[john_strinlai]

>"Age verification" means that everyone who does anything online will have to submit to fine-grained tracking and recording of all their online activities.

its been said 1000 times here, but: age verification doesn't have to be a nightmare dystopia of 24/7 fine-grained tracking and recording unless you are somehow hoping to achieve 100% success rate (something we have not done with any other law ever). there are several reasonable proposals that would be 90%+ successful without stepping on anyone's toes.

i am convinced that enough people in power know it, too, but see this as their chance to get the full-dystopia version rolled out.

[Wowfunhappy]

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general.

Heck—in most cases, we can't even tell the difference between humans and bots anymore! And it's true that we basically accept that some bots will slip through the cracks—but identifying bots also strikes me as significantly easier than identifying children.

[Aaargh20318]

The way identity wallets work:

The government issues an eID to your wallet. The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID. The government signs individual attributes combined with the public key with the government private key. The government certificate containing the public key is, well, public.

One of the attributes is ‘over_18’ (In the EU eID scheme countries can add other over_XX attributes if they want, but over_18 is mandatory).

When a website wants to requests attributes, in this case the over_18 attribute, they send a request to the user’s wallet app, including a challenge. The wallet sends back a package including the government-signed attribute, which contains the device public key and the over_18 attribute plus a response to the challenge (proving the credential didn’t get transferred).

The website only sees the ‘over_18’ attribute, which is backed by the government signature. They don’t see any other attributes (the wallet app shows in advance which attributes you are sharing). The government never sees which website wants to know if you’re 18+.

Of course this is all a bit simplified, check OIDC4VCI and OIDC4VP for details.

The only real issue is the wallet app and device binding. Because a compromised device could allow credentials to be transferred some form of attestation of device and wallet app is required. In practice this means no rooted/jailbroken phones.

[Aurornis]

> The website only sees the ‘over_18’ attribute, which is backed by the government signature

Not true. The device's public key is also sent, which functions as a stable device identifier.

We've spent years trying to get away from stable tracking IDs and fingerprinting. Returning to a system where devices are sending a stable ID to a website to prove ownership is a step backward.

There are proposed mitigations like issuing multiple sets of credentials or rotating them, but we're not going to get an infinite number of keypairs for every website or session in the secure enclave in practice.

Another reason why these proposals aren't getting much uptake is that they aren't addressing what the lawmakers are pursuing: They don't want anonymous authorization tied to the device. They want IDs tied to accounts and a way to discourage people from sharing IDs. In the anonymous systems it only takes one person a few minutes to put an over-18 identity into a device and there's no way to determine if someone is abusing the system by stealing IDs or if someone's 18 year old brother is setting up all of their younger brothers' phones for $5 each.

The situation gets stickier when you acknowledge that it's not possible to limit all of these websites to only mobile phone devices with secure enclaves that are not jailbroken. Once you open a door to desktop devices and other OSes accessing these sites, you open the door to replaying and proxying attacks, where someone will produce those `over_18` attestations on-demand for you, possibly for a minimal price. This brings us back to the public stable identifier to discourage fraud, which means governments won't be happy to issue as many keypairs as we want, which means we're back to semi-stable fingerprints.

[Aaargh20318]

> Not true. The device's public key is also sent, which functions as a stable device identifier.

This is covered by allowing for single-use credentials. IIRC the EU personal IDs will use this. Basically, the wallet requests a batch of single-use eIDs that all use different device key-pairs. Each credential is only used for one request and then deleted. The wallet will automatically request new credentials in batches when they run out. The old key-pairs are deleted along with the credential so you don’t run out of space in the secure enclave.

> Another reason why these proposals aren't getting much uptake

I’m not sure what you mean by not much uptake, EU countries are required to issue and accept them for official business by the end of 2026

[horsawlarway]

> In practice this means no rooted/jailbroken phones.

Personally - this is less acceptable to me than just having the site collect my image/id.

I'd support just putting the id in a dedicated device (ex - gov issues smart key) or just accepting that sometimes people will share id info (just like... physical ids).

It doesn't even close all the doors to transferring ids - since I can still just hand someone a phone (just like... physical ids).

[echoangle]

If you use physical ids to verify your identity, they normally verify that your face matches the image on the id, no? That’s not possible for web id.

[Wowfunhappy]

> The only real issue is the wallet app and device binding. Because a compromised device could allow credentials to be transferred some form of attestation of device and wallet app is required. In practice this means no rooted/jailbroken phones.

Yeah, and no Linux PCs, no custom builds of web browsers (which would effectively become open source in theory only)—basically the end of any kind of open platform. I would much rather just scan my ID!

[chollida1]

How does this work without a phone? I do 99% of my computer work, like now, not on a phone.

Do regular desktop and laptop computers have the same secure enclave feature?

[irusensei]

>The government issues an eID to your wallet

So people in dubious legal circumstances are locked out the internet?

[skinfaxi]

Couldn't the public key be used as an identifier for tracking?

[inigyou]

> which contains the device public key

And there it is.

[ninalanyon]

So now I have to have a mobile phone?

[sonic45132]

I feel the idea of public key encryption could be done without a phone but the device locking makes it harder to transfer the token off device. Like the parent comment said, I think 90% is all we can aim for. Nothing is going to be perfect.

[maccard]

Secure Enclave on a mobile phone, or an NFC smart card both work fine. It could be your passport, drivers license, national ID, whatever.

[rustyminnow]

Could probably be implemented by a smartcard or yubikey-like device as well. Shoot, just build it into my state issued ID card.

[intrasight]

Identity wallets can be made to work anywhere.

[pluralmonad]

And one you don't fully own/control. Fully owned devices will be unsupported, obviously.

[petemill]

Sounds like what a government issued card should be used for, which seems fine

[izacus]

You can have an ID card. Just like for buying alcohol and cigarettes.

[john_strinlai]

>Could you be more specific as to what you're imagining?

sure, i'll put my favorite two. though you'll find much more detailed and thought-out versions of these (and others) in the dozens of other giant threads on the same topic.

- buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is non-identifying.

- websites issue content tags, browsers consume them, you enter your age into the OS during setup.

[donmcronald]

> buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time

Why should I pay continuously to prove I'm an adult? And those cards will be getting sold to kids faster than you can blink. I bet a lot of parents would buy them for their kids.

[drdexebtjl]

> I bet a lot of parents would buy them for their kids.

Good. I should be able to make judgement calls about what my children can or can’t access outside of school.

It’s better if they do it under my supervision than against my back, aided by a predator whose only moat is lending their ID, or their face.

[sdeframond]

> I bet a lot of parents would buy them for their kids.

That changes the default from "anyone can do anything" to "gotta ask parents". Defaults matter at scale. It adds friction.

[john_strinlai]

>And those cards will be getting sold to kids faster than you can blink.

there's a reason i said 90% and not 100% effective. alcohol and tobacco get resold to kids, too.

[fl4regun]

What makes you think this will be close to 90%? Unless these cards are expensive I don't see that happening.

[john_strinlai]

>What makes you think this will be close to 90%? Unless these cards are expensive I don't see that happening.

its obviously just an illustrative guess. but if the penalty of possessing the card is similar to underage possession of alcohol/tobacco, and larger penalties if a store/person is found providing a card to someone underage, i see no reason why it wouldnt have a similar success rate as alcohol/tobacco.

[CPLX]

Why should you pay for an internet connection, or a computing device with a screen? This isn't a serious counterargument.

[fluoridation]

Because those things cost money to make and to maintain, whereas there's no intrinsic cost to prove one is an adult.

[CPLX]

Yes there is.

You need to pay for a drivers license or a passport and so on. So there is an intrinsic cost to prove who you are where you are from and what your birthday is already.

You have to pay for all sorts of small things to participate in normal society. This isn't a serious criticism.

By definition this is not a life critical thing, it's something that is procured in order to access specific services on the internet, which is not free.

[cogman10]

And honestly, all these should ultimately just be done client side in the browser. After the browser has verified "User is x or user is over 21" there's no reason to then send that information to the website.

Let websites issue a "window.isUserOver(16)" call once and then move forward based on the response to that query.

[Wowfunhappy]

This would require browser attestation, wouldn't it? Otherwise kids are just going to download a custom build of Chromium where `window.isUserOver(16)` is always `True`.

[cogman10]

Some probably will. 99% of them don't even know what "Chromium" is.

This doesn't have to be perfect.

[Wowfunhappy]

Right now, they don't know. They're going to learn very quickly when they want to use some website and they can't.

We agree it doesn't need to be 100% perfect. But it needs to be at least, like, 60% perfect, right? And unless you make it at least a bit hard to bypass, it will stop virtually no one.

[mindslight]

No, it only "requires" browser attestation if we taken it as a given that the onus is on tech companies for verifying who they are talking to - ie identity verification that most of these schemes boil down to regardless of how cute they're dressed up.

To effectively keep adult content away from kids, it merely requires secure boot and closed app stores, which are already widespread. And they are only required on the devices actually given to kids, rather than every single computing device.

But this proposal has another problem: it's easy for a website to run isUserOver(n) in a loop to derive the exact age. And on a persistent account, it can be queried every day to derive an exact birthday! Which comes back to my main point that the only technical schemes we should be considering are ones where information strictly flows one way - the website/app supplies information to the browser/OS, which then [may] implement parental control policy. anything else fundamentally boils down to a mandate for identity verification.

[Wowfunhappy]

> To effectively keep adult content away from kids, it merely requires secure boot and closed app stores, which are already widespread. And they are only required on the devices actually given to kids, rather than every single computing device.

...I guess I don't really see the difference.

Closed app stores are widespread on some platforms but certainly not others, and I for one would really like them to not spread any further.

[mminer237]

This is how California is legislating it—requiring the OS to let an admin set the user's age, then let browsers and through them, websites, to query that setting.

[inigyou]

You can get their exact age by binary search.

[ekr____]

Typically these APIs are designed so you can't make arbitrary queries, but rather there are fixed age brackets.

[utopiah]

> UUID card is non-identifying.

Kids aren't going to trade Pokemon cards in the playground anymore...

[choo-t]

Well, they could trade identifying ones too or even stollen ID cards if you want to go this way.

They could also trade porn-filled thumb drive or old-school glossy paper magazine. There no way to prevent kid's exposure to stuff at a 100% success rate.

There no way to avoid exposure completely

[dana-s]

I'm just left wondering, how would that be different than buying a phone? Most kids also don't have money to spend on devices, that's all coming from adults, how would the UUID work any different? In my view it seems we'll just reach the current state as with phones.

[oliwarner]

That's because you're treating AV as a system that must be 100% correct immediately. This isn't banking or an election.

As soon as you loosen off the requirements to "reasonable effort", you can start looking at account age, facial features, social attestation, and include retrospective tools to revisit someone's verification if they get in and start acting like a child. Heuristically messy but far from impossible to demand a stronger form of verification if their original might have been borderline.

The goal is broad coverage, not complete. Screening doesn't have to get 100% to have an effect.

[Wowfunhappy]

I understand it doesn't need to be 100% correct. But I think what you're describing is either (A) going to be very privacy invasive, (B) going to create problems for lots of adults, or (C) going to be precisely as effective as a checkbox saying "I agree I am over 18 years old".

[zug_zug]

Sure here's one example of decentralizing it -- it's going to be overly simple just as a toy example to show how easy it could be:

Whenever you want to prove your adult you go to "am I an adult.gov" and you use your credit card or whatever to prove you are an adult. At which point you get a 1-time 5-digit code that is UNIVERSAL TO EVERY SINGLE HUMAN and good for 1 hour (everybody who uses the site gets the same code that hour).

Then when you want to look at porn or something, you use this code. Boom simple and done.

There are even much better much more private techniques that use cryptography, and AI is happy to explain these graduate-degree level topics to you at your own pace.

Of course there are situations where people steal things, and use deep-fakes, etc, but those exist in every model.

[akmiller]

Same code for all people for 1 hour and you don't think we'd immediately have rotating codes to pass the gate?

[dpoloncsak]

I'd setup the .onion in a heartbeat. Take crypto donations, cash out in Monero

[malwrar]

Headline news: children infiltrate the universal adult one time password scheme for porn, parents panic! Turns out the 18 year olds started selling access to their younger friends, who resold it to their younger friends.

[sowbug]

Hopefully it would be less of a criticism of the system, and more spurring people to ask questions like "Wait, why did you leave a hunting knife on the coffee table?"

Design a scheme that equips parents with better tools to be better parents, rather than one that reduces the scope of parenting responsibilities.

[john_strinlai]

this happens with alcohol and tobacco every day. i cant think of the last time it reached headline news.

[malwrar]

My point is that the entire check is bypassed easily and instantly, and in the meantime the government gets data that someone _will_ figure out how to make personally identifying for adults, or will argue for changes to make it so. Alcohol age limits are a simple physical check for a vice that everyone accepts those who want it can get at. I’d rather demand that device manufacturers give parents effective controls before we try solving this problem by identifying internet users wholesale.

[pwg]

It does not reach headline news because everyone just accepts that the "filter" is imperfect.

But, for some reason, little twelve year old Jimmy obtaining access to porn evokes some kind of far more visceral reaction in Jimmy's parents (or if not Jimmy's parents, some "busybody" who wants to "protect all the children") than Jimmy managing to get himself a pack of Salem's or a Pabst Blue Ribbon tallboy.

[john_strinlai]

right, that's exactly what i was getting at with my original comment. none of the laws we have are 100% effective. so i find it weird that this specific topic always devolves into "well some kid will be able to get access, so your proposal sucks".

[lotu]

Using existing parental controls parents could set their kids age and that could be used for the age controls. Could the parents let the kids around the age gate? Sure but they could do that even if a government ID and camera was required. This actually might be more effective than a lot of these systems because other adults could not let the kids use their IDs

[inigyou]

Existing parental controls don't work - new ones would have to be created.

[netrap]

Perfect is the enemy of the good, right? I mean a page header or some other simple means to identify "adult" vs not is good for most cases? Just thinking about it.. obviously it can be bypassed but is there a good enough?

[blahaj]

Cryptographically blinded age verification with a government signed digital ID

[armchairhacker]

Make unrestricted devices like alcohol: you need ID to buy (but the box containing the device you’re sold is indistinguishable from any other, so the device may have a UUID but it can’t be traced to your ID); kids caught with unrestricted devices in school have them confiscated; maybe fine parents, but I think discouragement and banning in schools is enough. Kids can have restricted devices, distinguished from unrestricted by appearance in a way that’s hard to fake.

[Wowfunhappy]

I don't know, treating general-purpose computers like alcohol seems a lot more dystopian to me. Does this extend to PC components? Can I build a machine and put Linux on it?

[intrasight]

> Can I build a machine and put Linux on it?

Maybe for the next few years you'll be able to do that. Analogy: back in the day you could just build your own airplane and fly it around. There were no regulations.

[armchairhacker]

Do most kids have the ability and motivation to build their own machines?

AFAIK you don’t need ID to buy juice, sugar, and yeast to make your own alcohol, so I think it should be the same for computer parts.

[impure-aqua]

> Do most kids have the ability and motivation to build their own machines?

I and pretty much everyone else in my childhood TeamSpeak server did at roughly 14 years of age.

[armchairhacker]

Did the people in your Teamspeak server have issues with concentration and socialization like most social media addicts today?

[michael1999]

Info-minimized oidc handshakes with certified identity providers could verify age-category of a user with no other information shared.

Consider "log in with apple" as it is today. Depending on what you share, a relying website might not even get your name or email.

[bbminner]

Yes, that was my thought as well when i was visiting UK and reddit kept asking me to verify my age. It might be even more private and non-trackable than that - if "age.id.gov" central authority effectively "provides a new random user id" (implementation may vary and does not need to have a "literal username") every time you try to use it / log into a website that needs to verify your age - this way websites can not even track you across platforms.

It seems like all the tech stack is there to implement a very simple and privacy-persevering solution.

It does not even smell of state censorship because a website does not have to check your age if it decides to be "non compliant".

Why isn't it implemented like that? Based on the comments it seems more like a "free-for-all implement-your-own-PPI-handling-thon".

This will ofc make life harder for a some groups of people - like people without / limited access to IDs etc. And i do not even argue that the whole thing is necessary.

But there seem to be vastly superior technical means to implement that, aren't there?

[inigyou]

The only way to know that is to trust Apple.

[dfxm12]

If you don't think a checkbox saying "I am 13 or older" is adequate, with all the behavioral tracking available to say Meta, they can tell well enough. OpenAI talks about this too: https://openai.com/index/our-approach-to-age-prediction/

Knowing who someone is in general is different from having a photo of their face or government ID confirmation.

[lo_zamoyski]

This is a classic case for one time ZKPs. Sure, you can't get around attestation, but the party that needs to verify that you meet age criteria doesn't need to know your age or other private information.

I presume you're concerned by the attesting party's knowledge of both the signature and identify information. Yes, in principle these can be linked, but in practice, it may be difficult or made very difficult, and today, very little of our online activity is really anonymous anyway. It is generally not too difficult to infer identity based on the content someone generates and the bread crumbs they leave behind.

Of course, if the intent is to use age verification as a wedge to monitor everyone, then it will be difficult politically to secure the protections needed to prevent that sort of data fusion.

[Bjartr]

So let's see some of the champions of these systems acknowledge this downside and make the case that they should be built in a way that avoids it and not back down on that when it becomes inconvenient.

[vitally3643]

Why would they ever do that? The spying is the point.

[Retr0id]

Where are these mythical sweet-spot solutions? Concretely, half the websites I visit from the UK want me to either scan my face or upload ID documents to access their full featureset. Now that users have been conditioned to accept this, nobody seems very interested in figuring out how to collect less PII - only insulating themselves from liability by having the data processed by a third party.

[irusensei]

They don't exist because the organizations who lobbied governments were YOTI, Persona, K-ID and others who have a vested interest in collecting data and rent seek by latching through regulations like diseased ticks.

[cogman10]

The UK has draconian laws.

But some of the easiest middle ground solutions that solve 90% of the problem are things like simple math problems. Get asked "3+7" and that will pretty quickly filter out almost anyone under the age of 6. If you can accept that there are some smart 4 or 5 year olds who can do simple math, congrats you recognize there's a 10%.

[Retr0id]

They are indeed draconian, and the rest of the world is now eyeing up adopting similar legislation.

[dijksterhuis]

> half the websites I visit from the UK want me to either scan my face or upload ID documents to access their full featureset.

what kind of websites are you visiting to get age checked on half of the sites you visit? i've only been asked to verify for dating apps and "sexy stuff". and i definitely don't spend 50% of my total browsing time on those sites.

maybe this says more about the kind of content/sites you're accessing if it is really as high as 50%? UK age verification mostly only applies to sites which might end up hosting the content quoted below.

> pornographic images, and content that encourages, promotes, or provides instructions for eating disorders, self-harm, or suicide.

or you're just being hyperbolic? 79% of statistics are made up, after all.

[Retr0id]

reddit.com, discord.app, google.com with safe-search off (This one works sometimes, they are A/B testing force-enabling safe-search for unauth'd sessions)

[dofm]

Oh, reddit, yes. Good point.

I don't use that; it's worse for your brain than any regulated substance. Kick your reddit habit while you can.

Google safe search: I've only seen this from my PAYG mobile phone, because I've never bothered to lift the adult content lock on that after more than a decade, and Google is the only place I've seen ask, actually. Even so it rarely happens.

Discord: the mere idea of being in an adult-content-related discord group is enough to make my skin crawl.

Worth noting that of these three, only one of them is a UK-only decision, as far as I am aware: Google Safe Search respects UK phone companies' default adult content block on PAYG. They are about the only company that does. Reddit and Discord have made this decision globally, have they not? Because there are US state laws too.

[john_strinlai]

>mythical sweet-spot solutions?

there are thousands of comments on these threads every time it comes up. there's tons of what i consider reasonable solutions proposed. there's examples below, too, which don't require face scans.

>Concretely, half the websites I visit from the UK want me to either scan my face or upload ID documents

yeah, i agree that really sucks.

[Retr0id]

I've yet to see one I consider reasonable.

[john_strinlai]

if you think even the client-side "yes im 18" on OS setup proposals are unreasonable, i dont know what to say.

[Retr0id]

Privacy-wise I think they're completely acceptable, but in terms of circumvention I don't think the politicians will be satisfied. It's barely a step up from the "I'm over 18" buttons on websites.

[john_strinlai]

>It's barely a step up from the "I'm over 18" buttons on websites.

i think its a pretty decent step up from that, but i know what you mean.

>I don't think the politicians will be satisfied.

and that circles back to my original point. the politicians aren't satisfied with a "mostly effective" solution (e.g. OS-enforced age attestation) as they are with literally every other law, and instead are taking advantage of the issue to justify mass surveillance.

[intended]

I believe kids will always find circumvention pathways.

There is a signaling function these laws serve: things are the products we consider acceptable in society. We have these rules for cigarettes, booze, and vapes.

That said, privacy being sacrificed for signals, is an unacceptable trade, especially when better solutions can be crafted.

[gambiting]

Government builds a website where you can log in using any government issued ID or using one of the many many many available services that hold your details already(at least in the UK nearly everyone will have a DLVA account, HMRC account, HMPO account, NHS account.....all of these are government services which we can only assume hold our data securely already).

On that website, you can click "give me a verification code", it gives you a code that is single use and only valid 24 hours. You type that into whatever 18+ website you need to, they use a public API provided by the government to just check "yes this is a valid code and the user is 18" - bang, done, verified. The website knows nothing about you at all, except for the fact that you're 18.

In fact, the UK government ALREADY HAS THIS. For the EU settlement scheme, you can give your employeer(or anyone else who needs it) a special magic code that they type in on the government website, and it just says "yet his person has the right to reside in the UK" without spilling any of your personal information at all. The code is single use and valid a limited amount of time. And you can do the same with your driving licence, where anyone can verify you hold a valid licence without actually seeing it or any details on it.

Like, am I being stupid here? It seems like an almost trivial solution to the problem, especially given that it already exists for at least 2 services named above.

And yes, I know people will say "oh but that requires the government having this data on you, and that's bad" or "but then the government will know you've authenticated with pornhub!".

And yes, both of these are true - but on point 1 - like, I'd love some ideal situation where the government can simultaniously give me a passport or a driving licence AND not have any information about me at the same time, but that ain't happening, and on point 2 - yes, but that's still infinitely preferable to the current implementation, and it can be easily solved with legislation saying that the code authentication service doesn't log who requested verification, it just answers with yes/no and that's it.

[OkayPhysicist]

This means giving the government complete insight into your internet browsing. All they need to do is store a database table of handed out keys to ids.

This is unacceptable tyranny on its face.

[Retr0id]

Every time I search something, I open a fresh private tab and google it. If I want to turn safe-search off, I'd have to go through this code verification flow for every single search. Aside from just being annoying, they'd have to implement strict rate limiting to prevent automated code sharing, so I'd soon end up waiting for a rate limit to expire before I can search anything.

And "the government will know you've authenticated with pornhub" is extremely harmful, in my opinion.

[intended]

Sadly we got to this place because there are other harms that are occurring and those are forcing this conversation.

[OkayPhysicist]

The "other harms" are made up fearmongering by rightwing cowards and incompetent parents.

[intended]

[delayed]

[Jabrov]

The codes can trivially be shared in this case

[gambiting]

...and? Just like a child can "trivially" ask an adult to buy them a beer.

Who are these adults giving children their verification codes for adult websites?

[Retr0id]

Asking adults for beer doesn't scale, code sharing can. If you want to crack down on code sharing, you'd have to start surveilling who is signing up to what.

[pokstad]

Exactly. The same way that selling alcohol doesn’t require a paper trail of every beer I’ve bought.

[rationalist]

I don't know about this, stores around me are scanning people's IDs to verify their age.

I guess I could make an ID (not a counterfeit government ID) that uses the same encoding for the birthday.

[win311fwg]

Not anymore, at least. In these parts your alcohol purchases did require a paper trail once upon a time.

[SecretDreams]

To be fair, I buy my beers on CC. If someone really wanted to know the best IPAs and session able beers they could get, they could audit my CC records and then cross check to the breweries and pubs to see what I was buying. Just depends how much someone wants to learns bout good beer.

[normie3000]

Anything under 4% should be sessionable IME.

[Aerroon]

And yet in practice they do.

Well, not every beer but when you shop at Beers-R-Us they know.

[63stack]

What's the point in making this distinction? This is HN, 99% of the users here are aware of what zero knowledge proof is and that it's possible to implement it that way.

The general consensus and what the article is alluding to is that it will be probably implemented in a way that allows individual tracking and identification.

[john_strinlai]

>What's the point in making this distinction?

we're on a discussion board, so i started a discussion. that was the point.

[kemotep]

I also only learned about Zero-Knowledge Proofs from links to articles, blogs, and discussions here so someone has to bring it up.

[intended]

I don’t know? Maybe its the little give and take that helps build a solution that is mature and limits the kind of harms kid are facing, without sacrificing privacy?

It’s also the very cool, nuanced and technical tooling that people here tend to enjoy figuring out, and building.

It side steps the thought terminating tar pits of “privacy at all costs” or “save the children”.

[blaze33]

> age verification doesn't have to be a nightmare dystopia

But I feel there's not a lot of trust that whatever implementation we could end up with wouldn't be such a dystopia. The real world equivalent would be checkpoints at every intersection verifying the driver's age, the cashier who carded the 20 yo with a beer now does it for everyone, makes a copy of your ID and stores it in a big folder shared with their 427 "business partners".

Imo we should scrap the whole idea of age verification. Kids get a kidPhone with kidOS, whitelist of age-appropriate resources & capabilities. You wouldn't let an 8 yo drive on the highway, yet they can have a supercar to drive unsupervised on the information highway, no biggie. Internet is full of adults doing all sort of stuff while kids need supervision and education: design safe spaces for children, not checkpoints at every corner.

[Aerroon]

Yeah, and once you have the non-intrusive system in place you can just switch it out for the tracking one without the user knowing.

Or there's probably some kind of correlation trail possible that will track you even with the anonymous systems.

[hacker_88]

They can track you with cookies , now they have age and identity signals .

[ordu]

> age verification doesn't have to be a nightmare dystopia of 24/7 fine-grained tracking and recording unless you are somehow hoping to achieve 100% success rate

I believe you are missing the point. "To protect kids" is just a cover, the nightmare dystopia is the real goal. So age verification have to be a nightmare dystopia or it would be useless for those, who push for it.

[john_strinlai]

>I believe you are missing the point. "To protect kids" is just a cover, the nightmare dystopia is the real goal.

did i miss the point? because my last sentence literally says this.

[ordu]

Ah, well, no. Sorry, didn't read to the end of it. It is just I see no point at all to discuss other options, so sorta become bored reading about them.

[amanaplanacanal]

Well, some who push it anyway. There is another group whose motive is to get rid of all porn.

[sneak]

This isn’t about kids at all. The ID requirement is the WHOLE POINT.

That it is technically possible to do age verification in a privacy-preserving way is thus entirely irrelevant.

They want all online activity tied to ID so they can violently, illegally retaliate in the dark of night against protected expression online that they don’t like.

That’s all this is. Privacy-preserving techniques are irrelevant because they do not accomplish this goal.

[inigyou]

There is also, separately from that, a need to protect kids from growing up into the people in Idiocracy.

[sylos]

Getting children to not grow up into idiots requires intense parental interactions, healthy environments, and the ability to explore and get hurt. Identification isn't even on the list.

[sneak]

They already failed to do that by steadily eroding the educational system and its standards over the last 50-70 years. We’re already there. The electorate can’t locate the countries on a map in which the US is fighting multiple wars in their name.

Banning Instagram ain’t gonna fix that.

This is not in any way whatsoever about children.

[inigyou]

Is it possible that two or more things both harm children?

[shevy-java]

> age verification doesn't have to be a nightmare dystopia of 24/7 fine-grained tracking

Personally I don't care how much age sniffing is mandatory in that I think it is inacceptable on any level. Do you try to insinuate that a little bit of tracking is ok? Because I can not buy into that premise. To me the whole assumption is wrong from the get go.

[john_strinlai]

>Do you try to insinuate that a little bit of tracking is ok?

no, and you can read through other comments here and on the many threads of the same topic for proposals which have no tracking.

[sharperguy]

Doesn't _have_ to be except not enough voters can tell the difference which is exactly the goal.

[akmiller]

Doesn't 90% successful mean you are stepping on 10% toes???

[john_strinlai]

>Doesn't 90% successful mean you are stepping on 10% toes???

no, it means that <10% of kids under 16 or whatever age will still make it onto instagram

[akmiller]

Wouldn't this mean we don't know what age these 10% are in?

[john_strinlai]

i dont know what point you are trying to make.

there are laws against underage drinking and buying alcohol. some kids still get access to alcohol. the law is mostly successful, with an acceptable amount of failure rate.

same concept.

[akmiller]

Gating is not just for porn, they are talking about using for social media and various other things. You can imagine that many things end up age gated if this becomes legislation, as a preventative measure.

Then your 10% becomes problematic because you are either restricting or granting access based on invalid information. So in your world here we then need ways for people who were incorrectly gated to reach out and be corrected somehow.

[inigyou]

No, it means Instagram doesn't know.

[jazz9k]

It was never about the children. They are rolling this out, so online comments can be tracked to names and addresses.

It's to suppress free speech and arrest people that post anything against the government's narrative.

Many people have already been arrested in the UK for this. This is the next logical step.

[dfxm12]

i am convinced that enough people in power know it, too, but see this as their chance to get the full-dystopia version rolled out.

Correct. The goal here isn't "to save kids". That's just one of the Horsemen of the Infocalypse [0] used to market taking away our freedom.

0 - https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...

[XorNot]

I am convinced that no one will make any progress on this issue so long as they refuse to understand that their aren't a group of shadowy figures pushing for this but rather a sizeable chunk of the general population, buoyed on by various moral outrage interest groups including a great many HNers who have been happily stoking the narrative that social media is the cause of every negative statistical ill.

Who wants this? God damn everyone. And in so much as Facebook might do something with the data, what they really want is a legal moat of sufficient depth to drown possible competitors.

[bluebarbet]

In fairness (i.e. looking at the data with an open mind), social media does seem to be the cause of (or at least strongly correlated with) a bunch of ills.

[akmiller]

That's true but has anyone studied the good things that have happened from younger people being able to find community or other positive aspects?

Either way the solution again is not age gating, it's real meaningful data privacy laws that if enacted would have a huge effect on many companies today.

[kazinator]

In tech, 10% unsuccessful today is 100% unsuccessful next week, when everyone learns how to join that 10% who got around it.

The shit is horrible if 100% successful, and yet not worth doing if it isn't.

[mindslight]

Would you mind elaborating on the specific methods you're referencing? To me, the entire problem is framing the issue as "age verification" in the first place - this implies the web company is responsible for knowing and controlling who uses their service. Whether this is a full-on demand for drivers' license / face scan / verification can, or whether there can be a technical process that obscures some details doesn't change this underlying dynamic!

The other problem you're up against is in the low-friction online environment, 90% easily turns into a much lower percentage. Which will actually manifest itself as the initial methods that achieved "90%" being declared insufficient in favor of stronger methods of identity verification.

I say this as a parent staring down having to deal with the dumpster fire that is the modern web in the next short year or two - the only sane way to address this problem is through client-side parental control software that works based on website/app tags supplied by the server / app creator / etc. There is indeed a market failure here, so the sensible regulation is to make websites over a certain size publish labels about the suitability of their content for age brackets, whether a site is social media, contains user generated content, has algorithmic feeds, and so on - affirmative assertions about the content that carry legal weight and liability for them not being true. Device manufacturers over a certain size would need to include parental control software that can be enabled during the setup process.

If parental controls are enabled and a website has not published tags (too small, foreign jurisdiction, misconfiguration, etc), then it simply fails closed and refuses to display the site. This keeps decisions about content suitability in the hands of parents where it belongs, rather than putting it in the hands of corporate attorneys who will often make decisions directly contrary to what parents want! Remember this whole topic is being pushed by big tech to absolve themselves of liability for pushing harmful products!

[john_strinlai]

>Would you mind elaborating on the specific methods you're referencing?

well, i mean, you put a decently reasonable one in your own comment: "client-side parental control software that works based on website/app tags supplied by the server / app creator / etc."

another sibling comment mentions alcohol sales. government could issue a scratch card with UUID that's valid for some time, sold at anywhere alcohol/tobacco is already sold. most people are already comfortable with flashing an id at the beer store.

read any other the other dozen similar threads with hundreds of comments, and there are a handful of other neat ideas usually voted pretty high up.

[Aerroon]

Isn't getting around showing ID for alcohol about as easy as clicking "Yes I'm above 18"? All you need is to know someone that would buy it. Or know someone that knows someone that would buy it. Or know someone that had it bought for them.

Or I guess in the case of the US... maybe even just steal it considering how lax people seem to be with theft.

[john_strinlai]

>Isn't getting around showing ID for alcohol about as easy as clicking "Yes I'm above 18"? All you need is to know someone that would buy it.

and yet, most kids aren't walking around hammered. the penalties of underage possession and supplying to underage kids deters most people.

i will reemphasize that literally no law is 100% effective, so its silly to talk about age verification as if it has to be the first one to be 100% effective.

[mindslight]

Note that what I outlined is decidedly not "age verification" or "identity verification" - rather it relies on on-device parental controls, where the decision process is still completely under the control of the end users (ie parents). The main point of the legislation would be to prime the network effects to overcome the current market failure.

The details of the setup are very important as they lay out which way the situation will be pushed as the calls invariably continue. There are many other neat ideas that are voted high up, that still fundamentally still just boil down to identity verification! This why we need to talk specifics - even most programmers are bad at designing secure systems, as it requires the additional skill of adversarial thinking.

For instance, the scratch card idea you bring up fails with the same problem - it still puts the onus for yes/no decisions on the companies, meaning when the scratch cards are declared not good enough, those companies will then move on to additional methods - and it would be a tall order to craft legislation that prohibited companies from employing any other identity verification methods beyond the scratch cards. And in case it's not obvious, the scratch cards will readily be seen as not good enough - if they're truly private, it's easy for anyone to make a couple extra bucks by buying some (up to the limit), and then selling the tokens online.

(never mind that many beer stores have moved to online verification of licenses where they scan your ID# and it gets backhauled to some centralized database, so even buying beer isn't appropriately described as "flash your ID" any more)

(also note that any "age verification" or "identity verification" scheme does not merely absolve big tech of liability, rather it moves that legal liability on to parents themselves! )