But it is. In those European countries, IDPs and certification authorities are one and the same entity. So the technical requirement of privacy evaporates, the government will always know who is proving their age to which porn site.
Reputation is irrelevant. Everyone is trustworthy - until they are not. The dark web is filled with data leaks from reputable parties.
The trust has to be somewhere, so it seems quite natural that the most trustworthy entity is the one whose sole reason to exist is to protect your data.
The simple reality is that no state is adult enough to handle this responsibility.
Why should I accept the berlin internet wall anywhere? Any ecosystem should fight back against such ambitions.
If it really is about protecting kids, there could be some easy laws improving their privacy. These are not wanted. As well as there is no political will to restrict tracking for advertising and gambling.
The ZKP approach is what the EU is doing.
Note that in the article the objection to ZKP systems is not that they don't work correctly (because they do work). It is that it can be hard for some people to obtain IDs, it may cost to much for some sites, it could be hard to regulate IDPs effectively, and things like that.
- from the IDP to a port side, so the porn site will know what's your name (what a shame, how would I pretend it didn't happen after I close the tab);
- from the porn site to the IDP -- now your government knows that you watch porn and maybe the exact type of porn, so they can charge you a different tax rate for being straight.
Then of course, just by correlating ip addresses and timestamps in logs of the IDP and the porn site one can deanonimyze the visitors. Or just by ip in the logs itself because you don't pay your ISP in bitcoins.
The way these work is that the IDP issues a signed digital ID that is stored in a hardware security module tied to you. Typically this would be in your smartphone but could be something else like a smart card. Let's go with a smartphone for the rest of this comment.
Later, when you want to prove to a porn site that you are 18+ your smartphone can use a zero knowledge proof (ZKP) protocol to prove the porn site that your phone contains a signed ID from your IDP that shows your age is 18+.
The ZKP proof reveals nothing else from your digital ID other than that the date of birth field is at least 18 years in the past. All the porn site finds out is that someone who has an ID from your IDP that says they are 18+ is trying to use the porn site.
The IDP doesn't learn anything because they aren't involved in the age verification.
I can't wait for the next generation that will enjoy "nerding out" on how to best patrol every neighborhood with drones.
Let's put NFC tags on everyone at birth, we can then nerd out harder.