Re: [Privacy-pass] The harms of popular bits

I do think that the model (unified attester+issuer vs split attester/issuer) does make a difference here. If the client (via trust) has a better awareness of (a) what it discloses to the attester and (b) what the common properties and size of of the anonymity set through that attester are, then there is far less ability to have the bit be linked to unwanted characteristics. I.e., if I’m using an attester that is used by an Apple device, I know that the bit that I’m expressing from the Attester to the Issuer (if I trust it not to leak more) is that I’m on a particular device type, and then that the bit to the origins is the combination of that bit with the bits of all other Attesters the Issuer trusts.

Tommy

> On Mar 20, 2024, at 11:26 PM, Watson Ladd <watsonbladd@gmail.com> wrote:
> 
> Dear privacy pass WG,
> 
> I think the discussion of harms in the web context missed the issue, which I'll admit was rather subtly presented. Issuers might not be issuing tokens based on attributes like bot or not but rather characteristics such as race or religion we'd prefer not to. This even happens innocently.
> 
> Using private state tokens as an example social networks and dating sites have a lot of information about user interaction and humanity as a result. But I don't think we want sites to hunt for tokens from dating sites that may be oriented to particular demographics.
> 
> This can even happen unintentionally. If you have some sort of model looking at how users interact based on the bits you have and then selecting offers to show based on it this can end up discriminating even though the bit officially means human. It's just who issued it reveals more than that, even if they issue often.
> 
> I hope this clarifies the remarks I made at the mic.
> 
> Sincerely,
> Watson
> -- 
> Privacy-pass mailing list
> Privacy-pass@ietf.org
> https://www.ietf.org/mailman/listinfo/privacy-pass