Comment by AnthonyMouse
8 hours ago
> Then we don't legislate specific schemes?
Except that you have to in this case because IDs are issued by the government and then it's the government having to provide some privacy-protecting means of using them, which is the thing they're incapable of in practice.
> There are ways that private entities can implement age checks both securely and without leaking much other information
I have yet to see a single one implemented in real life. People point to attempts and then you look at the implementation and it's full of dubious choices and unforced errors, before you even start looking for bugs.
Moreover, private entities have the perverse incentive to do the opposite of implementing it securely, because they find it profitable to track people, or find it unprofitable to spend the resources necessary to prevent themselves from being infiltrated by foreign governments when their business is the sort which is useful to them as these are.
> it's the government having to provide some privacy-protecting means of using them
Nope, not necessarily.
> I have yet to see a single one implemented in real life.
There are likely to be a lot more coming as the newer standards in this area were finalised last year. Online identity is a continually evolving space.
> Moreover, private entities have the perverse incentive to do the opposite of implementing it securely, because they find it profitable to track people
Some do in some circumstances, but far from all. Others (often financial institutions) have wised up to PII being a liability rather than an opportunity and some are working on frameworks and capabilites in this space that don't involve any more storage or transfer of anyone's ID than already happens in banks.