4 ms·

>This system, referred to as “double anonymity”, means the porn site receives only a yes-or-no confirmation that the user is of legal age. The age-check provide

>This system, referred to as “double anonymity”, means the porn site receives only a yes-or-no confirmation that the user is of legal age. The age-check provider knows who the user is, but not which sites they visit. I don't know the specifics, but seems very reasonable if implemented matches the promise. If it's required also for some non porn sites (social media? gambling maybe), there should be no stigma attached either.

goda90 1y ago
Not sure if it's just a "trust us" thing, but a way to accomplish this would be anonymous credentials.https://csrc.nist.gov/presentations/2022/stppa4-anonym-cred https://csrc.nist.gov/presentations/2022/stppa4-anonym-cred
Arnt 1y ago
Is it financially viable? Do you happen to know roughly how much these services cost? Because it's easy to say "just use that third-party service" but if the cost of that service is well above the profit margin of a porn site, the site cannot really do it.
- palata 1y ago
  I think it could be a government website that gives you an anonymous token. The government checks your age from your identity (some "eID") and gives you a token that is "difficult" for them to track (see e.g. Privacy Pass [1]). Then you pass this token to your porn website and they can verify that this token means that you have the required age. But the porn website cannot identify you. Not sure about the price of such a service, but it would be paid by the public. [1]: https://privacypass.github.io https://privacypass.github.io
  - diggan 1y ago
    It seems the law allows either a government website, or 3rd party provider for the age checks, it doesn't mandate either. > Use an age verification provider that is legally and technically independent of any online platform hosting or providing porn content - https://www.yoti.com/blog/france-age-verification-law-adult-platforms-meaning-compliance https://www.yoti.com/blog/france-age-verification-law-adult-... So, could be a government website, but likely for-profit companies will try to capture it by any means necessary, the very least a lot of lobbying.
    - Arnt 1y ago
      In theory the government could operate a free service for the benefit of porn companies, but in practice I don't see that as very likely to happen.
      - palata 1y ago
        > for the benefit of porn companies Or for the benefit of the children who have a harder time accessing the porn sites, maybe?
palata 1y ago
I believe that the EFF talks about it here: https://www.eff.org/deeplinks/2025/04/age-verification-european-union-mini-id-wallet https://www.eff.org/deeplinks/2025/04/age-verification-europ... They question the quality of the Zero Knowledge Proofs (something like "it's still new") and raise what I find the more interesting question: "who will be left out?". Not only for porn, that is.
- ethbr1 1y ago
  To the "Who will be left out?" question, mandates like these should come with statutory {must issue} requirements. Much of the Secure Boot crap could have been avoided if all devices had been required to have a user-accessible mode that trusted a must-issue signer of last resort, and that signer was broadly available. E.g. LetsEncrypt for devices If on the one hand we want to improve security via encryption/verfication, then on the other hand we must remove the governments' and corporations' abilities to abuse it.
close04 1y ago
> This check must be carried out by an external service, not the porn site itself > the porn site receives only a yes-or-no confirmation that the user is of legal age What does the external service receive?
- palata 1y ago
  There are cryptographic ways to do that (e.g. [1]), making sure (or at least "difficult") that the external website cannot track you. [1]: https://privacypass.github.io https://privacypass.github.io
  - close04 1y ago
    There are always ways. But I asked what is that external provider actually receiving. Or to put it differently, what is it allowed to receive. If the law forces down people's throats an intermediary between them and a porn site, then it better also force the intermediary to guarantee anonymity.
    - palata 1y ago
      > There are always ways. Hmm... > But I asked what is that external provider actually receiving. Sure, I don't know. What I'm saying is that at least it seems possible to make is reasonably private. That's better than if it was impossible, e.g. putting a backdoor in E2EE "only for the good guys". But then I would be contradicting your statement that "there are always ways", so... well.
  - Aloisius 1y ago
    If 99% of reason to get verified is to look at porn (and let's be honest, near 100% of those who want to be verified after midnight), then the website doing the actual verification of identities has a list of people looking at porn. No amount of cryptography can protect against this. Now, if the French government issued tokens preemptively to everyone, that would work, but then it becomes trivial for to copy the tokens.
    - 1y ago
kennu 1y ago
At minimum, the government gets a "ping" when identified citizens visit adult sites requiring the age check, so they can keep a record. In worse scenarios, maybe some identifier leaks through that can also identify which site they visited. And of course, the identification apps can be hacked through supply chain attacks etc.
- rvnx 1y ago
  There is a very possible attack. Open a porn website, buy ad traffic in France, once users are here, claim identity needs to be verified. In the background, start the process to open a bank account in one of these online banks and act as a relay in the verification process.
  - ffsm8 1y ago
    Is that an actual thread model, and or are you just making stuff up? I'm asking because even oauth would make this kind of attack vector impossible, as the referrer and redirect urls are verified - and I sincerely doubt they're so incompetent not to do something similar in such a context.
    - rvnx 1y ago
      It is a relay attack. There are a lot of verification platforms, so the idea is that the user is asked to be verified and that his proof of identity is reused in live for something else. In the addressbar, user sees "dangerousporn.com" -> "safeidentify.com" The operator of "dangerousporn.com" starts (manually) an application to a [bank account / crypto exchange "bank.com"], using a fixed residential proxy (Luminati / Oxylabs, etc). Once a victim arrives on "safeidentify.com", the user that is on "safeidentify.com" is asked to follow the actions that "bank.com" is asking to do (upload your ID, turn head left, turn head right, up, down). "safeidentify.com" plays back the recorded video on the KYC platform of "bank.com" using an emulated Webcam. Difficult ? Yes and no, but manually doable on a case-by-case basis, and you don't need thousands of victims as it is really worth.
      - 1y ago
Zak 1y ago
It seems to me a much better way would be to require porn sites to check for an HTTP header that says the user is underage, and to require major consumer OS vendors to implement it. There are minimal privacy implications; it could also be applied to privacy laws and the like protecting minors; it would be trivial for sites to comply.
hiatus 1y ago
At the very least, wouldn't the age verification site know the API caller requesting verification? How else would it send a callback indicating that the user was or was not of legal age?

goda90 1y ago

Not sure if it's just a "trust us" thing, but a way to accomplish this would be anonymous credentials.https://csrc.nist.gov/presentations/2022/stppa4-anonym-cred https://csrc.nist.gov/presentations/2022/stppa4-anonym-cred

Arnt 1y ago

Is it financially viable? Do you happen to know roughly how much these services cost? Because it's easy to say "just use that third-party service" but if the cost of that service is well above the profit margin of a porn site, the site cannot really do it.

palata 1y ago
I think it could be a government website that gives you an anonymous token. The government checks your age from your identity (some "eID") and gives you a token that is "difficult" for them to track (see e.g. Privacy Pass [1]). Then you pass this token to your porn website and they can verify that this token means that you have the required age. But the porn website cannot identify you. Not sure about the price of such a service, but it would be paid by the public. [1]: https://privacypass.github.io https://privacypass.github.io
- diggan 1y ago
  It seems the law allows either a government website, or 3rd party provider for the age checks, it doesn't mandate either. > Use an age verification provider that is legally and technically independent of any online platform hosting or providing porn content - https://www.yoti.com/blog/france-age-verification-law-adult-platforms-meaning-compliance https://www.yoti.com/blog/france-age-verification-law-adult-... So, could be a government website, but likely for-profit companies will try to capture it by any means necessary, the very least a lot of lobbying.
  - Arnt 1y ago
    In theory the government could operate a free service for the benefit of porn companies, but in practice I don't see that as very likely to happen.
    - palata 1y ago
      > for the benefit of porn companies Or for the benefit of the children who have a harder time accessing the porn sites, maybe?

palata 1y ago

I believe that the EFF talks about it here: https://www.eff.org/deeplinks/2025/04/age-verification-european-union-mini-id-wallet https://www.eff.org/deeplinks/2025/04/age-verification-europ... They question the quality of the Zero Knowledge Proofs (something like "it's still new") and raise what I find the more interesting question: "who will be left out?". Not only for porn, that is.

ethbr1 1y ago
To the "Who will be left out?" question, mandates like these should come with statutory {must issue} requirements. Much of the Secure Boot crap could have been avoided if all devices had been required to have a user-accessible mode that trusted a must-issue signer of last resort, and that signer was broadly available. E.g. LetsEncrypt for devices If on the one hand we want to improve security via encryption/verfication, then on the other hand we must remove the governments' and corporations' abilities to abuse it.

close04 1y ago

> This check must be carried out by an external service, not the porn site itself > the porn site receives only a yes-or-no confirmation that the user is of legal age What does the external service receive?

palata 1y ago
There are cryptographic ways to do that (e.g. [1]), making sure (or at least "difficult") that the external website cannot track you. [1]: https://privacypass.github.io https://privacypass.github.io
- close04 1y ago
  There are always ways. But I asked what is that external provider actually receiving. Or to put it differently, what is it allowed to receive. If the law forces down people's throats an intermediary between them and a porn site, then it better also force the intermediary to guarantee anonymity.
  - palata 1y ago
    > There are always ways. Hmm... > But I asked what is that external provider actually receiving. Sure, I don't know. What I'm saying is that at least it seems possible to make is reasonably private. That's better than if it was impossible, e.g. putting a backdoor in E2EE "only for the good guys". But then I would be contradicting your statement that "there are always ways", so... well.
- Aloisius 1y ago
  If 99% of reason to get verified is to look at porn (and let's be honest, near 100% of those who want to be verified after midnight), then the website doing the actual verification of identities has a list of people looking at porn. No amount of cryptography can protect against this. Now, if the French government issued tokens preemptively to everyone, that would work, but then it becomes trivial for to copy the tokens.
  - 1y ago

kennu 1y ago

At minimum, the government gets a "ping" when identified citizens visit adult sites requiring the age check, so they can keep a record. In worse scenarios, maybe some identifier leaks through that can also identify which site they visited. And of course, the identification apps can be hacked through supply chain attacks etc.

rvnx 1y ago
There is a very possible attack. Open a porn website, buy ad traffic in France, once users are here, claim identity needs to be verified. In the background, start the process to open a bank account in one of these online banks and act as a relay in the verification process.
- ffsm8 1y ago
  Is that an actual thread model, and or are you just making stuff up? I'm asking because even oauth would make this kind of attack vector impossible, as the referrer and redirect urls are verified - and I sincerely doubt they're so incompetent not to do something similar in such a context.
  - rvnx 1y ago
    It is a relay attack. There are a lot of verification platforms, so the idea is that the user is asked to be verified and that his proof of identity is reused in live for something else. In the addressbar, user sees "dangerousporn.com" -> "safeidentify.com" The operator of "dangerousporn.com" starts (manually) an application to a [bank account / crypto exchange "bank.com"], using a fixed residential proxy (Luminati / Oxylabs, etc). Once a victim arrives on "safeidentify.com", the user that is on "safeidentify.com" is asked to follow the actions that "bank.com" is asking to do (upload your ID, turn head left, turn head right, up, down). "safeidentify.com" plays back the recorded video on the KYC platform of "bank.com" using an emulated Webcam. Difficult ? Yes and no, but manually doable on a case-by-case basis, and you don't need thousands of victims as it is really worth.
    - 1y ago

Zak 1y ago

It seems to me a much better way would be to require porn sites to check for an HTTP header that says the user is underage, and to require major consumer OS vendors to implement it. There are minimal privacy implications; it could also be applied to privacy laws and the like protecting minors; it would be trivial for sites to comply.

hiatus 1y ago

At the very least, wouldn't the age verification site know the API caller requesting verification? How else would it send a callback indicating that the user was or was not of legal age?