Re: [arch-d] Proposed IAB program on Wholistic Human-Oriented Discussions on Identity Systems (WHODIS)

[John Levine <[e-mail]>]

It appears that Toerless Eckert  <[e-mail]> said:
>Might not even need to have biometric verification if one assumes (IMHO rightfully so),
>that the chance of borrowing cell phones to someone else is pretty slim. And even slimmer
>when one puts some less intrusive incentives onto the cell phone to to not borrow them
>for such purpose.

Um, were you ever a teenager?

I can imagine ways to do this that mitigate the privacy risk but only
with a TTP at some point. For example, there's a device at the bar
that takes your picture and sends it to the phone using NFC along with
the minimum admission age. The phone compares the picture to the one
stored internally, and returns a yes/no result with a chain of
signatures back to the TTP so the bar's device knows it's credible.
(Yeah, they have your picture, but they don't need any fancy equipment
to take pictures of everyone who comes in.  They don't have your name or
anything other than the yes/no that you're the same person and you are
at least the required age.)

The automated immigration machines at Canadian airports do something
like this although the master photo is in their database, not on the
card.

But this is subtle and I agree both that it is worth thinking about
and that the scope of inquiry needs to be firmly limited to avoid
ocean boiling.

R's,
John