Law alone cannot fix it. Tech alone cannot fix it.
If we wish to preserve the values we grew up with, we need both.
1,372 karma · joined October 2, 2023
If we wish to preserve the values we grew up with, we need both.
It is foolish to assume we can innovate our way around the law as opposed to talking with lawmakers to oppose the law before it gets on the books.
The Constitution doesn't have a "except when technology gets advanced enough" clause either. I checked.
You wanting the Constitution to change is something else entirely - and that's not what you're advocating for.
> That’s the literal reality with mandated car insurance. If you don’t have car insurance you can be banned from driving. What was your point here?
I fail to see what car insurance analogizes to here.
>Yea, the freedom to swing your fist ends at my nose. Freedom of speech to explicitly lie like Steve Bannon organized and many others using the “flood the zone” strategy seems to the be at the end of my nose. If you are actively lying to manipulate me or others knowledge of reality, that is not feee speech, that’s Machiavellian manipulation.
Speech is not violence. Comparing it to violence diminishes the suffefing and harm faced by people who have been a victim of violence.
You have the freedom to pay attention to whatever you want to - as do media outlets and political consultants.
Why should the entire country suffer because the media frequented by political-news-saturated people is so easily disatractable? They have the option to just...not...cover irrelevant nonsense.
It's not the option they choose to take though. See: The reflecting pool news cycle.
You've promoted mutually exclusive concepts with regards to cryptography which is why I said you don't seem to understand it. And again - and again and again and again and again and again - what is the additional information you are authenticating based off of beyond age? Remote attestation provides absolutely zero privacy utility here whatsoever on its own! So you've remotely attested this ZKP key represents a person who is an adult. Creating another key based on that information alone is trivial to spoof - for it not to be trivial, it would require validating additional information!
What is your root of trust? What is the basis by which age is verified in a way that can't readily be spoofed?
> you also don't appear to know what a nullifier is, in a ZKP system you submit identifying information and a hash of a secret string. the CA adds the hash to a public database and in the future you prove you one of the members of the database with a nullifier - the anonymity-set is everyone in the database who entered it prior to your submission. this can also be done with a blind signature to the same effect.
That's nice and all for trivia on ZKP but how does that touch upon the problem being discussed?
The mechanics of ZKP are not relevant to the problem of ZKP being categorically worthless for the problem at hand. I don't say ZKP is worthless out of ignorance - more discussions about it won't change that.
The specifics of ZKP do not change the fact that you are validating either too little information to be useful for preventing fraud or too much to have privacy-preserving value.
> there is no further point to this discussion.
Evidently not.
We can't solve private age verification with blockchain tech. I'm happy you're so passionate about it, but it isn't a silver bullet.
Where to even begin here....
To generate the token, it needs to be based on specific data. How do you prevent people from generating tokens based on fake data and submitting that to the "terminus" that you mention? We already have cases of people bypassing facial scan liveliness checks for banks using AI-generated footage.
What about validating tokens during the token enrollment process based on your government ID? Though that makes sure that poor or undereducated people who don't have such an ID are locked out of large swaths of Internet services.
Though there's also the matter of it being trivial to generate fake IDs using AI.
If you have no gatekeeping for the token enrollment process, anyone can submit an arbitrary number of new tokens.
And if you do have gatekeeping, you're right back to square one of needing to validate against more than just your age.
After all - the cryptography algorithms will be publicly known. If the only thing ZKP is validating against is age, it won't take long to figure out how to generate identifiers based on fabricated information.
> whether or not the terminus can tie a token to a real world identity will depend on how careless the user was and how much collusion there is between the terminus and the services. at the very least it will impose an investigation cost.
No it won't. A user submits a token to a server. The user also logs in with their e-mail address or phone number. Their email and/or phone number is hashed and it, along with the ZKP token and any additional information the website has on you, will be sent to data brokers.
This is the same as any other bit of information out there that data brokers collect on the internet. They just associate your new info with other info you are required to provide in order to use various services.
This will be automated and will cost next to nothing for data brokers to take advantage of.
> contrast this with the situation as it currently is (under ideal assumptions) where a central authority verifies your real identity and issues temporary rate limited tokens which are then saved by each service and can at any time be linked to you whenever the central authority can get the service to disclose the database entry. the nullifier will force the central authority to do an investigation about who the nullifier actually belongs to which may actually fail.
....what? What investigation by central authorities? You are talking of a system that would constantly mediate permissions for billions upon billions upon billions of devices across dozens of services and accounts per device.
You couldn't hire an army of people large enough to handle this and AI is infamously awful at detecting when a given image has been generated with AI.
> realistically I expect VPNs and Tor to just become more popular in response to such nonsense. I wouldn't be using government issued tokens for anything that isn't trivial to tie to your identity already: such as a personal bank access.
Their popularity would only rise in order to VPN into jurisdictions that don't enforce this. Assuming major websites don't just mandate age/identity verification for all new users regardless of jurisdiction just because it's easier and cheaper to apply one system to everyone.
Look - I know you mean well, but it is clear from this discussion you aren't familiar with cryptography, system security guarantees, Internet infrastructure scaling, or what would be needed to introduce new descriptive information about a person on the Internet and not have it become a new privacy risk.
This is an issue that has no tech-only solution. The specifics aren't just something to just figure out at a later date - the specifics are everything. And it's something that is enormously difficult to get right and extremely easy to get very, very wrong.
To clarify - it's not cryptographically necessary to present the same token for each and every transaction and serves to categorically defeat the entire privacy guarantee of ZKP.
It also makes it trivial to associate your ZKP token with your real identity.
What combination of details can you validate on that is meaningfully privacy-preserving and couldn't result in wide-spread re-use of tokens?
Additionally - what would prevent some kids from getting a homeless man in the city to hand them his ID, get a facial scan, and everything else you can think of to generate a token and then pass that token around?
ZKP are a cryptography-nerd's joy but are are categorically unsuitable for the purpose of age verification. I stand by this without the slightest reservation.
You may as well advocate for no one to be allowed to drive cars because of the possibility of someone getting into a car accident.
Or (in case you're a fan of the second amendment) - advocate for guns not being allowed to be sold to law-abiding citizens because of the possibility of the gun later working its way into the hands of someone who would use it for a mass shooting.
Freedoms exist with the understanding that both positive and negative consequences can result from them. The argument is that the good vastly out-weighs the bad and are worth preserving.
Either they validate so little information that a single homeless person can authenticate the entire country or they validate so much information as to not have a significant privacy guarantee.
There is no in-between for ZKP validating someone's age.
Same concept applies to federal.
Ever pay attention to all those groups (private sector or otherwise) that end up influencing policy creation? Ever think of trying to get other government agencies or already-trusted organizations on your side as opposed to trying to establish yourself as a credible voice to ocotogenarians who can't tell the difference between an expert and someone blowing smoke?
Finding allies to support your policy goals doesn't need to stop at asking random people on the Internet. It's a woefully underexplored area for Internet freedom activists.
Cynicism is an assumption. Cynicism is emotional armor because the thought of caring again and the risk of it not panning out is more painful than not caring at all.
The only rational aspect of cynicism is that it makes you feel better. It isn't relevant about one's actual ability to change the world.
If efforts in the past didn't work to affect political change? Change what you do. Change your tactics. Clearly many groups - including ones with little-to-no-money - can and do succeed to influence policy on a regular basis.
The worst thing you can do is to convince others not to do anything about it. And right after that is to do nothing about it yourself.
"Need" is an extremely strong word that is not appropriate for many Internet services where facial recognition is being pushed for.
Maybe it's a better analogy to compare this to food-without-lead costing 10 times as much as food-with-lead in large part because of direct actions undertaken by lead manufacturers.
Hope you like being overworked!
Left unstated is what jobs philosophy and art history majors take.
There's more computer scientists working in computer science than there are philosophy or art history majors working in philosophy or art history.
Spam calls frequently don't have a source in the same country as their target victim.
I don't have a good frame of reference to know when VCs consider the industry worth pouring more money into or if it's a black hole for investment.
Surely there's gotta be some point where the industry has to prove itself worth additional investment $ rather than banking on finding another company where over 80% its valuation is based on memes and dreams (see: SpaceX) or has cartoonishly inflated expectation of future profitability (see: Palantir).
I'm aware of DIU and of greater outreach efforts to the bay area. I'm aware of a greater rhetorical focus within DoD leadership on taking advantage of Silicon Valley's tech expertise.
But I'm not aware of any substantive change to DoD acquisition law to address the fundamental incompatibility in funding models between DoD's traditional contractor base and bay area startups. The significant lag time to award contracts. The risk-aversion for the DoD where civil servants face political and, in some cases, legal liability for granting funding for projects that don't pan out.
Has the DoD's risk tolerance for investments changed recently? As in - accepting the possibility that some investments may not pan out if it means there's a good chance that other investments bear fruit.
Last I checked a few years ago, outreach to the bay area startups has been primarily using the DoD's equivalent of change found in the couch. A rounding error of DoD's overall available funding.
Thus the sentence I immediately followed the one this was made in response to where I said "They tend to die in that time if they have no funding."
> Right. So they raise funding.
In many, many cases when it comes to the DoD, their wants aren't seen as dual-purpose and start-ups struggle to find funding that isn't from some DoD-aligned and defense-focused investment firm - which haven't historically invested in large numbers of startups. At least not when I last checked several years ago.
And just to get ahead of this - a DoD want not being seen as dual purpose and the tech later being used for a dual purpose are two very different things.
> Your argument boils down to “the DoD won’t work with startups that don’t have funding,” which is both true and, frankly, as it should be, in my opinion.
My argument is that DoD contract law is poorly suited for funding meaningful sums of money to start-ups that do not have significant non-DoD sources of funding. I'm to understand relatively small sums of money can be awarded on a short time scale, but those sums of money are tiny compared to what's needed to execute on most contracts.