Comment on Mastodon says it doesn't 'have the means' to comply with age verification laws
Zwuzelmaus@feddit.org 7 months agoAge check happens by trusted entity (your government, not some sketchy big tech ass), they create a signed cert with a short lifespan to prevent your kid using the one you created yesterday and without the knowledge which service it is for.
Sorry, not sufficient.
Not secure.
" I certify that somebody is >18, but I don’t say who - just somebody "
This is an open invitation to fraud. You are going to create at least a black market for these certificates, since they are anonymous but valid.
And I’m sure some real fraudsters have even stronger ideas than I have.
What stops non-anonymous certificates from being sold?
If John Doe views way too much porn, then you expect the site to shut him down? They have no ability to track other site usage. The authorities have to block him after the 10,000th download.
At that point, why does the site need to know? Either the government blocks someone’s ID or they don’t
What stops
Can’t look at it in such a black or white manner. The possibilities are presumably less, and surely not that obvious.
You’re not solving any issue by losing privacy. The site itself “knowing” you’re John Doe can’t tell if that’s correct or not. Only the government can verify that, so why give the info to the site?
homoludens@feddit.org 7 months ago
Making the certs short-lived (a few minutes) and single use and having a rate limit for users could make it difficult enough with serious risks (if you make it a crime) for little profit (I doubt many kids will pay serious amounts of money to watch porn; definetly not drug-scale amounts of money).
Zwuzelmaus@feddit.org 7 months ago
You cannot make a certificate “single use” (except if it exists only inside a closed system).
amju_wolf@pawb.social 7 months ago
The website generates a random value, your government signs a cert for that value. That’s what makes it single use and zero trust.
homoludens@feddit.org 7 months ago
I was using the wording of OP who seems to be talking about tokens. The service asks the trusted entity if the token is valid, the trusted entity deletes the token after the first time.