Yoodle 🇨🇦

RE: https://mastodon.social/@txtx/116306932969421510

What do you guys think of this strategy? This seems like the only way to implement age verifcation that actually respects your #privacy (or does it?). I’m not necessarily endorsing it but I’m curious to hear peoples’ thoughts. #askfedi

2:02pmWeb
Show threadJustin Crozer15h ago
@chimpchomp @txtx all depends on the vendor and how the authentication protocol works. Can easily be corrupted or mass produced if not careful like how comodo had their certificates falsified — https://www.darkreading.com/cyberattacks-data-breaches/flawed-website-certificate-validation-process-led-to-comodo-hack
Show threadYoodle 🇨🇦14h ago
@justincrozer @txtx interesting. I guess the tokens would need to be random because if there was a pattern in how they are produced that could be exploited. Though maybe someone who understands this stuff better could come up with a more efficient solution
Show threadCodey McCodeface13h ago

@chimpchomp You’d have to trust that the bank or post office wouldn’t track which ID corresponds with each token.
Also needs to be a way to prevent you from handing your 18+ token to a 12 year old.

That’s assuming the People Pushing This want just age verification and not surveillance. Since Meta is pushing this, I don’t have much hope.

Show threadYoodle 🇨🇦3h ago

@bcasiello yeah, ive heard it proposed that these tokens should expire after a while to minimize the impact of people sharing this info with teens, but that seems like a hassle even for adults users who just want to go on the internet (imagine being unable to access your social media because you forgot to go out and buy your tokens)

is meta pushing for this kind of scheme though? I thought they were pushed for operating system level age verification

Show threadFruitConsumer12h ago

@chimpchomp
Well, my concept would be just to have the government mail adults a list of little single use codes they can use. With the codes not being connected to a specific identity. Maybe 200 codes.

And whenever something requires: "Authenticate adult status." you just pull up the little list of codes and write something like: "EOAY-2734-BB28" and the site asks some gov database if the code is legit and gets just a: "Yep." in response and that's it. Cheaper and safer than many alternatives.

Show threadYoodle 🇨🇦2h ago
@FruitConsumer government mailing the tokens out would make distribution easier, especially in remote locations that might not be able to easily access storefronts. But how can we make it so that the we know the government isn’t storing information about which tokens they send to who? They would have an incentive to secretly store that info for later spying, so we’d need a way transparent way to ensure that there’s no funny business