5 ms·

and just why is age verification 'draconian'?

cess11 1y ago
Because it axes a liberty humans have enjoyed since we started talking to each other.
tempfile 1y ago
Your reply has been generated! In order to receive your reply, please complete a routine Age Verification check. To verify, simply post a copy of your government-issued ID into the comment box. FAQs: Q: Why should I give some stranger on the internet a copy of my government ID? A:
maybewhenthesun 1y ago
because there is no way to verify someone's age without removing their privacy protections. No matter what politicians seem to believe it's just not possible. I've always taught my children never to use their real names online. Precisely to avoid creeps. Mandatory age verification means mandatory identification.
- edent 1y ago
  I don't think that's quite accurate. Most age verification services use either government providers or 3rd party providers. I show my passport (or whatever) to the third-party. They relay to the site "this user is / isn't over 18". They don't send the DoB, address, photo etc. So the online service only receives a binary yes/no and nothing else. I don't lose any privacy there. The third-party knows that you wanted to be verified on service xyz, but not what you do there. Depending on the service I'm using, I may or may not care that they know. Handing over a passport / licence to get into a bar leaks more information than that.
  - itake 1y ago
    how long does the bar retain access to your ID? how can you trust 3rd party providers?
    - edent 1y ago
      I don't know if you've been to a bar recently. Lots of them stick IDs in a scanner. I handed over my passport to a hotel recently, they took it away and photocopied it. I'd rather trust an organisation which stakes its business on being secure than handing over my ID to anyone.
      - wkat4242 1y ago
        I have never been 'carded' in a bar in my life. Maybe that's a US thing. Bars here are required to make sure you're old enough but if it's obvious they don't have to card anyone.
        itake 1y ago
        its definitely a US/CA thing. The penalties of serving alcohol to under aged are high, potentially losing your license to sell alcohol. Regulators perform random checks with plants to verify proper protocols are followed.
  - pjc50 1y ago
    You've just leaked your identity to the third party! These third parties tend to be US based, as well. That always raises privacy questions due to "Safe Harbor". It was completely stupid of the government not to even provide a UK age verification service before putting this in place.
    - edent 1y ago
      It isn't a leak if you do it intentionally. There are lots of age-verification providers in the UK / EU. The industry had plenty of notice this was coming and reacted accordingly.
      - arthens 1y ago
        > It isn't a leak if you do it intentionally. "Do it intentionally" is a funny way to spell "I'm forcing you to do it by law and if you don't you won't be allowed to communicate with other humans in a digital form or access digital content". And even then it's still a leak when the provider inevitably gets hacked and all your data is out there and you have no legal recourse to get reasonable compensation for it.
  - zx8080 1y ago
    > I don't lose any privacy there. By sending your gov ID(s) to a third party? You do! They will leak (or leak and then sell) your ID with your name to those who wants to buy it. With services you've ever authorized with them, and probably the list of services you visit with timestamps. As it's NOT the one-time token, I'm pretty sure it has to be renewed from time to time (12h expiration? 1h? Who knows). This is a system designed for tracking and control.
  - deleted 1y ago
    [deleted]
  - jayd16 1y ago
    Shouldn't it at least just give the user a site agnostic token they can relay themselves? Why does the verifier need the site?
    - edent 1y ago
      Absolutely. But I assume they want to know which site has made the request so they can bill them properly.
      - lucumo 1y ago
        But if you allow that, the third-party has your id and a list of ALL adult sites you visit. If that leaks it's even worse than a single site leaking your id.
  - immibis 1y ago
    So if it's really like that then what stops me charging people $5 to verify their account for them? Would I get in trouble for doing that? If so, that just proves it wasn't anonymous and people were right to get me to verify for them.
    - edent 1y ago
      Unsurprisingly, the regulations require that providers take adequate steps to verify identities. In the UK, that usually means being certified by https://accscheme.com/registry/ https://accscheme.com/registry/ or similar. Just saying "I asked some random provider to verify" isn't going to cut it. Incidentally, $5 is around 10x more expensive than most providers.
      - majorchord 1y ago
        Where would their definition of 'verify' be documented? In the US, the recent federal bill aimed at age verification is more of an 'honor system', where just a yes/no box would suffice. Their position seems to be that it's not the government's job to try to prove you're not lying. Japan does the same thing when you buy beer or cigarettes, you just tap "I'm at least 20" on the screen and off you go.
        edent 1y ago
        It is all documented at https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/age-assurance https://www.ofcom.org.uk/online-safety/illegal-and-harmful-c...
        ranger_danger 1y ago
        Endless captcha loops for me :/
      - immibis 1y ago
        So it's not anonymous after all?
- CaptainOfCoit 1y ago
  I'm not sure if you work in software or not, but it's definitely possible to come up with a schema where you could verify people's age in order to use a platform, without exposing your entire identity to said platform, with a combination of signatures and other cryptographic basics. Say you have a digital certificate from the government or similar that you use to do your taxes online or whatever, the government could have endpoints where you could use that certificate for signing a proof, that you then hand over to the platform you want to verify your age with. The platform can then confirm it's valid, and that $AGE>X, but they get no other details. You can even go a bit fancier/more complicated, and the government endpoints wouldn't know what platform you're trying to verify.
  - sleepychu 1y ago
    How do I prevent my citizens from sharing their certificates in order to bypass the block?
    - CaptainOfCoit 1y ago
      You don't, it's up to citizens to make sure whatever authentication they use can only be used by them, just like how it works for other services today where you authenticate online somehow and the government service assumes you're you since you were able to authenticate.
      - sleepychu 1y ago
        My point is that this is either a bearer token (in which case it will be obtainable by proxy) or tied to your identity. What is the incentive for the citizen to make sure their authentication isn't shared?
        owisd 1y ago
        > obtainable by proxy So no different to the rules around buying an 18+ DVD.
        CaptainOfCoit 1y ago
- tzs 1y ago
  That's not correct. With a government issued signed digital ID cryptographically bound to a hardware security module you can use a zero-knowledge proof based protocol to prove to any third party site that (1) you have a signed government ID, (2) you have the hardware security module that it was bound to when the government issued it to you, and (3) the date of birth field on that ID says you are older than the site's age threshold. This reveals no other information to the site. The EU is on track to deploy such a system by the end of 2026. They are currently doing field testing involving thousands of users.
  - thescriptkiddie 1y ago
    zero-knowledge proofs don't work like that
    - tzs 1y ago
      https://eprint.iacr.org/2024/2010 https://eprint.iacr.org/2024/2010 https://github.com/eu-digital-identity-wallet/av-doc-technical-specification/blob/main/docs/annexes/annex-B/annex-B-zkp.md https://github.com/eu-digital-identity-wallet/av-doc-technic... https://blog.google/technology/safety-security/opening-up-zero-knowledge-proof-technology-to-promote-privacy-in-age-assurance/ https://blog.google/technology/safety-security/opening-up-ze... https://news.ycombinator.com/item?id=44457390 https://news.ycombinator.com/item?id=44457390
  - immibis 1y ago
    Yup. For $5 (hypothetically) I'll use my ID to make that ZKP for you, and you can pass it to the site.
  - ranger_danger 1y ago
    But it still doesn't prove that the person creating the proof is the person who was assigned the government ID, right? What's to stop someone from using their ID to power a bunch of bots? And AFAIK unless the company has a database/API for all the existing IDs in the world, I would think it doesn't stop forged IDs from existing. And even then, corrupt employees could still issue forged IDs... there's no guarantee that a single ID equals a single person forever.
- dpark 1y ago
  So what is the problem? I don’t want my kids sharing real names online. I wouldn’t want them verifying their age with Bluesky either. But that’s fine because I also don’t want them getting porn or DMs on bluesky. This is win win for kids. It’s not a win for adults who now have to expose their identity.
  - gjsman-1000 1y ago
    [flagged]
    - immibis 1y ago
      I think people just don't want the government to surveil everything they do.
      - gjsman-1000 1y ago
        https://news.ycombinator.com/item?id=45430811 https://news.ycombinator.com/item?id=45430811
    - Aloisius 1y ago
      Em. Thomas Paine, James Madison, Alexander Hamilton, John Jay, Benjamin Franklin, John Marshall, John Locke, Immanuel Kant, David Hume, Baruch Spinoza, René Descartes and many, many more wrote anonymously. Some wrote anonymously because they wanted the words to speak for themselves, such as Madison, Hamilton and Jay writing the Federalist Papers. Some did it because they thought their name might detract from the message - such as Franklin's writings when he was a teenager. And some others did it to avoid consequences for their opinion - such as when Thomas Paine penned the case for American independence - literally treason. Even Paine's publisher, Benjamin Rush, remained anonymous! The idea that free speech without responsibility wasn't a consideration seems contradicted by how utterly pervasive it was by classical liberal philosophers and founding fathers and how influential those writings were to the founding of the country and the creation and passage of the first amendment.
  - Ajedi32 1y ago
gsich 1y ago
Because I don't trust any company with handling such verification.

Because it axes a liberty humans have enjoyed since we started talking to each other.

Your reply has been generated! In order to receive your reply, please complete a routine Age Verification check. To verify, simply post a copy of your government-issued ID into the comment box. FAQs: Q: Why should I give some stranger on the internet a copy of my government ID? A:

maybewhenthesun 1y ago

because there is no way to verify someone's age without removing their privacy protections. No matter what politicians seem to believe it's just not possible. I've always taught my children never to use their real names online. Precisely to avoid creeps. Mandatory age verification means mandatory identification.

edent 1y ago
I don't think that's quite accurate. Most age verification services use either government providers or 3rd party providers. I show my passport (or whatever) to the third-party. They relay to the site "this user is / isn't over 18". They don't send the DoB, address, photo etc. So the online service only receives a binary yes/no and nothing else. I don't lose any privacy there. The third-party knows that you wanted to be verified on service xyz, but not what you do there. Depending on the service I'm using, I may or may not care that they know. Handing over a passport / licence to get into a bar leaks more information than that.
- itake 1y ago
  how long does the bar retain access to your ID? how can you trust 3rd party providers?
  - edent 1y ago
    I don't know if you've been to a bar recently. Lots of them stick IDs in a scanner. I handed over my passport to a hotel recently, they took it away and photocopied it. I'd rather trust an organisation which stakes its business on being secure than handing over my ID to anyone.
    - wkat4242 1y ago
      I have never been 'carded' in a bar in my life. Maybe that's a US thing. Bars here are required to make sure you're old enough but if it's obvious they don't have to card anyone.
      - itake 1y ago
        its definitely a US/CA thing. The penalties of serving alcohol to under aged are high, potentially losing your license to sell alcohol. Regulators perform random checks with plants to verify proper protocols are followed.
- pjc50 1y ago
  You've just leaked your identity to the third party! These third parties tend to be US based, as well. That always raises privacy questions due to "Safe Harbor". It was completely stupid of the government not to even provide a UK age verification service before putting this in place.
  - edent 1y ago
    It isn't a leak if you do it intentionally. There are lots of age-verification providers in the UK / EU. The industry had plenty of notice this was coming and reacted accordingly.
    - arthens 1y ago
      > It isn't a leak if you do it intentionally. "Do it intentionally" is a funny way to spell "I'm forcing you to do it by law and if you don't you won't be allowed to communicate with other humans in a digital form or access digital content". And even then it's still a leak when the provider inevitably gets hacked and all your data is out there and you have no legal recourse to get reasonable compensation for it.
- zx8080 1y ago
  > I don't lose any privacy there. By sending your gov ID(s) to a third party? You do! They will leak (or leak and then sell) your ID with your name to those who wants to buy it. With services you've ever authorized with them, and probably the list of services you visit with timestamps. As it's NOT the one-time token, I'm pretty sure it has to be renewed from time to time (12h expiration? 1h? Who knows). This is a system designed for tracking and control.
- deleted 1y ago
  [deleted]
- jayd16 1y ago
  Shouldn't it at least just give the user a site agnostic token they can relay themselves? Why does the verifier need the site?
  - edent 1y ago
    Absolutely. But I assume they want to know which site has made the request so they can bill them properly.
    - lucumo 1y ago
      But if you allow that, the third-party has your id and a list of ALL adult sites you visit. If that leaks it's even worse than a single site leaking your id.
- immibis 1y ago
  So if it's really like that then what stops me charging people $5 to verify their account for them? Would I get in trouble for doing that? If so, that just proves it wasn't anonymous and people were right to get me to verify for them.
  - edent 1y ago
    Unsurprisingly, the regulations require that providers take adequate steps to verify identities. In the UK, that usually means being certified by https://accscheme.com/registry/ https://accscheme.com/registry/ or similar. Just saying "I asked some random provider to verify" isn't going to cut it. Incidentally, $5 is around 10x more expensive than most providers.
    - majorchord 1y ago
      Where would their definition of 'verify' be documented? In the US, the recent federal bill aimed at age verification is more of an 'honor system', where just a yes/no box would suffice. Their position seems to be that it's not the government's job to try to prove you're not lying. Japan does the same thing when you buy beer or cigarettes, you just tap "I'm at least 20" on the screen and off you go.
      - edent 1y ago
        It is all documented at https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/age-assurance https://www.ofcom.org.uk/online-safety/illegal-and-harmful-c...
        ranger_danger 1y ago
        Endless captcha loops for me :/
    - immibis 1y ago
      So it's not anonymous after all?
CaptainOfCoit 1y ago
I'm not sure if you work in software or not, but it's definitely possible to come up with a schema where you could verify people's age in order to use a platform, without exposing your entire identity to said platform, with a combination of signatures and other cryptographic basics. Say you have a digital certificate from the government or similar that you use to do your taxes online or whatever, the government could have endpoints where you could use that certificate for signing a proof, that you then hand over to the platform you want to verify your age with. The platform can then confirm it's valid, and that $AGE>X, but they get no other details. You can even go a bit fancier/more complicated, and the government endpoints wouldn't know what platform you're trying to verify.
- sleepychu 1y ago
  How do I prevent my citizens from sharing their certificates in order to bypass the block?
  - CaptainOfCoit 1y ago
    You don't, it's up to citizens to make sure whatever authentication they use can only be used by them, just like how it works for other services today where you authenticate online somehow and the government service assumes you're you since you were able to authenticate.
    - sleepychu 1y ago
      My point is that this is either a bearer token (in which case it will be obtainable by proxy) or tied to your identity. What is the incentive for the citizen to make sure their authentication isn't shared?
      - owisd 1y ago
        > obtainable by proxy So no different to the rules around buying an 18+ DVD.
      - CaptainOfCoit 1y ago
tzs 1y ago
That's not correct. With a government issued signed digital ID cryptographically bound to a hardware security module you can use a zero-knowledge proof based protocol to prove to any third party site that (1) you have a signed government ID, (2) you have the hardware security module that it was bound to when the government issued it to you, and (3) the date of birth field on that ID says you are older than the site's age threshold. This reveals no other information to the site. The EU is on track to deploy such a system by the end of 2026. They are currently doing field testing involving thousands of users.
- thescriptkiddie 1y ago
  zero-knowledge proofs don't work like that
  - tzs 1y ago
    https://eprint.iacr.org/2024/2010 https://eprint.iacr.org/2024/2010 https://github.com/eu-digital-identity-wallet/av-doc-technical-specification/blob/main/docs/annexes/annex-B/annex-B-zkp.md https://github.com/eu-digital-identity-wallet/av-doc-technic... https://blog.google/technology/safety-security/opening-up-zero-knowledge-proof-technology-to-promote-privacy-in-age-assurance/ https://blog.google/technology/safety-security/opening-up-ze... https://news.ycombinator.com/item?id=44457390 https://news.ycombinator.com/item?id=44457390
- immibis 1y ago
  Yup. For $5 (hypothetically) I'll use my ID to make that ZKP for you, and you can pass it to the site.
- ranger_danger 1y ago
  But it still doesn't prove that the person creating the proof is the person who was assigned the government ID, right? What's to stop someone from using their ID to power a bunch of bots? And AFAIK unless the company has a database/API for all the existing IDs in the world, I would think it doesn't stop forged IDs from existing. And even then, corrupt employees could still issue forged IDs... there's no guarantee that a single ID equals a single person forever.
dpark 1y ago
So what is the problem? I don’t want my kids sharing real names online. I wouldn’t want them verifying their age with Bluesky either. But that’s fine because I also don’t want them getting porn or DMs on bluesky. This is win win for kids. It’s not a win for adults who now have to expose their identity.
- gjsman-1000 1y ago
  [flagged]
  - immibis 1y ago
    I think people just don't want the government to surveil everything they do.
    - gjsman-1000 1y ago
      https://news.ycombinator.com/item?id=45430811 https://news.ycombinator.com/item?id=45430811
  - Aloisius 1y ago
    Em. Thomas Paine, James Madison, Alexander Hamilton, John Jay, Benjamin Franklin, John Marshall, John Locke, Immanuel Kant, David Hume, Baruch Spinoza, René Descartes and many, many more wrote anonymously. Some wrote anonymously because they wanted the words to speak for themselves, such as Madison, Hamilton and Jay writing the Federalist Papers. Some did it because they thought their name might detract from the message - such as Franklin's writings when he was a teenager. And some others did it to avoid consequences for their opinion - such as when Thomas Paine penned the case for American independence - literally treason. Even Paine's publisher, Benjamin Rush, remained anonymous! The idea that free speech without responsibility wasn't a consideration seems contradicted by how utterly pervasive it was by classical liberal philosophers and founding fathers and how influential those writings were to the founding of the country and the creation and passage of the first amendment.
- Ajedi32 1y ago

gsich 1y ago

Because I don't trust any company with handling such verification.