132
Age verification mean end of anonymous account (nord.pub)
submitted 2 weeks ago by to c/privacy@lemmy.world
54 comments fedilink hide all child comments
 

today I created a burner google account. these days google requires an Android phone in order to even create an account so I used an old phone to scan the QR code ( I am pretty sure this lets google grab all of the metadata of the mobile phone ). after about 1 hour creating the account. google's automated system disabled the account however I appealed and got the account back. before someone asks I need google because of where I live.

this made me wonder what if google mandates age verification? if there were age verification google would immediately notice that I am creating another account ( burner account ) which it won't like. burner account won't be created in the first place!

we already have too much surveillance and this makes it worse. my mobile number is already tied to my read government identity. I DO NOT want my online account to be tied to my read identify too! it is sad, it really is

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 2 weeks ago* (last edited 2 weeks ago) (6 children)

If they are use once tokens then you need to get more. If implemented badly, they could be asking for a new one every time, and now the issuer knows whenever you are using them. I'm not sure exactly what implementstion flaws The EFF article was talking about but they have links if you want to learn more.

Edit: also, now that I think of it, if it's single use, then they need to be invalidated every time they are used. So this probably also notifies the issuer every time a token is used, and which token it was. There are probably ways to do this privately but it is a tricky problem, and something the government probably won't get right the first time, which is the main issue that the EFF is talking about.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 2 weeks ago* (5 children)

    The single use part is just for your privacy, they don't have to be invalidated. You could just have them last a week or <time interval> on issue

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 1 point 2 weeks ago (4 children)

    You're talking about potential implementations. EFF is talking about issues in current implementation. As I said in my very first comment, I'm sure it can be done properly. The EFF is worried that if the current implementation is rolled out now, the system will stay unfixed for years and make privacy even worse.

    But anyways, since you seem knowledgeable about the EUDI implementation and I'm too lazy to look it up, do you know if the current implementation allows a website to collude with the issuer to get the identity of a user?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 2 weeks ago (3 children)

    My reference point is cloudflare's research on zero knowledge proofs used to issue anonymous tokens to bypass (pre-complete) captcha checkpoints.

    Neither website nor issuer (nor the combination) can determine the identity of a user from the token (hence zero knowledge), but other techniques entirely unrelated to the cryptography can identify a user. For example network or browser metadata or traditional browser fingerprinting.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 2 weeks ago (2 children)

    I see so it seems like we were talking past each other. I'm aware of Cloudflare's token system. As well as other systems like GNU Taler and Monero. So clearly privacy preserving systems can be built. But I also trust the EFF, and if they say the current system has major flaws I'm inclined to believe them

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 2 weeks ago (1 child)

    The age verification system can't be zero knowledge if they know what your token is, and can track it. Seems a bit funky

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •