Decentralized social network Mastodon says it cannot comply with age verification laws, like in Mississippi and elsewhere, and says it's up to individual server owners to decide.
Age check happens by trusted entity (your government, not some sketchy big tech ass), they create a signed cert with a short lifespan to prevent your kid using the one you created yesterday and without the knowledge which service it is for.
Sorry, not sufficient.
Not secure.
" I certify that somebody is >18, but I don’t say who - just somebody "
This is an open invitation to fraud. You are going to create at least a black market for these certificates, since they are anonymous but valid.
And I’m sure some real fraudsters have even stronger ideas than I have.
Making the certs short-lived (a few minutes) and single use and having a rate limit for users could make it difficult enough with serious risks (if you make it a crime) for little profit (I doubt many kids will pay serious amounts of money to watch porn; definetly not drug-scale amounts of money).
I was using the wording of OP who seems to be talking about tokens. The service asks the trusted entity if the token is valid, the trusted entity deletes the token after the first time.
What stops non-anonymous certificates from being sold?
If John Doe views way too much porn, then you expect the site to shut him down? They have no ability to track other site usage. The authorities have to block him after the 10,000th download.
At that point, why does the site need to know? Either the government blocks someone’s ID or they don’t
Sorry, not sufficient.
Not secure.
" I certify that somebody is >18, but I don’t say who - just somebody "
This is an open invitation to fraud. You are going to create at least a black market for these certificates, since they are anonymous but valid.
And I’m sure some real fraudsters have even stronger ideas than I have.
Making the certs short-lived (a few minutes) and single use and having a rate limit for users could make it difficult enough with serious risks (if you make it a crime) for little profit (I doubt many kids will pay serious amounts of money to watch porn; definetly not drug-scale amounts of money).
You cannot make a certificate “single use” (except if it exists only inside a closed system).
I was using the wording of OP who seems to be talking about tokens. The service asks the trusted entity if the token is valid, the trusted entity deletes the token after the first time.
What stops non-anonymous certificates from being sold?
If John Doe views way too much porn, then you expect the site to shut him down? They have no ability to track other site usage. The authorities have to block him after the 10,000th download.
At that point, why does the site need to know? Either the government blocks someone’s ID or they don’t
Not useful to look at it in such a black or white manner. The possibilities are presumably less, and surely not that obvious.