Many might’ve seen the Australian ban of social media for <16 y.o with no idea of how to implement it. There have been mentions of “double blind age verification”, but I can’t find any information on it.

Out of curiosity, how would you implement this with privacy in mind if you really had to?

  • demesisx
    link
    fedilink
    English
    arrow-up
    12
    ·
    3 months ago

    If a doctor or mechanic was wrong, at least you’d have an inkling that things were wrong and you’d be able to sue them. Whereas with cryptography, no one has ANY IDEA WHATSOEVER if there are back doors until they are used to rob people blind. In all of the cases you mentioned, victims of those abuses have recourse whereas in cryptography, if things are wrong, they often CANNOT be patched and it’s even exceptionally hard for an expert to prove what went wrong.

    • hedgehog@ttrpg.network
      link
      fedilink
      arrow-up
      2
      ·
      3 months ago

      What are you hiring this cryptographer to do? It sounds like you’re hiring them to roll your own crypto (it’s for your project, therefore it’s “yours”). That’s where you went wrong.

      If you go with an established cryptographic algorithm / OSS implementation, then that solution will be one that has received a great deal of review by cryptographers. If it has obvious vulnerabilities, those will have been noticed and documented. Many non-obvious vulnerabilities will have been documented, too.

      If you roll your own, even if you’re an expert, your algorithm will not have had the benefit of those thousands of hours spent reviewing it.

      But that doesn’t mean that your work can’t be reviewed. Even a developer who didn’t specialize in cryptography could potentially notice an issue, assuming they at least had some background, though it having experts review it would be better.

      If you’re following best practices and are using an established solution, then the reviewer doesn’t have to fully understand the field of crypto. It’s much easier to confirm that an algorithm is being implemented faithfully or that best practices are being followed.

      If a cryptographer you hired is trying to intentionally build an algorithm with backdoors, that may be difficult to notice, but if “no one has ANY IDEA WHATSOEVER if there are back doors until they are used to rob people blind” then that’s because you didn’t have enough experts review their work.

      • demesisx
        link
        fedilink
        English
        arrow-up
        4
        ·
        3 months ago

        I disagree with nothing you’ve said here. This is exactly what I would do and exactly what IS done in industry.