Hacker News Reader

Comment by immibis | Hacker News Reader

Either the certificate is the same every time and therefore it's an identifier.

Or the certificate isn't the same every time and therefore you can generate a whole bunch of them and give them out for $2 apiece.

Or the certificate isn't the same every time and also isn't anonymous so they can trace who's doing that.

You don't have to reuse the same certificate for several requests. You can get a new one for every request, for every person who is asked to verify their age and pays you $2, and if they're actually anonymous, there's no way to know you did this. Is a rate limit part of the proposal? Can I only sign up to one adult service per week?

Unless you meant the requester's real identity, in which case... we're back to not anonymous.

View on HN

I address all of that in my comment? I'm not sure if you even read it at this point.

No, you didn't?

I did, except for this bit that you added in an edit:

> You don't have to reuse the same certificate for several requests. You can get a new one for every request, for every person who is asked to verify their age and pays you $2, and if they're actually anonymous, there's no way to know you did this. Is a rate limit part of the proposal? Can I only sign up to one adult service per week?

This is trivially easy to detect at the attestation service. If someone is trying to repeatedly (and programmatically) use the same personal ID to generate attestations for different request IDs in a short time frame, you can throttle them, flag them, revoke their cert, whatever.

So you can only sign up for how many adult services per week before you get banned from signing up for any more?

What if I'm checking out all the online casinos and each one wants an age token?

Again, the service host and request id is part of the certification request, so you can easily separate a legitimate signup for multiple different websites from suspicious multi-signups to the same service for the same govt id.

So the government can tell I'm signing up for pornhub i.e. not anonymous. Also pornhub would need a government approval to operate or they'd just block their requests (and possibly arrest me for using an illegal service). I'd think we'd want service providers to also be anonymous without requiring government approval.

Reply on news.ycombinator.com