Post #2153432

been thinking about how that EU age verification app they were trying out was doing something very interesting in trying to not turn age verification into deanonymization it, apparently, generates "zero-knowledge proof" tokens that could be presented to third-party services and would only reveal that the user is above the required age and nothing else it has a limit on how often each specific token could be used, to prevent one person from just using a specific token everywhere and thus connecting every identity to themselves (and also to hinder multiple people from reusing the same token) i feel like this kind of mechanism could theoretically work, but only if (1) the services in charge of identity verification (which issue the tokens) do not keep records that could be used to re-link tokens to identities (very unlikely, and can easily change after an election) and if (2) third-party services are actually using these tokens responsibly and not sharing their data with 1000 trusted partners for ad targeting (which might be true if the GDPR is as strong as i've told it is, but i still don't believe it) and i think the people who came up with this system probably had good intentions, given that they've actually paid enough attention to cryptographic developments to know that zero-knowledge proofs are a thing -- if a mechanism like this existed in the physical world (you go to a local government office, show them your ID, they issue you a stamped document that just says you're over 18 years old and reveals nothing else about you, you can show it instead of your ID to go to bars and adult stores), it would be considered brilliant this is also why i dismissed the news articles about how terrible that app itself was -- a few small client-side vulnerabilities that can allow someone else with physical access to your device to use your token doesn't really compromise the whole system invented to generate those, and can be patched easily the real problem, as usual, is that things on the internet work very differently from meatspace, and especially when it comes to big tech companies, the default assumption is that every bit of information you reveal about yourself will either be intentionally used against you or get leaked (or both) like, the reason we as a society don't raise a panic about having to show your ID to buy alcohol is that in most cases, the system verifying the correctness of that ID is a single person who spends, at most, 10 seconds -- they're not going to take a photo of both the ID and your face, then send them to a face recognition system, then send that data to a bunch of different advertising companies for extra profit, and instead they'll probably forget both your face and your ID in just a few hours if i had to guess, it's another example of most politicians being people over the age of 60 and thus thinking of computers/phones/the internet less like very personal possessions that should only be meddled with in specific circumstances (like how most countries have laws demanding warrants before searching one's property) and more like another piece of equipment that must be "safe" at all costs (like all the safety regulations on cars and industrial equipment and kitchen appliances)