3 ms·

IMO the problem isn't ID-based age verification specifically, it's that such verification is usually impelemnted in a way where the service in question gets a l

IMO the problem isn't ID-based age verification specifically, it's that such verification is usually impelemnted in a way where the service in question gets a lot more data than they need, with no real control over how that data is kept and processed. It would absolutely be possible to implement that stuff in a fully privacy-preserving way, with nothing but basic cryptography, and the government could absolutely enforce that implementation. Nobody is actually interested in promoting that though, the anti-big-tech crowd just wants verification no matter what, and the pro-privacy crowd just wants something to get angry about. Nobody is looking for a reasonable compromise here.

devilbunny 2y ago
Yeah, the whole “we have to scan your driver’s license” which has my name, address, etc., encoded is way more than I want to share. I am mostly bald and even my beard is gray. There is no plausible situation where you think I might be under 21.
- genewitch 2y ago
  I've been gray for over a decade and get carded every time, because my state tries to enforce age restrictions. Minors don't seem to have much of a problem, though?
  - devilbunny 2y ago
    Nor would you if you sought the slummiest stores and gave some old wino $10 to go buy it for you.
AnthonyMouse 2y ago
> It would absolutely be possible to implement that stuff in a fully privacy-preserving way, with nothing but basic cryptography, and the government could absolutely enforce that implementation. There are ways to do this which are less bad, but there is no way to do it "in a fully privacy-preserving way" without also making it fully ineffective, because if there is no way to prove who someone is then there is no way to catch anyone providing false age verification as a service to minors. But if there a way to prove that, you've demonstrated the existence of a privacy failure because you could then use the same mechanism to determine what someone is looking at.
- consteval 2y ago
  You can verify who someone is without knowing specifically who "who" refers to. We do it all the time. I give a one-time code to service X and it knows I am who I say I am, but the code I gave is virtually worthless information. All it knows is that I have credentials, and I am the authorized person to have those credentials because I have physical access to some device, unknown, which is known to belong to said person.
  - AnthonyMouse 2y ago
    You're omitting the part where you have to disclose who you are to the party issuing the credential. If they issue you a unique credential while knowing your identity then they can trace back all your uses of it to your identity. When that party is the government or within the government's jurisdiction, the government has the capacity to do that even if the services where you use the credential are operated by a third party, so you very much haven't solved the privacy problem. The only way to actually solve it is to make the credential non-unique, i.e. issue the same one to everybody so they're fully indistinguishable. That does solve the privacy problem, but then you have the "who is telling the kids the secret password" problem.
    - tzs 2y ago
      The party that you must disclose your identity to doesn’t necessarily need to see the credential you will present to the party you wish to demonstrate your age to. A blind signature could be used to have the ID checking party sign the credential without seeing it.
      - AnthonyMouse 2y ago
        That's just introducing a complex new vector for compromise without getting out of the dichotomy. Option 1: Bob gets a credential that can be traced back to Bob; privacy fail. Option 2: Bob gets a credential that cannot be traced back to Bob, shares it with everyone; defeats the system. Notice also the tradeoff you're forcing for no benefit. If Bob has a unique blinded signature, even if the signer doesn't know the unblinded value, the verifier would and so Bob has to get a new signature for each use or the verifiers could correlate one use with another. But needing a new signature for each use creates a timing attack because now you can see that every time "someone" presents a signature to use a particular service, Bob had just requested a new signature. In this context blinded signatures have only costs and no benefits over universal shared passwords.
bigstrat2003 2y ago
> It would absolutely be possible to implement that stuff in a fully privacy-preserving way, with nothing but basic cryptography, and the government could absolutely enforce that implementation. Yeah, it seems like it would not be as much of a problem if you were able to have assurances that your data isn't being held onto. If I give my ID to a bouncer at a strip club, he isn't able to scan it and put it into a digital file. He just looks at it*, goes "yep this guy is of age", and gives it back. If we ensured a similar data flow for the Internet, then it wouldn't be nearly as much of a privacy issue. *These days I doubt I would even get carded as well. Getting older and all that. IDK how you could implement a similar check for the Internet though.
armchairhacker 2y ago
> It would absolutely be possible to implement that stuff in a fully privacy-preserving way, with nothing but basic cryptography, and the government could absolutely enforce that implementation. What are some implementation(s)? Different implementations vary in effectiveness. Anyone can give a minor access to their device, or a minor can steal their device. So in order to prevent access then, you'd need something like constant face monitoring (via a local model, possible to do anonymously, but expensive and fallible), or legal threats (impossible to do anonymously, because you must track the adult who gave their kid access; and many people are dumb with technology even when it matters, so you either have to fine or jail many people or selectively enforce). The easiest implementation I can think, which I'd recommend, is to make locked-down kid devices, require ID or even just a credit card (18+) to purchase a normal device, put the burden on adults to not share their device with kids, and only police merchants (for selling normal devices without ID) and websites (for serving adult content without blocking kid devices). Like what we do with alcohol, except not even trying to police people for sharing, because it would be ineffective and messy. Like alcohol, many kids will get access anyways, although less than now. I like this approach because, IMO importantly, kids who don't try to see adult content will be far less likely to, and parents who try to restrict their kids from adult content will be far more successful. I don't think you can stop determined kids with neglectful parents without drawbacks.

devilbunny 2y ago

Yeah, the whole “we have to scan your driver’s license” which has my name, address, etc., encoded is way more than I want to share. I am mostly bald and even my beard is gray. There is no plausible situation where you think I might be under 21.

genewitch 2y ago
I've been gray for over a decade and get carded every time, because my state tries to enforce age restrictions. Minors don't seem to have much of a problem, though?
- devilbunny 2y ago
  Nor would you if you sought the slummiest stores and gave some old wino $10 to go buy it for you.

AnthonyMouse 2y ago

> It would absolutely be possible to implement that stuff in a fully privacy-preserving way, with nothing but basic cryptography, and the government could absolutely enforce that implementation. There are ways to do this which are less bad, but there is no way to do it "in a fully privacy-preserving way" without also making it fully ineffective, because if there is no way to prove who someone is then there is no way to catch anyone providing false age verification as a service to minors. But if there a way to prove that, you've demonstrated the existence of a privacy failure because you could then use the same mechanism to determine what someone is looking at.

consteval 2y ago
You can verify who someone is without knowing specifically who "who" refers to. We do it all the time. I give a one-time code to service X and it knows I am who I say I am, but the code I gave is virtually worthless information. All it knows is that I have credentials, and I am the authorized person to have those credentials because I have physical access to some device, unknown, which is known to belong to said person.
- AnthonyMouse 2y ago
  You're omitting the part where you have to disclose who you are to the party issuing the credential. If they issue you a unique credential while knowing your identity then they can trace back all your uses of it to your identity. When that party is the government or within the government's jurisdiction, the government has the capacity to do that even if the services where you use the credential are operated by a third party, so you very much haven't solved the privacy problem. The only way to actually solve it is to make the credential non-unique, i.e. issue the same one to everybody so they're fully indistinguishable. That does solve the privacy problem, but then you have the "who is telling the kids the secret password" problem.
  - tzs 2y ago
    The party that you must disclose your identity to doesn’t necessarily need to see the credential you will present to the party you wish to demonstrate your age to. A blind signature could be used to have the ID checking party sign the credential without seeing it.
    - AnthonyMouse 2y ago
      That's just introducing a complex new vector for compromise without getting out of the dichotomy. Option 1: Bob gets a credential that can be traced back to Bob; privacy fail. Option 2: Bob gets a credential that cannot be traced back to Bob, shares it with everyone; defeats the system. Notice also the tradeoff you're forcing for no benefit. If Bob has a unique blinded signature, even if the signer doesn't know the unblinded value, the verifier would and so Bob has to get a new signature for each use or the verifiers could correlate one use with another. But needing a new signature for each use creates a timing attack because now you can see that every time "someone" presents a signature to use a particular service, Bob had just requested a new signature. In this context blinded signatures have only costs and no benefits over universal shared passwords.

bigstrat2003 2y ago

> It would absolutely be possible to implement that stuff in a fully privacy-preserving way, with nothing but basic cryptography, and the government could absolutely enforce that implementation. Yeah, it seems like it would not be as much of a problem if you were able to have assurances that your data isn't being held onto. If I give my ID to a bouncer at a strip club, he isn't able to scan it and put it into a digital file. He just looks at it*, goes "yep this guy is of age", and gives it back. If we ensured a similar data flow for the Internet, then it wouldn't be nearly as much of a privacy issue. *These days I doubt I would even get carded as well. Getting older and all that. IDK how you could implement a similar check for the Internet though.

armchairhacker 2y ago

> It would absolutely be possible to implement that stuff in a fully privacy-preserving way, with nothing but basic cryptography, and the government could absolutely enforce that implementation. What are some implementation(s)? Different implementations vary in effectiveness. Anyone can give a minor access to their device, or a minor can steal their device. So in order to prevent access then, you'd need something like constant face monitoring (via a local model, possible to do anonymously, but expensive and fallible), or legal threats (impossible to do anonymously, because you must track the adult who gave their kid access; and many people are dumb with technology even when it matters, so you either have to fine or jail many people or selectively enforce). The easiest implementation I can think, which I'd recommend, is to make locked-down kid devices, require ID or even just a credit card (18+) to purchase a normal device, put the burden on adults to not share their device with kids, and only police merchants (for selling normal devices without ID) and websites (for serving adult content without blocking kid devices). Like what we do with alcohol, except not even trying to police people for sharing, because it would be ineffective and messy. Like alcohol, many kids will get access anyways, although less than now. I like this approach because, IMO importantly, kids who don't try to see adult content will be far less likely to, and parents who try to restrict their kids from adult content will be far more successful. I don't think you can stop determined kids with neglectful parents without drawbacks.