There are a lot of GOP-controller legislatures in the USA pushing through so-called “child protection” laws, but there’s a toll in the form of impacting people’s rights and data privacy. Most of these bills involve requiring adults to upload a copy of their photo ID.
I thought it was obvious, but I guess I’m gonna go step-by-step. So, what’s needed to verify if you’re 18? Exactly one thing - a flag telling the other system yes/no! Very privacy friendly, porn site doesn’t know anything else about you. And obviously the auth system shouldn’t log that you verified for a porn site. That’s why it should be open source, so you can trust it.
The auth system knows you verified for something. The only way to actually preserve privacy is total anonymity to everyone.
Nope, it doesn’t. Did you read what I wrote or did you just have a knee-jerk reaction?
Please explain it to me like I’m five. How can the authentication service not know what your authenticating against? How can it provide you a token that you can’t use over and over again, or past other people?
OAuth specifically wants to know what you’re using your tokens for.
In principle if you insert a middleman into a transaction the middleman knows about the transaction. Thus it’s violates privacy
It is a basic tautological fact that you cannot verify an identity while keeping that identity private from the verifier.
If it’s private and secure and isn’t linked to your identity, we will share it and it will be useless because everyone who shares the same login is the same over-18 person.
If it is in any way linked to your identity, the data is online and a target for breach which will expose said identity.
There is no realistic way to implement this which both actually does anything at all, AND does not require adding attack surface for breaches.
Please reread what I wrote. And regarding attack surface, everything you use adds attack surface.
