Its possible to implement something that hides your actual age from a website, but the tricky part is hiding what website you’re visiting from an identity provider.
Let’s walk through a wrong solution to get some fundamentals. If you’re familiar with SSO login, a website makes a request token to login the user and makes claims (these request pieces of user information.) One could simply request “is the user older than 18?” And that hides the actual age and user identity.
The problem is how do you hide what website you’re going to from the identity provider? In most SSO style logins, you need to know the web page to redirect back to the original site. Thus leaking information about websites you probably don’t want to share.
The problem with proposals that focus on the crypto is that they actually have to be implemented using today’s browser and HTTP standards to get people to use them.
Its possible to implement something that hides your actual age from a website, but the tricky part is hiding what website you’re visiting from an identity provider.
Let’s walk through a wrong solution to get some fundamentals. If you’re familiar with SSO login, a website makes a request token to login the user and makes claims (these request pieces of user information.) One could simply request “is the user older than 18?” And that hides the actual age and user identity.
The problem is how do you hide what website you’re going to from the identity provider? In most SSO style logins, you need to know the web page to redirect back to the original site. Thus leaking information about websites you probably don’t want to share.
The problem with proposals that focus on the crypto is that they actually have to be implemented using today’s browser and HTTP standards to get people to use them.