About the part of sending the certificate, how do you say they should check the age? By smoke signs?
The whole point about certificates is that they are signed with an asymmetric cryptographic key so you can verify them on your own. You have a list of root certificates from trusted certificate authorities and when a user sends you a certificate that claims to be issued by the Spanish government, you check the signature with the Spanish root certificate. No need to contact the Spanish government’s server about that specific certificate.
This is exactly how any certificate validation process works today. Otherwise, your web browser would have to talk to a bunch of certificate authorities every time you open an HTTPS connection to a website.
You would need to include the birth date in the certificate. But of course that would have its own privacy implications.
And that’s what I’m trying to say: your “just do X” falls short. It is incredibly hard, maybe impossible, to build a reliable age verification system where neither the websites nor the government can violate your privacy. Even the tiniest mistake can mean that the whole thing comes crashing down. And no, “just trust your government” is not a solution. Even if I trust my current government, the next election could put raging Nazis in power who use every available database to identify and terrorize people they don’t like.
If someone designs a system that satisfies all these requirements and is reviewed by multiple independent security researchers, I’m all for implementing it. But from what I know about government IT projects, it currently looks like every country will implement its own system, each with obvious problems that can be exploited by the average computer science student.
Cl@ve gives you a one-use code of 3 letters that you have to validate on your phone and tells you who asks for validation.
About the part of sending the certificate, how do you say they should check the age? By smoke signs?
The whole point about certificates is that they are signed with an asymmetric cryptographic key so you can verify them on your own. You have a list of root certificates from trusted certificate authorities and when a user sends you a certificate that claims to be issued by the Spanish government, you check the signature with the Spanish root certificate. No need to contact the Spanish government’s server about that specific certificate.
This is exactly how any certificate validation process works today. Otherwise, your web browser would have to talk to a bunch of certificate authorities every time you open an HTTPS connection to a website.
But that doesn’t give the validation of age. Just the validation of the cert. Are you saying they have to add an “older than 16” database?
You would need to include the birth date in the certificate. But of course that would have its own privacy implications.
And that’s what I’m trying to say: your “just do X” falls short. It is incredibly hard, maybe impossible, to build a reliable age verification system where neither the websites nor the government can violate your privacy. Even the tiniest mistake can mean that the whole thing comes crashing down. And no, “just trust your government” is not a solution. Even if I trust my current government, the next election could put raging Nazis in power who use every available database to identify and terrorize people they don’t like.
If someone designs a system that satisfies all these requirements and is reviewed by multiple independent security researchers, I’m all for implementing it. But from what I know about government IT projects, it currently looks like every country will implement its own system, each with obvious problems that can be exploited by the average computer science student.