5 ms·

Hrm. I'm not a big fan of this proposal, but I think that implementation would be technically interesting. Say we create a "this is a child" header, which woul

Hrm. I'm not a big fan of this proposal, but I think that implementation would be technically interesting. Say we create a "this is a child" header, which would be sent with all HTTP requests and would mandate that the user not be tracked or advertised to. Great solution, except that everybody would immediately switch the header on because everybody hates ads. In effect, everybody wants to be a child. So now online services fight back and say "okay, well, TikTok is only for adults anyway, you must be 18 to use it, so if this header is present, you can't use TikTok." So adults turn the header back off, and kids go back to lying about being 18. Except for this to have teeth, we have to say that "a user's promise that they are an adult is insufficient to avoid the fine." So now we waltz into the realm of porn sites in the 1990s or Truth Social today: enter a valid credit card number to prove that you are an adult, or maybe take a photo of yourself holding your driver's license and submit it to TikTok for approval. Ick. Okay, so let's go further. Let's say that there's a Government Identity office that, when you turn 18, grants you an Adult Citizen ID# security key that lets you verify your identity digitally. That has the upside of solving a bunch of identity problems. You could imagine using it for voting, banking, signing contracts digitally, proving eligibility to work and citizenship. But also lets you verify to websites that you're an adult. Downside: easier than ever for governments and everybody else to reliably track you and cross-reference you between databases. Less great. But also, I'm not going to choose to "prove I'm an adult" to most of the Internet, just the sites I want to use. Proving I'm an adult is the same as telling them exactly who I am. Ain't no way I want to do that. Ads on random websites are dead. Google's dead overnight unless they require that I log in just to use it (which presumably they would, and I don't care for that at all). Now using the Internet in incognito mode becomes practically impossible. YouTube has a lot of product placement. Is Mark Rober going to get fined if I show my kids his videos? On the other hand, Ryan and Blippi become illegal. Actually, I'm suddenly 100% on board with this.

andreareina 4y ago
The key can attest "the identity associated with this key is over 18" without leaking the identity
- inkblotuniverse 4y ago
  Why would the government do that, though?
  - contravariant 4y ago
    we're so far in imaginary territory that the government doing something competently is hardly an objection.
    - inkblotuniverse 4y ago
      It's the competence I'm afraid of! If they did it competently, they would make sure they had absolute surveillance of every american's internet history.
bastawhiz 4y ago
> Let's say that there's a Government Identity office that, when you turn 18, grants you an Adult Citizen ID# security key that lets you verify your identity digitally. There's really no reason a non-SSN identification number couldn't be used for this. If SSNs weren't sensitive, you could just have a government endpoint that takes an SSN tells you whether the holder is over 18 (or "no, or the SSN is not valid). The only challenge is knowing whether the number belongs the the person sitting in front of the computer. There's no way to stop a kid from using their parent's number. Which is sort of the whole problem with SSNs in the first place: their value largely comes from the fact that they're secret-ish. In effect, they're passwords.
- d110af5ccf 4y ago
  There's also nothing stopping the service from remembering this hypothetical SSN equivalent (or a fingerprint of it), exchanging data with other service providers, and tracking you that way. There are certainly cryptographic primitives that can be used to solve the privacy concerns but I have approximately zero confidence that they would even be considered for use by the current technically illiterate batch of legislators.
  - CobrastanJorji 4y ago
    Maybe, if we're being idealistic, it needn't be particularly powerful. We could just say that every authority would get their own permutation of the ID, a hash of the real ID and the authority's ID or some such, just to make it fairly difficult for two companies to see if their respective IDs are identical. Not perfect, but simple and makes it harder to exploit.
d110af5ccf 4y ago
> I'm not going to choose to "prove I'm an adult" to most of the Internet, just the sites I want to use. Except for purchases and other business or government type interactions I flat out refuse to do this. I simply do not use web sites or services that require a real name. I only rarely use ones that require an email. Yes, this means I don't use most commercial services and major websites. I honestly think I'm better off for it. But it's also a line in the sand and I feel much better for observing it. HN doesn't require an email to sign up. If it did, I almost certainly would never have created an account here.
- CobrastanJorji 4y ago
  Right, but that's the problem with the "no advertising to kids" thing. It means that advertising probably can't be used on any site that doesn't require logins, and that means that most of the commercial sites that don't require logging in will go out of business overnight.
gampleman 4y ago
Surely you could have a trusted age verifier (perhaps a non-profit open source platform) that has the legal responsibility to verify age (via credit-card or photo or gov id or some other way). Then you can have something like an oauth flow, except the only piece of identity it exchanges is the is18? boolean field. One has to realise that for social media their networks effects are both their biggest strengths and their biggest weaknesses. Unlike for things like gaming or porn where there is a relatively large problem (i.e. 20%) if you manage to block only 80% of illegitimate access, for social media if suddenly 80% of the network disappears, than the incentive for the remaining 20% to keep coming drastically decreases.

andreareina 4y ago

The key can attest "the identity associated with this key is over 18" without leaking the identity

inkblotuniverse 4y ago
Why would the government do that, though?
- contravariant 4y ago
  we're so far in imaginary territory that the government doing something competently is hardly an objection.
  - inkblotuniverse 4y ago
    It's the competence I'm afraid of! If they did it competently, they would make sure they had absolute surveillance of every american's internet history.

bastawhiz 4y ago

> Let's say that there's a Government Identity office that, when you turn 18, grants you an Adult Citizen ID# security key that lets you verify your identity digitally. There's really no reason a non-SSN identification number couldn't be used for this. If SSNs weren't sensitive, you could just have a government endpoint that takes an SSN tells you whether the holder is over 18 (or "no, or the SSN is not valid). The only challenge is knowing whether the number belongs the the person sitting in front of the computer. There's no way to stop a kid from using their parent's number. Which is sort of the whole problem with SSNs in the first place: their value largely comes from the fact that they're secret-ish. In effect, they're passwords.

d110af5ccf 4y ago
There's also nothing stopping the service from remembering this hypothetical SSN equivalent (or a fingerprint of it), exchanging data with other service providers, and tracking you that way. There are certainly cryptographic primitives that can be used to solve the privacy concerns but I have approximately zero confidence that they would even be considered for use by the current technically illiterate batch of legislators.
- CobrastanJorji 4y ago
  Maybe, if we're being idealistic, it needn't be particularly powerful. We could just say that every authority would get their own permutation of the ID, a hash of the real ID and the authority's ID or some such, just to make it fairly difficult for two companies to see if their respective IDs are identical. Not perfect, but simple and makes it harder to exploit.

d110af5ccf 4y ago

> I'm not going to choose to "prove I'm an adult" to most of the Internet, just the sites I want to use. Except for purchases and other business or government type interactions I flat out refuse to do this. I simply do not use web sites or services that require a real name. I only rarely use ones that require an email. Yes, this means I don't use most commercial services and major websites. I honestly think I'm better off for it. But it's also a line in the sand and I feel much better for observing it. HN doesn't require an email to sign up. If it did, I almost certainly would never have created an account here.

CobrastanJorji 4y ago
Right, but that's the problem with the "no advertising to kids" thing. It means that advertising probably can't be used on any site that doesn't require logins, and that means that most of the commercial sites that don't require logging in will go out of business overnight.

gampleman 4y ago

Surely you could have a trusted age verifier (perhaps a non-profit open source platform) that has the legal responsibility to verify age (via credit-card or photo or gov id or some other way). Then you can have something like an oauth flow, except the only piece of identity it exchanges is the is18? boolean field. One has to realise that for social media their networks effects are both their biggest strengths and their biggest weaknesses. Unlike for things like gaming or porn where there is a relatively large problem (i.e. 20%) if you manage to block only 80% of illegitimate access, for social media if suddenly 80% of the network disappears, than the incentive for the remaining 20% to keep coming drastically decreases.