the security and welfare of the children.

                Even if the intention is good today, putting the framework and capability in just invites future corruption.

                • Rikudou_Sage
                  link
                  fedilink
                  English
                  11 year ago

                  Hence why such a system would need to be open source and publicly audited.

                  • @jet@hackertalks.com
                    link
                    fedilink
                    English
                    11 year ago

                    If the system exists it will be abused. Therefore the government should not create the system to start with

            • Rikudou_Sage
              link
              fedilink
              11 year ago

              Then you don’t know much about IT. Sure, the verifier must know your identity at the point of identification. Doesn’t mean it has to store any information about what you did. Unless of course you’re worried that the PC itself will magically come to life and do something with the information. In that case you need an entirely different kind of help. Source for my claims: Designing system architecture is literally my job.

      • Aetherielle
        link
        fedilink
        41 year ago

        If it’s private and secure and isn’t linked to your identity, we will share it and it will be useless because everyone who shares the same login is the same over-18 person.
        If it is in any way linked to your identity, the data is online and a target for breach which will expose said identity.
        There is no realistic way to implement this which both actually does anything at all, AND does not require adding attack surface for breaches.

        • Rikudou_Sage
          link
          fedilink
          11 year ago

          Please reread what I wrote. And regarding attack surface, everything you use adds attack surface.

          • Aetherielle
            link
            fedilink
            21 year ago

            Please reread what I wrote. And regarding everything you use adding attack surface, that is the absolute best argument to not use an additional service such as the aforementioned 3rd party auth.
            What are we doing here?