• 3 Posts
  • 298 Comments
Joined 3 years ago
cake
Cake day: June 5th, 2023

help-circle


  • That’s the universal human experience. Listen to every marginally famous person and they will tell you that a single negative comment feels like it weighs more than 100 positive ones. Then factor in that people who disagree feel compelled to voice their opinion while those who agree often silently nod to themselves and move on. So the 100 positive comments are likely representative of 500 people who agree but don’t say anything.

    So far, you seem to be doing well. Don’t let a couple of the haters get to you.

    Of course, if a pattern appears of many comments criticizing the same thing, then you can think about if there’s something you should change about your behavior. But even then, the change should come from your own realization that you want to change something, not from a desire to appeal to the faceless mass of terminally online weirdos.


  • From your other posts, I guess you are around 18 and this is your first long-term relationship. If that’s the case, don’t worry too much about it. Don’t expect your first relationship to last forever. Or your second. Or third. Enjoy what you have for as long as it lasts but don’t be afraid to move on when either of you becomes uncomfortable with it. If you treat every relationship as if it must last forever, you won’t recognize the signs if something develops in the wrong direction and you risk locking yourself into something you don’t want, just because you don’t realize that you have other options.

    Breakups hurt like hell but they also help you grow. With each one you learn something about yourself, your life goals and what you like and dislike in a partner. I’m in my late 30s now and if you count everything that lasted longer than a year, I’m in my third long-term relationship right now, with a hand full of shorter ones in between. The longest one lasted for about seven years and ended because we figured out that our plans for the future had changed in a way that no longer fit together. Breaking up was the right choice and maybe we should have done it a bit earlier but at the same time, I’m grateful for every single day we had and regret nothing.

    So in short: see where the journey goes. Be open-minded either way. Maybe you’ll stay together for another month, another year or another decade. Enjoy each other for as long as you’re both happy but don’t be afraid of ending things when you’re not.













  • You would need to include the birth date in the certificate. But of course that would have its own privacy implications.

    And that’s what I’m trying to say: your “just do X” falls short. It is incredibly hard, maybe impossible, to build a reliable age verification system where neither the websites nor the government can violate your privacy. Even the tiniest mistake can mean that the whole thing comes crashing down. And no, “just trust your government” is not a solution. Even if I trust my current government, the next election could put raging Nazis in power who use every available database to identify and terrorize people they don’t like.

    If someone designs a system that satisfies all these requirements and is reviewed by multiple independent security researchers, I’m all for implementing it. But from what I know about government IT projects, it currently looks like every country will implement its own system, each with obvious problems that can be exploited by the average computer science student.


  • About the part of sending the certificate, how do you say they should check the age? By smoke signs?

    The whole point about certificates is that they are signed with an asymmetric cryptographic key so you can verify them on your own. You have a list of root certificates from trusted certificate authorities and when a user sends you a certificate that claims to be issued by the Spanish government, you check the signature with the Spanish root certificate. No need to contact the Spanish government’s server about that specific certificate.

    This is exactly how any certificate validation process works today. Otherwise, your web browser would have to talk to a bunch of certificate authorities every time you open an HTTPS connection to a website.


  • And as a follow up to my previous point, now that I’m at my PC and don’t have to type on my phone:

    Even if we made certificates in a way that can’t be shared, for example by locking the private key inside a physical device (like a digital passport), we have solved nothing.

    Your certificate would immediately become your digital fingerprint that will be stored with your account (to find duplicates) and can be tracked across websites as soon as a database gets leaked or the sites’ owners sell your data to advertisers (when would that ever happen?). While that fingerprint alone doesn’t say anything about you except your age, it makes it trivial to aggregate your activity across the whole internet. Ever bought something on a site that requires age verification? Congratulations, your certificate is now tied to an address. Shared a selfie somewhere? Your certificate has a face. Even without personal data directly in the certificate, it would be a privacy nightmare and exactly what the EU GDPR tried (and failed) to prevent.

    The next step would be to find a mechanism that creates single use certificates every time you need one. But you can’t do that locally, because the certificates still need to be signed (and revocable) by a trusted authority. So maybe you need to send a certificate signing request to a government server every time you sign up for something. That could work for some use cases but requires expensive infrastructure that is never allowed to fail even for a few minutes or it would cause chaos.

    … and now I’ve noticed your exact wording, implying that sites would forward the users’ certificates to the authority to be verified. That’s a big no-no. A site may never ever acknowledge to an authority that it has seen a specific certificate. The authority necessarily knows who the owner of that certificate is and even if they don’t tell the website, the authority itself can keep track of every citizen. “On date X, PornHub asked us to verify the age for certificate ABCDEF which we know belongs to John Doe from Somesmalltown” is not something I would want to be stored on a government server.

    And this is all still assuming that the infrastructure for this would be implemented according to modern standards without security-critical shortcuts. If you have any hope that will ever happen, I recommend you click through https://media.ccc.de/ and watch some talks about government IT fails. Many are available in English.


  • Certificates that can’t be tied to a specific person can and will be shared, making them essentially worthless.

    We‘ve had that in Germany about 20 years ago. Some websites asked you to verify your age by entering a part of the encoded data on the back of your ID card. It took maybe a few days until lists with valid IDs were all over the internet.

    Sure, certificates are marginally more reliable because they can be revoked but at that point, websites need to update their revocation lists close to real time which isn’t practical and still can’t catch every shared cert.

    Reliably verifying your identity without revealing too many personal details is an extremely hard problem that has troubled computer scientists for decades.