8 ms·

The topic of ID verification for porn sites has gotten a lot of commentary on HN recently, e.g. North Carolina's law requiring ID recently went into effect. Sl

The topic of ID verification for porn sites has gotten a lot of commentary on HN recently, e.g. North Carolina's law requiring ID recently went into effect. Slightly sidestepping the issue of needing an ID for porn in the first place, though, I wanted to comment on the extreme shortsightedness of any sort of ID verification laws (most specifically, financial KYC laws) that require that each individual company verify and store your identity documents themselves. This is quite simply a data breach hackers dream. For example, when Stripe released their Identity product, which captures ID images and selfies, people were at first surprised that the businesses needing ID verification had full access to the ID images (after all, this is contrary to their credit card processing services where businesses never can get access to full credit card numbers, which is great as it keeps those businesses out of the most arduous requirements of PCI rules). But Stripe explained they had to give every end-business access to all the full image data for regulatory compliance reasons. It would make much more sense to rewrite the regulations so that 99% of companies would never need to store identity verification info themselves, but could just delegate that to an approved provider who has much more stringent security checks (or better yet, allow people to cryptographically sign info to prove their identity without giving up their whole passport image, but that's a ways off). I'm not saying this would solve all issues (big companies get hacked, after all), but I hope by now we've put to bed the idea that companies, generally, can secure their data against determined hackers.

deleted 3y ago
[deleted]
grotorea 3y ago
Hasn't there been a few countries with some sort of digital ID development already? I get the impression the Anglosphere has an anti-ID card tradition so it seems like it's a bit behind in that.
- reaperducer 3y ago
  The anti-ID sentiment comes from looking back on history, and not pretending that the future can only be better. People who don't know history repeat its mistakes.
  - lxgr 3y ago
    Germany is extremely focused on that aspect of history and even used to have laws [1] in the books prohibiting anything SSN-like for many years. Yet German ID cards have a built-in contactless chip that allows using them for online identity verification and e-signing. This is obviously more secure than taking a photo of an analog ID as an "online identity proof" (a somewhat absurd idea if you think about it, yet it's the state of the art in most countries today). But if done correctly (and I do realize that this is a very big if), it even be more privacy-preserving too: For example, when trying to prove your age to a website, the only thing that site really should have to learn is the fact whether you were born more or less than a certain number of days ago. Not your date of birth, not your name, and certainly not a picture of your face or any other biometric data. Digital ID can do that (e.g. by asking the secure chip "Is the accountholder born before $date? If so, please sign this challenge using a key shared among all ID cards" or something equivalent). Analog ID requires you to reveal strictly more information than that to a service provider and hope for the best. [1] Technically a supreme court opinion
    - amaccuish 3y ago
      To add to this, the AusweisApp in Germany shows what information you're sharing to a website and asks you to confirm its ok
    - cardanome 3y ago
      I have used the e-signing function of my German ID card exactly zero times. Even government websites don't support it for the stuff I would like to use it. So it isn't exactly a success story.
      - lxgr 3y ago
        True, it does seem to be suffering from a chicken-and-egg type of problem: Not enough services accept it, so not enough people actually remember the PIN and care to install the app necessary to use it. But now that both iOS and Android phones can be used as "card readers", I hope we should finally be seeing some more adoption. Before that, almost nobody had a card reader handy when they needed one. The EU's eIDAS digital ID/signature portability scheme should also help boost it.
- AniseAbyss 3y ago
  [dead]
dragonwriter 3y ago
> This is quite simply a data breach hackers dream That's... well, not the point of the laws, but inseparable from them; the point is to build a database (distributed, when the information isn't also reported to the government at time of collection) which the government can access at need;
- mulmen 3y ago
  That’s just a bad design though. When I go to a bar they don’t store a record of my ID for future review by the government. They look at my ID, see I am of age, and then our interaction is complete. No further record exists, nor should it. The government can try accessing porn sites themselves to see if the sites are in compliance. The same way we do, well, everything. That it isn’t designed this way shows the incompetence of the regulators and their disregard for public safety and free society. And hopefully it doesn’t need to be pointed out but none of this actually protects children. This is abuse of power for the purpose of puritanical guilt tripping.
  - dragonwriter 3y ago
    > That’s just a bad design though. When I go to a bar they don’t store a record of my ID for future review by the government. Banking KYC isn't about making sure people are authorized to bank, its about making sure the government is able to track them down if they are (determined by the government to be) associated with bad things. The purpose is not the same as checking ID at a bar. (Now, there's an argument that, for porn consumption, the purpose of any ID requirements should be like a bar and not like banking KYC, even if for porn production or distribution, there is more of an argument for a banking KYC-like regime.)
    - mulmen 3y ago
      For porn production you need KYC. For porn consumption you need a bouncer. That the regulators miss this is either incompetence or malice and maybe both but that doesn’t make this a good idea. Real harms will come from this when the databases are breached. The kids will still be able to find porn and alcohol. To make matters worse when they grow up they will live in a surveillance state.
pixl97 3y ago
>This is quite simply a data breach hackers dream. The problem here is you're missing the point of the people making these laws. This is a feature, not a bug to these people. They want to punish you for stepping outside of your cis normative + 2.5 kids relationship that good 'religion of their choice' people do.
- Nifty3929 3y ago
  Gave you an upvote because you're calling out that this is a feature, not a bug. But I don't think you needed to go down the religious-norms path to get there. It's not really fair. I think you could easily substitute items from the other side and end up in the same place. The point is that the government wants all this information for the same reason they want to spy on our chat communications and all the rest - they want to control us with it.
  - pixl97 3y ago
    Eh, I'm not really much of a 'both sides' type of person when one particular group (in the US in this case) is increasing pushing rules that border fascism while the other side may have bad ideas, but are far more moderate. To do so hands power directly to the fascists and makes them an acceptable choice.
    - Nifty3929 3y ago
      I hear you, but I think you're slightly missing my point. Even if I grant that the current regime is focused on religious/conservative issues, that can easily change over time. The problem is allowing our governments to use spying and surveillance to control us. That's something that gets worse over time and doesn't get rolled back with changes in elected or unelected officials. In 100 years, will progressives or conservatives be in charge? I don't know, but I'm pretty sure that whatever spying apparatus we put in place now will still exist (or be enhanced) by then.
      - swells34 3y ago
CubsFan1060 3y ago
I think this is what Apple introduced in iOS16: https://www.apple.com/newsroom/2022/06/apple-unveils-new-ways-to-share-and-communicate-in-ios-16/ https://www.apple.com/newsroom/2022/06/apple-unveils-new-way... Keys and IDs in Wallet get expanded support. Users can use their ID in Wallet for apps requiring identity and age verification. To ensure a private and secure experience, only the necessary information required for the transaction will be provided to the app, and the user can review and consent to share it using Face ID or Touch ID.
- AJ007 3y ago
  While acknowledging identity verification is problematic and bordering an unsolved problem, that really is a horrible precedent for someone to be required to own an electronic device that rapidly falls in to obsolescence to perform basic activities. In the more extreme sense, the complexity and security hurdles really make this something only the largest multi-billion dollar corporations could do. European countries really seem to do a good job of re-enforcing existing American monopolies while hamstringing their own economy and the freedom of the internet as a whole. I don't know if this is intentional (regulatory capture) or just based on a very superstitious understanding of computer science and mathematics (see the recent encryption debacles.) Apple has gotten a free pass for security & privacy, so far, by mostly producing secure(ish) devices, at least relative to the competition and give the never solved problem of keeping an always-on always-connected device that can receive messages from anyone in the world secure. However, as Apple's only remaining growth area is advertising their privacy reputation is going to diminish. Apple's leadership over the next decade or two will determine just how quickly that erodes. Definitely not a company I would want to be reliant on ID verification.
  - CubsFan1060 3y ago
    I believe this is just based on: https://www.iso.org/standard/69084.html https://www.iso.org/standard/69084.html Some information: https://www.ul.com/sites/g/files/qbfpbp251/files/2021-08/mDL%20eBook_Final_0.pdf https://www.ul.com/sites/g/files/qbfpbp251/files/2021-08/mDL... I've never tried it, but there's an implementation here: https://github.com/walt-id/waltid-identity/tree/main/waltid-mdoc-credentials https://github.com/walt-id/waltid-identity/tree/main/waltid-... From: https://walt.id https://walt.id I don't think Apple did anything magical here, and from what I can tell there's no lock in. You could load your ID to any number of places for this verification, it's not just locked to Apple.
cfn 3y ago
This is spot on. I have had to do KYC for me and my company on a couple of financial sites and I hate to think where that data is saved and what will it actually be used for. And this is mandated by law which is crazy.
michaelteter 3y ago
I don't know the details, but I think what you're describing is what the Dutch DigID ( https://www.digid.nl/ https://www.digid.nl/ ) system provides. It is used on local and national government data portals as well as for legal document signing, etc. It works very well in my experience, and in fact I don't even have to have a username/password on the websites.
- messe 3y ago
  There's a similar system in Denmark called MitID (my ID), it can even be used by businesses. I can pop into my local REMA 1000, scan my groceries —including alcohol—on my phone, and pay for them all in-app without any interaction with another human being. Because I'm logged in with MitID, there's no need for the additional age verification that more traditional self-scan checkouts require for purchasing alcohol.
dgrin91 3y ago
At least in the US this is already how it works. There are existing KYC vendors where you can basically pass along info to them and they will give you a KYC score for a customer.
mjevans 3y ago
I'd rather require 'Kid mode' devices _self identify_ as being in _kid mode_ and a two layer approach of websites which are known to be not 'kid friendly' identify as redirect to a kid-friendly resource. Do not lock up adults on the Internet. Rather, keep the kids in the nanny's care in their own device context rather than on the wider network.
- layer8 3y ago
  I’m not sure that making kids identifiable as such to any random website is a good idea.
  - vsskanth 3y ago
    I agree with the parent here. If the device is designated a kids device by some means, websites can ensure no adult content gets transmitted and their data isn't mined for ads.
    - salawat 3y ago
      Why is anyone's data mined for ads? If you're going to make a kids mode flag that denies data mining effort, then just fucking make the don't mine me switch and open it to everyone.
      - rad_gruchalski 3y ago
        “But my next Ferrari…”
    - layer8 3y ago
      And malicious sites can decide that the user is a promising target for grooming or scamming, etc.
      - stuartjohnson12 3y ago
        Could you give an example of such an attack that is intractable in the status quo?
theptip 3y ago
My thoughts exactly. If the state wants to ensure that ID checks are rigorous (or otherwise monopolize them) they can provide an attestation API for that purpose, and legislate that only tokens signed by a cert trusted by the government’s root are valid. This can be solved in a zero-knowledge way, and the government should commit to open source here. You don’t want the government seeing the sites you visit; the government should just issue a token associating the attestation (age, work status, whatever) with your private key. I think the details end up being non-trivial but it should be doable.
- orwin 3y ago
  > This can be solved in a zero-knowledge way, and the government should commit to open source here. This is what France's government is working on if i understand correctly what i'm hearing (i'm working for the private sector right now, so i'm not as well informed as i should be on those kind of things). Not really a fan, but i note when they're doing good shit, and on that they're on point. I don't mind a zero-knowledge age verification, i will strongly oppose anything else (with both money and time).
  - kergonath 3y ago
    > This is what France's government is working on if i understand correctly what i'm hearing Would you have any source discussing this? I don’t doubt you at all, I would like to learn more about where they want to go. It seems that they are working with a decent team at INRIA. I would like to know better how compatible their developments are with the stance of the government (and other more or less hysterical ones like in the UK).
    - orwin 3y ago
      Sorry, it's mostly rumors and stuff I catch reading the chats I'm still in. I've found a kind of white paper that link to LINC and Olivier Blazy: https://www.cnil.fr/fr/verification-de-lage-en-ligne-trouver-lequilibre-entre-protection-des-mineurs-et-respect-de-la-vie https://www.cnil.fr/fr/verification-de-lage-en-ligne-trouver... And the LINC repo might have some stuff? https://github.com/LINCnil https://github.com/LINCnil
numtel 3y ago
Interesting to know that's the reason. I make a website called Coinpassport.net that uses Stripe Identity to do just like you describe: verify once and reuse it on other sites. I would have loved if Stripe signed the results so that it could be more decentralized and anybody could verify with their own stripe account and have it be comparable to others.
Eddy_Viscosity2 3y ago
These laws are (almost always) written by smart and competent industry lobbiests. The lack of privacy security is likely the point. I doubt very much that this was merely an oversight or they that they just hadn't thought it through. They got what they wanted.

deleted 3y ago

[deleted]

grotorea 3y ago

Hasn't there been a few countries with some sort of digital ID development already? I get the impression the Anglosphere has an anti-ID card tradition so it seems like it's a bit behind in that.

reaperducer 3y ago
The anti-ID sentiment comes from looking back on history, and not pretending that the future can only be better. People who don't know history repeat its mistakes.
- lxgr 3y ago
  Germany is extremely focused on that aspect of history and even used to have laws [1] in the books prohibiting anything SSN-like for many years. Yet German ID cards have a built-in contactless chip that allows using them for online identity verification and e-signing. This is obviously more secure than taking a photo of an analog ID as an "online identity proof" (a somewhat absurd idea if you think about it, yet it's the state of the art in most countries today). But if done correctly (and I do realize that this is a very big if), it even be more privacy-preserving too: For example, when trying to prove your age to a website, the only thing that site really should have to learn is the fact whether you were born more or less than a certain number of days ago. Not your date of birth, not your name, and certainly not a picture of your face or any other biometric data. Digital ID can do that (e.g. by asking the secure chip "Is the accountholder born before $date? If so, please sign this challenge using a key shared among all ID cards" or something equivalent). Analog ID requires you to reveal strictly more information than that to a service provider and hope for the best. [1] Technically a supreme court opinion
  - amaccuish 3y ago
    To add to this, the AusweisApp in Germany shows what information you're sharing to a website and asks you to confirm its ok
  - cardanome 3y ago
    I have used the e-signing function of my German ID card exactly zero times. Even government websites don't support it for the stuff I would like to use it. So it isn't exactly a success story.
    - lxgr 3y ago
      True, it does seem to be suffering from a chicken-and-egg type of problem: Not enough services accept it, so not enough people actually remember the PIN and care to install the app necessary to use it. But now that both iOS and Android phones can be used as "card readers", I hope we should finally be seeing some more adoption. Before that, almost nobody had a card reader handy when they needed one. The EU's eIDAS digital ID/signature portability scheme should also help boost it.
AniseAbyss 3y ago
[dead]

dragonwriter 3y ago

> This is quite simply a data breach hackers dream That's... well, not the point of the laws, but inseparable from them; the point is to build a database (distributed, when the information isn't also reported to the government at time of collection) which the government can access at need;

mulmen 3y ago
That’s just a bad design though. When I go to a bar they don’t store a record of my ID for future review by the government. They look at my ID, see I am of age, and then our interaction is complete. No further record exists, nor should it. The government can try accessing porn sites themselves to see if the sites are in compliance. The same way we do, well, everything. That it isn’t designed this way shows the incompetence of the regulators and their disregard for public safety and free society. And hopefully it doesn’t need to be pointed out but none of this actually protects children. This is abuse of power for the purpose of puritanical guilt tripping.
- dragonwriter 3y ago
  > That’s just a bad design though. When I go to a bar they don’t store a record of my ID for future review by the government. Banking KYC isn't about making sure people are authorized to bank, its about making sure the government is able to track them down if they are (determined by the government to be) associated with bad things. The purpose is not the same as checking ID at a bar. (Now, there's an argument that, for porn consumption, the purpose of any ID requirements should be like a bar and not like banking KYC, even if for porn production or distribution, there is more of an argument for a banking KYC-like regime.)
  - mulmen 3y ago
    For porn production you need KYC. For porn consumption you need a bouncer. That the regulators miss this is either incompetence or malice and maybe both but that doesn’t make this a good idea. Real harms will come from this when the databases are breached. The kids will still be able to find porn and alcohol. To make matters worse when they grow up they will live in a surveillance state.

pixl97 3y ago

>This is quite simply a data breach hackers dream. The problem here is you're missing the point of the people making these laws. This is a feature, not a bug to these people. They want to punish you for stepping outside of your cis normative + 2.5 kids relationship that good 'religion of their choice' people do.

Nifty3929 3y ago
Gave you an upvote because you're calling out that this is a feature, not a bug. But I don't think you needed to go down the religious-norms path to get there. It's not really fair. I think you could easily substitute items from the other side and end up in the same place. The point is that the government wants all this information for the same reason they want to spy on our chat communications and all the rest - they want to control us with it.
- pixl97 3y ago
  Eh, I'm not really much of a 'both sides' type of person when one particular group (in the US in this case) is increasing pushing rules that border fascism while the other side may have bad ideas, but are far more moderate. To do so hands power directly to the fascists and makes them an acceptable choice.
  - Nifty3929 3y ago
    I hear you, but I think you're slightly missing my point. Even if I grant that the current regime is focused on religious/conservative issues, that can easily change over time. The problem is allowing our governments to use spying and surveillance to control us. That's something that gets worse over time and doesn't get rolled back with changes in elected or unelected officials. In 100 years, will progressives or conservatives be in charge? I don't know, but I'm pretty sure that whatever spying apparatus we put in place now will still exist (or be enhanced) by then.
    - swells34 3y ago

CubsFan1060 3y ago

I think this is what Apple introduced in iOS16: https://www.apple.com/newsroom/2022/06/apple-unveils-new-ways-to-share-and-communicate-in-ios-16/ https://www.apple.com/newsroom/2022/06/apple-unveils-new-way... Keys and IDs in Wallet get expanded support. Users can use their ID in Wallet for apps requiring identity and age verification. To ensure a private and secure experience, only the necessary information required for the transaction will be provided to the app, and the user can review and consent to share it using Face ID or Touch ID.

AJ007 3y ago
While acknowledging identity verification is problematic and bordering an unsolved problem, that really is a horrible precedent for someone to be required to own an electronic device that rapidly falls in to obsolescence to perform basic activities. In the more extreme sense, the complexity and security hurdles really make this something only the largest multi-billion dollar corporations could do. European countries really seem to do a good job of re-enforcing existing American monopolies while hamstringing their own economy and the freedom of the internet as a whole. I don't know if this is intentional (regulatory capture) or just based on a very superstitious understanding of computer science and mathematics (see the recent encryption debacles.) Apple has gotten a free pass for security & privacy, so far, by mostly producing secure(ish) devices, at least relative to the competition and give the never solved problem of keeping an always-on always-connected device that can receive messages from anyone in the world secure. However, as Apple's only remaining growth area is advertising their privacy reputation is going to diminish. Apple's leadership over the next decade or two will determine just how quickly that erodes. Definitely not a company I would want to be reliant on ID verification.
- CubsFan1060 3y ago
  I believe this is just based on: https://www.iso.org/standard/69084.html https://www.iso.org/standard/69084.html Some information: https://www.ul.com/sites/g/files/qbfpbp251/files/2021-08/mDL%20eBook_Final_0.pdf https://www.ul.com/sites/g/files/qbfpbp251/files/2021-08/mDL... I've never tried it, but there's an implementation here: https://github.com/walt-id/waltid-identity/tree/main/waltid-mdoc-credentials https://github.com/walt-id/waltid-identity/tree/main/waltid-... From: https://walt.id https://walt.id I don't think Apple did anything magical here, and from what I can tell there's no lock in. You could load your ID to any number of places for this verification, it's not just locked to Apple.

cfn 3y ago

This is spot on. I have had to do KYC for me and my company on a couple of financial sites and I hate to think where that data is saved and what will it actually be used for. And this is mandated by law which is crazy.

michaelteter 3y ago

I don't know the details, but I think what you're describing is what the Dutch DigID ( https://www.digid.nl/ https://www.digid.nl/ ) system provides. It is used on local and national government data portals as well as for legal document signing, etc. It works very well in my experience, and in fact I don't even have to have a username/password on the websites.

messe 3y ago
There's a similar system in Denmark called MitID (my ID), it can even be used by businesses. I can pop into my local REMA 1000, scan my groceries —including alcohol—on my phone, and pay for them all in-app without any interaction with another human being. Because I'm logged in with MitID, there's no need for the additional age verification that more traditional self-scan checkouts require for purchasing alcohol.

dgrin91 3y ago

At least in the US this is already how it works. There are existing KYC vendors where you can basically pass along info to them and they will give you a KYC score for a customer.

mjevans 3y ago

I'd rather require 'Kid mode' devices _self identify_ as being in _kid mode_ and a two layer approach of websites which are known to be not 'kid friendly' identify as redirect to a kid-friendly resource. Do not lock up adults on the Internet. Rather, keep the kids in the nanny's care in their own device context rather than on the wider network.

layer8 3y ago
I’m not sure that making kids identifiable as such to any random website is a good idea.
- vsskanth 3y ago
  I agree with the parent here. If the device is designated a kids device by some means, websites can ensure no adult content gets transmitted and their data isn't mined for ads.
  - salawat 3y ago
    Why is anyone's data mined for ads? If you're going to make a kids mode flag that denies data mining effort, then just fucking make the don't mine me switch and open it to everyone.
    - rad_gruchalski 3y ago
      “But my next Ferrari…”
  - layer8 3y ago
    And malicious sites can decide that the user is a promising target for grooming or scamming, etc.
    - stuartjohnson12 3y ago
      Could you give an example of such an attack that is intractable in the status quo?

theptip 3y ago

My thoughts exactly. If the state wants to ensure that ID checks are rigorous (or otherwise monopolize them) they can provide an attestation API for that purpose, and legislate that only tokens signed by a cert trusted by the government’s root are valid. This can be solved in a zero-knowledge way, and the government should commit to open source here. You don’t want the government seeing the sites you visit; the government should just issue a token associating the attestation (age, work status, whatever) with your private key. I think the details end up being non-trivial but it should be doable.

orwin 3y ago
> This can be solved in a zero-knowledge way, and the government should commit to open source here. This is what France's government is working on if i understand correctly what i'm hearing (i'm working for the private sector right now, so i'm not as well informed as i should be on those kind of things). Not really a fan, but i note when they're doing good shit, and on that they're on point. I don't mind a zero-knowledge age verification, i will strongly oppose anything else (with both money and time).
- kergonath 3y ago
  > This is what France's government is working on if i understand correctly what i'm hearing Would you have any source discussing this? I don’t doubt you at all, I would like to learn more about where they want to go. It seems that they are working with a decent team at INRIA. I would like to know better how compatible their developments are with the stance of the government (and other more or less hysterical ones like in the UK).
  - orwin 3y ago
    Sorry, it's mostly rumors and stuff I catch reading the chats I'm still in. I've found a kind of white paper that link to LINC and Olivier Blazy: https://www.cnil.fr/fr/verification-de-lage-en-ligne-trouver-lequilibre-entre-protection-des-mineurs-et-respect-de-la-vie https://www.cnil.fr/fr/verification-de-lage-en-ligne-trouver... And the LINC repo might have some stuff? https://github.com/LINCnil https://github.com/LINCnil

numtel 3y ago

Interesting to know that's the reason. I make a website called Coinpassport.net that uses Stripe Identity to do just like you describe: verify once and reuse it on other sites. I would have loved if Stripe signed the results so that it could be more decentralized and anybody could verify with their own stripe account and have it be comparable to others.

Eddy_Viscosity2 3y ago

These laws are (almost always) written by smart and competent industry lobbiests. The lack of privacy security is likely the point. I doubt very much that this was merely an oversight or they that they just hadn't thought it through. They got what they wanted.