3 ms·

There are cryptographic tools (zero-knowledge proofs, for example) that can provide anonymous attestations for a user's age. The problem is that the infrastruct

There are cryptographic tools (zero-knowledge proofs, for example) that can provide anonymous attestations for a user's age. The problem is that the infrastructure to support it isn't provided by the same government that's requiring it to exist. And even if the private sector innovated here, there's no approval from the government to accept math nerd solutions as legally valid. Which means you basically have to scan and upload your photo ID to these websites, or use a payment card, or something else that will stand up in court.

nateshelley 2y ago
Which makes sense, and also sounds like applying monetary pressure, say losing access to multiple states in the US, would incentivize prioritizing some engineers into solving this. The reason it doesn't exist yet, is because we've collectively decided through indifference and inaction that an "I swear bro" button is fine in the virtual world, but not the physical, and have now learned that it's not enough.
- bdangubic 2y ago
  there is a HUGE difference between presenting ID in the physical world and digital world. In the digital world, once I provide an ID it is there forever. and it will be used for who knows what by who knows who. the only way to compare the two would be if in the physical world we provided an ID and whoever requested it gets to keep it and of course no place like that exists, you flash the ID (not that much unlike “I am 18 I swear” button in a lot of places) and you move on
  - ndriscoll 2y ago
    Not that I think this is acceptable, but grocery stores around me scan your ID for alcohol purchases. In some states this is legally required. At least with all the porn bills I've read, it's illegal to retain the information.
    - bdangubic 2y ago
      yes, without an option to opt-out and have your ID “manually” checked that is fucked up.
- Hizonner 2y ago
  You didn't read the post you were replying to. That would be a "math nerd solution" that the states have not committed to accept, regardless of whether it actually works. Also, that sort of thing tends to require active cooperation from the entity issuing the IDs, which no state governments have committed to provide. By the way, Pornhub actually has a preferred technical solution involving "device attestation". It's only marginally better than the snake oil the AV industry wants to use, and I don't like it, but they have said they'd stop objecting if something along those lines were standardized. They just don't want to have to deal with a patchwork of mutually incompatible stuff (a) that's totally ineffective, (b) that leaves them either handling everybody's ID or dealing with questionable contractors to hold it, and/or (c) that leaves them having to convince the users to trust them or those questionable contractors with those ID images.
  - quotemstr 2y ago
    > require active cooperation from the entity issuing the IDs It doesn't actually. Third party zero knowledge attestation works just fine. Think through the cryptosystem. It's possible for an authority to verify an ID for a given name and target site without revealing the former to the latter of the latter to the former
0xcde4c3db 2y ago
The commercial incentives around this are also terrible, given that the prevailing assumption is that a private third party will do the attestation as a for-profit service. It's practically guaranteed to add cost and liability for the porn vendor as well as risk of leaks, tracking, and data brokering for the consumer. It may as well have been designed to shut down free porn altogether. And maybe it was, considering the history of porn regulation in the US. If you look at the requirements and contemporary rhetoric around 18 USC 2257 (yes, the thing that basically all legit porn sites with US operations have a disclaimer for), it was pretty blatantly intended to render the porn industry unable to operate. Porn producers were never actually intended to come into compliance, but rather presumed to be unable to (due to the ridiculous procedures and the supposed omnipresent use of underage, undocumented, and coerced performers).
- Hizonner 2y ago
  > It may as well have been designed to shut down free porn altogether. There was and is a fairly coordinated program of shopping this around to various legislative bodies (not only US states). It started maybe two years ago, I think. It didn't just catch on organically. Some of it seems to be driven/funded by the AV companies, who presumably actually want the verification to happen. But a lot of the legwork and political contacts are provided by organizations that would definitely love to drive every porn site out of business. I doubt they expect to get all of them, or even all the free ones, but, sure, somebody like NCOSE knows that it's a major burden, and absolutely thinks that any damage to adults' access to porn is a positive feature. It's not obvious that most of the legislators who vote for these things understand the implications at all. So some of the people you could blame for this legislation definitely have such intentions, but probably not all of them. > If you look at the requirements and contemporary rhetoric around 18 USC 2257 (yes, the thing that basically all legit porn sites with US operations have a disclaimer for), it was pretty blatantly intended to render the porn industry unable to operate. Hmm. I'm ready to believe you, but 2257 doesn't seem totally infeasible to comply with in a VHS world. Dangerous to the performers, yes, because it requires tons of people to keep records of who they are and where they live, and those records are pretty much guaranteed to leak and be abused. An expensive nuisance, also yes. A chance to hound anybody who messes up out of business, and threaten them with prison, OK. Obnoxious overreach, sure. But totally impossible to comply with? I'm not sure about that. It actually seems easier than user AV. The thing that always really got me about 2257 was that the claim was it was supposed to prevent another Traci Lords. They checked Traci Lords' ID. She showed ID. She had a real driver's license (based on a fake birth certificate, but it was the state that was supposed to check that, and anyway it was presumably a good fake). As far as I know, 2257 wouldn't even have slowed Traci Lords down.
stvltvs 2y ago
Do these cryptographic tools prevent the government entity providing them from knowing which websites verify your age? If not, then that's too much Uncle Sam watching over your shoulder as you watch your porn.
- quotemstr 2y ago
  Yes, they do precisely that, and in a way that depends only in math and cryptography. No possibility of leaking some naughty list after a hack.
  - stvltvs 2y ago
    Can a malicious gov site gather a list of which sites are asking for your verification?
    - quotemstr 2y ago
      No. The output of the government site is an attestation of age. It's a bundle of bytes. The site doesn't know or care what you do with the attestation.
      - stvltvs 2y ago
        How does the website prove compliance with the law under this scheme?
        quotemstr 2y ago
        Same as a liquor store.
- some_furry 2y ago
  It depends on the tool. https://zkdocs.com https://zkdocs.com has some protocols described, if you're curious to learn more about this space.
- Izkata 2y ago

nateshelley 2y ago

Which makes sense, and also sounds like applying monetary pressure, say losing access to multiple states in the US, would incentivize prioritizing some engineers into solving this. The reason it doesn't exist yet, is because we've collectively decided through indifference and inaction that an "I swear bro" button is fine in the virtual world, but not the physical, and have now learned that it's not enough.

bdangubic 2y ago
there is a HUGE difference between presenting ID in the physical world and digital world. In the digital world, once I provide an ID it is there forever. and it will be used for who knows what by who knows who. the only way to compare the two would be if in the physical world we provided an ID and whoever requested it gets to keep it and of course no place like that exists, you flash the ID (not that much unlike “I am 18 I swear” button in a lot of places) and you move on
- ndriscoll 2y ago
  Not that I think this is acceptable, but grocery stores around me scan your ID for alcohol purchases. In some states this is legally required. At least with all the porn bills I've read, it's illegal to retain the information.
  - bdangubic 2y ago
    yes, without an option to opt-out and have your ID “manually” checked that is fucked up.
Hizonner 2y ago
You didn't read the post you were replying to. That would be a "math nerd solution" that the states have not committed to accept, regardless of whether it actually works. Also, that sort of thing tends to require active cooperation from the entity issuing the IDs, which no state governments have committed to provide. By the way, Pornhub actually has a preferred technical solution involving "device attestation". It's only marginally better than the snake oil the AV industry wants to use, and I don't like it, but they have said they'd stop objecting if something along those lines were standardized. They just don't want to have to deal with a patchwork of mutually incompatible stuff (a) that's totally ineffective, (b) that leaves them either handling everybody's ID or dealing with questionable contractors to hold it, and/or (c) that leaves them having to convince the users to trust them or those questionable contractors with those ID images.
- quotemstr 2y ago
  > require active cooperation from the entity issuing the IDs It doesn't actually. Third party zero knowledge attestation works just fine. Think through the cryptosystem. It's possible for an authority to verify an ID for a given name and target site without revealing the former to the latter of the latter to the former

0xcde4c3db 2y ago

The commercial incentives around this are also terrible, given that the prevailing assumption is that a private third party will do the attestation as a for-profit service. It's practically guaranteed to add cost and liability for the porn vendor as well as risk of leaks, tracking, and data brokering for the consumer. It may as well have been designed to shut down free porn altogether. And maybe it was, considering the history of porn regulation in the US. If you look at the requirements and contemporary rhetoric around 18 USC 2257 (yes, the thing that basically all legit porn sites with US operations have a disclaimer for), it was pretty blatantly intended to render the porn industry unable to operate. Porn producers were never actually intended to come into compliance, but rather presumed to be unable to (due to the ridiculous procedures and the supposed omnipresent use of underage, undocumented, and coerced performers).

Hizonner 2y ago
> It may as well have been designed to shut down free porn altogether. There was and is a fairly coordinated program of shopping this around to various legislative bodies (not only US states). It started maybe two years ago, I think. It didn't just catch on organically. Some of it seems to be driven/funded by the AV companies, who presumably actually want the verification to happen. But a lot of the legwork and political contacts are provided by organizations that would definitely love to drive every porn site out of business. I doubt they expect to get all of them, or even all the free ones, but, sure, somebody like NCOSE knows that it's a major burden, and absolutely thinks that any damage to adults' access to porn is a positive feature. It's not obvious that most of the legislators who vote for these things understand the implications at all. So some of the people you could blame for this legislation definitely have such intentions, but probably not all of them. > If you look at the requirements and contemporary rhetoric around 18 USC 2257 (yes, the thing that basically all legit porn sites with US operations have a disclaimer for), it was pretty blatantly intended to render the porn industry unable to operate. Hmm. I'm ready to believe you, but 2257 doesn't seem totally infeasible to comply with in a VHS world. Dangerous to the performers, yes, because it requires tons of people to keep records of who they are and where they live, and those records are pretty much guaranteed to leak and be abused. An expensive nuisance, also yes. A chance to hound anybody who messes up out of business, and threaten them with prison, OK. Obnoxious overreach, sure. But totally impossible to comply with? I'm not sure about that. It actually seems easier than user AV. The thing that always really got me about 2257 was that the claim was it was supposed to prevent another Traci Lords. They checked Traci Lords' ID. She showed ID. She had a real driver's license (based on a fake birth certificate, but it was the state that was supposed to check that, and anyway it was presumably a good fake). As far as I know, 2257 wouldn't even have slowed Traci Lords down.

stvltvs 2y ago

Do these cryptographic tools prevent the government entity providing them from knowing which websites verify your age? If not, then that's too much Uncle Sam watching over your shoulder as you watch your porn.

quotemstr 2y ago
Yes, they do precisely that, and in a way that depends only in math and cryptography. No possibility of leaking some naughty list after a hack.
- stvltvs 2y ago
  Can a malicious gov site gather a list of which sites are asking for your verification?
  - quotemstr 2y ago
    No. The output of the government site is an attestation of age. It's a bundle of bytes. The site doesn't know or care what you do with the attestation.
    - stvltvs 2y ago
      How does the website prove compliance with the law under this scheme?
      - quotemstr 2y ago
        Same as a liquor store.
some_furry 2y ago
It depends on the tool. https://zkdocs.com https://zkdocs.com has some protocols described, if you're curious to learn more about this space.
Izkata 2y ago