• 5gruel@lemmy.world
    link
    fedilink
    English
    arrow-up
    3
    ·
    edit-2
    13 hours ago

    Not sure that’s necessarily true. I don’t see why it couldn’t work like this:

    1. request personal token from authority. it works similar to a certificate chain, your token is derived from a central certificate
    2. you store your token locally
    3. you visit an age-restricted website. you send your token (or a challenge encrypted with that token) back to the website
    4. the website verifies your token with the certificate from the authority, (like how literal Certificate Authorities work) . the CA doesn’t know when or why your token was used.

    (fwiw I am sure governments will try their best to make this process less private)

    • wewbull@feddit.uk
      link
      fedilink
      English
      arrow-up
      2
      ·
      edit-2
      12 hours ago

      Your step 4 will make the token reusable, or at least reusable within a time frame. If a token can only be used once there has to be some information flow back to a central approval authority.