And how would that app verify you’ve given your actual age? Now you need to deanonymize yourself to that app and while random sites might not know who you are the app does and the app also knows every site you visit (that requests your age).
So no, that’s no longer anonymous. In practice that’s just your government (as that’s the most likely source of authority to verify your age) tracking what you’re doing on the web. Is that really preferable to parents parenting their children?
You can use a driver’s license or your bank. Different methods to verify it to the app. After verification, the app won’t save the info, just the knowledge that you’re over 18.
the app also knows every site you visit (that requests your age)
Not much of a worry locally. Disabling history is probably included in this (sort of porn mode/incognito, same as your browser). The info isn’t much use locally anyway
In practice that’s just your government (as that’s the most likely source of authority to verify your age) tracking what you’re doing on the web.
Government knows you’ve verified the app but they don’t know what you’re using the app for, it doesn’t have phone home. Your app is giving the site a generated cryptographic key, the site compares that to see if it is a valid key and then accepts it. The key doesn’t carry your personal info with it, so the central db doesn’t know who is being asked about, just whether the key is valid (so someone is 18+)
Now you’ve got a system without oversight. A child just needs an adult key and everything gets bypassed. And before you think it won’t be done, I know from my childhood children who used their older sibling identification to buy alcohol without the older sibling even knowing it was being done. Kids are creative and they will find a way to bypass something without oversight. That arguably will put them in even greater danger because while kids are creative they’re not that great at assessing dangers. For example a bad actor could give keys to kids and then use that same key as blackmail to control them.
I know kids steal or fake ids but yeah not a reason imo to not card people hah
This whole post exists because the need to card people and then use that card to verify that person and how it opens up the door for your identifiable information getting stolen.
The child would need to get the app and have it verified (id and face scan, bank logins).
How would that work, be around to verify with the app or something?
The way your proposed solution works is that the verification process is asynchronous. The government verifies the identity in the app and then the app is used to verify identity elsewhere. Those are two separate steps that don’t happen in succession. There’s bound to be some time between the two steps if for no other reason than for the government to push the new key into third party databases (because if it uses the pull method then you’ve reintroduced government tracking. That means there’s a timeframe where person A verifies themselves, gives the key to person B and then person B uses the key until it expires. Now you need to start building in safeguards to prevent keys from leaking from within the app.
I’ll ask a counter-question since my point was is it really preferable to parents parenting. How complex (which increases how costly the development will be) and how inconvenient does it have to get for you to consider that perhaps parenting is a better solution? Because I’ll also add this, this solution doesn’t prevent “bad parenting” because a bad parent can just identify themselves and let children use their identification to bypass whatever the kids want to bypass.
I’m against sending pictures of your card. Just showing your card to a shopkeeper, that’s fine imo.
I don’t think there being a delay once you originally setup the app is a big issue or takes more than a few minutes max. You do that first time and then your phone is generating the key based on the master key, the site confirms the key with the central server. That sort of handshake or what it is called happens almost instantly.
I’d be more worried if the apps were closed source but the ones I’ve heard about that are making an actual implementation of the protocol are open source so you can see everything it is doing, who it is contacting etc
And how would that app verify you’ve given your actual age? Now you need to deanonymize yourself to that app and while random sites might not know who you are the app does and the app also knows every site you visit (that requests your age).
So no, that’s no longer anonymous. In practice that’s just your government (as that’s the most likely source of authority to verify your age) tracking what you’re doing on the web. Is that really preferable to parents parenting their children?
You can use a driver’s license or your bank. Different methods to verify it to the app. After verification, the app won’t save the info, just the knowledge that you’re over 18.
Not much of a worry locally. Disabling history is probably included in this (sort of porn mode/incognito, same as your browser). The info isn’t much use locally anyway
Government knows you’ve verified the app but they don’t know what you’re using the app for, it doesn’t have phone home. Your app is giving the site a generated cryptographic key, the site compares that to see if it is a valid key and then accepts it. The key doesn’t carry your personal info with it, so the central db doesn’t know who is being asked about, just whether the key is valid (so someone is 18+)
Now you’ve got a system without oversight. A child just needs an adult key and everything gets bypassed. And before you think it won’t be done, I know from my childhood children who used their older sibling identification to buy alcohol without the older sibling even knowing it was being done. Kids are creative and they will find a way to bypass something without oversight. That arguably will put them in even greater danger because while kids are creative they’re not that great at assessing dangers. For example a bad actor could give keys to kids and then use that same key as blackmail to control them.
The child would need to get the app and have it verified (id and face scan, bank logins).
I know kids steal or fake ids but yeah not a reason imo to not card people hah
How would that work, be around to verify with the app or something?
This whole post exists because the need to card people and then use that card to verify that person and how it opens up the door for your identifiable information getting stolen.
The way your proposed solution works is that the verification process is asynchronous. The government verifies the identity in the app and then the app is used to verify identity elsewhere. Those are two separate steps that don’t happen in succession. There’s bound to be some time between the two steps if for no other reason than for the government to push the new key into third party databases (because if it uses the pull method then you’ve reintroduced government tracking. That means there’s a timeframe where person A verifies themselves, gives the key to person B and then person B uses the key until it expires. Now you need to start building in safeguards to prevent keys from leaking from within the app.
I’ll ask a counter-question since my point was is it really preferable to parents parenting. How complex (which increases how costly the development will be) and how inconvenient does it have to get for you to consider that perhaps parenting is a better solution? Because I’ll also add this, this solution doesn’t prevent “bad parenting” because a bad parent can just identify themselves and let children use their identification to bypass whatever the kids want to bypass.
I’m against sending pictures of your card. Just showing your card to a shopkeeper, that’s fine imo.
I don’t think there being a delay once you originally setup the app is a big issue or takes more than a few minutes max. You do that first time and then your phone is generating the key based on the master key, the site confirms the key with the central server. That sort of handshake or what it is called happens almost instantly.
The app is from the government and open source at every endpoint. You can see for yourself that it doesn’t track activity.
the government would never do that
I’d be more worried if the apps were closed source but the ones I’ve heard about that are making an actual implementation of the protocol are open source so you can see everything it is doing, who it is contacting etc