[handoflixue]

In this specific case, why fear the government?

My government has already seen my government-issued ID. If my government hasn't worked out my phone number, they can always ask the phone company. My address is required for the ID, voting, and filing taxes. I don't see how the government learns anything from this?

Conversely, I would like to believe most companies do not have my government-issued ID, nor a lot of the information on it.

[broken-kebab]

In this specific case your government can ban you from the web by refusing to verify. E.g. to punish dissidents abroad Belarusian dictatorship simply nullifies their IDs, and lists them as terrorists in public data. Apparently that's enough to ruin somebody's life worldwide. But at least they can use their browsers, which would be not that easy in a world where gov't-backed verification is norm on the net.

[wyldberry]

From an American perspective, i don't trust the government with the implementation details, nor do I trust our political climate, misaligned incentives, and general disinterest in good governance to implement something so sensitive.

If I lived in say, Sweden, I feel much more comfortable trusting their government to implement. In America, I feel I must always vote in a way that prevents giving any power to the government that I wouldn't want my political opponents to have over me.

[soco]

In said US of America, when the government wants to know something about you, they will get everything they want from the companies - it's even written clearly in the US laws. So I'm not sure why (or where) you draw that line...

[sterlind]

1. if they have to subpoena each site each time they need user data, it reduces mass surveillance risk. I'm okay with cops getting a warrant to access someone's gmail. I'm not okay requiring everyone to use email.gov.

2. I use a VPN and pseudonyms. they could unmask me if they cared to, but it'd be annoying. it'd be a lot more annoying if they wanted to unmask every VPN user all the time.

[NetMageSCW]

Being available as part of Google Cliud means subpoenaing Google is probably sufficient for most web sites.

[slaw]

the grass is always greener on the other side

[AlecSchueler]

You think people in Nordic countries think they'd be able to trust their government more if they were American?

[slaw]

OP never lived in Europe and is looking through rose-colored glasses.

[AlecSchueler]

Sometimes your grass is just yellow.

[AnthonyMouse]

> My government has already seen my government-issued ID.

If you have a government ID and all you use it for is voting and paying taxes, then they know that you vote and you pay taxes.

If you have to use it for accessing the internet then they know everything you do on the internet. What you read, who you talk to, what you post, when you sleep, where you are at any given time -- it's very much not the same thing as just having a picture of you and your name.

[ForHackernews]

No they do not. A properly designed government app that uses cryptography to generate a deniable token that can't be cross-correlated but proves your humanity/age to a consuming site is manifestly different than Google adtech hoovering up as much of your activity as possible.

[AnthonyMouse]

> A properly designed government app

Oof, that's not a great premise to take as a requirement right out of the gate. More counterexamples than examples for that one.

> that uses cryptography to generate a deniable token that can't be cross-correlated but proves your humanity/age

If it's actually deniable/anonymous then how would it work for rate limiting? If you can't correlate their activity then you don't know if the million requests are a million people or one bot with a million connections. If you can correlate their activity then it's not anonymous.

Moreover, it's a false dichotomy that we should be doing either of these things. The better alternative to corporate surveillance isn't government IDs, it's no surveillance.

[ForHackernews]

A site can still choose to have a login system if it wants to. Sites can still rate limit based on IP address or cookies or whatever they use today.

The idea would be to use ZK proofs to demonstrate that "yes, this anonymous request is from a client acting on behalf of an adult human EU citizen" - that's something that is not easy to do today.

[AnthonyMouse]

> A site can still choose to have a login system if it wants to. Sites can still rate limit based on IP address or cookies or whatever they use today.

So then you don't need either attestation or government IDs, right?

> The idea would be to use ZK proofs to demonstrate that "yes, this anonymous request is from a client acting on behalf of an adult human EU citizen" - that's something that is not easy to do today.

But how is that even useful? Is it good to exclude real people from Korea or South America? Do we really expect criminal organizations or for that matter even children to be unable to find a single adult EU citizen willing to anonymously loan them an ID?

It's about as plausible as criminals being unable to run their code on a device that can pass attestation. They're both authoritarians with a conflict of interest trying to foist a hellscape on everyone under a pretext their proposal can't even really address.

[darkwater]

> It's about as plausible as criminals being unable to run their code on a device that can pass attestation. They're both authoritarians with a conflict of interest trying to foist a hellscape on everyone under a pretext their proposal can't even really address.

How is the system proposed by GP authoritarian? It's not actually giving away any real PII. We could just argue that it would make Internet less usable for "illegal" immigrants who don't have a Gov ID - whcih can be seen as a problem already in itself, but still doesn't make that solution "authoritarian".

[ForHackernews]

You're moving the goalposts. I was responding to your claim that any verification system involves the government getting a complete record of all online activity.

If you're willing to admit this is entirely possible from a technical standpoint, there's a separate question about how useful/valuable it is.

Making it harder for children to access extreme pornographic or violent content seems useful to me. Many advertisers want to be able to say they've shown ads to a human not a bot. Humans in WEIRD* countries have more valuable eyeballs than humans in the developing world.

If you don't solve for those use-cases in a privacy preserving way, adtech will do it in an intrusive way - which is what Google are doing in the OP.

*"Western, Educated, Industrialized, Rich, and Democratic"

[sterlind]

I have not seen any government adopt such a standard.

some EU countries claim to provide anonymous age verification services, but those only hide your identity from the relying party. the site you visited is logged to the government's database along with your identity, before you're redirected to the target site with an "anonymous" token.

[ForHackernews]

> the site you visited is logged to the government's database along with your identity

Is that true, or are you spreading FUD? Because the system in question is not even live yet, it's only had experimental releases.

[sterlind]

MitID has been active since 2024: https://www.nordicalcohol.org/post/id-now-required-in-denmar...

https://idura.eu/blog/mitid-vs-age-verification-login

[ForHackernews]

That's not the system I'm talking about: https://ageverification.dev/

> Unlinkability is achieved by design through Zero-Knowledge Proof cryptography see the "Privacy by design" section below.

[SturgeonsLaw]

They could do it like that, but they won't do it like that, because tracking the population is a feature not a bug

[a96]

In a general case, your own government can literally have a gun to your head if they happen to decide they don't like you. A foreign one needs some extra steps.

And governments change. Any one might look benign now, but one election away might be different.