10 ms·
Users claim Discord's age verification can be tricked with video game characters
- dylan604 1y agoIf it works for video game characters, why not just any random actor? There's going to be plenty of footage available of them in various positions to get around the can't use just one image "security" feature.
- ethan_smith 1y agoThe fundamental issue is that these verification models are trained on datasets containing fictional characters and celebrities, so they're essentially being asked to distinguish between inputs that were part of their own training distribution.
- dylan604 1y agoYet TFA shows the character used to beat the verification is a game character based on the likeness of an actor famous for the role he pays the game character is based. So you’re saying what, that the system isn’t aware it was trained on this person, the training isn’t looking that person is known to the training, or the system just doesn’t work as advertised?
- moritonal 1y agoThe fact another story on the front page is about a User Verification site having a massive leak is pretty relevant (https://news.ycombinator.com/item?id=44684373 https://news.ycombinator.com/item?id=44684373)
- jhgg 1y ago> government passes law that requires companies to age verify users > said government provides no way to actually verify a human's age > hilarity ensues
- brogufaw 1y agoIt’s intentional to give them wiggle room to define truth as needed case by case. Not saying it’s good or bad. Just that it’s intentional.
- Culonavirus 1y agoMy bank has an API endpoint that (basically) returns your name and age (in this use case). It can return more for signing electronic docs etc. and is basically your digital ID. https://en.wikipedia.org/wiki/BankID https://en.wikipedia.org/wiki/BankID Need to buy "toys", vape products, alcohol... anything adult online? There's a 3rd party web app (you rightfully don't trust) as an age check in the shopping cart / user account of any of these adult shops, and this has multiple ways of verifying your age - and one of them is the bank's api, you pick it, your bank's identity sharing page loads, you log in, it shows exactly what information will be shared in a bullet point list, you tap OK, immediately a request like "this app wants to know your age, please verify" pops up in your smart banking app on your phone, you tap ok, fingerprint scan, DONE. Problem solved. The 3rd party app knows just what it needs to. All of this takes maybe a minute and your personal info is perfectly safe (unless you don't trust your bank at which point you have bigger problems to worry about...)
- cronin101 1y agoAs a Brit that relocated to Norway a decade ago, trust me when I say you cannot fathom the lack of organization around identity that the UK (somewhat intentionally) has. (It’s constantly used for political Godwin’s-law fear-mongering) There is no centralized ID number, the closest is your social security number but this is basically only outbound for PAYE tax and haphazardly correlated to your pension payments in late life. Everything operates on a “trust system” where you often present paper (!) with whatever address you claim to be living at as proof you are real (e.g. opening bank accounts). Passport loss is rectified by seeking out “professionals” with government-approved occupations that are not related to you that can vouch you are actually the person you are trying to replace a passport for. The entire thing is a mess and living in digital-identity-native Europe is a dream come true that you should be extremely thankful for.
- hhh 1y agoI think the way discords setup works is reasonable. It’s an on-device model that only submits the outcome of the scan to the platform. I hope they just improve that performance, rather than see this and back out of it entirely and require ID checks.
- edm0nd 1y agoI think this is the correct way too. Some of the age verification systems that use digital ids (mDLs) do the same thing but people freak out about how they work because I think they misunderstand the tech. They system basically asks the mDL via an api call "is this user above the age of 18/21" and the app only responds with a yes or no. It doesn't pass the users fulls details over or anything like that.
- MattPalmer1086 1y agoDo these systems prevent linkability or allow the use of pseudonyms? As in, if I repeatedly ask for age verification to the same service, does it know: 1) the identity of the user making the request, and 2) whether repeated requests comes from the same user (even if they don't know who it is?)
- ndriscoll 1y agoMy non-expert understanding is that in the short term mDL is linkable to a cert serial, but those are supposed to be regularly rotated. So you might have 2) for a day or whatever the rotation period is. I think I've seen it asserted that it is possible to have a ZKP framework that doesn't require this, but I don't know how that might work. The age verification bills in the US at least also make it illegal to record that information, sometimes with high penalties (e.g. my reading of Texas's is that it is up to $10k per retained record).
- MattPalmer1086 1y agoThanks. Didn't know it was illegal to record it in the US - or does that vary by State? There's a bunch of ways to achieve this privately. The work of Jan Camenisch on Anonymous Credentials and other things was done quite a long time ago now. It's a well studied field.
- codedokode 1y agoAge verification should be made on OS or firmware level when buying a device. And not by sending your passport scan to random companies with dubious data collection practices. A law must mandate that an "adult" version of OS (or device) may be sold only to adult users. It is not difficult for Microsoft/Apple to implement this yet they do not want to for some reason. This would allow more reliable age verification, without revealing identity of account owners. Well, maybe the govt wants exactly the opposite.
- herbst 1y agoI can tell how this would be implemented. Microsoft rolls their own awkward standard nobody asked for. Other major companies try to use a somewhat common standard. The Industrie enforces new rules and suddenly it costs $150000 and has awkward requirements to get your OS certified adult. For the years to come only the most recent windows versions and customer devices like phones will work. No Linux will pay to get a standard they haven't asked for. Embed devices will stop working as more and more stuff gets simply flagged "adult only" Just don't ... :) Edit:// see Silverlight, or why it took years until something like Netflix was even legally technically possible
- valenterry 1y agoListen to that guy!
- immibis 1y agoI think they'll just send X-Is-Over18: Yes. Nobody actually cares about this issue enough to invest money in it - just enough to get certain stupid politicians off their backs. There will be third party browsers that always send the header, and they'll be banned from the app store upon discovery, and if they get famous enough their creators will be sent to jail, just like Tornado Cash.
- codedokode 1y agoThis should work the other way: a website must send a header that the content in the response is safe for those under 18. If there is no header, the browser doesn't display the page. It is easy to implement and there is no need to change existing websites for this.
- can16358p 1y agoAm I the only one who sees website appear for a split second and become completely blank white? (iOS Safari) Okay turning off content blockers did the trick. AdGuard was blocking the whole site for some reason.
- jimbobthemighty 1y agoNo - on a chromebook as well
- inquirerGeneral 1y ago[dead]
- nottorp 1y agoThe one good thing about the stupid age verification is it stimulates thinking outside the box in kids :)
- IshKebab 1y agoNot really - only one kid has to think outside the box. They others just copy.
- avodonosov 1y agoWho can think submitting biometrics online is in user's interest?
- Yeul 1y ago[flagged]
- userbinator 1y agoIronic that this comes at a time when AI-generated pictures are getting better and better. Personally, I will never use Discord and they just gave me another reason not to.
- silisili 1y agoMaybe I'm old. Well, no, I am relatively old. Either way, when I see a person or business advertise a Discord link, I immediately think of either as immature. I miss the days of forums, and wish something like them could thrive again instead of rather private, but importantly ephemeral chats.
- ekianjo 1y agoits seems even more self defeating when its a FOSS project whose only way to connect with the community is a Discord space.
- michaelt 1y ago> I miss the days of forums, and wish something like them could thrive again instead of rather private, but importantly ephemeral chats. Open source projects have long had ephemeral chats, private to the people in the chat at that moment - it just used to be called IRC.
- pmg101 1y ago[flagged]
- W3zzy 1y agoThe banning guns is easier when you control the sales part. Preventing children from accessing certain websites is not working at all. It also is a cop out. I have children aged 15 and 17. They received their forest smartphone at age 12. The phones were restricted in a certain way and they didn't get unlimited use. We educated them about proper use and at age 15 restrictions were lifted. They allready know how to use VPN's because they're on my paid account. I see it no different from sexual education. I don't need a government to make a private company collecting my personal identification. The best guardrail against data loss is not collecting any.
- DecoySalamander 1y agoThe idea that some countries have managed to block children from accessing adult content is laughable. But are there countries that have banned guns? A quick Wikipedia check shows that, in 2025, more people were killed in school shootings in Europe than in the U.S.
- tmtvl 1y agoWhich is weird considering there have been over 10 times the amount of school shootings in the U.S. compared to Europe... including an incident where a gun went off in the backpack of a second grader at an elementary school. Europe: 4 shootings distributed across 4 countries - <https://en.wikipedia.org/wiki/List_of_school_shootings_in_Europe#2020s https://en.wikipedia.org/wiki/List_of_school_shootings_in_Eu...> U.S.: 41 shootings across 19 states - <https://en.wikipedia.org/wiki/List_of_school_shootings_in_the_United_States_(2000%E2%80%93present)#2025 https://en.wikipedia.org/wiki/List_of_school_shootings_in_th...>
- pacifika 1y agoSeveral articles say that Ofcom has said platforms must not host, share, or permit content encouraging the use of VPNs to bypass age checks, adding that parents should be aware of how VPNs can be used to bypass the Act.
- makerofthings 1y agoAll those parents that couldn’t use parental controls to limit what their children see in a browser are not suddenly going to start policing VPNs. This is terrible legislation wrapped in terrible advice.
- ndsipa_pomu 1y agoThat annoys me as the VPN isn't necessarily bypassing the age check, but instead is allowing the person to pretend that they don't live in a country with stupid laws. I mean, Ofcom might as well warn parents about cheap holiday websites that encourage people to bypass the age checks by flying to a sane country.
- immibis 1y agoYes? I expect that "take a weekend to France to bypass age verification" and "subscribe to NordVPN to bypass age verification" are both legal while "take a weekend to France to see the Eiffel tower" and "use NordVPN to increase your security" are both legal. Did you never wonder why VPN ads don't really list any actual use cases, yet they're wildly popular? If you know what you need it for, the ad doesn't have to tell you - just has to tell you which company to give your money to.
- mgaunard 1y agoI've seen formerly free content platforms now require a payment of 2 GBP to prove your age. Ridiculous.
- johnisgood 1y agoPocket change. :D And yeah, absurd.
- Palmik 1y agoBased on my possibly biased data, most (90%) of UK users prefer to pay with debit card rather than credit card and that isn't good enough as a proof of adulthood.
- 2OEH8eoCRo0 1y agoSomething that's occurred to me is that we are already deanonymized and tracked everywhere online but most people are fine with it because it's done secretly and transparently (you don't notice). Age verification w/ something like a license online brings the issue front and center. It's not hidden that you are not anonymous online and people freak out.
- phendrenad2 1y agoThere's a lot of hype around age verification by letting AI look at the user's face. But everyone has met someone who was 28 and looked 16, or vice versa. It's not exactly uncommon. A few genes go wrong and you get some weird facial features that throws off our perception of age. Guess what? Our brains are just neural nets trained on data. So AI will fail in exactly the same way.
- isoprophlex 1y ago"Open your mouth to verify your age" Not that different from "Drink a verification can to continue". Hilariously dystopian.
- beeflet 1y agoThe best part is that this is going to work for about 5 days until someone develops a computer model of a face that can simulate the inside of the mouth. Then we have two problems!
- marcosdumay 1y agoOh, very soon only computers will be able to generate "realistic" enough images. Just like solving captchas.
- ReflectedImage 1y ago"Very soon" is last year in this case
- ReflectedImage 1y agoThat already exists: https://huggingface.co/spaces/fffiloni/expression-editor https://huggingface.co/spaces/fffiloni/expression-editor
- zahlman 1y agoPart of the point of the "verification can" story is that users were being forced into additional consumption (in multiple senses).
- zahlman 1y agoI can't recall ever being asked by Discord for any kind of age verification. Can't people get around this by just claiming to live somewhere other than the UK?