16 ms·

All these ID check laws are out of hand. Parents are expecting the government, and random websites, to raise their kids. Why would anyone trust some random blog

All these ID check laws are out of hand. Parents are expecting the government, and random websites, to raise their kids. Why would anyone trust some random blog with their ID? If these laws move forward (and I don’t think they should), there needs to be a way to authenticate as over 18 without sending picture of your ID off to random 3rd parties, or giving actual personal details. I don’t want to give this data, and websites shouldn’t want to shoulder the responsibility for it. It seems like this could work much like Apple Pay, just without the payment. A prompt comes up, I use some biometric authentication on my phone, and it sends a signal to the browser that I’m 18+. Apple has been adding state IDs into the Wallet, this seems like it could fall right in line. The same thing could be used for buying alcohol at U-Scan checkout. People should also be able to set their browser/computer to auto-send this for single-user devices, where it is all transparent to the user. I don’t have kids and no one else’s uses my devices. Why should I need to jump through hoops?

alwa 1y ago
And we could call this way… zero-knowledge proof! :) https://en.m.wikipedia.org/wiki/Zero-knowledge_proof https://en.m.wikipedia.org/wiki/Zero-knowledge_proof I bet we could even get a major phone OS vendor to support such a thing… https://blog.google/products/google-pay/google-wallet-age-identity-verifications/ https://blog.google/products/google-pay/google-wallet-age-id...
- michaelt 1y ago
  Do we expect Apple to implement a special, privacy-preserving age proof for porn viewers? Apple hates porn, when it's on websites like Tumblr.
  - alwa 1y ago
    At the same time they seem pragmatic about putting their mark on standards. It seems to me like we’re at a confluence: a regulatory tipping point where there really is pressure to bring laws to bear on online harms affecting kids; and a socio-technological moment where “gotta distinguish kids from adults” can realistically happen separately from “…by handing over personal info directly to shady random counterparts.” Individual smartphones with biometrics are these days a whole-of-society norm, technologists have developed a mature body of cryptographic work to assert ZKPs, the US population seem to have lost their aversion to centralized ID systems… and the periodic moral panic about the kids seems to be at a high tide. In the same way that Apple don’t prevent, say, Safari from being used for prurient purposes, or Final Cut Pro from being used to edit naughty bits, I don’t see why they wouldn’t want an opinionated implementation as a concept develops of a generic “digital tool to assert your age, and only that.” Especially since Android is doing it and leaning into the privacy angle.
  - meowkit 1y ago
    Zero knowledge proof smart contract verification called by the site interested in your age. You provide your public key wallet with its government issued soul bound NFT of your identification. This can be done, its not that crazy, it just requires a bunch of people to get their heads out of their sand in regards to tech and blockchain, which admittedly might be a harder problem. —— Additonal thought- if you don’t understand what I’m saying or have a negative reaction just plug the comment + thread context into an LLM and see what it says / ask for a clearer explanation.
    - root_axis 1y ago
      ZKP is all you need. The NFT or blockchain stuff is unnecessary can be discarded.
  - tzs 1y ago
    I expect Apple will implement a general privacy-preserving arbitrary attribute proof, with age proof just one of the things it could be used for, probably using something similar to the library that Google recently released [1]. [1] https://news.ycombinator.com/item?id=44457390 https://news.ycombinator.com/item?id=44457390
- deleted 1y ago
  [deleted]
- deleted 1y ago
  [deleted]
- blurbleblurble 1y ago
  Yet then again how hard is it to just grab your parents' ids while they're not looking and add it to your phone wallet?
  - __turbobrew__ 1y ago
    Gate it in the touch id secure enclave. Then only the biometrics of the adult can provide the proof that they are over 18.
    - blurbleblurble 1y ago
      I'm just saying that if age verification is done via a "smart card" then it shouldn't be hard to just add that to the phone. Unless of course they're planning on making us go to some facility to ensure our phones get the digital components of the IDs get loaded into the secure enclave? Which sounds dystopian as heck given the scenes coming out of the US right now.
  - sigwinch 1y ago
    Accessing my site after that would violate CFAA, right? Minors are not exempt from CFAA.
  - cloverich 1y ago
    They can require a selfie to compare against, multiple documents, a video, etc. IMHO best bet is to consolidate the validation to a small set of reputable companies, delegate validation to them, then improve regulations around access. Eg non-reputable site needs to know you are 18 (etc) but not see your actual id if they can have a third party do it in a blind-to-them fashion.
- andrepd 1y ago
  Eh. So now I'm forced to have all my IDs stored at an advertising behemoth. Not really a great situation either. You're practically forced to have a Google/Apple account and a google/apple smartphone to even exist in today's world.
- Aerroon 1y ago
  I bet that in practice, at scale, these zero knowledge proofs end up being a lot more than zero. Not to mention that you're almost certainly going to have to tie this stuff to specific accounts that will then forever and ever keep your habits collected. One day somebody enterprising is going to add all that data together too.
  - Tadpole9181 1y ago
    VPNs and zero knowledge proof systems are vulnerable to traffic analysis (based on packet size and timestamps) and there's almost no cure. Mullvad is the only VPN I know of that has a mode that normalizes all packets to the same size (going into the VPN) and sends fake packets that don't get sent as real traffic. But that's only obfuscation and, at low traffic or high bandwidth (videos) or with sufficient heuristics, it can be beaten. The US has basically zero regulation on selling this data. I can imagine a world where within a couple decades the US has one of the largest blackmail crisis ever seen, as foreign governments target civil workers. Or, I guess, at this point, the US government against the "undesirable" party within this administration.
    - bawolff 1y ago
      > VPNs and zero knowledge proof systems are vulnerable to traffic analysis Zero knowledge proofs are not vulnerable to traffic analysis the same way VPNs are.
      - Tadpole9181 1y ago
        It really depends on the implementation around it, how a user conducts themselves, and what data you can buy. While there is zero knowledge inside the proof, its use creates a side channel that reveals information. For instance: The relying party server needs to call the auth server on novel users. Thats a new, unavoidable indicator! How large are token batches and how long do they last? Will the implementation force them to wait a time period between redemption and use? A bad implementation means the user IP will talk to the A server, then it will contact the RP server, who will contact the A server. Because this happens once per connection (or 60 minutes in this bill) and takes maybe a few hundred milliseconds. there's not going to be a huge number of candidates to have to sort through. And that's just the handshake.
- Springtime 1y ago
  It would be preferable if the prover party that holds the credentials in this scenario weren't Google. If anything I'd prefer a government issued digital ID with some form of local-only cryptographic exchange where neither the government knows someone has verified at a particular site/service and the verifier doesn't get info about one's identity. Just some cryptographic proof that verifies an age ('just' is doing some heavy lifting). In past HN comments this apparently exists IRL in Germany and/or Canada, where age can be proven via a smartphone without leaking one's identity to the verifier and without any communication back to the government.
gxs 1y ago
There was a thread on reddit asking the other day what about the modern world bothers you the most I actually considered this question and after thinking about it, despite everything going on, I think it boils down to lack of privacy as my biggest gripe in the modern world It’s such a tough concept to explain to the if you don’t have anything to hide crowd, but if someone wants to disappear, I don’t care if for good or bad reasons, they should be able to If you don’t want the government on you, if you don’t want people you know to find you, if you just want to reinvent yourself, it doesn’t matter why - you should be able to do this. It just “feels” like an innate right. Normally I don’t like to argue using “vibes” as justification, but this to me is just part of my value system/morals which is inherently arbitrary to begin with Encroaching on this privacy encroaches on a bunch of other rights, like free speech as you’ve mentioned The fact that this is the case makes it even clearer to me that privacy is a basic fundamental primitive Would love to hear alternative perspectives and other justifications for or against privacy
- olddustytrail 1y ago
  That's literally what EU privacy laws are about and guess what... Anti government folk from the USA hated them and decided they were government overreach.
  - base698 1y ago
    Ah yes, lock you up for Facebook posts UK is the bastion of privacy.
    - gxs 1y ago
      To be fair to OP I don’t think the UK is in the EU
    - olddustytrail 1y ago
      Firstly, the UK is not in the EU. That's what Brexit was. Secondly, incitement to violence is illegal in most countries. If you think it's not in yours, why not try it and see where you end up?
soulofmischief 1y ago
This goes against the very ethos of the early web. We should not be normalizing any form of this extreme moral overreach.
- CPLX 1y ago
  How did widespread adoption of the libertarian techno-utopianism of the early web work out for society as a whole?
  - dmix 1y ago
    It existed only on the edges, usually in softer pragmatic forms, and stopped a lot of bad ideas as a pressure group. Characterizing the entire development of software and the internet in 90s-2000s as based on libertarian techno-utopinanism is largely manufactured narrative though. One I keep seeing pop up more and more. Largely by people trying to push poorly though out authoritarian gov-controlled internet by spinning the present internet (and parenting) as a product of some ideological radicalism.
    - watwut 1y ago
      I got us 4chan and 8chan. It got us mass shootings and endless "they are just trolling, they are just teenagers, they are just ironic" chorus constantly bad faith defending the far right.
      - mindslight 1y ago
        So now that we've arrived at the far right, it's time to stop decentralized dissent and prevent the pendulum from swinging back? This seems like a terrible idea. And personally I'd say mass shootings are primarily encouraged by corporate mass media (including social media) glorifying the events and the shooters, rather than anonymous message board speech.
        overfeed 1y ago
        "arrived" and "swinging back"? You sound like an optimist; the dark-enlightenment Neo-Reactionary folk behind this are only just getting started.
api 1y ago
Devils advocate: parents that are too busy or not tech savvy are helpless to block content without essentially forbidding their kids from using any connected device. I run a pi-hole that blocks ads and porn, but that’s way beyond the technical capability of probably 95% of people. There are some commercial products but they are expensive and also take time and at least a little tech ability to set up. … and of course any phone with 5G/LTE gets around this. Cellular is impossible to police.
- hansvm 1y ago
  That still seems better than the proposed cure. Connected devices are overrated.
  - api 1y ago
    What happens when their friends have them? It is very hard for parents who aren’t tech savvy or are busy (single parents or both work) to police this stuff. I’m playing devils advocate because if we pretend this isn’t a problem eventually governments will force onerous regulation. It is a problem. We need to come up with better solutions if we don’t want worse ones. It’s devils advocate because I think while kids shouldn’t be looking at porn the brain rot shit is at least as bad and possibly worse. Kids YouTube is a lobotomy.
    - salawat 1y ago
      Sounds like marketing is the problem. In fact, I'd say 90% of the Internet's more problematic aspects disappear once you get rid of marketing/monetization. We had a good thing. We let mercantilism and surveillance capitalism ruin it.
      - reliabilityguy 1y ago
        To some extent, Section 230 is to blame.
- tomrod 1y ago
  With all due respect to parents that overscheduled themselves: Tough. Raise your kids. Don't try to raise mine.
Sharlin 1y ago
[flagged]
- antonymoose 1y ago
  I expect a liquor store to check ID, why not a porn store?
  - __loam 1y ago
    [flagged]
  - trhway 1y ago
    Interesting, why did you give up your right to buy liquor anonymously? And you also seem to be willing to give up your right to anonymous porn. Why?
    - probably_wrong 1y ago
      > why did you give up your right to buy liquor anonymously? That's not entirely true - once you look old enough most places will stop asking for ID. As for why: because there is (or at least, was) no other system to identify whether someone is underage and, by extension, more likely to underestimate the consequences of their actions, make worse choices under the effect of alcohol, and suffer its effects more strongly. Same reason why the legal system makes a difference between minors and adults.
    - jkaplowitz 1y ago
      Most of us alive in the US today never had a right to buy liquor anonymously, unless you’re making a natural rights argument independent of contrary constitutional or statutory law. The 21st Amendment gives lots of authority to states to regulate or prohibit alcohol sales, including the right to require ID. With that said, even now, it’s normal that liquor stores only look at IDs without transmitting or recording the information anywhere (in the absence of fraud concerns), so if the purchase itself is made with cash, it has most (not quite all) of the same data privacy and security consequences as a true anonymous purchase. This is very different from the online porn age verification proposals.
danaris 1y ago
> If these laws move forward (and I don’t think they should), there needs to be a way to authenticate as over 18 without sending picture of your ID off to random 3rd parties, or giving actual personal details. But there won't be. Because the ultimate purpose of laws like this isn't really to prevent minors from accessing porn. Ultimately, it's to 1) outlaw porn for everyone, because it's "sinful", and 2) outlaw discussions and depictions of queer—and more specifically, nowadays, especially trans—issues, because according to them, anything queer is automatically pornographic, no matter how tame the actual content is.
- blurbleblurble 1y ago
  Don't forget about sex education and literature in general
  - toomuchtodo 1y ago
    Knowledge is power.
- deleted 1y ago
  [deleted]
- IAmGraydon 1y ago
  You’re getting downvoted, likely because the people downvoting you dont realize that Project 2025 explicitly calls for the complete outlawing of pornography and the imprisonment of anyone who produces it. They also frame transgender ideology and LGBTQ+ educational materials as falling under “pornography”, essentially calling for these to be banned.
  - TheOtherHobbes 1y ago
    And when they've banned all of those, they'll be banning r/pastorarrested for pointing out what everyone already knows about these fine upstanding moralists.
  - ModernMech 1y ago
    > They also frame transgender ideology and LGBTQ+ educational materials as falling under “pornography”, essentially calling for these to be banned. Close, but it's worse than that -- they don't want LGBTQ+ material merely banned; they want LGBTQ+ people dead, or at the very least banned from all public life. The next step is where they call for the death penalty for child abuse (also in Project 2025). So according to them LGBTQ+ is pornographic -> pornography is child abuse -> child abuse is punishable by death -> therefore existing as a queer person is punishable by death.
ai-christianson 1y ago
The pre-red-tape internet was glorious. Only way to get that back is to decentralize everything.
- trod1234 1y ago
  No entity willingly gives up control, and that is what this issue is about. This is going to impact every book out there, creating an environment where the authors simply can't tell their stories anymore because of someone's moral shock. Bad things happen in stories to characters, and authors need that flexibility. Its the journey in overcoming these things that makes the story good. The moment you or an author can't express reality without it being a felony, is the moment you no longer have real writers. Some people don't write for money, and these things impose untenable cost on everyone.
conradev 1y ago
You mean like this? https://webkit.org/blog/16993/news-from-wwdc25-web-technology-coming-this-fall-in-safari-26-beta/#:~:text=The%20Digital%20Credentials%20API%20leverages%20the%20existing%20Credential%20Management%20API%20and%20introduces%20a%20%E2%80%9Cdigital%E2%80%9D%20member%20for%20requesting%20identity%20documents.%20Requesting%20an%20identity%20document%20relies%20on%20the%20ISO/IEC%2018013%2D7%20Annex%20C%20international%20standard%2C%20which%20is%20identified%20by%20the%20protocol%20string%20%22org%2Diso%2Dmdoc%22. https://webkit.org/blog/16993/news-from-wwdc25-web-technolog... It’s a W3C spec led by Okta, Apple and Google based on an ISO standard and it is being rolled out as we speak. This part other iOS applications that have registered themselves as an Identity Document Provider. Has some fun history: California went with an independent contractor for its mDL implementation, which ultimately pressured Apple into integrating open(-ish) standards to interoperate.
- al_borland 1y ago
  This is interesting, but I’d like to go a step further. I watched the first quarter of the video on where they go over how it works. The site requests data from your ID and they get that data. The site chooses which data it needs and if it will store it or it or not. Sites these days have a tendency to ask for more than what they need, and to store it for profiling purposes. The user can deny the request, but then can’t use the site. They are then left with a dilemma. Give up this personal information or not have access at all? Companies are betting on users giving up privacy in exchange for access. What I’d like to see is for the site’s request to contain their access rules. Must be over 18, must be in country X, etc. Then on-device it checks my ID against that rule set, and simply returns a pass/fail result from those checks. This way the site would know if I’m allowed to be there, but they don’t get any specific or identifiable information about me. Maybe I’m 18, maybe I’m 56… they don’t know, they both simply send a pass. For a simple age check, a user’s exact birthday, name, address, etc are irrelevant, but I bet companies will get greedy and try to pull it anyway. I see the monkey paw of the ID spec as leading to more companies seeking to get all our data, when they really don’t need it, and have shown they can’t be trusted with it. I already see this with Apple Pay. When buying a digital item, some companies are awesome and simply take the payment with no other data. Others pull name, address, email, etc to make a payment when none of that is required.
loeg 1y ago
> Parents are expecting the government, and random websites, to raise their kids. This is simplistic. I think you'll find parents are not a uniform bloc in favor of this kind of overreach.
deleted 1y ago
[deleted]
throw0101c 1y ago
> All these ID check laws are out of hand. Parents are expecting the government, and random websites, to raise their kids. Why would anyone trust some random blog with their ID? Kind of unfortunate that PICS[1][2] and POWDER[3][4] never really took off: it allowed web sites to 'self-label' and then browsers (and proxies?) could use the metadata and built-in rules/filters to determine if the content should be displayed. [1] https://en.wikipedia.org/wiki/Platform_for_Internet_Content_Selection https://en.wikipedia.org/wiki/Platform_for_Internet_Content_... [2] https://www.w3.org/PICS/ https://www.w3.org/PICS/ [3] https://en.wikipedia.org/wiki/Protocol_for_Web_Description_Resources https://en.wikipedia.org/wiki/Protocol_for_Web_Description_R... [4] https://www.w3.org/2007/powder/ https://www.w3.org/2007/powder/
- Bender 1y ago
  PICS and ICRA were not adopted by many due to complexity. RTA [1][2] is a more generic header that can be used on any adult site or site that allows user contributed content and is easier to implement. There needs to be a law that requires clients to look for this header if parental controls are enabled. Not perfect, nothing is. Teens will easily get around it but most small children will not which should be the spirit of the ID verification movement. It's better than what we have today. The centralized ID verification sites will push many small sites to Tor and bigger sites to island nations and tax evasion in my opinion. More browsers are natively supporting .onion domains. Congress critters should be opposed to the centralized ID verification systems as their browsing habbits will be exposed to the world when those sites ooopsie dooopsie "leak" the data or just openly sell it or an employee turns that data into a summarized online spreadsheet of who is into what. The kickbacks and lobbying they may be potentially receiving will not be worth it. [1] - https://www.rtalabel.org/index.php?content=howtofaq#single https://www.rtalabel.org/index.php?content=howtofaq#single [2] - https://www.shodan.io/search?query=RTA-5042-1996-1400-1577-RTA https://www.shodan.io/search?query=RTA-5042-1996-1400-1577-R... [dont follow the links, NSFW]
  - sigwinch 1y ago
    > There needs to be a law that requires clients to look for this header if parental controls are enabled Would that require MiTM at the network level? Or, is there a custom X.509 RTA that would tell clients not to accept the certificate?
deleted 1y ago
[deleted]
aaaja 1y ago
This is a barrier put in place so that children are less likely to casually access these sites while they're browsing around. As an adult, no-one is forcing you to view pornographic websites. If you don't want to provide your ID as per these laws, simply refrain from viewing. It really is that straightforward a choice.
- const_cast 1y ago
  Right, so you're admitting what we already know to be true: it's censorship. Now, I can get behind some censorship if it's for very good reasons. As soon as it's for moralistic reasons, you've lost me. This is a morality law. Morality laws are bad, period. We need real, concrete reasons for blocking content and enforcing censorship - not morality. Why not? Because morals change from person to person and throughout history. What an evangelical thinks is moral is different from what I think is moral. If the internet existed during times of slavery, would they have censored websites addressing freedom because it is "immoral"? In my mind, yes. That's a problem with the entire thought process. So, we should throw the thought process out. I don't know what the future holds in 10 years, 20 years, 30. I don't want to be bound to laws that rely solely on morality. That's just asking for trouble. I mean, even just the word "pornography" is a moral footgun. Who defines that? Because a large portion of the US believes anything containing homosexuals is automatically pornographic, regardless of the material.
  - aaaja 1y ago
    Proving one's age is required for many other activities that are considered unsuitable for children, such as purchasing alcohol and drugs, and watching age-restricted films in the cinema. Of course this means that any adult, when challenged, who refuses to show ID as proof of age, will be denied service. But again that refusal is their choice. They voluntarily refrained from complying with the access requirements. How is this substantially different to an adult refusing to show ID to access an age-restricted website?
    - const_cast 1y ago
      The internet is already blocked by age. In order to order internet service, you must be an adult, and you must prove it by showing papers, such as residence and pay stubs. Once the service or good is sold, all bets are off. The clerk at the corner store might ask for your ID to buy alcohol, yes. But they do not follow you home to ensure you don't give wine to your kid. And, if they did, would you be comfortable with that? I think no. Why not? Privacy. I don't want a random clerk watching me every time I decide to drink or smoke. It's a violation of my privacy. So, privacy - there's your answer, that's the difference.
Eavolution 1y ago
I am never providing my ID to anyone who can store it indefinitely. I am an adult and have no problem showing it in a shop if required as it isn't stored. Unless it can be proven it wont be stored (i.e. the bytes are never sent from my laptop) I will not provide it.
- ivan_gammel 1y ago
  Your ID is effectively stored by the issuer indefinitely. What’s the difference between one and two entities? What’s the difference between two and a hundred?
  - al_borland 1y ago
    The more people you give your personal information to, the less personal it becomes. The servers storing this information have been hacked in the past and it will happen again in the future. The fewer places your ID lives, the lower the risk of it leaking. Even if you don’t view the data as sensitive, it still associates a person with a website. Depending on the site, that can have negative ramifications in a person’s life. This is especially true when certain websites get associated with various political leaning and when the data leaks, the people who happened to be registered (for whatever their reason) get attacked.
    - delusional 1y ago
      Where I'm from we sorted this out with laws. It's not hard to figure out if one of your workers are associating with a union, but you're not allowed to treat them differently based on that. Laws make sure you don't, even though you technically could.
      - al_borland 1y ago
        The tricky part is proving you’re being treated differently and that’s the reason why. Trying to legislate human behavior at that level doesn’t seem to work well. My company has rules against retaliation. Good luck proving that’s the reason you didn’t get promoted, or were left off of a project. People get left off projects and don’t get promoted all the time. Keeping your job because the company is legally obligated to sounds like an uncomfortable working environment.
VBprogrammer 1y ago
The slippery slope from here to banning under 18s looking at websites discussing suicidal thoughts, transgender issues, homosexually and onto anything some group of middle age mothers decide isn't appropriate seems dangerously anti-fallacitical.
- windowshopping 1y ago
  Anti-fallacitical?
- JumpCrisscross 1y ago
  The hilarious part is this only regulates American speakers. If you want to sell Americans porn and ignore the age gate, publish from abroad.
  - kevingadd 1y ago
    How will you sell them porn when VISA and Mastercard ban you?
    - galangalalgol 1y ago
      Sepa, pix, ideal, swish? Bitcoin? A debit card from a bank on the us west coast that has state laws forbidding them to comply with laws like Texas'? If your hosting, banking, and residence are in CA, OR, or WA, and there was no discernable intent to target residents of the other state, it seems pretty unlikely anything could happen to you. Just don't take any plane that might get emergency diverted to some other state.
  - trehalose 1y ago
    It's only hilarious until they criminalize even looking at such content.
- cmilton 1y ago
  While I completely understand the slippery slope concept, we ban all kinds of things for under 18s based on morals. Why couldn't these be any different? How else does a society decide as a whole what they are for or against. Obviously, there should be limits.
noosphr 1y ago
If you need an id to buy porn irl why wouldn't you need one to buy it online?
- breadwinner 1y ago
  Because 'online' is the entire planet, including sellers in foreign countries. Would you like to have "digital borders" between countries, where data has to show some sort of passport to cross the border?
  - noosphr 1y ago
    Again, if I want to import pron from Japan I need to not only prove I'm 18 to the border censors but make sure the pron is legal locally. Plenty of people have been arrested for importing things legal in Japan that are illegal in the West. Plenty of countries have laws on the books that make it a felony to even look at what's on the average Japanese store bookshelf while you're in Japan. Why should the laws be different just because you're moving electrons instead of atoms?
    - int_19h 1y ago
      They shouldn't, of course. Those existing regulations that you're referencing are equally bad for all the same reasons, and we should get rid of them.
  - delusional 1y ago
    I mean if the alternative is complete lawlessness, then I suppose I do want digital borders. AMA.
    - dangraper2 1y ago
      Challenge accepted
    - dangraper2 1y ago
      How old are you?
38 1y ago
VPN.
- Tadpole9181 1y ago
  Oh, don't you worry, they'll come after VPNs next. After all, this makes them accomplices to felony acts.
  - deleted 1y ago
    [deleted]
  - 38 1y ago
    laughs in residential proxy
phendrenad2 1y ago
> Why would anyone trust some random blog with their ID? They won't have to, most websites will use 3rd party age verification. This is basically what Doordash and Uber Eats use to verify your age before delivering alcohol or THC to your apartment. Rife for abuse? Absolutely. Will these databases get leaked and increase the chances of your identity getting stolen? Yes. But isn't a small increase to an already-existing problem.
- sethammons 1y ago
  Those drivers check my ID at the door.
  - phendrenad2 1y ago
    You didn't have to provide your ID when you enabled alcohol delivery? That's how it works in California, at least.
    - sethammons 1y ago
      I have never interacted with the app. I just show ID if those are in the order and I am the one answering the door.
      - phendrenad2 1y ago
        Ah I see, thanks for clarifying that your response was uninformed.
        sethammons 1y ago
        I don't understand your seemingly petty and demeaning retort. What makes me uninformed? It sounds like you were the one who was unfamiliar with the ability to interact with door dash with an ID and not having to upload it. I have accepted door dash as a non-door dash customer. They check for ID. Just like the store.
drak0n1c 1y ago
Thinking about client vs server, wouldn't it be even less wide-ranging, less costly to enforce, and more appropriately targeted if such mandates are one-time and on the client side - only on device manufacturers and OEM-shipped OS? Suppose new mass market devices are defaulted to parental controls on, until unlocked by an adult at point-of-sale or afterwards through a form of validation? The KYC of who unlocked it could be anonymized or the PII-proving side of the log if it needs keeping could be on-device only (high bar for criminal investigations). There should be a clear exemption threshold for low volume indie products, build your own PC, and open source self-install like Linux - since the purpose is to protect ignorant/apathetic consumers.
- anondude24 1y ago
  Are you ok with all devices considering the user hostile and coming with heavy encryption and locked bootloaders? > There should be a clear exemption threshold for low volume indie products, build your own PC, and open source self-install like Linux - since the purpose is to protect ignorant/apathetic consumers. Then everyone will just follow a YouTube tutorial to reinstall their operating system and bypass restrictions. There were TikTok videos teaching kids how to steal cars, would there not be easy to follow instructions to bypass whatever client side filtering is implemented? I get where you're coming from, but mandated client side filtering has been tried and has been ridiculed as a complete failure every time. Attempts have been made to market and provide filtering products to parents with little effect, with them either being easy to bypass or difficult to use. It's actually kind of interesting to see the people who were fighting against client side filtering are now advocating for it, because server side restrictions are the next logical step.
  - al_borland 1y ago
    This would actually be an effective way to teach kids about technology. If they learn enough to install their own OS, let them have their smut. I’m hearing more and more how younger generations don’t have what people used to call basic computer skills, because everything just kind of works now. Putting up some road blocks that require research and hands on tinkering to solve, is an invaluable part of the learning process.
raincole 1y ago
> Parents are expecting the government, and random websites, to raise their kids. I mean, they are. But I've never seen a similar reaction on HN or any forum when social media require age verification. Actually, I think most HN users would cheer if the government required Facebook to only allow users over 18. I feel the general opinion about something on the internet basically comes down to this simple rule: !(do American Christians want that thing?), no matter what that thing is.
- sigwinch 1y ago
  This would apply to Facebook just as any other site, and that’s obvious to the HN crowd. It’s the ambulance chaser section of the article that explains the problem. American Christians can and should rely on content blockers rather than lawsuits.
  - SauciestGNU 1y ago
    I think American Christians should do neither. Restricting a child's access to information in order to indoctrinate them into a set of beliefs unquestioningly is a form of child abuse. Various forms of psychological and physical abuse are extremely prevalent in American Christian parenting practices, and it's something as a society we should not tolerate.
    - olddustytrail 1y ago
      Exposing children to propaganda that they are ill equipped to deal with is also child abuse. Just because someone can argue better than you can does not mean they are right. Climate change deniers can be very convincing if you don't understand physics.
      - deleted 1y ago
        [deleted]
leptons 1y ago
These are Authoritarian Christo-fascists. They do not care. They will demonize everyone involved in anything related to online sex. They are coming for the sex workers, and all of porn too - they stated they would do this in "Project 2025". "Think of the children" is how they justify it.
tw04 1y ago
The irony here being that the same people who want this are the ones screaming from the rooftops about the government indoctrinating their kids. *Also, I can’t wait for the first lawsuit over a breastfeeding page, because you know it’s coming.
yieldcrv 1y ago
yeah my thoughts are that this is largely a User Experience problem than an onerous liability problem The blog owner doesn't need to implement an ID check, the browser or OS just needs to tap into a service that has checked ID
486sx33 1y ago
[dead]
bastawhiz 1y ago
> there needs to be a way to authenticate as over 18 No there doesn't. Why is the burden on ME (as a site owner) to do literally anything at all? The burden should be on parents to control their childrens' Internet use. Install a robust content blocker or don't give them Internet access. Am I, a site owner, supposed to work with every asinine state and national system for making this attestation system work? How do I know the person behind the keyboard is actually the person whose age is being verified (and not one of their parents')? And as a citizen and consumer, why do I have to go out of my way to get some kind of digital identification that proves my age? Why does this have to stop at porn? The logical next step is that legislators and parents will demand that sites will block folks from accessing blasphemous content. Or that you need to prove that you're not a resident of a particular state in order to access medical facts about abortion (because if you're looking it up, you obviously intend to get one or help someone get one)? I don't want people to know how old I am or am not. Or where I live or don't live, or my sexual orientation, or anything else about me. I don't want to have to know any of these things about people who visit my website. And frankly, the idea that I am the one who is responsible for this and not the extreme minority of folks who want to keep certain content away from their kids or whatever is wild.
freejazz 1y ago
You can't show porn to kids in regular stores, I'm not sure why it's okay to do it on the internet, such that it becomes "raising" the kids when it's not in the first instance.
john01dav 1y ago
I'm concerned that such validation would need to be proprietary and locked down with some sort of user hostile TPM-like-thing in order to be effective. If this wasn't the case, then anyone could fork the foss tool and create a bypass. The average child won't do this, but a few will and some adults probably will over anti DRM principles and then it's published and widely available.
- sigwinch 1y ago
  These are ideological litigious fanatics among a much bigger herd of worried parents. They’ll attack any bypass tool and risk degrading the features of normal stuff like browsers and url parser libraries; totally ineffective at solving the problem but doing something in the eyes of unsophisticated constituents.
ndiddy 1y ago
The actual point of these laws isn't to stop minors from viewing the material, it's to stop sites from hosting the material entirely. They're using "protect the kids from obscene content" as a wedge to get popular support. Acting like some technical solution to make authenticating as an adult more user-friendly would make the politicians who want this implemented happy is disingenuous. Let's take a look at how Tennessee has legislated their ID check should be implemented: - ID must be verified either by matching a photo of the user to their photo ID, or by processing private transactional data (i.e. a credit card transaction). - The user must verify their ID at the start of the session, and every hour the session is active. - Historical anonymized ID verification data must be retained for at least 7 years. - Anyone running a site that's viewable in Tennessee without the above ID verification rules is committing a class C felony, regardless of what state they reside in or host their site in. This is clearly an attempt to stop any content they label as "obscene" (using a very broad definition of "obscenity") from being viewable at all in Tennessee. It's a completely unreasonable set of hoops to jump through that solely exists as a fig leaf because they know that making a law banning the content entirely would be ruled unconstitutional.
- BobaFloutist 1y ago
  7 years is crazy. I can't think of a single plausible justification for that that isn't dramaticallly expanding the purported scope of the law
skybrian 1y ago
By a similar argument, why should stores check id's when selling alcohol or cigarettes? Raising kids is not their job either. The answer is because we live in a society. Society is about families, not just adults. Sure, raising kids is primarily the job of the parents, but everyone helps. Sometimes that results in a bit of inconvenience for businesses. Excluding kids from businesses that are adult-only isn't very kid-friendly, but it's the bare minimum when there are children around.
- sigwinch 1y ago
  It’s not the material cigarettes or alcohol that are the problem, it’s lying to get them. Same is true for sins like gambling and explicit romance novels. The enforcement here is quite twisted: it attracts greedy litigants. Lying is bad, but greed is a mortal sin.
- raincole 1y ago
  And educating the kids should be, and always has been a collective effort. Even in pre-industrial societies it was true. In the modern world it should be doubly true. I think most people would agree that we need public schools, even though some of them disagree with how sex ed and evolution were taught there.
- rocqua 1y ago
  The issue is that currently, adding restrictions to what minors can do is expensive, both economically, and politically. It requires the cooperation of a lot of non-government appointed people, and many of them could (locally) sabotage the restrictions. This limits the restrictions to those with incredibly broad support. Keeping a lot of agency with families on how to raise their children. Digital age verification, if implemented well, is easy to enact, and hard to sabotage without being noticed. That enables restrictions that 49% of people disagree with. Heck, it enables restrictions that 49% of Congress disagrees with. That could be 60% of people disagreeing.
  - skybrian 1y ago
    I don't think it's all that different, because nothing is foolproof. People will still circumvent age restrictions by sharing devices. (For example, borrowing a phone.)
deleted 1y ago
[deleted]
dcow 1y ago
> Parents are expecting the government, and random websites, to raise their kids. (1) Without addressing the general statement, specifically this isn't new. You’ve historically not been allowed to buy pornography or cigarettes or alcohol without age verification or watch obscene content between the nightly news runs. I don't see this specifically as parents wanting the government to raise their kids at all. It’s people without any other real options wanting to make it more difficult for inappropriate material to end up in the hands of minors. When I was 12 I remember getting online with AOL discs and having popups with porn appear in front of me as I’m playing neopets, because some unsavory ad got accidentally “clicked” many sessions ago. How can a parent “parent” that? > If these laws move forward (and I don’t think they should) (2) These laws already exist, the internet was a loophole. If it’s done right you verify your age when you make your account and the site doesn’t bug you again. Not sure how frequently you’re visiting new porn sites, but I can’t imagine getting over prompted would be a real problem. (3) There is a concept of using ZKPs to do more things client side. However I think currently people are more excited about selective disclosure. You just give the site a signed claim that you’re over 18 and that’s all they know. It’s more private than handing over your DL at the grocery store checkout. > People should also be able to set their browser/computer to auto-send this for single-user devices, where it is all transparent to the user. They should, shouldn’t they. But some privacy nut out there will say we can’t have nice things because an advertiser might use it to profile you. Really though one aspect of digital identity is presence and liveliness checking. The states that issue your ID to Apple Wallet are only willing to do so because Apple ensures that the user presence is verified at time of use. The question isn’t why should you have to jump through hoops, it’s why should we enforce age restrictions in person but not in the internet—why haven't you had to jump through all the existing hoops to watch internet porn until now?
- sigwinch 1y ago
  1) it doesn’t go as far back as you think. Only within my lifetime did the drinking age settle on 21. The Feds couldn’t do it directly, so they hacked highway funds. So that’s a bad example when porno has changed so much. What we’re risking here is parents who haven’t tried any solutions being convinced that litigation is the only way. 2+3. A simple cookie with a birth year ought to work. Why should every site worry about South Dakota’s definitions when checking a cookie seems reasonable effort. Circumvention of that is already fraud.
csomar 1y ago
> If these laws move forward (and I don’t think they should), there needs to be a way to authenticate as over 18 without sending picture of your ID off to random 3rd parties, or giving actual personal details. I don’t want to give this data, and websites shouldn’t want to shoulder the responsibility for it. Sure. A government issued certificate that is required to get an IP and be able to navigate the internet. How does that f-+-ing sound?
- cowboylowrez 1y ago
  >Sure. A government issued certificate that is required to get an IP and be able to navigate the internet. How does that f-+-ing sound? sounds like the solution to me. disallow under 18s from internet access. any parent who allows an underage to browse the internet unsupervised should be penalized to the same degree that they would if they directly provided hardcore pornography to the child, because thats exactly what it is. I personally would choose this route, handing kids fully internet enabled pornography consumption devices is beyond ridiculous, and the size factor of smartphones (take them everywhere, camera connected directly to encrypted chats with strangers) well the fact that the government even allows this is simply a matter of confusion to my small mind. What am I missing here? Why do we allow children internet access?
deleted 1y ago
[deleted]
kvgr 1y ago
Everybody will get a chip implant for 18th birthday. Solved ;)
amelius 1y ago
I think the majority of people on HN are well aware of this. The big question is how to transfer this simple idea to the people in charge at governments.
Eddy_Viscosity2 1y ago
But I bet that signal would still be a unique identifier. It doesn't have to be, but it will be because that is the point. Not to see who is old enough, but to track every page visit and interaction of everybody all the time.

alwa 1y ago

And we could call this way… zero-knowledge proof! :) https://en.m.wikipedia.org/wiki/Zero-knowledge_proof https://en.m.wikipedia.org/wiki/Zero-knowledge_proof I bet we could even get a major phone OS vendor to support such a thing… https://blog.google/products/google-pay/google-wallet-age-identity-verifications/ https://blog.google/products/google-pay/google-wallet-age-id...

michaelt 1y ago
Do we expect Apple to implement a special, privacy-preserving age proof for porn viewers? Apple hates porn, when it's on websites like Tumblr.
- alwa 1y ago
  At the same time they seem pragmatic about putting their mark on standards. It seems to me like we’re at a confluence: a regulatory tipping point where there really is pressure to bring laws to bear on online harms affecting kids; and a socio-technological moment where “gotta distinguish kids from adults” can realistically happen separately from “…by handing over personal info directly to shady random counterparts.” Individual smartphones with biometrics are these days a whole-of-society norm, technologists have developed a mature body of cryptographic work to assert ZKPs, the US population seem to have lost their aversion to centralized ID systems… and the periodic moral panic about the kids seems to be at a high tide. In the same way that Apple don’t prevent, say, Safari from being used for prurient purposes, or Final Cut Pro from being used to edit naughty bits, I don’t see why they wouldn’t want an opinionated implementation as a concept develops of a generic “digital tool to assert your age, and only that.” Especially since Android is doing it and leaning into the privacy angle.
- meowkit 1y ago
  Zero knowledge proof smart contract verification called by the site interested in your age. You provide your public key wallet with its government issued soul bound NFT of your identification. This can be done, its not that crazy, it just requires a bunch of people to get their heads out of their sand in regards to tech and blockchain, which admittedly might be a harder problem. —— Additonal thought- if you don’t understand what I’m saying or have a negative reaction just plug the comment + thread context into an LLM and see what it says / ask for a clearer explanation.
  - root_axis 1y ago
    ZKP is all you need. The NFT or blockchain stuff is unnecessary can be discarded.
- tzs 1y ago
  I expect Apple will implement a general privacy-preserving arbitrary attribute proof, with age proof just one of the things it could be used for, probably using something similar to the library that Google recently released [1]. [1] https://news.ycombinator.com/item?id=44457390 https://news.ycombinator.com/item?id=44457390
deleted 1y ago
[deleted]
deleted 1y ago
[deleted]
blurbleblurble 1y ago
Yet then again how hard is it to just grab your parents' ids while they're not looking and add it to your phone wallet?
- __turbobrew__ 1y ago
  Gate it in the touch id secure enclave. Then only the biometrics of the adult can provide the proof that they are over 18.
  - blurbleblurble 1y ago
    I'm just saying that if age verification is done via a "smart card" then it shouldn't be hard to just add that to the phone. Unless of course they're planning on making us go to some facility to ensure our phones get the digital components of the IDs get loaded into the secure enclave? Which sounds dystopian as heck given the scenes coming out of the US right now.
- sigwinch 1y ago
  Accessing my site after that would violate CFAA, right? Minors are not exempt from CFAA.
- cloverich 1y ago
  They can require a selfie to compare against, multiple documents, a video, etc. IMHO best bet is to consolidate the validation to a small set of reputable companies, delegate validation to them, then improve regulations around access. Eg non-reputable site needs to know you are 18 (etc) but not see your actual id if they can have a third party do it in a blind-to-them fashion.
andrepd 1y ago
Eh. So now I'm forced to have all my IDs stored at an advertising behemoth. Not really a great situation either. You're practically forced to have a Google/Apple account and a google/apple smartphone to even exist in today's world.
Aerroon 1y ago
I bet that in practice, at scale, these zero knowledge proofs end up being a lot more than zero. Not to mention that you're almost certainly going to have to tie this stuff to specific accounts that will then forever and ever keep your habits collected. One day somebody enterprising is going to add all that data together too.
- Tadpole9181 1y ago
  VPNs and zero knowledge proof systems are vulnerable to traffic analysis (based on packet size and timestamps) and there's almost no cure. Mullvad is the only VPN I know of that has a mode that normalizes all packets to the same size (going into the VPN) and sends fake packets that don't get sent as real traffic. But that's only obfuscation and, at low traffic or high bandwidth (videos) or with sufficient heuristics, it can be beaten. The US has basically zero regulation on selling this data. I can imagine a world where within a couple decades the US has one of the largest blackmail crisis ever seen, as foreign governments target civil workers. Or, I guess, at this point, the US government against the "undesirable" party within this administration.
  - bawolff 1y ago
    > VPNs and zero knowledge proof systems are vulnerable to traffic analysis Zero knowledge proofs are not vulnerable to traffic analysis the same way VPNs are.
    - Tadpole9181 1y ago
      It really depends on the implementation around it, how a user conducts themselves, and what data you can buy. While there is zero knowledge inside the proof, its use creates a side channel that reveals information. For instance: The relying party server needs to call the auth server on novel users. Thats a new, unavoidable indicator! How large are token batches and how long do they last? Will the implementation force them to wait a time period between redemption and use? A bad implementation means the user IP will talk to the A server, then it will contact the RP server, who will contact the A server. Because this happens once per connection (or 60 minutes in this bill) and takes maybe a few hundred milliseconds. there's not going to be a huge number of candidates to have to sort through. And that's just the handshake.
Springtime 1y ago
It would be preferable if the prover party that holds the credentials in this scenario weren't Google. If anything I'd prefer a government issued digital ID with some form of local-only cryptographic exchange where neither the government knows someone has verified at a particular site/service and the verifier doesn't get info about one's identity. Just some cryptographic proof that verifies an age ('just' is doing some heavy lifting). In past HN comments this apparently exists IRL in Germany and/or Canada, where age can be proven via a smartphone without leaking one's identity to the verifier and without any communication back to the government.

gxs 1y ago

There was a thread on reddit asking the other day what about the modern world bothers you the most I actually considered this question and after thinking about it, despite everything going on, I think it boils down to lack of privacy as my biggest gripe in the modern world It’s such a tough concept to explain to the if you don’t have anything to hide crowd, but if someone wants to disappear, I don’t care if for good or bad reasons, they should be able to If you don’t want the government on you, if you don’t want people you know to find you, if you just want to reinvent yourself, it doesn’t matter why - you should be able to do this. It just “feels” like an innate right. Normally I don’t like to argue using “vibes” as justification, but this to me is just part of my value system/morals which is inherently arbitrary to begin with Encroaching on this privacy encroaches on a bunch of other rights, like free speech as you’ve mentioned The fact that this is the case makes it even clearer to me that privacy is a basic fundamental primitive Would love to hear alternative perspectives and other justifications for or against privacy

olddustytrail 1y ago
That's literally what EU privacy laws are about and guess what... Anti government folk from the USA hated them and decided they were government overreach.
- base698 1y ago
  Ah yes, lock you up for Facebook posts UK is the bastion of privacy.
  - gxs 1y ago
    To be fair to OP I don’t think the UK is in the EU
  - olddustytrail 1y ago
    Firstly, the UK is not in the EU. That's what Brexit was. Secondly, incitement to violence is illegal in most countries. If you think it's not in yours, why not try it and see where you end up?

soulofmischief 1y ago

This goes against the very ethos of the early web. We should not be normalizing any form of this extreme moral overreach.

CPLX 1y ago
How did widespread adoption of the libertarian techno-utopianism of the early web work out for society as a whole?
- dmix 1y ago
  It existed only on the edges, usually in softer pragmatic forms, and stopped a lot of bad ideas as a pressure group. Characterizing the entire development of software and the internet in 90s-2000s as based on libertarian techno-utopinanism is largely manufactured narrative though. One I keep seeing pop up more and more. Largely by people trying to push poorly though out authoritarian gov-controlled internet by spinning the present internet (and parenting) as a product of some ideological radicalism.
  - watwut 1y ago
    I got us 4chan and 8chan. It got us mass shootings and endless "they are just trolling, they are just teenagers, they are just ironic" chorus constantly bad faith defending the far right.
    - mindslight 1y ago
      So now that we've arrived at the far right, it's time to stop decentralized dissent and prevent the pendulum from swinging back? This seems like a terrible idea. And personally I'd say mass shootings are primarily encouraged by corporate mass media (including social media) glorifying the events and the shooters, rather than anonymous message board speech.
      - overfeed 1y ago
        "arrived" and "swinging back"? You sound like an optimist; the dark-enlightenment Neo-Reactionary folk behind this are only just getting started.

api 1y ago

Devils advocate: parents that are too busy or not tech savvy are helpless to block content without essentially forbidding their kids from using any connected device. I run a pi-hole that blocks ads and porn, but that’s way beyond the technical capability of probably 95% of people. There are some commercial products but they are expensive and also take time and at least a little tech ability to set up. … and of course any phone with 5G/LTE gets around this. Cellular is impossible to police.

hansvm 1y ago
That still seems better than the proposed cure. Connected devices are overrated.
- api 1y ago
  What happens when their friends have them? It is very hard for parents who aren’t tech savvy or are busy (single parents or both work) to police this stuff. I’m playing devils advocate because if we pretend this isn’t a problem eventually governments will force onerous regulation. It is a problem. We need to come up with better solutions if we don’t want worse ones. It’s devils advocate because I think while kids shouldn’t be looking at porn the brain rot shit is at least as bad and possibly worse. Kids YouTube is a lobotomy.
  - salawat 1y ago
    Sounds like marketing is the problem. In fact, I'd say 90% of the Internet's more problematic aspects disappear once you get rid of marketing/monetization. We had a good thing. We let mercantilism and surveillance capitalism ruin it.
    - reliabilityguy 1y ago
      To some extent, Section 230 is to blame.
tomrod 1y ago
With all due respect to parents that overscheduled themselves: Tough. Raise your kids. Don't try to raise mine.

Sharlin 1y ago

[flagged]

antonymoose 1y ago
I expect a liquor store to check ID, why not a porn store?
- __loam 1y ago
  [flagged]
- trhway 1y ago
  Interesting, why did you give up your right to buy liquor anonymously? And you also seem to be willing to give up your right to anonymous porn. Why?
  - probably_wrong 1y ago
    > why did you give up your right to buy liquor anonymously? That's not entirely true - once you look old enough most places will stop asking for ID. As for why: because there is (or at least, was) no other system to identify whether someone is underage and, by extension, more likely to underestimate the consequences of their actions, make worse choices under the effect of alcohol, and suffer its effects more strongly. Same reason why the legal system makes a difference between minors and adults.
  - jkaplowitz 1y ago
    Most of us alive in the US today never had a right to buy liquor anonymously, unless you’re making a natural rights argument independent of contrary constitutional or statutory law. The 21st Amendment gives lots of authority to states to regulate or prohibit alcohol sales, including the right to require ID. With that said, even now, it’s normal that liquor stores only look at IDs without transmitting or recording the information anywhere (in the absence of fraud concerns), so if the purchase itself is made with cash, it has most (not quite all) of the same data privacy and security consequences as a true anonymous purchase. This is very different from the online porn age verification proposals.

danaris 1y ago

> If these laws move forward (and I don’t think they should), there needs to be a way to authenticate as over 18 without sending picture of your ID off to random 3rd parties, or giving actual personal details. But there won't be. Because the ultimate purpose of laws like this isn't really to prevent minors from accessing porn. Ultimately, it's to 1) outlaw porn for everyone, because it's "sinful", and 2) outlaw discussions and depictions of queer—and more specifically, nowadays, especially trans—issues, because according to them, anything queer is automatically pornographic, no matter how tame the actual content is.

blurbleblurble 1y ago
Don't forget about sex education and literature in general
- toomuchtodo 1y ago
  Knowledge is power.
deleted 1y ago
[deleted]
IAmGraydon 1y ago
You’re getting downvoted, likely because the people downvoting you dont realize that Project 2025 explicitly calls for the complete outlawing of pornography and the imprisonment of anyone who produces it. They also frame transgender ideology and LGBTQ+ educational materials as falling under “pornography”, essentially calling for these to be banned.
- TheOtherHobbes 1y ago
  And when they've banned all of those, they'll be banning r/pastorarrested for pointing out what everyone already knows about these fine upstanding moralists.
- ModernMech 1y ago
  > They also frame transgender ideology and LGBTQ+ educational materials as falling under “pornography”, essentially calling for these to be banned. Close, but it's worse than that -- they don't want LGBTQ+ material merely banned; they want LGBTQ+ people dead, or at the very least banned from all public life. The next step is where they call for the death penalty for child abuse (also in Project 2025). So according to them LGBTQ+ is pornographic -> pornography is child abuse -> child abuse is punishable by death -> therefore existing as a queer person is punishable by death.

ai-christianson 1y ago

The pre-red-tape internet was glorious. Only way to get that back is to decentralize everything.

trod1234 1y ago
No entity willingly gives up control, and that is what this issue is about. This is going to impact every book out there, creating an environment where the authors simply can't tell their stories anymore because of someone's moral shock. Bad things happen in stories to characters, and authors need that flexibility. Its the journey in overcoming these things that makes the story good. The moment you or an author can't express reality without it being a felony, is the moment you no longer have real writers. Some people don't write for money, and these things impose untenable cost on everyone.

conradev 1y ago

You mean like this? https://webkit.org/blog/16993/news-from-wwdc25-web-technology-coming-this-fall-in-safari-26-beta/#:~:text=The%20Digital%20Credentials%20API%20leverages%20the%20existing%20Credential%20Management%20API%20and%20introduces%20a%20%E2%80%9Cdigital%E2%80%9D%20member%20for%20requesting%20identity%20documents.%20Requesting%20an%20identity%20document%20relies%20on%20the%20ISO/IEC%2018013%2D7%20Annex%20C%20international%20standard%2C%20which%20is%20identified%20by%20the%20protocol%20string%20%22org%2Diso%2Dmdoc%22. https://webkit.org/blog/16993/news-from-wwdc25-web-technolog... It’s a W3C spec led by Okta, Apple and Google based on an ISO standard and it is being rolled out as we speak. This part other iOS applications that have registered themselves as an Identity Document Provider. Has some fun history: California went with an independent contractor for its mDL implementation, which ultimately pressured Apple into integrating open(-ish) standards to interoperate.

al_borland 1y ago
This is interesting, but I’d like to go a step further. I watched the first quarter of the video on where they go over how it works. The site requests data from your ID and they get that data. The site chooses which data it needs and if it will store it or it or not. Sites these days have a tendency to ask for more than what they need, and to store it for profiling purposes. The user can deny the request, but then can’t use the site. They are then left with a dilemma. Give up this personal information or not have access at all? Companies are betting on users giving up privacy in exchange for access. What I’d like to see is for the site’s request to contain their access rules. Must be over 18, must be in country X, etc. Then on-device it checks my ID against that rule set, and simply returns a pass/fail result from those checks. This way the site would know if I’m allowed to be there, but they don’t get any specific or identifiable information about me. Maybe I’m 18, maybe I’m 56… they don’t know, they both simply send a pass. For a simple age check, a user’s exact birthday, name, address, etc are irrelevant, but I bet companies will get greedy and try to pull it anyway. I see the monkey paw of the ID spec as leading to more companies seeking to get all our data, when they really don’t need it, and have shown they can’t be trusted with it. I already see this with Apple Pay. When buying a digital item, some companies are awesome and simply take the payment with no other data. Others pull name, address, email, etc to make a payment when none of that is required.

loeg 1y ago

> Parents are expecting the government, and random websites, to raise their kids. This is simplistic. I think you'll find parents are not a uniform bloc in favor of this kind of overreach.

deleted 1y ago

[deleted]

throw0101c 1y ago

> All these ID check laws are out of hand. Parents are expecting the government, and random websites, to raise their kids. Why would anyone trust some random blog with their ID? Kind of unfortunate that PICS[1][2] and POWDER[3][4] never really took off: it allowed web sites to 'self-label' and then browsers (and proxies?) could use the metadata and built-in rules/filters to determine if the content should be displayed. [1] https://en.wikipedia.org/wiki/Platform_for_Internet_Content_Selection https://en.wikipedia.org/wiki/Platform_for_Internet_Content_... [2] https://www.w3.org/PICS/ https://www.w3.org/PICS/ [3] https://en.wikipedia.org/wiki/Protocol_for_Web_Description_Resources https://en.wikipedia.org/wiki/Protocol_for_Web_Description_R... [4] https://www.w3.org/2007/powder/ https://www.w3.org/2007/powder/

Bender 1y ago
PICS and ICRA were not adopted by many due to complexity. RTA [1][2] is a more generic header that can be used on any adult site or site that allows user contributed content and is easier to implement. There needs to be a law that requires clients to look for this header if parental controls are enabled. Not perfect, nothing is. Teens will easily get around it but most small children will not which should be the spirit of the ID verification movement. It's better than what we have today. The centralized ID verification sites will push many small sites to Tor and bigger sites to island nations and tax evasion in my opinion. More browsers are natively supporting .onion domains. Congress critters should be opposed to the centralized ID verification systems as their browsing habbits will be exposed to the world when those sites ooopsie dooopsie "leak" the data or just openly sell it or an employee turns that data into a summarized online spreadsheet of who is into what. The kickbacks and lobbying they may be potentially receiving will not be worth it. [1] - https://www.rtalabel.org/index.php?content=howtofaq#single https://www.rtalabel.org/index.php?content=howtofaq#single [2] - https://www.shodan.io/search?query=RTA-5042-1996-1400-1577-RTA https://www.shodan.io/search?query=RTA-5042-1996-1400-1577-R... [dont follow the links, NSFW]
- sigwinch 1y ago
  > There needs to be a law that requires clients to look for this header if parental controls are enabled Would that require MiTM at the network level? Or, is there a custom X.509 RTA that would tell clients not to accept the certificate?

deleted 1y ago

[deleted]

aaaja 1y ago

This is a barrier put in place so that children are less likely to casually access these sites while they're browsing around. As an adult, no-one is forcing you to view pornographic websites. If you don't want to provide your ID as per these laws, simply refrain from viewing. It really is that straightforward a choice.

const_cast 1y ago
Right, so you're admitting what we already know to be true: it's censorship. Now, I can get behind some censorship if it's for very good reasons. As soon as it's for moralistic reasons, you've lost me. This is a morality law. Morality laws are bad, period. We need real, concrete reasons for blocking content and enforcing censorship - not morality. Why not? Because morals change from person to person and throughout history. What an evangelical thinks is moral is different from what I think is moral. If the internet existed during times of slavery, would they have censored websites addressing freedom because it is "immoral"? In my mind, yes. That's a problem with the entire thought process. So, we should throw the thought process out. I don't know what the future holds in 10 years, 20 years, 30. I don't want to be bound to laws that rely solely on morality. That's just asking for trouble. I mean, even just the word "pornography" is a moral footgun. Who defines that? Because a large portion of the US believes anything containing homosexuals is automatically pornographic, regardless of the material.
- aaaja 1y ago
  Proving one's age is required for many other activities that are considered unsuitable for children, such as purchasing alcohol and drugs, and watching age-restricted films in the cinema. Of course this means that any adult, when challenged, who refuses to show ID as proof of age, will be denied service. But again that refusal is their choice. They voluntarily refrained from complying with the access requirements. How is this substantially different to an adult refusing to show ID to access an age-restricted website?
  - const_cast 1y ago
    The internet is already blocked by age. In order to order internet service, you must be an adult, and you must prove it by showing papers, such as residence and pay stubs. Once the service or good is sold, all bets are off. The clerk at the corner store might ask for your ID to buy alcohol, yes. But they do not follow you home to ensure you don't give wine to your kid. And, if they did, would you be comfortable with that? I think no. Why not? Privacy. I don't want a random clerk watching me every time I decide to drink or smoke. It's a violation of my privacy. So, privacy - there's your answer, that's the difference.

Eavolution 1y ago

I am never providing my ID to anyone who can store it indefinitely. I am an adult and have no problem showing it in a shop if required as it isn't stored. Unless it can be proven it wont be stored (i.e. the bytes are never sent from my laptop) I will not provide it.

ivan_gammel 1y ago
Your ID is effectively stored by the issuer indefinitely. What’s the difference between one and two entities? What’s the difference between two and a hundred?
- al_borland 1y ago
  The more people you give your personal information to, the less personal it becomes. The servers storing this information have been hacked in the past and it will happen again in the future. The fewer places your ID lives, the lower the risk of it leaking. Even if you don’t view the data as sensitive, it still associates a person with a website. Depending on the site, that can have negative ramifications in a person’s life. This is especially true when certain websites get associated with various political leaning and when the data leaks, the people who happened to be registered (for whatever their reason) get attacked.
  - delusional 1y ago
    Where I'm from we sorted this out with laws. It's not hard to figure out if one of your workers are associating with a union, but you're not allowed to treat them differently based on that. Laws make sure you don't, even though you technically could.
    - al_borland 1y ago
      The tricky part is proving you’re being treated differently and that’s the reason why. Trying to legislate human behavior at that level doesn’t seem to work well. My company has rules against retaliation. Good luck proving that’s the reason you didn’t get promoted, or were left off of a project. People get left off projects and don’t get promoted all the time. Keeping your job because the company is legally obligated to sounds like an uncomfortable working environment.

VBprogrammer 1y ago

The slippery slope from here to banning under 18s looking at websites discussing suicidal thoughts, transgender issues, homosexually and onto anything some group of middle age mothers decide isn't appropriate seems dangerously anti-fallacitical.

windowshopping 1y ago
Anti-fallacitical?
JumpCrisscross 1y ago
The hilarious part is this only regulates American speakers. If you want to sell Americans porn and ignore the age gate, publish from abroad.
- kevingadd 1y ago
  How will you sell them porn when VISA and Mastercard ban you?
  - galangalalgol 1y ago
    Sepa, pix, ideal, swish? Bitcoin? A debit card from a bank on the us west coast that has state laws forbidding them to comply with laws like Texas'? If your hosting, banking, and residence are in CA, OR, or WA, and there was no discernable intent to target residents of the other state, it seems pretty unlikely anything could happen to you. Just don't take any plane that might get emergency diverted to some other state.
- trehalose 1y ago
  It's only hilarious until they criminalize even looking at such content.
cmilton 1y ago
While I completely understand the slippery slope concept, we ban all kinds of things for under 18s based on morals. Why couldn't these be any different? How else does a society decide as a whole what they are for or against. Obviously, there should be limits.

noosphr 1y ago

If you need an id to buy porn irl why wouldn't you need one to buy it online?

breadwinner 1y ago
Because 'online' is the entire planet, including sellers in foreign countries. Would you like to have "digital borders" between countries, where data has to show some sort of passport to cross the border?
- noosphr 1y ago
  Again, if I want to import pron from Japan I need to not only prove I'm 18 to the border censors but make sure the pron is legal locally. Plenty of people have been arrested for importing things legal in Japan that are illegal in the West. Plenty of countries have laws on the books that make it a felony to even look at what's on the average Japanese store bookshelf while you're in Japan. Why should the laws be different just because you're moving electrons instead of atoms?
  - int_19h 1y ago
    They shouldn't, of course. Those existing regulations that you're referencing are equally bad for all the same reasons, and we should get rid of them.
- delusional 1y ago
  I mean if the alternative is complete lawlessness, then I suppose I do want digital borders. AMA.
  - dangraper2 1y ago
    Challenge accepted
  - dangraper2 1y ago
    How old are you?

38 1y ago

VPN.

Tadpole9181 1y ago
Oh, don't you worry, they'll come after VPNs next. After all, this makes them accomplices to felony acts.
- deleted 1y ago
  [deleted]
- 38 1y ago
  laughs in residential proxy

phendrenad2 1y ago

> Why would anyone trust some random blog with their ID? They won't have to, most websites will use 3rd party age verification. This is basically what Doordash and Uber Eats use to verify your age before delivering alcohol or THC to your apartment. Rife for abuse? Absolutely. Will these databases get leaked and increase the chances of your identity getting stolen? Yes. But isn't a small increase to an already-existing problem.

sethammons 1y ago
Those drivers check my ID at the door.
- phendrenad2 1y ago
  You didn't have to provide your ID when you enabled alcohol delivery? That's how it works in California, at least.
  - sethammons 1y ago
    I have never interacted with the app. I just show ID if those are in the order and I am the one answering the door.
    - phendrenad2 1y ago
      Ah I see, thanks for clarifying that your response was uninformed.
      - sethammons 1y ago
        I don't understand your seemingly petty and demeaning retort. What makes me uninformed? It sounds like you were the one who was unfamiliar with the ability to interact with door dash with an ID and not having to upload it. I have accepted door dash as a non-door dash customer. They check for ID. Just like the store.

drak0n1c 1y ago

Thinking about client vs server, wouldn't it be even less wide-ranging, less costly to enforce, and more appropriately targeted if such mandates are one-time and on the client side - only on device manufacturers and OEM-shipped OS? Suppose new mass market devices are defaulted to parental controls on, until unlocked by an adult at point-of-sale or afterwards through a form of validation? The KYC of who unlocked it could be anonymized or the PII-proving side of the log if it needs keeping could be on-device only (high bar for criminal investigations). There should be a clear exemption threshold for low volume indie products, build your own PC, and open source self-install like Linux - since the purpose is to protect ignorant/apathetic consumers.

anondude24 1y ago
Are you ok with all devices considering the user hostile and coming with heavy encryption and locked bootloaders? > There should be a clear exemption threshold for low volume indie products, build your own PC, and open source self-install like Linux - since the purpose is to protect ignorant/apathetic consumers. Then everyone will just follow a YouTube tutorial to reinstall their operating system and bypass restrictions. There were TikTok videos teaching kids how to steal cars, would there not be easy to follow instructions to bypass whatever client side filtering is implemented? I get where you're coming from, but mandated client side filtering has been tried and has been ridiculed as a complete failure every time. Attempts have been made to market and provide filtering products to parents with little effect, with them either being easy to bypass or difficult to use. It's actually kind of interesting to see the people who were fighting against client side filtering are now advocating for it, because server side restrictions are the next logical step.
- al_borland 1y ago
  This would actually be an effective way to teach kids about technology. If they learn enough to install their own OS, let them have their smut. I’m hearing more and more how younger generations don’t have what people used to call basic computer skills, because everything just kind of works now. Putting up some road blocks that require research and hands on tinkering to solve, is an invaluable part of the learning process.

raincole 1y ago

> Parents are expecting the government, and random websites, to raise their kids. I mean, they are. But I've never seen a similar reaction on HN or any forum when social media require age verification. Actually, I think most HN users would cheer if the government required Facebook to only allow users over 18. I feel the general opinion about something on the internet basically comes down to this simple rule: !(do American Christians want that thing?), no matter what that thing is.

sigwinch 1y ago
This would apply to Facebook just as any other site, and that’s obvious to the HN crowd. It’s the ambulance chaser section of the article that explains the problem. American Christians can and should rely on content blockers rather than lawsuits.
- SauciestGNU 1y ago
  I think American Christians should do neither. Restricting a child's access to information in order to indoctrinate them into a set of beliefs unquestioningly is a form of child abuse. Various forms of psychological and physical abuse are extremely prevalent in American Christian parenting practices, and it's something as a society we should not tolerate.
  - olddustytrail 1y ago
    Exposing children to propaganda that they are ill equipped to deal with is also child abuse. Just because someone can argue better than you can does not mean they are right. Climate change deniers can be very convincing if you don't understand physics.
    - deleted 1y ago
      [deleted]

leptons 1y ago

These are Authoritarian Christo-fascists. They do not care. They will demonize everyone involved in anything related to online sex. They are coming for the sex workers, and all of porn too - they stated they would do this in "Project 2025". "Think of the children" is how they justify it.

tw04 1y ago

The irony here being that the same people who want this are the ones screaming from the rooftops about the government indoctrinating their kids. *Also, I can’t wait for the first lawsuit over a breastfeeding page, because you know it’s coming.

yieldcrv 1y ago

yeah my thoughts are that this is largely a User Experience problem than an onerous liability problem The blog owner doesn't need to implement an ID check, the browser or OS just needs to tap into a service that has checked ID

486sx33 1y ago

[dead]

bastawhiz 1y ago

> there needs to be a way to authenticate as over 18 No there doesn't. Why is the burden on ME (as a site owner) to do literally anything at all? The burden should be on parents to control their childrens' Internet use. Install a robust content blocker or don't give them Internet access. Am I, a site owner, supposed to work with every asinine state and national system for making this attestation system work? How do I know the person behind the keyboard is actually the person whose age is being verified (and not one of their parents')? And as a citizen and consumer, why do I have to go out of my way to get some kind of digital identification that proves my age? Why does this have to stop at porn? The logical next step is that legislators and parents will demand that sites will block folks from accessing blasphemous content. Or that you need to prove that you're not a resident of a particular state in order to access medical facts about abortion (because if you're looking it up, you obviously intend to get one or help someone get one)? I don't want people to know how old I am or am not. Or where I live or don't live, or my sexual orientation, or anything else about me. I don't want to have to know any of these things about people who visit my website. And frankly, the idea that I am the one who is responsible for this and not the extreme minority of folks who want to keep certain content away from their kids or whatever is wild.

freejazz 1y ago

You can't show porn to kids in regular stores, I'm not sure why it's okay to do it on the internet, such that it becomes "raising" the kids when it's not in the first instance.

john01dav 1y ago

I'm concerned that such validation would need to be proprietary and locked down with some sort of user hostile TPM-like-thing in order to be effective. If this wasn't the case, then anyone could fork the foss tool and create a bypass. The average child won't do this, but a few will and some adults probably will over anti DRM principles and then it's published and widely available.

sigwinch 1y ago
These are ideological litigious fanatics among a much bigger herd of worried parents. They’ll attack any bypass tool and risk degrading the features of normal stuff like browsers and url parser libraries; totally ineffective at solving the problem but doing something in the eyes of unsophisticated constituents.

ndiddy 1y ago

The actual point of these laws isn't to stop minors from viewing the material, it's to stop sites from hosting the material entirely. They're using "protect the kids from obscene content" as a wedge to get popular support. Acting like some technical solution to make authenticating as an adult more user-friendly would make the politicians who want this implemented happy is disingenuous. Let's take a look at how Tennessee has legislated their ID check should be implemented: - ID must be verified either by matching a photo of the user to their photo ID, or by processing private transactional data (i.e. a credit card transaction). - The user must verify their ID at the start of the session, and every hour the session is active. - Historical anonymized ID verification data must be retained for at least 7 years. - Anyone running a site that's viewable in Tennessee without the above ID verification rules is committing a class C felony, regardless of what state they reside in or host their site in. This is clearly an attempt to stop any content they label as "obscene" (using a very broad definition of "obscenity") from being viewable at all in Tennessee. It's a completely unreasonable set of hoops to jump through that solely exists as a fig leaf because they know that making a law banning the content entirely would be ruled unconstitutional.

BobaFloutist 1y ago
7 years is crazy. I can't think of a single plausible justification for that that isn't dramaticallly expanding the purported scope of the law

skybrian 1y ago

By a similar argument, why should stores check id's when selling alcohol or cigarettes? Raising kids is not their job either. The answer is because we live in a society. Society is about families, not just adults. Sure, raising kids is primarily the job of the parents, but everyone helps. Sometimes that results in a bit of inconvenience for businesses. Excluding kids from businesses that are adult-only isn't very kid-friendly, but it's the bare minimum when there are children around.

sigwinch 1y ago
It’s not the material cigarettes or alcohol that are the problem, it’s lying to get them. Same is true for sins like gambling and explicit romance novels. The enforcement here is quite twisted: it attracts greedy litigants. Lying is bad, but greed is a mortal sin.
raincole 1y ago
And educating the kids should be, and always has been a collective effort. Even in pre-industrial societies it was true. In the modern world it should be doubly true. I think most people would agree that we need public schools, even though some of them disagree with how sex ed and evolution were taught there.
rocqua 1y ago
The issue is that currently, adding restrictions to what minors can do is expensive, both economically, and politically. It requires the cooperation of a lot of non-government appointed people, and many of them could (locally) sabotage the restrictions. This limits the restrictions to those with incredibly broad support. Keeping a lot of agency with families on how to raise their children. Digital age verification, if implemented well, is easy to enact, and hard to sabotage without being noticed. That enables restrictions that 49% of people disagree with. Heck, it enables restrictions that 49% of Congress disagrees with. That could be 60% of people disagreeing.
- skybrian 1y ago
  I don't think it's all that different, because nothing is foolproof. People will still circumvent age restrictions by sharing devices. (For example, borrowing a phone.)

deleted 1y ago

[deleted]

dcow 1y ago

> Parents are expecting the government, and random websites, to raise their kids. (1) Without addressing the general statement, specifically this isn't new. You’ve historically not been allowed to buy pornography or cigarettes or alcohol without age verification or watch obscene content between the nightly news runs. I don't see this specifically as parents wanting the government to raise their kids at all. It’s people without any other real options wanting to make it more difficult for inappropriate material to end up in the hands of minors. When I was 12 I remember getting online with AOL discs and having popups with porn appear in front of me as I’m playing neopets, because some unsavory ad got accidentally “clicked” many sessions ago. How can a parent “parent” that? > If these laws move forward (and I don’t think they should) (2) These laws already exist, the internet was a loophole. If it’s done right you verify your age when you make your account and the site doesn’t bug you again. Not sure how frequently you’re visiting new porn sites, but I can’t imagine getting over prompted would be a real problem. (3) There is a concept of using ZKPs to do more things client side. However I think currently people are more excited about selective disclosure. You just give the site a signed claim that you’re over 18 and that’s all they know. It’s more private than handing over your DL at the grocery store checkout. > People should also be able to set their browser/computer to auto-send this for single-user devices, where it is all transparent to the user. They should, shouldn’t they. But some privacy nut out there will say we can’t have nice things because an advertiser might use it to profile you. Really though one aspect of digital identity is presence and liveliness checking. The states that issue your ID to Apple Wallet are only willing to do so because Apple ensures that the user presence is verified at time of use. The question isn’t why should you have to jump through hoops, it’s why should we enforce age restrictions in person but not in the internet—why haven't you had to jump through all the existing hoops to watch internet porn until now?

sigwinch 1y ago
1) it doesn’t go as far back as you think. Only within my lifetime did the drinking age settle on 21. The Feds couldn’t do it directly, so they hacked highway funds. So that’s a bad example when porno has changed so much. What we’re risking here is parents who haven’t tried any solutions being convinced that litigation is the only way. 2+3. A simple cookie with a birth year ought to work. Why should every site worry about South Dakota’s definitions when checking a cookie seems reasonable effort. Circumvention of that is already fraud.

csomar 1y ago

> If these laws move forward (and I don’t think they should), there needs to be a way to authenticate as over 18 without sending picture of your ID off to random 3rd parties, or giving actual personal details. I don’t want to give this data, and websites shouldn’t want to shoulder the responsibility for it. Sure. A government issued certificate that is required to get an IP and be able to navigate the internet. How does that f-+-ing sound?

cowboylowrez 1y ago
>Sure. A government issued certificate that is required to get an IP and be able to navigate the internet. How does that f-+-ing sound? sounds like the solution to me. disallow under 18s from internet access. any parent who allows an underage to browse the internet unsupervised should be penalized to the same degree that they would if they directly provided hardcore pornography to the child, because thats exactly what it is. I personally would choose this route, handing kids fully internet enabled pornography consumption devices is beyond ridiculous, and the size factor of smartphones (take them everywhere, camera connected directly to encrypted chats with strangers) well the fact that the government even allows this is simply a matter of confusion to my small mind. What am I missing here? Why do we allow children internet access?

deleted 1y ago

[deleted]

kvgr 1y ago

Everybody will get a chip implant for 18th birthday. Solved ;)

amelius 1y ago

I think the majority of people on HN are well aware of this. The big question is how to transfer this simple idea to the people in charge at governments.

Eddy_Viscosity2 1y ago

But I bet that signal would still be a unique identifier. It doesn't have to be, but it will be because that is the point. Not to see who is old enough, but to track every page visit and interaction of everybody all the time.