Has passed third Senate reading 15/4/2026

Has passed first House of Commons reading 30/4/2026.

  • brax@sh.itjust.works
    link
    fedilink
    arrow-up
    1
    ·
    2 months ago

    Lmao, what a waste of tax dollars. Like, it’s been a complete failure in the other countries that have lobotomized themselves and done it - yeah we should do it too! What could possibly go wrong?

    …idiots

  • Sunshine@piefed.caOP
    link
    fedilink
    English
    arrow-up
    1
    ·
    2 months ago

    We the people need to write to our mps that we oppose this attack on privacy.

  • tleb@lemmy.ca
    link
    fedilink
    arrow-up
    0
    ·
    2 months ago

    Age verification would be fine if it was an OAuth type thing - I sign in with the government on the government’s website, they report back that I have the 18+ grant. I don’t know why they’re going in this direction of just requiring that private companies collect a bunch of personal information to “verify” me

    • Nik282000@lemmy.ca
      link
      fedilink
      arrow-up
      0
      ·
      2 months ago

      Is there anything to stop the government side from compiling a list of users and the sites that request verification? Because that just makes a centralized target for hacking or internal crime. There’s got to be a way that allows for both verification and zero trust :/

      • JasonDJ@lemmy.zip
        link
        fedilink
        arrow-up
        1
        ·
        2 months ago

        I mean…yeah…but it sounds really bad on the surface.

        Crypto. Namely, certificates or smartcards.

        Imagine if your driver’s license were a smartcard. It’d essentially just be a cryptographic key pair that asserts that you are “you” because the card says you are and you both have the card and know the unlock PIN.

        Now, that sounds like the government could easily track you, but not quite. All that really matters is that the certificate is valid. Not expired, not revoked, and there is a mutual trust in a third party (the issuer).

        This doesn’t require a query to the issuer. It can, and should, i.e. using OCSP or CRLs. CRLs, in particular, are a bit better here…instead of the service going back to the issuer and saying “is this certificate still good”, instead, the issuer periodically publishes a list of all revoked serial numbers that get downloaded by anybody who wants them.

        The important thing is, the service provider (i.e. the website) never has to ask about you by name. They know you are you, because you possess your private keys, and they trust that the issuer of your certificate (a corresponding public key, signed by the issuers private key) is thorough in verifying your identity.

        I think a mutual-third-party trust model (basically, certificates) is about as good as it can get. I don’t think you can verify without trust. That’s not how the proverb goes. Not at all.