Many might’ve seen the Australian ban of social media for <16 y.o with no idea of how to implement it. There have been mentions of “double blind age verification”, but I can’t find any information on it.
Out of curiosity, how would you implement this with privacy in mind if you really had to?
I find it intimidating for sure. They say “never roll your own crypto” and I take those words to heart. Still, it would suck to have to hire someone and just trust their work. That person could be another Sam Bankman Fried or Do Kwan and you’d be party to their scam and you’d have no idea.
I’m not sure what these things have to do with each other. How exactly would cryptography have prevented SBF, you know, a crypto bro.
It wouldn’t have. You totally misunderstood my comment. Reread it.
To paraphrase: when you hire a cryptographer to work on your project you have to hope that they are not a scammer because they could easily lie to you about the soundness of their cryptography and you’d have no idea. You see, SBF and Do Kwan were liars. If they had been cryptographers (they aren’t and weren’t) their employer would have to believe them since they would be an expert in something nearly impossible for a layman to understand.
Do you get it yet?
I get what you’re trying to say, but I’m not sure it makes sense.
I mean, that’s literally every field you’re not an expert in. And most of us are experts in less than one field.
You don’t know about medicine, car engines, electricity or tax laws, you have your guys for that. Even in our field, we have guys for databases, OSes, networking, because quite frankly nobody understands those really.
So I’m not sure what the point of your comment is. That having experts is good? Yeah, I guess? Did we need to have that reinforced?
If a doctor or mechanic was wrong, at least you’d have an inkling that things were wrong and you’d be able to sue them. Whereas with cryptography, no one has ANY IDEA WHATSOEVER if there are back doors until they are used to rob people blind. In all of the cases you mentioned, victims of those abuses have recourse whereas in cryptography, if things are wrong, they often CANNOT be patched and it’s even exceptionally hard for an expert to prove what went wrong.
What are you hiring this cryptographer to do? It sounds like you’re hiring them to roll your own crypto (it’s for your project, therefore it’s “yours”). That’s where you went wrong.
If you go with an established cryptographic algorithm / OSS implementation, then that solution will be one that has received a great deal of review by cryptographers. If it has obvious vulnerabilities, those will have been noticed and documented. Many non-obvious vulnerabilities will have been documented, too.
If you roll your own, even if you’re an expert, your algorithm will not have had the benefit of those thousands of hours spent reviewing it.
But that doesn’t mean that your work can’t be reviewed. Even a developer who didn’t specialize in cryptography could potentially notice an issue, assuming they at least had some background, though it having experts review it would be better.
If you’re following best practices and are using an established solution, then the reviewer doesn’t have to fully understand the field of crypto. It’s much easier to confirm that an algorithm is being implemented faithfully or that best practices are being followed.
If a cryptographer you hired is trying to intentionally build an algorithm with backdoors, that may be difficult to notice, but if “no one has ANY IDEA WHATSOEVER if there are back doors until they are used to rob people blind” then that’s because you didn’t have enough experts review their work.
I disagree with nothing you’ve said here. This is exactly what I would do and exactly what IS done in industry.