[cocoto]

The real and robust method will be generating artificial video input instead of the real webcam. I really don’t think any platform will be able to counter this. If they start requiring to use a phone with harder to spoof camera input, you will simply be able to put the camera in front of a high resolution screen. The cat and mouse game will not last long.

[michaelt]

> I really don’t think any platform will be able to counter this.

Do platforms want to counter it?

Seems to me with an unreliable video selfie age verification:

* Reasonable people with common sense don't need to upload scans of their driving licenses and passports

* The platform gets to retain users without too much hassle

* Porn site users are forced to create accounts; this enables tracking, boosting ad revenue and growth numbers.

* Politicians get to announce that they have introduced age controls.

* People who claimed age checks wouldn't invade people's privacy don't get proven wrong

* Teens can sidestep the age checks and retain their access; teens trying to hide their porn from their parents is an age-old tradition.

* Parents don't see their teens accessing porn. They feel reassured without having to have any awkward conversations or figure out any baffling smartphone parental controls.

Everyone wins.

[ulrikrasmussen]

I think you forgot :

* authorities get to selectively crack down on sites for not implementing "proper" age verification. The sites never had a widespread problem with grooming to begin with but just so happened to have a lot of other activity that the authorities didn't like.

Having everyone operate in a gray area is dangerous and threatens the rule of law.

[hhh]

Discord does have a problem with grooming.

[ulrikrasmussen]

I did not mean to talk about Discord specifically but all sites which will be required to do age verification.

It wouldn't be hard to imagine a situation where social media sites leaning towards the government (e.g. Truth Social, X or the like) will be getting a free pass on using age verification methods which are easy to bypass while social media sites that are more critical (e.g. Reddit) will be sanctioned into implementing the strictest and most privacy invading measures. The end result is that people choosing the path of least resistance will be lead to the government-leaning sites.

[hhh]

Yes, I think there needs to be a way to do attribute based credentials or provide as anonymous as possible authorization for citizens from the government. Somewhere between DigID and the DECODE projects ABC trials in Amsterdam.

[nofriend]

It depends. If the law says "you must perform such-and-such steps to verify age" then no, they don't care if you can counter it. If the law says "you must use an approach that is at least x% effective" then yes they do care if enough people counter it.

We already had a half-assed solution, where websites would require you to press the button that says "I am over 18". Clearly somebody decided that wasn't good enough. That person is not going to stop until good enough is achieved.

[mjevans]

How about just requiring browser, OS vendors, and phone makers to give parents real child accounts that are easy to use and keep kids off the Internet?

[zythyx]

There are a lot of actual solutions that could be implemented that don't invade privacy, but that's the point. These rules are all designed TO invade your privacy. They're designed for you to give up your online anonymity and make you accountable for your speech and actions online.

[giantrobot]

> They're designed for you to give up your online anonymity and make you accountable for your speech and actions online.

They're designed destroy anonymity to give the in group pretext to persecute the out group. It will be propagandized as accountability but it will be anything but.

[foltik]

Is this serious or meant as satire about us-vs-them framing?

[GuB-42]

I would rather avoid having the government decide what I should run on my devices, private companies are already bad enough.

[mattnewton]

I'm becoming increasingly cynical that the lack of privacy in online communication is what most of the sponsors of these bills are after, and people thinking of the real harms to children are useful to them.

[trinix912]

This would suddenly mean no more custom browsers, no more custom OSes, and I doubt they'd cater to the Linux and BSD crowds with this one. It's something the OSS community has been trying to fight for the last 4 decades. With a full-on government requirement this would lock you to the vetted platforms while letting anything other get in would be illegal for the site owners.

[int_19h]

It doesn't mean any of that? The point is that the parent, not the child, is the owner of the device. So the parent can restrict the device they own before handing it off to the child (or the same with accounts on the same device).

[trinix912]

That’s what we currently have with parental controls. If they wanted the OS to check for the parent legally being an adult, that would rule out custom OSes and browsers which couldn’t be trusted (by the government) to check for that.

[direwolf20]

Not really, they'd just have to send the "I'm a child" header if the "I'm a child" flag is set. Linux could have /etc/childlocked set to 1 — a global setting instead of per account isn't ideal, but it would satisfy the law.

[internetter]

Until somebody (likely a politician or anti-porn advocacy group) decides to poke the bear and ruin it

[tjoff]

If we normalize this shit everyone will lose.

> Reasonable people with common sense don't need to upload scans of their driving licenses and passports

Cue random bans.

> People who claimed age checks wouldn't invade people's privacy don't get proven wrong

And? Is that supposed to change anything?

[raincole]

> Everyone wins.

Only if the lawmakers agreed.

[ge96]

> Porn site users are forced to create accounts

I'm curious the sites that enforce this like 'your state has banned...' what traffic loss they have. Because I'm not gonna sign up for a porn site lmao, the stigma

[gclawes]

Don't Windows Hello camera devices have some kind of hardware attestation? I'm sure verification schemes like this will eventually go down that path soon.

My guess is that's probably one of the reasons Google tried to push for Play Store only apps, provide a measurable/verifiable software chain for stuff like this.

[nitwit005]

That the camera is real doesn't imply the thing it's viewing is real.

[kulahan]

You're not wrong, but I have had to do video verification over a phone once, and it seemed quite advanced. It would flash through a number of colors and settings and take probably 30 frames of you. I presume they're checking for "this came from a screen and not a human", but of course I have no idea how it works, so I don't know if it's truly sophisticated or not.

[michaelt]

As I understand it, 'Windows Hello' requires a near-IR image alongside the RGB image.

It's not the fancy structured light of phone-style Face ID, but it still protects against the more common ways of fooling biometrics, like holding up a photo or wearing a simple paper mask.

[nitwit005]

Fair enough. That removes the virtual option, and you'll be forced to point the camera at your older brother.

[fortran77]

Windows Hello cameras are all "depth" cameras so a flat photo won't pass muster.

[forgotTheLast]

Two flat images, one for each of the sensor's camera

[naikrovek]

That’s not how they work. They emit structured light in the form of an array of infrared dots and they measure the time of flight to where the dots strike something.

Maybe new ones are different but that’s how they used to be. Little Kinect devices, really, for sensing faces instead of whole people.

[fortran77]

You are exactly right. There's a description here:

https://learn.microsoft.com/en-us/windows-hardware/design/de...

These cameras are considered a "secure biometric" device and AFAIK nobody has faked them. I've flagged the poster who said "try two flat images"

[OptionOfT]

Yes they do. Part of the reason why you can't use certain webcams that are Windows Hello compatible (I.e. with IR) in recent versions of Windows.

[KellyCriterion]

IIRC they had these fingerprinting pads?

[jsheard]

They already support ID checks as an alternative to face scanning, if the latter proves to be untenable then it's literally a case of flipping a switch to mandate ID instead.

[Gigachad]

The long term solution would have to be some kind of integration with a government platform where the platform doesn’t see your ID and the government doesn’t see what you are signing up for.

I don’t this will happen in the US but I can see it in more privacy responding countries.

Apple and Google may also add some kind of “child flag” parents can enable which tells websites and apps this user is a child and all age checks should immediately fail.

[xp84]

I do like the idea of the “this is a child” taint (ok, terrible name but I really think it should be a near-unremovable thing on a platform like Apple’s that’s so locked down/crypto signed etc).

Like, you’d enroll it by adding a DOB and the computer/phone/etc would just intentionally fail all compatible age checks until that date is 18 years in the past. To remove it (e.g. reuse a device for a non-child), an adult would need to show ID in person at Apple.

Government IDs could be used to do completely privacy preserving, basically OpenID Connect but with no identifying property, just an “isEighteenOrMore” property. However, i agree it’ll never happen in the US because “regular” people still don’t know how identity providers can attest without identifying, and thus would never agree to use their government ID to sign into a pornsite. And on top of all that yeah nobody trusts the government, basically in either party, so they’d be convinced the government was secretly keeping a record of which porn sites they use. Which to be fair is not entirely unlikely. Heck, they’d probably even do it by incompetence via logs or something and then have people get blackmailed!

[RupertSalt]

When I played an MMOG, if the admins found out that a child was underage, it was customary for them to suspend their account until their 13th birthday. I thought this was a clever policy, but I just can't understand the reverse of authenticating someone's age based on that of their account...

[rkagerer]

This assumes people are putting in their real birthdays, which IMO is a terrible practice to encourage.

I never put in my real birthday. It's just one more datapoint to leak in an inevitable hack and help scammers exploit me.

Just because a website sticks a field on a form, doesn't mean you need to fill it out.

I can think of maybe 1 website I use that has a legitimate use to know this info about me... and a dozen that use my fictious birthday for no other purpose than an excuse to market at me under the shallow guise of a 'Happy Birthday' email.

[rmunn]

There are many websites that believe I was born on January 1st, in a year close to my actual birth year.

When it's actually required by some law or regulation (e.g. financial stuff) I give my actual birthday. But when some site is just wanting to comply with age verification? Yep, I'm over 30, so you don't need to see my identification. (Jedi hand wave).

[RupertSalt]

They were not, actually.

IIRC, it went like this: the account creation screen prompted them for a birthdate. They entered a fictitious one and pretended to be over 13. (I saw my niece do this in front of me, and I just sighed a very heavy sigh. She was way more interested in Club Penguin.)

Then later, they let the cat out of the bag. They tell their friends "lol I'm only 10! Today's my birthday, so give me a hat!" or something. And so if they claimed they're 10 they got 3 years suspension.

I think there was never any verification done, and no verification was possible: think about it, under COPPA, a service in the USA cannot collect PII from children under 13, so what do you do when a kid gives you two contradicting datapoints? Err on the side of caution.

I gave Yahoo! a false birthdate when I signed up. I was 27, but I also just felt they weren't entitled to knowing it. However, I soon found that maintaining a fraudulent identity is tiresome and error-prone. And Yahoo! wouldn't let me simply change my birthdate as often as I wanted to.

I once had a conversation with a friend about cheating on IRS taxes. She said "can you lie to a piece of paper?" like fudging numbers wasn't like lying to an auditor's face. It was a rhetorical question, of course.

[fph]

Exactly, that's the problem: with OIDC the ID provider gets to know which sites you visit. That is unavoidable given how the protocol works. And you don't want to give all that information to the government in the first place.

[Aurornis]

> where the platform doesn’t see your ID

ID checks aren't very worthwhile if anyone can use any ID with no consequences.

How long would it take for someone's 18 year old brother to realize they can charge everyone $10 to "verify" everyone's accounts with their ID, because it doesn't matter whose ID is used?

[BobaFloutist]

Ok, at which point an adult has taken responsibility for giving them access.

The older brother could also rent an R (or x) rated movie, buy cigarettes, lighters, dry ice, and give them to the kids. The point of the age check is to prevent kids from getting access without an adult in the loop, not to prevent an adult from providing kids access

[Y-bar]

This is a good point. We could extend it to computing devices: An adult gives a child access to a device, and now the adult is in the loop and takes responsibility. If said adult (parent, most often) want to automatically restrict certain activities/content on the device they can use the parental controls available. No panopticon required.

[imtringued]

You can only keep the adult in the loop if you have a panopticon that traces back to said adult.

[Gigachad]

The system doesn’t have to be bulletproof. It just has to be better than the free for all it is today.

[notpushkin]

Better?..

[Dylan16807]

Yes, there are good use cases for an anonymous age gate. So making one would be better than today's situation.

[Barrin92]

this is already how the EU infrastructure for digital ID works, basically. Using public/private keys on your national id, the government functions as a root authority that you (and other trusted verifiers downstream) can identify you with and commercial platforms only get a yes/no when you want to identify yourself but have no access to any data.

South Korea also has had various versions of this even going back to ~2004 I think.

[vintermann]

Yes, it has been possible for a long time to provide anonymous attestations. But somehow, they also always seem to require that you have something like Google play services running for you to ask for the attestation in the first place. And with PKI, even though they could do with just the public key, they somehow also always insist on generating the keys for you (so they have the private key as well).

[Semaphor]

Do all EU countries have that? I know our (German) ID works that way, using the FOSS AusweisApp, but I hadn’t heard of it being EU-wide (it should be, though).

[fcatalan]

Spanish ID cards have had an X. 509 cert inside them for more than 10 years, I use it all the time to sign documents and access government sites. There is already legislation and a push for an EU-wide digital identity wallet that should be up and running this year, look up eidas 2.0 and the EUDI wallet.

That looks like it should make things like privacy compatible age verification "trivial".

[Semaphor]

Thanks, that looks very cool, and apparently close to coming into effect.

[trinix912]

It's been a slow rollout but yes, it's an EU wide thing. Slovenian IDs issued after around 2022 have them too.

[int_19h]

It's nice that the platforms don't get access to data, but does the government gets information about who is trying to access what?

[shevy-java]

I see this currently being pushed by some politicians in the EU. And I have a slight suspicion that some of these politicians are literally lobbyists.

The "oh my god, think of the children" is similar to "oh my god, think of the terrorists". I am not saying all of this is propaganda 1:1 or a lie, but a lot of it is and it is used as a rhetoric tool of influence by many politicians. Both seems to connect to many people who do not really think about who influences them.

[alright2565]

ID is much easier to forge, it's just a flat 2-d shape. None of the physical security features come through in images.

[TheDong]

In functioning states, the ID contains a chip with a private key that can be used to sign a message, and ID verification would not be an image of the ID card, but rather holding your phone's NFC reader to the card and signing a message from the site.

In Japan, there are already multiple apps which use something like this to verify user's age via the "my number card" + the smartphone's NFC reader.

It's more or less impossible to forge without stealing the government's private keys, or infiltrating the government and issuing a fraudulent card.

Of course, the US isn't a functioning state, the people don't trust it with their identity and security and would rather simply give all their information to private companies instead.

[notpushkin]

> In Japan, there are already multiple apps which use something like this to verify user's age via the "my number card" + the smartphone's NFC reader.

Does this also leak your identity to the app?

[charcircuit]

There is not a way to share just your date of birth. After providing your PIN it can read more than just your date of birth.

[klausa]

That's... partially true.

If you use the _digital_ MyNa card (e.g. the one in the Wallet.app; not the plastic one); the iOS SDK lets you only request the "is user more than XX years old" flag; without getting the actual identity: https://developer.apple.com/documentation/passkit/requesting...

Now, AFAICT nobody actually does this, but the technical ability is there.

[junon]

When I had to prove my passport for my bank over a video call they told me to rotate it around in the sunlight to show that it had the holo-whatever ink. So I wouldn't put it past them.

[digiown]

A call requires a human, which is inherently not scalable. And even humans have trouble distinguishing AI content these days.

[ziml77]

And it's not like Discord actually cares. They just care about appearing like they care. Something to keep the heat off of them from regulators and angry parents.

[uncletscollie]

Discord built its own TSA?

[krisoft]

A “video call” perhaps requires a human, but the type of test described need not be a video call. One can imagine a network trained to distinguish a fake id card from real one from a video recorded where the user is asked to move the card such that the holograph is glinting in the sunlight.

[arcologies1985]

They can't feasibly do this in the US since many people don't have drivers licenses or passports.

[jsheard]

Don't you have to be over 18 to get a credit card in the US? How many wouldn't be able to present a CC or ID?

[Aurornis]

Age verification requires a document that can be matched to your ID, such as by the photo on your ID card.

Credit cards don't have photos.

> How many Americans wouldn't be able to present a CC or ID?

The number of Americans who don't have a government issued photo ID is estimated around 1%. The number gets larger if you start going by technicalities like having an expired ID that hasn't been renewed yet.

The intersection between the 1% of 18+ Americans who don't have an ID and those who want to fully verify their Discord accounts is probably a very small number.

[Gigachad]

At least in Australia you absolutely can have a debit card under 18 and it’s extremely common for adults to not have a credit card.

[jsheard]

> At least in Australia you absolutely can have a debit card under 18

Same in the UK, but Steam uses credit cards for age verification there and refuses if you provide a debit card instead. Evidently the payment backends can tell credit and debit apart.

[tpxl]

When does steam require age verification?

It sometimes asks for my age for viewing a game and I can input any ol' date I want to. It doesn't even flinch if I input a different date every time.

I also don't recall them asking about my age when I was actually underage and paid using a PaySafeCard, but then again they didn't have porn on the platform at that point either.

[monocasa]

> Evidently the payment backends can tell credit and debit apart.

Yeah those are parallel systems for reasons that amount to technical debt.

[Denatonium]

Only to have your own card. You can be an authorized user on a credit card even if you're under 18.

[jsheard]

Ah right. That's no use for verification then, unless there's a way for payment gateways to distinguish the primary user from their authorized users.

[carcabob]

Those without driver's licenses or passports can get a state ID card instead, if I'm not mistaken. A pain, but an option.

[efreak]

It's actually not a pain. It's the same process as getting a driver's license, minus the test. You go into the DMV and wait in the same lines (at least in California; I have a CA state ID, not a license)

[buzzerbetrayed]

Yeah that’s not true. It’s a lie. And we all know why it’s a lie. Adults in the US with ID is 99%

[bikezen]

*Citation needed

> Nearly 21 million voting-age U.S. citizens do not have a current (non-expired) driver’s license. Just under 9%, or 20.76 million people, who are U.S. citizens aged 18 or older do not have a non-expired driver’s license. Another 12% (28.6 million) have a non- expired license, but it does not have both their current address and current name. For these individuals, a mismatched address is the largest issue. Ninety-six percent of those with some discrepancy have a license that does not have their current address, 1.5% have their current address but not their current name, and just over 2% do not have their current address or current name on their license. Additionally, just over 1% of adult U.S. citizens do not have any form of government-issued photo identification, which amounts to nearly 2.6 million people.

From https://cdce.umd.edu/sites/cdce.umd.edu/files/pubs/Voter%20I...

[Aurornis]

That seems like a good citation, but it supports the 99% number above

> Additionally, just over 1% of adult U.S. citizens do not have any form of government-issued photo identification, which amounts to nearly 2.6 million people.

The rest of the statistic is about driver's licenses specifically, including technicalities like expiration dates and address changes. The online ID check for age verification don't care about the address part anyway, in my experience.

If someone has an expired drivers' license or they changed their name and haven't updated their IDs, they have bigger problems than age-verifying their Discord accounts.

[Brybry]

My driver's license was expired for 8 years until last year. I wasn't driving so the pressure to renew it was very low.

I actually only renewed it to get medical care and because renewing the license was only a little more expensive than getting an ID-only card.

It did prevent me from using some porn sites because my state requires ID verification but many sites just ignore the requirement so I just didn't use the sites that required ID.

[jtmarl1n]

Somehow they don’t have trouble getting an ID when they want to buy alcohol

[tzs]

It only takes one person with ID buy alcohol for a group.

[novemp]

A lot of people don't drink alcohol.

[monocasa]

Also, in a lot of states you don't get IDed for alcohol after about age 35.

[edm0nd]

wat. the majority of Americans have a DL, ID, or Passport. What a silly thing to say.

For DL alone:

>Data indicates that approximately 84% to 91% of all Americans hold a driver's license, with roughly 237.7 million licensed drivers in the U.S. as of 2023.

Add in an ID and Passport and we are likely closer to 99%

[SoftTalker]

Yep. You basically cannot function in legal society without an ID. If you are an adult and don't have ID you are intentionally trying to live a cloaked life and it won't be very easy.

[beambot]

Personal Identity Verification (PIV) and Common Access Card (CAC) credentials used by US government & military via NFC already work on web browsers. States should just move to digital IDs stored on smartphones, with chain of trust up through the secure element...

[drnick1]

This is extremely dangerous, and would only work with hardware/software that is nonfree (i.e., not under the user's control, or any attestation could be spoofed).

[beambot]

This is effectively PKI for personhood. The State DMV acts as the Certificate Authority (CA), signing a "leaf certificate" that is bound to the device's hardware Secure Element.

It’s less like a TLS handshake and more like OpenID for Verifiable Presentations (OID4VP). The "non-free" hardware requirement serves as Remote Attestation—it allows a verifier to cryptographically prove that the identity hasn't been cloned or spoofed by a script. The verification happens offline or via a standard web flow using the DMV’s public key to validate the data signature, ensuring the credential is authentic without requiring a phone-home to the issuer.

[esseph]

So centralizing control over personhood. Got it.

[esseph]

> Personal Identity Verification (PIV) and Common Access Card (CAC) credentials used by US government & military via NFC already work on web browsers. States should just move to digital IDs stored on smartphones, with chain of trust up through the secure element...

I think you're... missing the point of the pushback. People DO NOT WANT to be identified online, for fear for different types of persecution.

[airstrike]

And lose every user in the process

[jasonfarnon]

Is there any data on what kind of hits to enrollment were taken by facebook, gmail etc when they added requirements like a phone #? Maybe it's buried in their sec filings. Anyway, this "cat and mouse" game is probably irrelevant. They're not looking for and don't need a perfect system. Bc 99% of the public couldn't care less about handing over their information.

[drnick1]

Google does not require a phone number. They may ask for one and tell you it's for your own good, but you can skip the request.

[dark-star]

I think you massively overestimate how many people actually care.

My guess is that 95% or more of all Discord users do not care and simply upload their selfie or ID card and be done with it. I know I will (although they did say that they expect 80%+ to not require verification since they can somehow infer their age from other parameters)

[airstrike]

Remember digg?

I've already cancelled my Nitro account. I'm quite active on a ~5k member programming server and we're giving Zulip another try. I think it's unlikely we'll stay on Discord.

Obviously anecdotal, but eventually this adds up.

[lossyalgo]

Also cancelled my Nitro after 5 years.

This whole thing being "for the safety of kids" is obviously a farce just to get more user data because Nitro users supposedly will have to do the ID check as well, but if you're paying with a CC/Paypal, you are obviously of sufficient age to not require an ID check.

[esseph]

> I know I will

Are you a minority, LGBTQ+, etc or of a "different" political persuasion that might have any reason to be distrustful of the US government? If so, you probably wouldn't just "be done with it".

[dark-star]

No, I'm not, and I also don't live under an opressive government that tracks those people down. I simply don't care if the us government or some random US company knows about what I play, eat, talk about or who I sleep with. And my guess is that outside the US LGBTQ+ and "different political view" bubble, most people also don't care. And that bubble makes up maybe 5% of Discord's user base

[int_19h]

The real question is, how much of the "terminally online" population who is more likely to use paid Discord features?

[bee_rider]

Those 5% are the unusual sorts that separate Discord from Facebook.

[jasonfarnon]

Is there any data on what kind of hits to enrollment were taken by facebook, gmail etc when they added requirements like a phone #? Maybe it's buried in their sec filings.

[Forgeties79]

Most people under the driving age don’t have ID’s, at least in the US.

[darth_avocado]

> The cat and mouse game will not last long.

Yes but for completely different reasons: I will not bother to play the game and stop using the platform.

[gnarbarian]

you counter this by using an id verified service like login.gov or okta verify.

That's the endgame and what the EU really wants. No poasting unless they can arrest you for inconvenient memes.

[leftouterjoins]

Yes this is spot on. Apple & Google mobile platforms are locked down tight for this reason. Try installing okta verify on graphene OS. You cannot.

[monksy]

They're getting worse with attested and validated environments. This one of the reasons that google is trying to kill sideloaded apps and checking for root access.

Weird thing.. the people who want this validation fully expect for you to pay for, maintain, keep it valid, and pay for upkeep/service for their desires. Honestly, this is something that SHOULD get very aggressive pushback.. but most people accept for no reason.

[Nifty3929]

It's not "accepting" - it's actual wanting. Many people want surveillance. Many people want age verification.

[uncletscollie]

A vague answer that says nothing and can't be proven. Thank you for wasting our time.

[apeters]

Wow. The EU.

[gnarbarian]

yes, avoiding EU fines and ensuring availability there is most likely the motivating factor behind the change.

[kevinh]

Alternatively, hand someone $20 and your phone and have them do the verification for you.

[pfych]

This is just what I did, and plan to continue to do.

[ddtaylor]

You can just use a video from YouTube there are people that do it that just don't care

[zjaffee]

There's no need to counter it, the whole point is to hit the social aspect of being on these platforms. If even half the kids can't figure out how to make it work, then a massive part of the problem is solved because a much larger percentage are only using it due to network effects.

[EGreg]

Actually, there are many ways. For example they change colors on your screen and check in real time how it reflects on your face, eyes, etc. Very hard for a model to be trained to respond this quickly to what's on the screen.

They also have you move your head in multiple directions.

[cocoto]

You could always generate a random face model with real time rendering with enough details to trick any AI detector (or even human) and then you can do real time animation to orders or screen light tricks. You could also simply use some face filter on your face and these ones are really convincing these days (like on Snapchat and such).

[EGreg]

Show me such a model.

It would be interesting to see a model completely indistinguishable from a real human in behavior, as well as real-time reflection off different surfaces, etc.

The next step would be to make a complete digital clone of a person based on surreptitiously recording them with hidden cameras. I doubt it's possible.

[viraptor]

The pieces are there. If you're not modifying everything in the image all the time, there's no reason to run it through a visual model. Generate it once (we have it), transform into textured 3d model (we have it), animate and map to movements with vtuber software (we have it). Adding screen colour reflection is trivial. We just need a pipeline for this.

We had facerig for over a decade now. Facefilter recently. It's not hard anymore.

[ddtaylor]

This is doable using high end stuff like Runway with a draft quality.

Your better bet would be to generate a face as an image and then you can easily generate that same face in different expected poses and conditions. You can then use existing models where you get to select the starting image and the ending image. Add some filters and noise to just make it look like normal crappy low light camera.

As for the color that's another expected condition and can be overlayed or pre-generated.

[lazzlazzlazz]

Apple is believed to be adding multispectral imaging to future generations of the iPhone. This and 3d mapping are more than enough to defeat the "point the camera at a high res screen" trick.

The issue is that age verifiers (like Discord) are not really trying.

[bob1029]

They could do what a bank does and run everyone's ID through chexsystems. It's really hard to defeat this. Fake identities don't exist in the system and stolen ones would get flagged by geographic, time of use and velocity rules.

[decimalenough]

Doesn't work for places like Australia, where the social media ban applies only to under-16s. Teenagers rarely have ID, especially in countries where the minimum driving age is higher than 16 (read: most of the world outside the US).

[bob1029]

The concept of identity doesn't necessarily have to be embodied by a piece of physical plastic that goes into a wallet.

Ad-hoc identification can occur via other means like dynamic knowledge based authentication. The sources of this mechanism can be literally anything. Social media itself being one obvious source for the target cohort.

You can walk into many US financial institutions without an ID and still get really far using KBA workflows. The back office will hassle you for a proper scan of a physical ID, but you can often get an account open and funded with just KBA.

[michaelt]

Knowledge-based authentication is a joke - it doesn't work at all.

This basically only gets used for businesses that need a fig leaf for regulatory purposes. You know, $30 loans for uber eats and tiny loans like that.

[RupertSalt]

Unix and Windows and MacOS and every computer since 1970 has relied on knowledge-based authentication, so let's cool the hyperbole.

In the nomenclature of Multi-Factor Authentication, "something you know" is one factor. So if you know a password and you have a hardware token, that's 2 factors and combining different types is the key to MFA.

Many "knowledge based authentication" tries to string together "things you know" without a different type, and that's a weakness.

However, it can be strengthened through various techniques. If a human is authenticating you in real-time, they may choose a factoid that an impostor is unlikely to know which may be agreed in advance. For example, the security questions combined with other challenges, or a "curve ball" that may elicit a stutter, pause, or prevarication. This is a dynamic method that bob refers to.

In fact, knowledge-based quizzes are used routinely by credit reporting agencies -- the big ones like Experian. And they've been presented by background check services, too. They work like this: they scrape your credit reports and public records in a deep dive for your old addresses, employers, contact info, a whole smorgasbord of stuff. Maybe attackers know some of it. But it's multiple choice: "which of these did you live at? None of the above? All of them?" "Which one of these wasn't your employer?" And the attacker would need to have the same list of public records, and also know the wrong answers! Knowing the wrong answers is the "curve ball" here! How many attackers know that I didn't work for Acme, Inc, and I never lived in San Antonio?

It's also worth pointing out that I've opened at least 3 bank accounts without setting foot in a bank. Even if yours is brick-and-mortar, they probably have a flow on their website for account creation and funding. It is not difficult to satisfy their ID requirements. If they glitch, then you're just flagged a bit, and you follow up as instructed. I've also authenticated identity to the federal government agencies, and accessed several DMV services, using only the apps and websites.

People may feel reticent about establishing their identity online, but isn't it better that you do it first before someone else does? If your identity is known and registered and builds up data points that correspond to you, aren't you less likely to be a victim of fraud or identity theft when things don't add up?

[michaelt]

> In fact, knowledge-based quizzes are used routinely by credit reporting agencies -- the big ones like Experian. And they've been presented by background check services, too.

Yes - and they don't work.

> They work like this: they scrape your credit reports and public records in a deep dive for your old addresses, employers, contact info, a whole smorgasbord of stuff.

Most of which don't work on an 18-year-old. No credit history, no past employers, no bill payments, no history of moving houses, address is their parents' house.

There is no smorgasbord. There's name, date of birth, parents' address - all of which are widely known matters of public record (which is why the credit rating agency has them in the first place).

> But it's multiple choice: "which of these did you live at? None of the above? All of them?" "Which one of these wasn't your employer?"

Fantastic, the credit rating agency has just told the fraudster several of your past addresses, and your past employers.

Sure, there's a phony or two in the list - but the fraudster can try as many times as they want, comparing employer and address lists between different credit applications.

[shevy-java]

But how many users will do so? 1%? 5%?

Also, they will probably find that out, and the moment people do so, they become suspicious to state actors. I understand the rationale behind the work around you described; I just don't think it will be a huge factor. I see this elsewhere too - for instance, I use ublock origin a lot. But how many people world wide use it? I think never above 30%, most likely significantly fewer (or perhaps all anti-advertisement extensions, I think it most definitely is below 50% and probably below 30% too).

[tjpnz]

Death Stranding 2 photo-mode works well for this.

[TheDong]

There is an easy solution to this - require a government ID, and only permit government IDs that can be verified with the state's government.

There are a lot of countries and US states where such validation is possible.

Given the state is mandating these checks, it only makes sense that the state should be responsible for making it possible to perform these checks.

[darth_avocado]

Remind me again, why do people need government approved ids to access discord in the first place? Everyone in this thread is solutioning how we could make government ids work, but no one seems to be asking if that’s a good idea.

[duskdozer]

Well, certainly not for linking all of your online activities with your real life identity of course, not sure where you got that idea from. It's to protect children. And of course, just in some very limited anti-terrorism cases...

[imtringued]

I've heard a politician explicitly request a real name policy on all internet platforms in Germany. Obviously the goal is always mass surveillance.

[subscribed]

Because governments really want people to think about children with naughty stuff.

Gross.

(I'm not verifying anywhere unless required for official business. Still have my non-KYC sim for people)

[samename]

Manufacturing consent at work

[toomuchtodo]

You require a human to identity proof in real life and bind that to a digital identity with a strong authenticator. Anti fraud detection systems can suspend or ban if evasion attempts are detected. Perfect is not the target, it doesn’t have to be.

See: Login.gov (USPS offline proofing) and other national identity systems.

(digital identity is a component of my work)

[gruez]

>You require a human to identity proof in real life and bind that to a digital identity

That's going to be a no from me, dawg. I'm sympathetic to ID checks like if you're buying beer or whatever, but not linking my real life identity to discord or whatever.

[dark-star]

You have to show ID to buy beer?

[subscribed]

If you aren't obviously adult then yeah. Where do you live so there are no laws on selling the alcohol to children?

[notpushkin]

There are laws, but in many countries they are not strictly enforced. In Japan, buying beer in the self checkout lane will just give you an “are you over 20?” prompt, no verification: https://news.ycombinator.com/item?id=46227987

[subscribed]

Interesting, thank you!

[michaelt]

Store doesn't get to photograph your ID, share it with 548 of their advertising partners, and leak it to 7 different hacker groups.

[wileydragonfly]

Why should anyone inclined to want to buy beer have to show ID to do it?

[chrysoprace]

I don't know how it works where you live, but in many jurisdictions around the world (including the one I live in), you have to provide ID to prove that you're of drinking age.

[usefulposter]

I don't know how this false equivalency keeps coming up on HN, but see https://news.ycombinator.com/item?id=46983668.

[chrysoprace]

Not sure what your point was, here in Australia they just look at it, they can't take a photocopy.

[toomuchtodo]

Because you’re required to in all 50 states to prove you’re over 21.

[coldpie]

I don't think that's true? Rather, stores must not sell to anyone under 21. I'm almost 40 and rarely get carded these days.

[toomuchtodo]

Not my call, it’ll be the law of the land. Some may leave, but most won’t, and that’s good enough for corporate and enterprise value purposes.

Pornhub is fighting state age verification and keeps losing state by state, for example.

[toomuchtodo]

Porn site fined £800,000 for not rolling out age checks - https://news.ycombinator.com/item?id=46990755 - February 2026

[MrDrMcCoy]

Which is by nature transient. There are many more and quite dangerous strings attached to doing this online. You never know if all parties involved in the verification are trustworthy.

[vagab0nd]

> you will simply be able to put the camera in front of a high resolution screen

Are you sure it's that simple? How high does the resolution need to be for the camera to not be able to tell? And I'm sure there are sublet clues. Remember, you can't modify the photo or change the camera.

[ddtaylor]

I did this with OBS Virtual Camera for a thing in Oregon and it worked.

[geniium]

This is the right question. Who will benefits from blocking young people? Probably not the platform.

[nicman23]

hardware attestation webcams :) . in the dark future of the 2k there is only windows

[qwertox]

you put a flickering light, pwm creating artifacts in the video and have it apologize for it, to hopefully break some watermarks. my led light started acting up since yesterday, i have no other bulb.

[mudkipdev]

If it was that easy, Face ID wouldn't be used