6 ms·

An identity provider can make verified age one of the claims on an OAuth token. It removes anonymity, but at least you don't have to provide your personal detai

An identity provider can make verified age one of the claims on an OAuth token. It removes anonymity, but at least you don't have to provide your personal details to everybody on the internet demanding age verification. You provide those details to your trusted identity provider, they provide the claim of your age to the website. With that in place we can easily make beer, liquor, marijuana and tobacco sales on the internet possible! And porn too, I guess.

basisword 4y ago
Where are you based? I can purchase alcohol from Amazon UK with no obvious age checks. Deliveroo require that riders verify your age but in reality they just ask you to type it in. And the major grocery stores deliver alcohol without any obvious checking too. I imagine teenage drinking is much easier these days thanks to the above :)
- conro1108 4y ago
  In the Bay Area I’m also easily able to order alcohol on all the big delivery services, but they all seem pretty consistent about scanning your ID for age verification before they drop it off.
- mkoryak 4y ago
  About a month ago I had my groceries delivered from Wholefoods and the deliver driver carded me for some non-alcoholic beer I had purchased. I tried explaining to him that he didn't have to do that, but he wouldn't unload my groceries until I let him scan my ID.
  - _yb2s 4y ago
    I had this a lot during the pandemic lockdown, for groceries and takeout… things that weren’t even liquid or food were mislabeled in some database as alcohol, requiring stressful social interaction when the whole point was no contact dropoff. Crazy how people aren’t allowed to use common sense but have to follow an apps instructions.
    - 0xffff2 4y ago
      It's really not that crazy. "allowed to use common sense" is a loophole you could drive a semi truck through.
      - anigbrowl 4y ago
        Good, I don't want to live in an open-air prison where everything has to be approved by some administrator.
        0xffff2 4y ago
        Okay, so advocate for repealing laws that age-restrict sales of alcohol, tobacco, etc. I don't think you'll find much support for your position, and until you do the company has a duty to do basic due diligence to not break the law.
        anigbrowl 4y ago
        False dichotomy. Basic due diligence can include asking the obviously young if they're old enough and does not need to be so heavily bureaucratized or strictly regulated. I suggest that restricting tobacco advertising and imposing high taxes on tobacco sales has done far more to limit youth consumption than any number of ID checks and retail license policing. Most other developed countries get by just fine with a much more relaxed attitude. Demanding identification and legal documentation for every little thing is excessive and imposes a compliance burden on everyone. It's fair in the sense of being non-discriminatory, but unfair in the sense that it creates a massive aggregate burden, reduces privacy, and institutes authoritarian presumptions.
  - whats_a_quasar 4y ago
    This happens to me at self-checkout at Safeway. I guess I can get somebody to come and check my ID, but seems unnecessary.
    - taylodl 4y ago
      Right? Why can't you scan your ID and then be prompted what information to share with the system, like age? I scan my ID, the system asks to retrieve age information, it retrieves it, now I can proceed to scan my alcohol. No human interaction required. If the person manning the self-checkout operations thinks you look awfully young to be buying alcohol then they can always demand to see your ID. Simple.
      - baristavibes 4y ago
        No way to check you're actually the person on the ID this way
      - kevin_thibedeau 4y ago
        Lots of places have mandatory ID checks regardless of appearance.
        anigbrowl 4y ago
        Stop complying with them. If they won't sell to you, take your business elsewhere and tell them why. If they whine about laws tell them to hire better lobbyists.
        kevin_thibedeau 4y ago
        Eliminating the discretion of a cashier is not a bad thing. It harms no one and makes their job easier.
        anigbrowl 4y ago
        It harms me by making me ask permission of strangers to eat and drink what I choose. I don't think telling people to operate as mindless robots makes their job easier.
  - ghostpepper 4y ago
    Wait they actually scan your ID? Or did you mean visually 'scan' it
    - bragr 4y ago
      Actually scan. I sometimes get beer via door dash, and they quickly verify your age by scanning the barcode on your ID. It pops up green so fast that at least some of the verification must be local to the phone, but I'm sure some data gets sent back. But I had to upload my ID to Door Dash the first time, so incremental scans don't really give them anything new.
- jen20 4y ago
  > I imagine teenage drinking is much easier these days thanks to the above When I was in (secondary) school in the UK, we could get served beer in the pub at lunchtime while wearing school uniform! Doesn't get much easier than that!
  - dmje 4y ago
    We waited for the French Exchange kids to be staying with us. They all looked about 25 when we were all 15. They were always happy to buy our booze for us :-)
  - wkat4242 4y ago
    In Holland beer and wine was allowed from 16 years of age and only spirits were 18+. Unfortunately a recent conservative government switched it all to 18+. I'm much older but I think 16 is old enough for a beer. I didn't when I were that age but I don't begrudge them their beer. And it's not like the law will stop it from happening anyway.
    - crmd 4y ago
      People in the US seem to be at higher risk than Europeans of catastrophic problem drinking (where alcohol use leads to a loss of employment, housing, marriage / social connections, etc). I have seen this with several European friends who relocated to the US and found their relationship with alcohol turning dark. My personal theory is that life in the states may be on average more stressful than in Europe, perhaps due to lack of healthcare, at-will employment, etc., and this life pressure causes people here to be more at risk of self-medication problem drinking.
      - TchoBeer 4y ago
        This is true of western europe, but eastern europe is worse than the US in terms of drinking problems.
- throwaway60607 4y ago
  [flagged]
  - ChrisRR 4y ago
    From your comments it seem you're in Germany where the legal drinking age is 16, so it's not surprising
    - throwaway60607 4y ago
      Not in Germany, just nearby. The legal drinking age where I live is 18.
- loeg 4y ago
  Enforcement is much more strict in the states, generally. It does vary some state to state.
- xdennis 4y ago
  But God forbid you try to buy a kitchen knife! It used to be that you had to show ID at delivery, but now Amazon requires adding ID before the purchase.
  - r00fus 4y ago
    Not in my state (CA). I had kitchen knives delivered by Amazon with no additional checks/verification.
    - anigbrowl 4y ago
      Are you ordering from Amazon UK? If not, then this isn't relevant.
- jfk13 4y ago
  > I can purchase alcohol from Amazon UK with no obvious age checks Using your UK credit card? If so, that's an age check in itself.
  - robin_reala 4y ago
    Here’s a common UK bank (well, building society technically) that has a Visa debit card for their kids account from 11 and up: https://www.nationwide.co.uk/current-accounts/flexone/ https://www.nationwide.co.uk/current-accounts/flexone/
    - jfk13 4y ago
      Yes, my kids had debit cards too. But not credit cards; those have a minimum age of 18.
bloak 4y ago
With physical goods it's probably enough to check the age of the person taking delivery. Presumably the people who deliver groceries know what to do if the groceries include a crate of beer and the person who opens the door looks as if they might be under 18. Presumably they ask to see a driving licence or for someone older to come to the door. Or the crate of beer gets sadly removed from the order and the teenager's father is disappointed when he gets back from his evening walk.
theptip 4y ago
+1 for teaching lawmakers how to achieve their goals at the protocol layer. Imagine how much better the web would be if cookie consent was a browser protocol on top of HTTP headers. This is the Obviously Correct solution, they just needed to work with browser vendors to make it happen. I’d rather you have websites support a generic cryptographically-secure claim schema for ages (implementable in any signed token the browser can emit) than actually check everyone’s identity.
- AdamJacobMuller 4y ago
  They would never do this, because, cookie consent only "works" by making it much harder to opt out than to just "accept all"
- drdaeman 4y ago
  > Imagine how much better the web would be if cookie consent was a browser protocol on top of HTTP headers. Imagine how much better the web would be if the browsers would have a built-in ability to accept or reject cookies on a per-site basis... oh, wait, they do. And had that since forever (or at least IE5). Almost no one used that because it was obnoxious to have a popup on every website. So browser vendors moved those settings to the farthest corners of the most obscure configuration dialogs... and then the politicians brought those prompts back (but in a crappy, non-standardized, not-even-working way).
  - theptip 4y ago
    Right, but to be clear the cookie consent thing was about purpose limitation, not blocking all cookies outright. The idea was that core functionality shouldn’t break if you block unnecessary tracking, which the old cookie blockers couldn’t achieve, which was why politicians got involved in the first place. Great idea, terrible implementation.
    - drdaeman 4y ago
      P3P also existed, but no one had any respect for it beyond sending it fake policies to get their third-party cookies enabled.
RajT88 4y ago
> but at least you don't have to provide your personal details to everybody on the internet demanding age verification. I think some of the aim of these bills is to shame people into not consuming vice.
- solarmist 4y ago
  More than some I’d guess. If they though they'd get away with it they would mandate public lists of who does these things.
  - deleted 4y ago
    [deleted]
  - deleted 4y ago
    [deleted]
  - hellojesus 4y ago
    Yes, but as of now there is no punishment for letting others borrow your oauth token. So just publish your oauth and let anyone use it to sign up for services. It may get tricky if sites limit registration to unique keys, but so long as it's purely checking with a third party and not storing your info, they're shouldn't be a way to validate an id is used more than once.
djha-skin 4y ago
A much better solution than was suggested by PornHub: > PornHub said that a better solution is to identify users by their device. Fingerprinting is not and should not be the sanctioned way of identifying people. On the engineering side, it is a horrible hack. On the ethical side, it is much worse to (attempt to) fingerprint since it tells PornHub waaay more than just age.
- deleted 4y ago
  [deleted]
- AdamJacobMuller 4y ago
  Yeah I really did not understand what they were suggesting with "device verification" but it seemed both ineffective and likely to provide them with far more data than needed.
- deleted 4y ago
  [deleted]
- proprietario 4y ago
  >Fingerprinting is not and should not be the sanctioned way of identifying people. If I understood PornHubs proposal correctly they want to only provide the content if your browser does not send a "Child-Mode" flag or something. Given that parents should introduce children to their first mobile devices and guide them, setting this flag seems not to be so hard. Just set at account creation "minor: true" and done, or am I missing something?
  - deleted 4y ago
    [deleted]
deleted 4y ago
[deleted]
bewo001 4y ago
More interesting data for the identity provider.. Leaving the filtering to the client side is a less intrusive method and puts the responsibility into the hands of parents (or work places). rtalabel.org proposes simple well-known meta tags to simplify this filtering.
- Ajedi32 4y ago
  I support the idea of shifting this to the client side, but RTA seems to be going about it in a rather bizarre way: > Hit the SELECT TAG button, then copy and paste this META tag into the header section of every page on your site that includes content inappropriate for minors: > <meta name="RATING" content="RTA-5042-1996-1400-1577-RTA" /> So far so good... > by using the label you signify that you agree to our TERMS AND CONDITIONS. ...uh, what? I'd rather support a different implementation released as an open standard.
mrweasel 4y ago
Denmark has a system like this, MitID, it support OAuth2 and OpenID Connect, so here it should be possible. The US doesn't have a country wide system for identification only, not that I know of at least. I can understand companies, like PornHub, not wanting to pay along, unless the government provides a system for age verification. Still it would also be a lot of work to integrate with every single government ID scheme around the world. Also they normally aren't free to use, each query normally cost money, why would the porn sites want to pay for a service they didn't want anyway. Another issue with these system: They are high value target and they tend to be just as crashy as other government IT projects.
dirtyid 4y ago
Checkbox for "I don't want to view or reply to comments by under 18s" for websites would be a plus. Think web will get somewhat better when adults stop getting into arguments with kids without knowing it. Wouldn't mind even more granularity, i.e. I don't want to interact with with anyone +/-10 my age. Queue the full Tinderization of online interaction, I only want to see coments from X race, Y age, Z height with following list of orientations and identitites.

basisword 4y ago

Where are you based? I can purchase alcohol from Amazon UK with no obvious age checks. Deliveroo require that riders verify your age but in reality they just ask you to type it in. And the major grocery stores deliver alcohol without any obvious checking too. I imagine teenage drinking is much easier these days thanks to the above :)

conro1108 4y ago
In the Bay Area I’m also easily able to order alcohol on all the big delivery services, but they all seem pretty consistent about scanning your ID for age verification before they drop it off.
mkoryak 4y ago
About a month ago I had my groceries delivered from Wholefoods and the deliver driver carded me for some non-alcoholic beer I had purchased. I tried explaining to him that he didn't have to do that, but he wouldn't unload my groceries until I let him scan my ID.
- _yb2s 4y ago
  I had this a lot during the pandemic lockdown, for groceries and takeout… things that weren’t even liquid or food were mislabeled in some database as alcohol, requiring stressful social interaction when the whole point was no contact dropoff. Crazy how people aren’t allowed to use common sense but have to follow an apps instructions.
  - 0xffff2 4y ago
    It's really not that crazy. "allowed to use common sense" is a loophole you could drive a semi truck through.
    - anigbrowl 4y ago
      Good, I don't want to live in an open-air prison where everything has to be approved by some administrator.
      - 0xffff2 4y ago
        Okay, so advocate for repealing laws that age-restrict sales of alcohol, tobacco, etc. I don't think you'll find much support for your position, and until you do the company has a duty to do basic due diligence to not break the law.
        anigbrowl 4y ago
        False dichotomy. Basic due diligence can include asking the obviously young if they're old enough and does not need to be so heavily bureaucratized or strictly regulated. I suggest that restricting tobacco advertising and imposing high taxes on tobacco sales has done far more to limit youth consumption than any number of ID checks and retail license policing. Most other developed countries get by just fine with a much more relaxed attitude. Demanding identification and legal documentation for every little thing is excessive and imposes a compliance burden on everyone. It's fair in the sense of being non-discriminatory, but unfair in the sense that it creates a massive aggregate burden, reduces privacy, and institutes authoritarian presumptions.
- whats_a_quasar 4y ago
  This happens to me at self-checkout at Safeway. I guess I can get somebody to come and check my ID, but seems unnecessary.
  - taylodl 4y ago
    Right? Why can't you scan your ID and then be prompted what information to share with the system, like age? I scan my ID, the system asks to retrieve age information, it retrieves it, now I can proceed to scan my alcohol. No human interaction required. If the person manning the self-checkout operations thinks you look awfully young to be buying alcohol then they can always demand to see your ID. Simple.
    - baristavibes 4y ago
      No way to check you're actually the person on the ID this way
    - kevin_thibedeau 4y ago
      Lots of places have mandatory ID checks regardless of appearance.
      - anigbrowl 4y ago
        Stop complying with them. If they won't sell to you, take your business elsewhere and tell them why. If they whine about laws tell them to hire better lobbyists.
        kevin_thibedeau 4y ago
        Eliminating the discretion of a cashier is not a bad thing. It harms no one and makes their job easier.
        anigbrowl 4y ago
        It harms me by making me ask permission of strangers to eat and drink what I choose. I don't think telling people to operate as mindless robots makes their job easier.
- ghostpepper 4y ago
  Wait they actually scan your ID? Or did you mean visually 'scan' it
  - bragr 4y ago
    Actually scan. I sometimes get beer via door dash, and they quickly verify your age by scanning the barcode on your ID. It pops up green so fast that at least some of the verification must be local to the phone, but I'm sure some data gets sent back. But I had to upload my ID to Door Dash the first time, so incremental scans don't really give them anything new.
jen20 4y ago
> I imagine teenage drinking is much easier these days thanks to the above When I was in (secondary) school in the UK, we could get served beer in the pub at lunchtime while wearing school uniform! Doesn't get much easier than that!
- dmje 4y ago
  We waited for the French Exchange kids to be staying with us. They all looked about 25 when we were all 15. They were always happy to buy our booze for us :-)
- wkat4242 4y ago
  In Holland beer and wine was allowed from 16 years of age and only spirits were 18+. Unfortunately a recent conservative government switched it all to 18+. I'm much older but I think 16 is old enough for a beer. I didn't when I were that age but I don't begrudge them their beer. And it's not like the law will stop it from happening anyway.
  - crmd 4y ago
    People in the US seem to be at higher risk than Europeans of catastrophic problem drinking (where alcohol use leads to a loss of employment, housing, marriage / social connections, etc). I have seen this with several European friends who relocated to the US and found their relationship with alcohol turning dark. My personal theory is that life in the states may be on average more stressful than in Europe, perhaps due to lack of healthcare, at-will employment, etc., and this life pressure causes people here to be more at risk of self-medication problem drinking.
    - TchoBeer 4y ago
      This is true of western europe, but eastern europe is worse than the US in terms of drinking problems.
throwaway60607 4y ago
[flagged]
- ChrisRR 4y ago
  From your comments it seem you're in Germany where the legal drinking age is 16, so it's not surprising
  - throwaway60607 4y ago
    Not in Germany, just nearby. The legal drinking age where I live is 18.
loeg 4y ago
Enforcement is much more strict in the states, generally. It does vary some state to state.
xdennis 4y ago
But God forbid you try to buy a kitchen knife! It used to be that you had to show ID at delivery, but now Amazon requires adding ID before the purchase.
- r00fus 4y ago
  Not in my state (CA). I had kitchen knives delivered by Amazon with no additional checks/verification.
  - anigbrowl 4y ago
    Are you ordering from Amazon UK? If not, then this isn't relevant.
jfk13 4y ago
> I can purchase alcohol from Amazon UK with no obvious age checks Using your UK credit card? If so, that's an age check in itself.
- robin_reala 4y ago
  Here’s a common UK bank (well, building society technically) that has a Visa debit card for their kids account from 11 and up: https://www.nationwide.co.uk/current-accounts/flexone/ https://www.nationwide.co.uk/current-accounts/flexone/
  - jfk13 4y ago
    Yes, my kids had debit cards too. But not credit cards; those have a minimum age of 18.

bloak 4y ago

With physical goods it's probably enough to check the age of the person taking delivery. Presumably the people who deliver groceries know what to do if the groceries include a crate of beer and the person who opens the door looks as if they might be under 18. Presumably they ask to see a driving licence or for someone older to come to the door. Or the crate of beer gets sadly removed from the order and the teenager's father is disappointed when he gets back from his evening walk.

theptip 4y ago

+1 for teaching lawmakers how to achieve their goals at the protocol layer. Imagine how much better the web would be if cookie consent was a browser protocol on top of HTTP headers. This is the Obviously Correct solution, they just needed to work with browser vendors to make it happen. I’d rather you have websites support a generic cryptographically-secure claim schema for ages (implementable in any signed token the browser can emit) than actually check everyone’s identity.

AdamJacobMuller 4y ago
They would never do this, because, cookie consent only "works" by making it much harder to opt out than to just "accept all"
drdaeman 4y ago
> Imagine how much better the web would be if cookie consent was a browser protocol on top of HTTP headers. Imagine how much better the web would be if the browsers would have a built-in ability to accept or reject cookies on a per-site basis... oh, wait, they do. And had that since forever (or at least IE5). Almost no one used that because it was obnoxious to have a popup on every website. So browser vendors moved those settings to the farthest corners of the most obscure configuration dialogs... and then the politicians brought those prompts back (but in a crappy, non-standardized, not-even-working way).
- theptip 4y ago
  Right, but to be clear the cookie consent thing was about purpose limitation, not blocking all cookies outright. The idea was that core functionality shouldn’t break if you block unnecessary tracking, which the old cookie blockers couldn’t achieve, which was why politicians got involved in the first place. Great idea, terrible implementation.
  - drdaeman 4y ago
    P3P also existed, but no one had any respect for it beyond sending it fake policies to get their third-party cookies enabled.

RajT88 4y ago

> but at least you don't have to provide your personal details to everybody on the internet demanding age verification. I think some of the aim of these bills is to shame people into not consuming vice.

solarmist 4y ago
More than some I’d guess. If they though they'd get away with it they would mandate public lists of who does these things.
- deleted 4y ago
  [deleted]
- deleted 4y ago
  [deleted]
- hellojesus 4y ago
  Yes, but as of now there is no punishment for letting others borrow your oauth token. So just publish your oauth and let anyone use it to sign up for services. It may get tricky if sites limit registration to unique keys, but so long as it's purely checking with a third party and not storing your info, they're shouldn't be a way to validate an id is used more than once.

djha-skin 4y ago

A much better solution than was suggested by PornHub: > PornHub said that a better solution is to identify users by their device. Fingerprinting is not and should not be the sanctioned way of identifying people. On the engineering side, it is a horrible hack. On the ethical side, it is much worse to (attempt to) fingerprint since it tells PornHub waaay more than just age.

deleted 4y ago
[deleted]
AdamJacobMuller 4y ago
Yeah I really did not understand what they were suggesting with "device verification" but it seemed both ineffective and likely to provide them with far more data than needed.
deleted 4y ago
[deleted]
proprietario 4y ago
>Fingerprinting is not and should not be the sanctioned way of identifying people. If I understood PornHubs proposal correctly they want to only provide the content if your browser does not send a "Child-Mode" flag or something. Given that parents should introduce children to their first mobile devices and guide them, setting this flag seems not to be so hard. Just set at account creation "minor: true" and done, or am I missing something?
- deleted 4y ago
  [deleted]

deleted 4y ago

[deleted]

bewo001 4y ago

More interesting data for the identity provider.. Leaving the filtering to the client side is a less intrusive method and puts the responsibility into the hands of parents (or work places). rtalabel.org proposes simple well-known meta tags to simplify this filtering.

Ajedi32 4y ago
I support the idea of shifting this to the client side, but RTA seems to be going about it in a rather bizarre way: > Hit the SELECT TAG button, then copy and paste this META tag into the header section of every page on your site that includes content inappropriate for minors: > <meta name="RATING" content="RTA-5042-1996-1400-1577-RTA" /> So far so good... > by using the label you signify that you agree to our TERMS AND CONDITIONS. ...uh, what? I'd rather support a different implementation released as an open standard.

mrweasel 4y ago

Denmark has a system like this, MitID, it support OAuth2 and OpenID Connect, so here it should be possible. The US doesn't have a country wide system for identification only, not that I know of at least. I can understand companies, like PornHub, not wanting to pay along, unless the government provides a system for age verification. Still it would also be a lot of work to integrate with every single government ID scheme around the world. Also they normally aren't free to use, each query normally cost money, why would the porn sites want to pay for a service they didn't want anyway. Another issue with these system: They are high value target and they tend to be just as crashy as other government IT projects.

dirtyid 4y ago

Checkbox for "I don't want to view or reply to comments by under 18s" for websites would be a plus. Think web will get somewhat better when adults stop getting into arguments with kids without knowing it. Wouldn't mind even more granularity, i.e. I don't want to interact with with anyone +/-10 my age. Queue the full Tinderization of online interaction, I only want to see coments from X race, Y age, Z height with following list of orientations and identitites.