• wewbull@feddit.uk
    link
    fedilink
    English
    arrow-up
    6
    ·
    17 hours ago

    This authority will provide you with tokens indicating you are 18+ (or whatever age verfication you may need) These tokens are stored locally, and contain no identifying information other than a simple “is this guy 18+?”

    So they’re reusable? One token can be used for multiple age checks, right?

    If not, then think about what that means.

    1. The token gets sent back to the authority for revocation.
    2. The token is authorised by the central authority as still valid.
    3. The token is uniquely identifiable
    4. The central authority knows who it issued each token for
    5. The central authority knows who has asked it the verify age.

    Sure, the company you’re purchasing from may have no new information, but the central authority now has everything it needs to know:

    • How often you buy tobacco, alcohol or medications
    • What discussion boards you are a member of
    • Have you purchased anything age restricted from any store (e.g. propane from a DIY store)
    • 5gruel@lemmy.world
      link
      fedilink
      English
      arrow-up
      3
      ·
      edit-2
      14 hours ago

      Not sure that’s necessarily true. I don’t see why it couldn’t work like this:

      1. request personal token from authority. it works similar to a certificate chain, your token is derived from a central certificate
      2. you store your token locally
      3. you visit an age-restricted website. you send your token (or a challenge encrypted with that token) back to the website
      4. the website verifies your token with the certificate from the authority, (like how literal Certificate Authorities work) . the CA doesn’t know when or why your token was used.

      (fwiw I am sure governments will try their best to make this process less private)

      • wewbull@feddit.uk
        link
        fedilink
        English
        arrow-up
        2
        ·
        edit-2
        14 hours ago

        Your step 4 will make the token reusable, or at least reusable within a time frame. If a token can only be used once there has to be some information flow back to a central approval authority.