135
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 06 Aug 2023
135 points (100.0% liked)
Asklemmy
44137 readers
856 users here now
A loosely moderated place to ask open-ended questions
If your post meets the following criteria, it's welcome here!
- Open-ended question
- Not offensive: at this point, we do not have the bandwidth to moderate overtly political discussions. Assume best intent and be excellent to each other.
- Not regarding using or support for Lemmy: context, see the list of support communities and tools for finding communities below
- Not ad nauseam inducing: please make sure it is a question that would be new to most members
- An actual topic of discussion
Looking for support?
Looking for a community?
- Lemmyverse: community search
- sub.rehab: maps old subreddits to fediverse options, marks official as such
- !lemmy411@lemmy.ca: a community for finding communities
~Icon~ ~by~ ~@Double_A@discuss.tchncs.de~
founded 5 years ago
MODERATORS
If the service is open source, I could actually see this working.
No. Open Source does not make violations of freedom somehow okay.
I thought it was obvious, but I guess I'm gonna go step-by-step. So, what's needed to verify if you're 18? Exactly one thing - a flag telling the other system yes/no! Very privacy friendly, porn site doesn't know anything else about you. And obviously the auth system shouldn't log that you verified for a porn site. That's why it should be open source, so you can trust it.
The auth system knows you verified for something. The only way to actually preserve privacy is total anonymity to everyone.
Nope, it doesn't. Did you read what I wrote or did you just have a knee-jerk reaction?
What good is it for the system to know, if the system disregards that information right after auth? Effectively it's like no one ever knew.
Hence why such a system would need to be open source and publicly audited.
It is a basic tautological fact that you cannot verify an identity while keeping that identity private from the verifier.
Then you don't know much about IT. Sure, the verifier must know your identity at the point of identification. Doesn't mean it has to store any information about what you did. Unless of course you're worried that the PC itself will magically come to life and do something with the information. In that case you need an entirely different kind of help. Source for my claims: Designing system architecture is literally my job.
No verifier can ever be trusted. The only way to have privacy is anonymity.
If it's private and secure and isn't linked to your identity, we will share it and it will be useless because everyone who shares the same login is the same over-18 person.
If it is in any way linked to your identity, the data is online and a target for breach which will expose said identity.
There is no realistic way to implement this which both actually does anything at all, AND does not require adding attack surface for breaches.
Please reread what I wrote. And regarding attack surface, everything you use adds attack surface.
Please reread what I wrote. And regarding everything you use adding attack surface, that is the absolute best argument to not use an additional service such as the aforementioned 3rd party auth.
What are we doing here?
Yeah. It's possible, but I'm guessing there isn't a will or an understanding of available tools.