this post was submitted on 30 Nov 2024
126 points (99.2% liked)

Programming

17671 readers
156 users here now

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person's post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Rules

  • Follow the programming.dev instance rules
  • Keep content related to programming in some way
  • If you're posting long videos try to add in some form of tldr for those who don't want to watch videos

Wormhole

Follow the wormhole through a path of communities [email protected]



founded 2 years ago
MODERATORS
 

Many might've seen the Australian ban of social media for <16 y.o with no idea of how to implement it. There have been mentions of "double blind age verification", but I can't find any information on it.

Out of curiosity, how would you implement this with privacy in mind if you really had to?

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 14 points 3 weeks ago* (last edited 3 weeks ago) (3 children)

Its possible to implement something that hides your actual age from a website, but the tricky part is hiding what website you're visiting from an identity provider.

Let's walk through a wrong solution to get some fundamentals. If you're familiar with SSO login, a website makes a request token to login the user and makes claims (these request pieces of user information.) One could simply request "is the user older than 18?" And that hides the actual age and user identity.

The problem is how do you hide what website you're going to from the identity provider? In most SSO style logins, you need to know the web page to redirect back to the original site. Thus leaking information about websites you probably don't want to share.

The problem with proposals that focus on the crypto is that they actually have to be implemented using today's browser and HTTP standards to get people to use them.

[–] [email protected] 2 points 3 weeks ago

It can be done. The website provider can generate a request that it forwards to you. You then pass on this request to the age verifier, who can answer "yes person is over 16" without knowing why you want to know, or who generated the request.

The requester wouldn't know your age, just that you were old enough.

There are a few problems.

One is that the website could embed some identifier in the signature of their request. But any information there can be easily send by the web site provider to the age verifier directly if they wanted so this is not a big problem.

Another problem is that the age verifier could look at times when requests were submitted and create a sort of "fingerprint" based on when requests arrived for different sites. This could be partially helped by having browsers request age verification randomly in the background any time you use a browser.

[–] [email protected] 2 points 3 weeks ago (2 children)

Could it be maybe a token signed by the verifying party living permanently on your computer (like cookie), and websites can request permission to query it to verify the age?

[–] [email protected] 4 points 3 weeks ago (1 children)

Since age tends to not decrease, that may make sense: once you reach 18 you get a signed token you can use forever.

Your token might be used by someone else, though

[–] [email protected] 5 points 3 weeks ago (1 children)

Your token might be used by someone else, though

Yeah. I feel like that cool bad influence not-actually-my-uncle is gonna publish their porn access token everywhere.

[–] [email protected] 4 points 3 weeks ago

Porn Access Token lmao

[–] [email protected] 3 points 3 weeks ago

The hard part is browsers. Cookies and local storage are limited by the origin URL. You need it explicitly set on the domains you intend to visit, but those domains don't know your age. The one that knows the age is the identity provider, but it can't set it for all domains. There are other techniques that you could use, like a smart card combined with a browser extension to do local based user info attestation, but those are difficult to manage at a nation scale and I suspect people will struggle with them, though there are some countries that do have national smart cards (e.g. Estonia.)

[–] [email protected] 0 points 3 weeks ago

The problem is how do you hide what website you’re going to from the identity provider?

Not only don't you need to, you would really have to know the generator of the token because it needs to verify that you are the user that was issued the token.