11 ms·

The internet wants to check your ID

125 points by jbegley 1y ago

righthand 1y ago
All of this so people can pretend to live in another community instead of the one they physically reside in. For the actual issue, Tea would be better suited with a web of trust system rather than forcing identification audits. If a woman is inviting male accounts then a web of trust would allow the service to shutdown anyone invited from the bad account (similar Lobste.rs bans).
meowkit 1y ago
And we should be pushing for ZKP verifiable identification. https://blog.google/technology/safety-security/opening-up-zero-knowledge-proof-technology-to-promote-privacy-in-age-assurance/ https://blog.google/technology/safety-security/opening-up-ze...
- nemomarx 1y ago
  I'd prefer zkp if we're doing this at all, but I think you could go simpler still. Google is skipping it for accounts with an associated credit card, that would work in lots of sites really
- easterncalculus 1y ago
  The problem with ZKPs, especially for age verification in the US, is that it you obviously still need some digital identity to perform the proof against. That not only doesn't exist in the US, but introduces a sensitive identity that like any other can be leaked. The same is true for cryptocurrency of course but that risk is implicit in holding a private key to spend in the first place.
  - cmdli 1y ago
    If there is no provable link between the service and the identity, however, there isn't that much harm in the leak itself. It just becomes a list of names and ages which are a dime a dozen on the internet. Hell, if the identity service was the government itself then it would be entirely useless outside of getting a list of people who have a driver's license (is this public info already?)
    - wmf 1y ago
      In the Google and Apple systems you have to load your driver's license and all its contents and then your phone issues a proof of age. However a bug could leak the entire contents.
- pr337h4m 1y ago
  In this case, compromise is equivalent to surrender
- mindslight 1y ago
  No, we most certainly should not! Zero knowledge proofs are not some magic privacy faerie dust that can be sprinkled around to provide any desired security property. For this use ZKPs are trivially proxyable, and thus this type of system also requires additional security properties from treacherous computing [0] - specifically remote attestation which prevents your ability to run code of your choosing on your own device. And Google (et al) are quite eager to supply this type of environment ("Safety" Net, WEI, etc). This is exactly why the new UK system requires the use of a locked down corpo-controlled phone, and why corpos are pushing this idea that there is a "secure" way this can be done. Essentially they are advertising the cool privacy-preserving half of the system, without mentioning the necessary other half that destroys privacy and freedom. [0] "trusted" computing in corpo speak. In other words, a crippled model of computing that the corpos can trust us to have.
  - nullc 1y ago
    I don't follow your agument. Yes, you could use someone elses ID to access the porn. That someone else could also sit next to you and press the button. There is no solution that isn't 'proxyable' with the aid of the approved party. No solutions being considered are even particularly resistant to borrowing someone's ID or credit card, etc.. ZKP are no worse in this respect. Adding treacherous computing doesn't improve any of them other than "approved software says its okay" is just a cheap (and fairly insecure!) way of implementing looksalike functionality to an actual cryptographic technique.
    - mindslight 1y ago
      It's the old dynamic when customary things are made into digital systems, those digital sytems need to be perfect because exploiting the flaws is also made extremely efficient. Someone else sitting next to you follows meatspace rules. They need to know a minor, be trusted enough to be reasonably left alone with said minor, and they will also be aware of possible legal consequences for facilitating a minor's access to porn. Society has been dealing with this for quite a long time. This extends to directly using someone else's ID from behind a keyboard - whether they trust you (above scenario), or you've got remote access to their system (rare), or it's the type of ID that is copyable from data leaks (revokable, I guess). The barrier is still pretty high. Whereas if parties are able to run any software of their choosing, the ZKP approach allows anybody on the Internet to decide to "help out" with minors viewing porn. Either for some ideological cause (which might not even be about helping 17 year olds access porn, but rather just about privacy with distrust of fancy crypto), or simply for money or other things of value. The basic promised properties of the ZKP approach are that that the ID provider won't know what sites you're going to, and that sites won't be able to get your identity, right? The first one removes the downside to an individual creating extra credentials for others - they must just like porn sites more than the average person. And the second one makes it so abuse of issued proofs can't be traced back to the person granting use of their ID. So in real world usage, something has to give about this situation. With the way the computing landscape is setup, that something is likely to be focusing on the ability to split the client into two parts being run by different parties. There are alternative responses, of course - one would be to gradually walk back the security provided by the ZKP, spilling more and more information to the site. But treacherous computing (aka computational disenfranchisement) seems to be what people used to customary meatspace systems reflexively reach for when confronted with the frustrating realities of clients having computational freedom. And as I pointed out, the UK system is already demanding treacherous computing, and Google has already been pushing it for their own purposes.
anonfordays 1y ago
The internet will interpret ID checks as damage and route around it.
- betaby 1y ago
  How? Please explain in technical details.
  - vorpalhex 1y ago
    Other sites that don't oblige the rules will come up and gain traffic. If those sites gain ire from the UK then they will migrate or be replaced. See OnlyFans et al where the alternatives have slowly been taking over as OnlyFans is forced to become ever more restrictive. Technically multiple tools are available from poor IP blocking that technically meets the requirement (eg malicious compliance) to tools like ohttp where the origin is unaware of the customers location and can claim genuine surprise. This is basically a repeat of the UK PirateRadio. Either there's about to be a PornBBC (heh) or users and sites will migrate around ofcom.
    - TimorousBestie 1y ago
      > PornBBC Well, that’s absolutely begging for some domain squatting.
  - rolph 1y ago
    the internet is not your browser, or the WWW. the internet is a connectivity resource that is simply about exchanging data. those who can work beyond the web browser have thier options, let the web fail is one of them. The web can be worked around in much the same way it is now, but advancing tech for peer to peer hosting of localized blogs/sites, whiteboards, and indexes of like peers, strong development of IP8 like protocols, is an other.
    - betaby 1y ago
      I don't buy that. History shows that's not happening. We have fewer independent sites now than we had 20 years ago. Developed countries like UK factually criminalized running forums. 'the internet is a connectivity resource' is less and less true given that sites getting blocked by DPI, DNS and on raw L3 IP addresses by countries like Spain, Italy and many other.
stego-tech 1y ago
I’ll say it again: the fact an adult has to sign up and pay for internet service and devices that can access those services should be all the age verification needed, full stop. If parents don’t want kids getting into mischief online, then they need to restrict device and network access appropriately. The internet was never intended for children, and we need to stop placing the onus on other adults to police themselves instead of on parents to police their children.
- FirmwareBurner 1y ago
  It was never about "protecting the children", that's just the glazing they wrap internet censorship in so citizens would swallow it. Case in point, the same UK politicians who try to burry the Muslim grooming gangs story where kids got harmed, are now suddenly the ones pushing for Internet ID to "protect the children". If they cared so much about the children, why didn't they go after the grooming gangs immediately, instead of trying to hide it. What they want is internet censorship, to take away the internet freedom of assembly, the ability to control and ban any criticism from the public targeting politicians and the elite the same way they do to mainstream media. No more people taking about political scandals, corruption, illegal immigration, sex scandals, Epstein list, Ukraine, Gaza, law enforcement abuse, mass shootings, etc, they don't give a damn about the kids.
  - stego-tech 1y ago
    I’m aware, but I go right back to the substance of the original conceit instead of letting myself get dragged into the details; that’s how you get these ghouls accusing you of being a pedophile or claiming you want to show children pornography in the classroom. You gotta attack the root argument: this space was never intended for children, and it is the sole responsibility of parents to protect their children in adults-only spaces like the internet.
    - crinkly 1y ago
      Eh use their own hammer against them. Calling someone a pedophile is libel in the UK. Sue them!
FirmwareBurner 1y ago
It's not "the Internet" who wants to check your ID, it's politicians who want to, since the internet is the new place where citizens are exercising their freedom of assembly rights and that frightens politicians. Life would be so much easier for Trump if people stopped pestering him online about that bloody Epstein list, or if EU citizens would stop pestering their politicians about the crimes of illegal immigrants. They want to control your speech using the daily boogieman flavor: terrorists, protecting the kids, Russian trolls, etc
- trinix912 1y ago
  Exactly. As always, the debate gets fixated on the “think about the kids!” part instead of looking behind the curtain. It’s then impossible to make a sound counterargument (in the eye of the non-technical majority), as you’re easily dismissed for “supporting the horrors”.
- izzydata 1y ago
  It would be ironic if they limit free speech online to such a point that people start exercising their freedoms in person.
  - FirmwareBurner 1y ago
    They want you to do it in person because there they can: 1. brand protestors as radicals and arrest them, serving as a public warning to deter others. 2. police(outside the US) have a major force advantage over unarmed population and can easily overpower you, whereas online they do not have any kind of power without censorship, which is why they're trying to gain control over it
- golemiprague 1y ago
  [dead]
WhereIsTheTruth 1y ago
Can we go back to when the same people kept spitting "social credit, china bad" narrative Tasteless rulers
- jajuuka 1y ago
  We're supposed to be copying the good parts of other countries, not the bad ones. It's definitely mind blowing seeing the pivot from "great firewall of China, they don't have access to open information and that's why we're better." to "we need a great firewall too" in such a short amount of time.
- knallfrosch 1y ago
  I haven't heard much criticism of China's "kids are only allowed 1 hour of screen time" rule, though :)
  - Velocifyer 1y ago
    Run TTS on the following: Kids should get more than 1 hour of screen time if they want it
mathiaspoint 1y ago
I'm just going to bounce if you ask for ID and if I can't find a forum I like I'll get a foreign VPS and host it myself. The only way around that is to kill the internet, good luck recreating North Korea's intranet as a replacement.
ryandv 1y ago
The web is ripe for disruption. Decades of historical baggage, technical cruft, and now a new set of encumbrances in the form of aggressive state surveillance under the moniker of "regulation;" it's strange to me that there are no movements in this space to replace an aging and decrepit web that has grown increasingly user hostile.
- whall6 1y ago
  should be pretty easy to do once starlink has full global coverage... could easily circumvent ISPs
  - FirmwareBurner 1y ago
    Starlink isn't above government laws the same way how Youtbe, Apple, Google, Facebook and your ISP aren't. If the EU/UK/Australian governments say 'jump', these companies will say 'how high' or face criminal charges. They aren't gonna die on a hill and go to jail to protect your anonymity and privacy when the armed law enforcement show up at their offices with subpoenas. Their business and freedom is more important than your privacy. You need to talk to push for change in your democratic government, not try to find technical workarounds around government tyranny while going on with your day as if what your government is doing is normal.
  - riffic 1y ago
    Starlink itself is an ISP. so you're going to circumvent an ISP - with an ISP?
    - whall6 1y ago
      sure, why not? I'm not saying that I personally could, but the entire network of starlink satellites is owned by one person. Interesting to think about the possibilities at the very least
- ActorNightly 1y ago
  A lot of the tech "movements" that are all about disruption have leaned heavily conservative in the past decade, and its the conservatives that are implementing these rules. There was some merit to being anti-establishment in the past under Democratic leadership because for sure there were issues, but thinking that the conservative party is the way out because they are all about personal liberty and freedom, when in reality they are the complete opposite, is why you don't see the same amount of effort being put into this now.
arcumaereum 1y ago
https://archive.ph/yBbYn https://archive.ph/yBbYn
Zealotux 1y ago
Is there any serious investigation or a good article that explain how these ID check laws got simultaneously rolled out in the UK, EU and Australia? As well as the main payment processors heavily restricting adult content? It seems like there are remarkably powerful groups pushing for these things, or maybe it really is just happenstance.
- donmcronald 1y ago
  Canada too. It’s corporate interests that want a government mandated customer base with a legal requirement to participate. Get ready for verified id on everything, and to pay for it via taxes.
  - trinix912 1y ago
    An additional consequence is it’s going to be significantly harder to set up an alternative social media site, as you’ll have to play by these rules which might end up favoring a certain provider’s implementation, or delegating the government the ability to shut down your site on a whim (even if through a court). This, I think, is way more concerning than having to ID your account on Meta.
  - pmontra 1y ago
    Next step: mandate that every web site verifies the identity of its users, no matter the content, whether users register or not. Goodbye old style personal static sites and blogs. Everyone forced to join a content silo or serve no content.
    - pixxel 1y ago
      [dead]
- chamomeal 1y ago
  Yeah I’m wondering the same thing. I feel like this came out of nowhere, all at once. Before this I was only aware of a few instances of ID checks, like Utah and pornhub, or something? Now laws are getting passed all over the place. Is this something that people really want? I guess I’m just out of loop?
advisedwang 1y ago
Far better to promote device controls than service ID checks. * It allows parents to decide what age to allow kiddo to see certain content, not the state. * It allows others to restrict content too. E.g. a gambling addict who doesn't want to see gambling content. * It has no risk of leaks etc for adults. I'd like to see laws mandating that service provides respect a new content restriction header or something like that.
- trinix912 1y ago
  But wouldn’t that be too easy to counterfeit? Or if it were handled by a special government-approved piece of software that’s then just DRM all over again.
  - stebalien 1y ago
    Counterfeit what? This is about labeling and filtering: the device doesn't present an ID, the device prevents the user from accessing content with/without specific labels if so configured. Specifically, governments mandate that: 1. Websites/apps/etc. MAY label content (via headers) indicating when their content/service is/isn't appropriate for some specific audience (e.g., children) according to X/Y/Z regulations. Websites/apps/etc. MUST NOT incorrectly label their content. 2. Devices that can access the internet must not be sold directly to miners without parental consent. 3. Devices that can access the internet must include parental control software can be configured to allow/forbid all apps/content that may contain content not deemed suitable for children (in the jurisdiction where the device is sold). Importantly, this kind of solution solves the "borderless internet" problem: 1. Device sellers are regulated in the jurisdiction where they sell the device. 2. Service providers take no (additional) per-jusrisdiction responsibility until they start labeling their content. By labeling their content, they are claiming to abide by specific regulations.
    - WarOnPrivacy 1y ago
      > governments mandate that ... Websites/apps/etc. MAY label content (via headers) indicating when their content/service is/isn't appropriate Which government? This list of pornographic film studios indicates they reside in many countries. https://en.wikipedia.org/wiki/List_of_pornographic_film_studios https://en.wikipedia.org/wiki/List_of_pornographic_film_stud... Past that, the USA alone has thousands of governments. Many have opinions.
general1726 1y ago
I wonder when there will be first Generate ID as a Service (GIDaaS). I would expect something like choose state, ID type, pay 10USD in crypto and now I am Joaquim van Ender from Netherlands. Of course, this will get combated by governments letting tech companies to query IDs against their databases, which inevitably will leak the IDs which will then make this exercise pointless.
- Jommi 1y ago
  yup
- knallfrosch 1y ago
  In Germany, the age verification could happen using the national ID. How do you imagine faking this?
  - general1726 1y ago
    If there won't be a callback into governmental database, you can make stuff up as you go with something what resembles correct ID. If there will be callback into gov database, you can just query it and mine valid IDs using gov database as an oracle.
    - zgk7iqea 1y ago
      German IDs have cryptographic keys in their chips that make them theoretically unfakeable, so no
      - general1726 1y ago
        Which works only if you have card reader. If you are making a photo for internet service, then how do you read the chip?
        zgk7iqea 1y ago
        phone, the app already exists https://www.ausweisapp.bund.de/ https://www.ausweisapp.bund.de/ a lot of people still scan their id but theoretically fraud prevention is possible
neko_ranger 1y ago
Lots of discussion on this and not much comparison to another democratic country (South Korea) that already implement this type of control. Account creation for non-critical services (games, etc) requires a SSN type equivalent during signup, so they very clearly know who is associated with the account. They also implement child specific locks, such as limiting the duration kids can play a game, and for only specific hours (not during night time).
nerdjon 1y ago
Slightly bothered that it seems like the article is conflating an app/website choosing to implement some form of verification vs a law requiring it. I think that if a website or app wants to make this choice, they should be allowed too. Obviously we should expect that they have proper security, and we should make the choice on if we want to take that risk. But I think it is a perfectly valid choice by the developer, and users can choose whether or not they think it is worth it or use a competitor that doesn't (or a competitor is created that doesn't). But the issue of laws requiring it I think is where things have gone too far. So much of this is being framed as "protect the children" but most of it really seems to be fueled from a puritanical "porn is bad" and needing to make it harder to get access too for adults. I really wish we could move past this as a society, stop vilifying it, being ashamed of sex, etc. And likely throw in some tracking of what people are doing online since now you no longer have the anonymity. Edit: If you really truly are trying to "protect the children"... Maybe educate them instead of hiding things from them.
docdeek 1y ago
I know it is not the same as ‘prove who you are to surf’ but when I open the page and am greeted with a note that explains that, in exchange for reading the article, The New Yorker will share my personal information with 219 different partners, you sort of wonder where the anonymity they are so worried about has gone. >> "We, and our 219 partners use cookies and similar methods to recognize visitors and remember their preferences. We may also use these technologies to gauge the effectiveness of advertising campaigns, target advertisements, and analyze website traffic. Some of these technologies are essential for ensuring the proper functioning of the service or website and cannot be disabled, while others are optional but serve to enhance the user experience in various ways. We, in collaboration with our partners, store and/or access information on a user's device, including but not limited to IP addresses, unique identifiers, and browsing data stored in cookies, in order to process personal data."
- xethos 1y ago
  The writers and editors understand that privacy is central to their lifestyle and work - few sources will allow exclusively on-the-record interviews. The accountants that pay the writers and editors believe that, to make the math work of "Cheap enough that a viable number of subscribers will pay", the subscription must be ad-subsidized. These are two seperate groups, and lumping them in to call them both hypocritical is lazy in thought, or ignorant in recognizing that the New Yorker is more than one person. Yes, change should start at the paper running the story. The fact they haven't yet convinced all their subscribers or accountants, and ~~possibly not even~~ presumably the public at large, does not detract from their point. Edited, but struck-through instead of deleted
tiberius_p 1y ago
Will we have to share our ID when we connect to Tor too?
- wmf 1y ago
  I expect Tor will just be completely blocked in UK/EU/Australia.
  - radicaldreamer 1y ago
    That’ll come as part of a VPN ban…
thomassmith65 1y ago
The internet badly needs a standard system for people to verify their age*, identity**, etc but it's a terrible idea for that system not to be pseudonymous. * as in "I am over n years old", not "my exact birthday is nnnn-nn-nn" ** as in "I am a unique human you know as <uuid>", not "I am John Q Smith"
- delusional 1y ago
  What would you do with <UUID>? How would you verify that you are actually <UUID> or 18 years old?
  - Tadpole9181 1y ago
    Zero knowledge proofs from a provider who has your ID allows validation without data leaking. Though creates other issues with, i.e. selling validation tokens.
    - delusional 1y ago
      What I'm gathering from that description is a flow that would involve three parties: Me, the restricted resource, and an ID validator. When I wanted to access the restricted resource, they'd ask for a valid token that I would then go to my ID validator to get since they've already identified me, they'd then pass that valid token back to me which I could pass to the restricted resource. They'd presumably then save that token as proof that they did their legally required validation. Is that roughly correct? I think that's the model they're working on in the EU using Bitstring Status List, OpenID for Verifiable Presentations, and ISO 18013-5. If you want to know more there's a reference implementation: https://github.com/eu-digital-identity-wallet/eudi-doc-architecture-and-reference-framework https://github.com/eu-digital-identity-wallet/eudi-doc-archi...
      - Tadpole9181 1y ago
        Just about, yup! I don't know about your specific link there, but the "zero knowledge" part comes from the token sent to the provider being non-reversible. A token cannot be used to identify the person who generated the token, even by ID validator. This works because the token is just used as material in (simplified) a hash function.
jwr 1y ago
I find it sad that all these problems have solutions already (see for example https://sovrin.org https://sovrin.org). You do not need a full ID or exact birthday to perform a check for age. As usual, mental laziness means that complexity kills the acceptance of good solutions and instead we legislate privacy-invading garbage.
- 8organicbits 1y ago
  The link appears to be for a project that shutdown.
  - jwr 1y ago
    Yes — that was part of my point, actually. Insufficient adoption. If you read their documents, the concepts are there, quite valid, and the entire system is well designed. But these kinds of solutions are "too difficult" and require thinking.
thinkingemote 1y ago
It seems very coincidental but totally unnoticed by many that this is occurring during discussions about AI bot activity and how to control access. ID access is a human check fundamentally with an on the surface primary aim of age checking. To me its noteworthy that it seems that most of those who would agree that checking for human vs bot is a Good Thing are very opposed to checking for human vs human. It's advocating for the same tools, same machines, same algorithms. I like to try to find a metaphor (or is it a simile?): it's a little bit like building surveillance and spying tools for nation states and campaigning and protesting to spying by nation states on your own person. It could be like protesting against selling arms to armies while advocating for personal gun ownership.
honeybadger1 1y ago
A poor enforcement of such a goal(since it's led by government, this is just about a guarantee) will give birth to a new movement in technology to completely avoid it. I am ready for this.
ChrisArchitect 1y ago
Related: Ready or not, age verification is rolling out across the internet https://news.ycombinator.com/item?id=44781492 https://news.ycombinator.com/item?id=44781492
Almondsetat 1y ago
Does the platform host 18+ content? Yes ---> Require ID to view/register No ---> Can register without ID in a read-only mode. To interact with other people, "upgrade" account with ID verification Why is this so difficult to implement?
sharpshadow 1y ago
It’s really hard to imagine getting asked for an ID online and outside those mentioned countries not noticeable at all that something that fundamentally changed. It certainly affects the behaviour of the person if they showed their ID before and can easily be taken to responsibility. Would not even be surprised if they try to prosecute people who faked it to access online content.
tantalor 1y ago
The old way of using driver's license (or any ID) to verify age is the antipattern. We shouldn't replicate that in technological solutions. ID is for "who you are", which doesn't matter for the types of things we use for age checks (bars, etc.) There should be a way to verify your age without showing ID. Sure, ID can do that. It is sufficient, but it should not be necessary.
- DoneWithAllThat 1y ago
  How do you propose a system to be effective that proves you are over a particular age but also does not prove that you are you? In other words I don’t see a way to solve the problem of needing both proof of identity and proof of age to accomplish proof of age.
  - tantalor 1y ago
    You could give people a photo card that says "this person is over 18". It doesn't have any identifiable information like your name, address, or DOB. And you can't pass it if you don't match the photo.
  - nullc 1y ago
    With an anonymous credential. Imagine you have a private key whose public key is signed by a trusted issuer if and only if you're an adult. Now you use this to get an account. What if you share your private key? Well you can only have one account per key and it's otherwise the same as just obtaining the porn for the improper users yourself (which is always possible). Won't that ID just get linked between sites and used to track you? Yes. But you can use a somewhat more complicated version of this scheme where you can get access to a single unlinkable ID per site... so then you can't be tracked.
josefritzishere 1y ago
This is a hard no.
Jommi 1y ago
great time to build fine tuned open source passport and "alive" face generation models
contingencies 1y ago
Old news. It's kind of telling when the article is published on a paywalled site that was once a newspaper.
throwaway89201 1y ago
It seems enormously underreported that the European Parliament has already voted in favor of a law that mandates age verification for pornography with a one year prison sentence. It was included as a last minute amendment into this bill [1]. See "Amendment 186". The full accepted article reads: "Disseminating pornographic content online without putting in place robust and effective age verification tools to effectively prevent children from accessing pornographic content online shall be punishable by a maximum term of imprisonment of at least 1 year." It's not law yet, as the first reading is now sent back to the Council of the European Union, but I don't think it's very likely it will get a second reading. [1] https://www.europarl.europa.eu/doceo/document/TA-10-2025-0116_EN.html https://www.europarl.europa.eu/doceo/document/TA-10-2025-011...
TheAdamist 1y ago
The Internet doesn't want to check your id. The government wants to force your the Internet to check your id. In the least safe way possible. And as a convenient side effect dissuade people from using "morally objectionable" internet resources under fear of identity theft and doxxing.
johnnienaked 1y ago
Bit weird that the guy with the flagship AI company destroying the internet with bots is also the guy who wants you to scan your retina to prove you're human to use the internet. Nothing to see here though, I'm sure.

125 points by jbegley 1y ago

All of this so people can pretend to live in another community instead of the one they physically reside in. For the actual issue, Tea would be better suited with a web of trust system rather than forcing identification audits. If a woman is inviting male accounts then a web of trust would allow the service to shutdown anyone invited from the bad account (similar Lobste.rs bans).

meowkit 1y ago

And we should be pushing for ZKP verifiable identification. https://blog.google/technology/safety-security/opening-up-zero-knowledge-proof-technology-to-promote-privacy-in-age-assurance/ https://blog.google/technology/safety-security/opening-up-ze...

nemomarx 1y ago
I'd prefer zkp if we're doing this at all, but I think you could go simpler still. Google is skipping it for accounts with an associated credit card, that would work in lots of sites really
easterncalculus 1y ago
The problem with ZKPs, especially for age verification in the US, is that it you obviously still need some digital identity to perform the proof against. That not only doesn't exist in the US, but introduces a sensitive identity that like any other can be leaked. The same is true for cryptocurrency of course but that risk is implicit in holding a private key to spend in the first place.
- cmdli 1y ago
  If there is no provable link between the service and the identity, however, there isn't that much harm in the leak itself. It just becomes a list of names and ages which are a dime a dozen on the internet. Hell, if the identity service was the government itself then it would be entirely useless outside of getting a list of people who have a driver's license (is this public info already?)
  - wmf 1y ago
    In the Google and Apple systems you have to load your driver's license and all its contents and then your phone issues a proof of age. However a bug could leak the entire contents.
pr337h4m 1y ago
In this case, compromise is equivalent to surrender
mindslight 1y ago
No, we most certainly should not! Zero knowledge proofs are not some magic privacy faerie dust that can be sprinkled around to provide any desired security property. For this use ZKPs are trivially proxyable, and thus this type of system also requires additional security properties from treacherous computing [0] - specifically remote attestation which prevents your ability to run code of your choosing on your own device. And Google (et al) are quite eager to supply this type of environment ("Safety" Net, WEI, etc). This is exactly why the new UK system requires the use of a locked down corpo-controlled phone, and why corpos are pushing this idea that there is a "secure" way this can be done. Essentially they are advertising the cool privacy-preserving half of the system, without mentioning the necessary other half that destroys privacy and freedom. [0] "trusted" computing in corpo speak. In other words, a crippled model of computing that the corpos can trust us to have.
- nullc 1y ago
  I don't follow your agument. Yes, you could use someone elses ID to access the porn. That someone else could also sit next to you and press the button. There is no solution that isn't 'proxyable' with the aid of the approved party. No solutions being considered are even particularly resistant to borrowing someone's ID or credit card, etc.. ZKP are no worse in this respect. Adding treacherous computing doesn't improve any of them other than "approved software says its okay" is just a cheap (and fairly insecure!) way of implementing looksalike functionality to an actual cryptographic technique.
  - mindslight 1y ago
    It's the old dynamic when customary things are made into digital systems, those digital sytems need to be perfect because exploiting the flaws is also made extremely efficient. Someone else sitting next to you follows meatspace rules. They need to know a minor, be trusted enough to be reasonably left alone with said minor, and they will also be aware of possible legal consequences for facilitating a minor's access to porn. Society has been dealing with this for quite a long time. This extends to directly using someone else's ID from behind a keyboard - whether they trust you (above scenario), or you've got remote access to their system (rare), or it's the type of ID that is copyable from data leaks (revokable, I guess). The barrier is still pretty high. Whereas if parties are able to run any software of their choosing, the ZKP approach allows anybody on the Internet to decide to "help out" with minors viewing porn. Either for some ideological cause (which might not even be about helping 17 year olds access porn, but rather just about privacy with distrust of fancy crypto), or simply for money or other things of value. The basic promised properties of the ZKP approach are that that the ID provider won't know what sites you're going to, and that sites won't be able to get your identity, right? The first one removes the downside to an individual creating extra credentials for others - they must just like porn sites more than the average person. And the second one makes it so abuse of issued proofs can't be traced back to the person granting use of their ID. So in real world usage, something has to give about this situation. With the way the computing landscape is setup, that something is likely to be focusing on the ability to split the client into two parts being run by different parties. There are alternative responses, of course - one would be to gradually walk back the security provided by the ZKP, spilling more and more information to the site. But treacherous computing (aka computational disenfranchisement) seems to be what people used to customary meatspace systems reflexively reach for when confronted with the frustrating realities of clients having computational freedom. And as I pointed out, the UK system is already demanding treacherous computing, and Google has already been pushing it for their own purposes.

anonfordays 1y ago

The internet will interpret ID checks as damage and route around it.

betaby 1y ago
How? Please explain in technical details.
- vorpalhex 1y ago
  Other sites that don't oblige the rules will come up and gain traffic. If those sites gain ire from the UK then they will migrate or be replaced. See OnlyFans et al where the alternatives have slowly been taking over as OnlyFans is forced to become ever more restrictive. Technically multiple tools are available from poor IP blocking that technically meets the requirement (eg malicious compliance) to tools like ohttp where the origin is unaware of the customers location and can claim genuine surprise. This is basically a repeat of the UK PirateRadio. Either there's about to be a PornBBC (heh) or users and sites will migrate around ofcom.
  - TimorousBestie 1y ago
    > PornBBC Well, that’s absolutely begging for some domain squatting.
- rolph 1y ago
  the internet is not your browser, or the WWW. the internet is a connectivity resource that is simply about exchanging data. those who can work beyond the web browser have thier options, let the web fail is one of them. The web can be worked around in much the same way it is now, but advancing tech for peer to peer hosting of localized blogs/sites, whiteboards, and indexes of like peers, strong development of IP8 like protocols, is an other.
  - betaby 1y ago
    I don't buy that. History shows that's not happening. We have fewer independent sites now than we had 20 years ago. Developed countries like UK factually criminalized running forums. 'the internet is a connectivity resource' is less and less true given that sites getting blocked by DPI, DNS and on raw L3 IP addresses by countries like Spain, Italy and many other.

stego-tech 1y ago

I’ll say it again: the fact an adult has to sign up and pay for internet service and devices that can access those services should be all the age verification needed, full stop. If parents don’t want kids getting into mischief online, then they need to restrict device and network access appropriately. The internet was never intended for children, and we need to stop placing the onus on other adults to police themselves instead of on parents to police their children.

FirmwareBurner 1y ago
It was never about "protecting the children", that's just the glazing they wrap internet censorship in so citizens would swallow it. Case in point, the same UK politicians who try to burry the Muslim grooming gangs story where kids got harmed, are now suddenly the ones pushing for Internet ID to "protect the children". If they cared so much about the children, why didn't they go after the grooming gangs immediately, instead of trying to hide it. What they want is internet censorship, to take away the internet freedom of assembly, the ability to control and ban any criticism from the public targeting politicians and the elite the same way they do to mainstream media. No more people taking about political scandals, corruption, illegal immigration, sex scandals, Epstein list, Ukraine, Gaza, law enforcement abuse, mass shootings, etc, they don't give a damn about the kids.
- stego-tech 1y ago
  I’m aware, but I go right back to the substance of the original conceit instead of letting myself get dragged into the details; that’s how you get these ghouls accusing you of being a pedophile or claiming you want to show children pornography in the classroom. You gotta attack the root argument: this space was never intended for children, and it is the sole responsibility of parents to protect their children in adults-only spaces like the internet.
  - crinkly 1y ago
    Eh use their own hammer against them. Calling someone a pedophile is libel in the UK. Sue them!

FirmwareBurner 1y ago

It's not "the Internet" who wants to check your ID, it's politicians who want to, since the internet is the new place where citizens are exercising their freedom of assembly rights and that frightens politicians. Life would be so much easier for Trump if people stopped pestering him online about that bloody Epstein list, or if EU citizens would stop pestering their politicians about the crimes of illegal immigrants. They want to control your speech using the daily boogieman flavor: terrorists, protecting the kids, Russian trolls, etc

trinix912 1y ago
Exactly. As always, the debate gets fixated on the “think about the kids!” part instead of looking behind the curtain. It’s then impossible to make a sound counterargument (in the eye of the non-technical majority), as you’re easily dismissed for “supporting the horrors”.
izzydata 1y ago
It would be ironic if they limit free speech online to such a point that people start exercising their freedoms in person.
- FirmwareBurner 1y ago
  They want you to do it in person because there they can: 1. brand protestors as radicals and arrest them, serving as a public warning to deter others. 2. police(outside the US) have a major force advantage over unarmed population and can easily overpower you, whereas online they do not have any kind of power without censorship, which is why they're trying to gain control over it
golemiprague 1y ago
[dead]

WhereIsTheTruth 1y ago

Can we go back to when the same people kept spitting "social credit, china bad" narrative Tasteless rulers

jajuuka 1y ago
We're supposed to be copying the good parts of other countries, not the bad ones. It's definitely mind blowing seeing the pivot from "great firewall of China, they don't have access to open information and that's why we're better." to "we need a great firewall too" in such a short amount of time.
knallfrosch 1y ago
I haven't heard much criticism of China's "kids are only allowed 1 hour of screen time" rule, though :)
- Velocifyer 1y ago
  Run TTS on the following: Kids should get more than 1 hour of screen time if they want it

mathiaspoint 1y ago

I'm just going to bounce if you ask for ID and if I can't find a forum I like I'll get a foreign VPS and host it myself. The only way around that is to kill the internet, good luck recreating North Korea's intranet as a replacement.

ryandv 1y ago

The web is ripe for disruption. Decades of historical baggage, technical cruft, and now a new set of encumbrances in the form of aggressive state surveillance under the moniker of "regulation;" it's strange to me that there are no movements in this space to replace an aging and decrepit web that has grown increasingly user hostile.

whall6 1y ago
should be pretty easy to do once starlink has full global coverage... could easily circumvent ISPs
- FirmwareBurner 1y ago
  Starlink isn't above government laws the same way how Youtbe, Apple, Google, Facebook and your ISP aren't. If the EU/UK/Australian governments say 'jump', these companies will say 'how high' or face criminal charges. They aren't gonna die on a hill and go to jail to protect your anonymity and privacy when the armed law enforcement show up at their offices with subpoenas. Their business and freedom is more important than your privacy. You need to talk to push for change in your democratic government, not try to find technical workarounds around government tyranny while going on with your day as if what your government is doing is normal.
- riffic 1y ago
  Starlink itself is an ISP. so you're going to circumvent an ISP - with an ISP?
  - whall6 1y ago
    sure, why not? I'm not saying that I personally could, but the entire network of starlink satellites is owned by one person. Interesting to think about the possibilities at the very least
ActorNightly 1y ago
A lot of the tech "movements" that are all about disruption have leaned heavily conservative in the past decade, and its the conservatives that are implementing these rules. There was some merit to being anti-establishment in the past under Democratic leadership because for sure there were issues, but thinking that the conservative party is the way out because they are all about personal liberty and freedom, when in reality they are the complete opposite, is why you don't see the same amount of effort being put into this now.

arcumaereum 1y ago

https://archive.ph/yBbYn https://archive.ph/yBbYn

Zealotux 1y ago

Is there any serious investigation or a good article that explain how these ID check laws got simultaneously rolled out in the UK, EU and Australia? As well as the main payment processors heavily restricting adult content? It seems like there are remarkably powerful groups pushing for these things, or maybe it really is just happenstance.

donmcronald 1y ago
Canada too. It’s corporate interests that want a government mandated customer base with a legal requirement to participate. Get ready for verified id on everything, and to pay for it via taxes.
- trinix912 1y ago
  An additional consequence is it’s going to be significantly harder to set up an alternative social media site, as you’ll have to play by these rules which might end up favoring a certain provider’s implementation, or delegating the government the ability to shut down your site on a whim (even if through a court). This, I think, is way more concerning than having to ID your account on Meta.
- pmontra 1y ago
  Next step: mandate that every web site verifies the identity of its users, no matter the content, whether users register or not. Goodbye old style personal static sites and blogs. Everyone forced to join a content silo or serve no content.
  - pixxel 1y ago
    [dead]
chamomeal 1y ago
Yeah I’m wondering the same thing. I feel like this came out of nowhere, all at once. Before this I was only aware of a few instances of ID checks, like Utah and pornhub, or something? Now laws are getting passed all over the place. Is this something that people really want? I guess I’m just out of loop?

advisedwang 1y ago

Far better to promote device controls than service ID checks. * It allows parents to decide what age to allow kiddo to see certain content, not the state. * It allows others to restrict content too. E.g. a gambling addict who doesn't want to see gambling content. * It has no risk of leaks etc for adults. I'd like to see laws mandating that service provides respect a new content restriction header or something like that.

trinix912 1y ago
But wouldn’t that be too easy to counterfeit? Or if it were handled by a special government-approved piece of software that’s then just DRM all over again.
- stebalien 1y ago
  Counterfeit what? This is about labeling and filtering: the device doesn't present an ID, the device prevents the user from accessing content with/without specific labels if so configured. Specifically, governments mandate that: 1. Websites/apps/etc. MAY label content (via headers) indicating when their content/service is/isn't appropriate for some specific audience (e.g., children) according to X/Y/Z regulations. Websites/apps/etc. MUST NOT incorrectly label their content. 2. Devices that can access the internet must not be sold directly to miners without parental consent. 3. Devices that can access the internet must include parental control software can be configured to allow/forbid all apps/content that may contain content not deemed suitable for children (in the jurisdiction where the device is sold). Importantly, this kind of solution solves the "borderless internet" problem: 1. Device sellers are regulated in the jurisdiction where they sell the device. 2. Service providers take no (additional) per-jusrisdiction responsibility until they start labeling their content. By labeling their content, they are claiming to abide by specific regulations.
  - WarOnPrivacy 1y ago
    > governments mandate that ... Websites/apps/etc. MAY label content (via headers) indicating when their content/service is/isn't appropriate Which government? This list of pornographic film studios indicates they reside in many countries. https://en.wikipedia.org/wiki/List_of_pornographic_film_studios https://en.wikipedia.org/wiki/List_of_pornographic_film_stud... Past that, the USA alone has thousands of governments. Many have opinions.

general1726 1y ago

I wonder when there will be first Generate ID as a Service (GIDaaS). I would expect something like choose state, ID type, pay 10USD in crypto and now I am Joaquim van Ender from Netherlands. Of course, this will get combated by governments letting tech companies to query IDs against their databases, which inevitably will leak the IDs which will then make this exercise pointless.

Jommi 1y ago
yup
knallfrosch 1y ago
In Germany, the age verification could happen using the national ID. How do you imagine faking this?
- general1726 1y ago
  If there won't be a callback into governmental database, you can make stuff up as you go with something what resembles correct ID. If there will be callback into gov database, you can just query it and mine valid IDs using gov database as an oracle.
  - zgk7iqea 1y ago
    German IDs have cryptographic keys in their chips that make them theoretically unfakeable, so no
    - general1726 1y ago
      Which works only if you have card reader. If you are making a photo for internet service, then how do you read the chip?
      - zgk7iqea 1y ago
        phone, the app already exists https://www.ausweisapp.bund.de/ https://www.ausweisapp.bund.de/ a lot of people still scan their id but theoretically fraud prevention is possible

neko_ranger 1y ago

Lots of discussion on this and not much comparison to another democratic country (South Korea) that already implement this type of control. Account creation for non-critical services (games, etc) requires a SSN type equivalent during signup, so they very clearly know who is associated with the account. They also implement child specific locks, such as limiting the duration kids can play a game, and for only specific hours (not during night time).

nerdjon 1y ago

Slightly bothered that it seems like the article is conflating an app/website choosing to implement some form of verification vs a law requiring it. I think that if a website or app wants to make this choice, they should be allowed too. Obviously we should expect that they have proper security, and we should make the choice on if we want to take that risk. But I think it is a perfectly valid choice by the developer, and users can choose whether or not they think it is worth it or use a competitor that doesn't (or a competitor is created that doesn't). But the issue of laws requiring it I think is where things have gone too far. So much of this is being framed as "protect the children" but most of it really seems to be fueled from a puritanical "porn is bad" and needing to make it harder to get access too for adults. I really wish we could move past this as a society, stop vilifying it, being ashamed of sex, etc. And likely throw in some tracking of what people are doing online since now you no longer have the anonymity. Edit: If you really truly are trying to "protect the children"... Maybe educate them instead of hiding things from them.

docdeek 1y ago

I know it is not the same as ‘prove who you are to surf’ but when I open the page and am greeted with a note that explains that, in exchange for reading the article, The New Yorker will share my personal information with 219 different partners, you sort of wonder where the anonymity they are so worried about has gone. >> "We, and our 219 partners use cookies and similar methods to recognize visitors and remember their preferences. We may also use these technologies to gauge the effectiveness of advertising campaigns, target advertisements, and analyze website traffic. Some of these technologies are essential for ensuring the proper functioning of the service or website and cannot be disabled, while others are optional but serve to enhance the user experience in various ways. We, in collaboration with our partners, store and/or access information on a user's device, including but not limited to IP addresses, unique identifiers, and browsing data stored in cookies, in order to process personal data."

xethos 1y ago
The writers and editors understand that privacy is central to their lifestyle and work - few sources will allow exclusively on-the-record interviews. The accountants that pay the writers and editors believe that, to make the math work of "Cheap enough that a viable number of subscribers will pay", the subscription must be ad-subsidized. These are two seperate groups, and lumping them in to call them both hypocritical is lazy in thought, or ignorant in recognizing that the New Yorker is more than one person. Yes, change should start at the paper running the story. The fact they haven't yet convinced all their subscribers or accountants, and ~~possibly not even~~ presumably the public at large, does not detract from their point. Edited, but struck-through instead of deleted

tiberius_p 1y ago

Will we have to share our ID when we connect to Tor too?

wmf 1y ago
I expect Tor will just be completely blocked in UK/EU/Australia.
- radicaldreamer 1y ago
  That’ll come as part of a VPN ban…

thomassmith65 1y ago

The internet badly needs a standard system for people to verify their age*, identity**, etc but it's a terrible idea for that system not to be pseudonymous. * as in "I am over n years old", not "my exact birthday is nnnn-nn-nn" ** as in "I am a unique human you know as <uuid>", not "I am John Q Smith"

delusional 1y ago
What would you do with <UUID>? How would you verify that you are actually <UUID> or 18 years old?
- Tadpole9181 1y ago
  Zero knowledge proofs from a provider who has your ID allows validation without data leaking. Though creates other issues with, i.e. selling validation tokens.
  - delusional 1y ago
    What I'm gathering from that description is a flow that would involve three parties: Me, the restricted resource, and an ID validator. When I wanted to access the restricted resource, they'd ask for a valid token that I would then go to my ID validator to get since they've already identified me, they'd then pass that valid token back to me which I could pass to the restricted resource. They'd presumably then save that token as proof that they did their legally required validation. Is that roughly correct? I think that's the model they're working on in the EU using Bitstring Status List, OpenID for Verifiable Presentations, and ISO 18013-5. If you want to know more there's a reference implementation: https://github.com/eu-digital-identity-wallet/eudi-doc-architecture-and-reference-framework https://github.com/eu-digital-identity-wallet/eudi-doc-archi...
    - Tadpole9181 1y ago
      Just about, yup! I don't know about your specific link there, but the "zero knowledge" part comes from the token sent to the provider being non-reversible. A token cannot be used to identify the person who generated the token, even by ID validator. This works because the token is just used as material in (simplified) a hash function.

jwr 1y ago

I find it sad that all these problems have solutions already (see for example https://sovrin.org https://sovrin.org). You do not need a full ID or exact birthday to perform a check for age. As usual, mental laziness means that complexity kills the acceptance of good solutions and instead we legislate privacy-invading garbage.

8organicbits 1y ago
The link appears to be for a project that shutdown.
- jwr 1y ago
  Yes — that was part of my point, actually. Insufficient adoption. If you read their documents, the concepts are there, quite valid, and the entire system is well designed. But these kinds of solutions are "too difficult" and require thinking.

thinkingemote 1y ago

It seems very coincidental but totally unnoticed by many that this is occurring during discussions about AI bot activity and how to control access. ID access is a human check fundamentally with an on the surface primary aim of age checking. To me its noteworthy that it seems that most of those who would agree that checking for human vs bot is a Good Thing are very opposed to checking for human vs human. It's advocating for the same tools, same machines, same algorithms. I like to try to find a metaphor (or is it a simile?): it's a little bit like building surveillance and spying tools for nation states and campaigning and protesting to spying by nation states on your own person. It could be like protesting against selling arms to armies while advocating for personal gun ownership.

honeybadger1 1y ago

A poor enforcement of such a goal(since it's led by government, this is just about a guarantee) will give birth to a new movement in technology to completely avoid it. I am ready for this.

ChrisArchitect 1y ago

Related: Ready or not, age verification is rolling out across the internet https://news.ycombinator.com/item?id=44781492 https://news.ycombinator.com/item?id=44781492

Almondsetat 1y ago

Does the platform host 18+ content? Yes ---> Require ID to view/register No ---> Can register without ID in a read-only mode. To interact with other people, "upgrade" account with ID verification Why is this so difficult to implement?

sharpshadow 1y ago

It’s really hard to imagine getting asked for an ID online and outside those mentioned countries not noticeable at all that something that fundamentally changed. It certainly affects the behaviour of the person if they showed their ID before and can easily be taken to responsibility. Would not even be surprised if they try to prosecute people who faked it to access online content.

tantalor 1y ago

The old way of using driver's license (or any ID) to verify age is the antipattern. We shouldn't replicate that in technological solutions. ID is for "who you are", which doesn't matter for the types of things we use for age checks (bars, etc.) There should be a way to verify your age without showing ID. Sure, ID can do that. It is sufficient, but it should not be necessary.

DoneWithAllThat 1y ago
How do you propose a system to be effective that proves you are over a particular age but also does not prove that you are you? In other words I don’t see a way to solve the problem of needing both proof of identity and proof of age to accomplish proof of age.
- tantalor 1y ago
  You could give people a photo card that says "this person is over 18". It doesn't have any identifiable information like your name, address, or DOB. And you can't pass it if you don't match the photo.
- nullc 1y ago
  With an anonymous credential. Imagine you have a private key whose public key is signed by a trusted issuer if and only if you're an adult. Now you use this to get an account. What if you share your private key? Well you can only have one account per key and it's otherwise the same as just obtaining the porn for the improper users yourself (which is always possible). Won't that ID just get linked between sites and used to track you? Yes. But you can use a somewhat more complicated version of this scheme where you can get access to a single unlinkable ID per site... so then you can't be tracked.

josefritzishere 1y ago

This is a hard no.

Jommi 1y ago

great time to build fine tuned open source passport and "alive" face generation models

contingencies 1y ago

Old news. It's kind of telling when the article is published on a paywalled site that was once a newspaper.

throwaway89201 1y ago

It seems enormously underreported that the European Parliament has already voted in favor of a law that mandates age verification for pornography with a one year prison sentence. It was included as a last minute amendment into this bill [1]. See "Amendment 186". The full accepted article reads: "Disseminating pornographic content online without putting in place robust and effective age verification tools to effectively prevent children from accessing pornographic content online shall be punishable by a maximum term of imprisonment of at least 1 year." It's not law yet, as the first reading is now sent back to the Council of the European Union, but I don't think it's very likely it will get a second reading. [1] https://www.europarl.europa.eu/doceo/document/TA-10-2025-0116_EN.html https://www.europarl.europa.eu/doceo/document/TA-10-2025-011...

TheAdamist 1y ago

The Internet doesn't want to check your id. The government wants to force your the Internet to check your id. In the least safe way possible. And as a convenient side effect dissuade people from using "morally objectionable" internet resources under fear of identity theft and doxxing.

johnnienaked 1y ago

Bit weird that the guy with the flagship AI company destroying the internet with bots is also the guy who wants you to scan your retina to prove you're human to use the internet. Nothing to see here though, I'm sure.