5 ms·

I don't think that's quite accurate. Most age verification services use either government providers or 3rd party providers. I show my passport (or whatever) to

by edent 1y ago

I don't think that's quite accurate. Most age verification services use either government providers or 3rd party providers. I show my passport (or whatever) to the third-party. They relay to the site "this user is / isn't over 18". They don't send the DoB, address, photo etc. So the online service only receives a binary yes/no and nothing else. I don't lose any privacy there. The third-party knows that you wanted to be verified on service xyz, but not what you do there. Depending on the service I'm using, I may or may not care that they know. Handing over a passport / licence to get into a bar leaks more information than that.

itake 1y ago
how long does the bar retain access to your ID? how can you trust 3rd party providers?
- edent 1y ago
  I don't know if you've been to a bar recently. Lots of them stick IDs in a scanner. I handed over my passport to a hotel recently, they took it away and photocopied it. I'd rather trust an organisation which stakes its business on being secure than handing over my ID to anyone.
  - wkat4242 1y ago
    I have never been 'carded' in a bar in my life. Maybe that's a US thing. Bars here are required to make sure you're old enough but if it's obvious they don't have to card anyone.
    - itake 1y ago
      its definitely a US/CA thing. The penalties of serving alcohol to under aged are high, potentially losing your license to sell alcohol. Regulators perform random checks with plants to verify proper protocols are followed.
pjc50 1y ago
You've just leaked your identity to the third party! These third parties tend to be US based, as well. That always raises privacy questions due to "Safe Harbor". It was completely stupid of the government not to even provide a UK age verification service before putting this in place.
- edent 1y ago
  It isn't a leak if you do it intentionally. There are lots of age-verification providers in the UK / EU. The industry had plenty of notice this was coming and reacted accordingly.
  - arthens 1y ago
    > It isn't a leak if you do it intentionally. "Do it intentionally" is a funny way to spell "I'm forcing you to do it by law and if you don't you won't be allowed to communicate with other humans in a digital form or access digital content". And even then it's still a leak when the provider inevitably gets hacked and all your data is out there and you have no legal recourse to get reasonable compensation for it.
zx8080 1y ago
> I don't lose any privacy there. By sending your gov ID(s) to a third party? You do! They will leak (or leak and then sell) your ID with your name to those who wants to buy it. With services you've ever authorized with them, and probably the list of services you visit with timestamps. As it's NOT the one-time token, I'm pretty sure it has to be renewed from time to time (12h expiration? 1h? Who knows). This is a system designed for tracking and control.
deleted 1y ago
[deleted]
jayd16 1y ago
Shouldn't it at least just give the user a site agnostic token they can relay themselves? Why does the verifier need the site?
- edent 1y ago
  Absolutely. But I assume they want to know which site has made the request so they can bill them properly.
  - lucumo 1y ago
    But if you allow that, the third-party has your id and a list of ALL adult sites you visit. If that leaks it's even worse than a single site leaking your id.
immibis 1y ago
So if it's really like that then what stops me charging people $5 to verify their account for them? Would I get in trouble for doing that? If so, that just proves it wasn't anonymous and people were right to get me to verify for them.
- edent 1y ago
  Unsurprisingly, the regulations require that providers take adequate steps to verify identities. In the UK, that usually means being certified by https://accscheme.com/registry/ https://accscheme.com/registry/ or similar. Just saying "I asked some random provider to verify" isn't going to cut it. Incidentally, $5 is around 10x more expensive than most providers.
  - majorchord 1y ago
    Where would their definition of 'verify' be documented? In the US, the recent federal bill aimed at age verification is more of an 'honor system', where just a yes/no box would suffice. Their position seems to be that it's not the government's job to try to prove you're not lying. Japan does the same thing when you buy beer or cigarettes, you just tap "I'm at least 20" on the screen and off you go.
    - edent 1y ago
      It is all documented at https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/age-assurance https://www.ofcom.org.uk/online-safety/illegal-and-harmful-c...
      - ranger_danger 1y ago
        Endless captcha loops for me :/
  - immibis 1y ago
    So it's not anonymous after all?

by edent 1y ago

itake 1y ago

how long does the bar retain access to your ID? how can you trust 3rd party providers?

edent 1y ago
I don't know if you've been to a bar recently. Lots of them stick IDs in a scanner. I handed over my passport to a hotel recently, they took it away and photocopied it. I'd rather trust an organisation which stakes its business on being secure than handing over my ID to anyone.
- wkat4242 1y ago
  I have never been 'carded' in a bar in my life. Maybe that's a US thing. Bars here are required to make sure you're old enough but if it's obvious they don't have to card anyone.
  - itake 1y ago
    its definitely a US/CA thing. The penalties of serving alcohol to under aged are high, potentially losing your license to sell alcohol. Regulators perform random checks with plants to verify proper protocols are followed.

pjc50 1y ago

You've just leaked your identity to the third party! These third parties tend to be US based, as well. That always raises privacy questions due to "Safe Harbor". It was completely stupid of the government not to even provide a UK age verification service before putting this in place.

edent 1y ago
It isn't a leak if you do it intentionally. There are lots of age-verification providers in the UK / EU. The industry had plenty of notice this was coming and reacted accordingly.
- arthens 1y ago
  > It isn't a leak if you do it intentionally. "Do it intentionally" is a funny way to spell "I'm forcing you to do it by law and if you don't you won't be allowed to communicate with other humans in a digital form or access digital content". And even then it's still a leak when the provider inevitably gets hacked and all your data is out there and you have no legal recourse to get reasonable compensation for it.

zx8080 1y ago

> I don't lose any privacy there. By sending your gov ID(s) to a third party? You do! They will leak (or leak and then sell) your ID with your name to those who wants to buy it. With services you've ever authorized with them, and probably the list of services you visit with timestamps. As it's NOT the one-time token, I'm pretty sure it has to be renewed from time to time (12h expiration? 1h? Who knows). This is a system designed for tracking and control.

deleted 1y ago

[deleted]

jayd16 1y ago

Shouldn't it at least just give the user a site agnostic token they can relay themselves? Why does the verifier need the site?

edent 1y ago
Absolutely. But I assume they want to know which site has made the request so they can bill them properly.
- lucumo 1y ago
  But if you allow that, the third-party has your id and a list of ALL adult sites you visit. If that leaks it's even worse than a single site leaking your id.

immibis 1y ago

So if it's really like that then what stops me charging people $5 to verify their account for them? Would I get in trouble for doing that? If so, that just proves it wasn't anonymous and people were right to get me to verify for them.

edent 1y ago
Unsurprisingly, the regulations require that providers take adequate steps to verify identities. In the UK, that usually means being certified by https://accscheme.com/registry/ https://accscheme.com/registry/ or similar. Just saying "I asked some random provider to verify" isn't going to cut it. Incidentally, $5 is around 10x more expensive than most providers.
- majorchord 1y ago
  Where would their definition of 'verify' be documented? In the US, the recent federal bill aimed at age verification is more of an 'honor system', where just a yes/no box would suffice. Their position seems to be that it's not the government's job to try to prove you're not lying. Japan does the same thing when you buy beer or cigarettes, you just tap "I'm at least 20" on the screen and off you go.
  - edent 1y ago
    It is all documented at https://www.ofcom.org.uk/online-safety/illegal-and-harmful-content/age-assurance https://www.ofcom.org.uk/online-safety/illegal-and-harmful-c...
    - ranger_danger 1y ago
      Endless captcha loops for me :/
- immibis 1y ago
  So it's not anonymous after all?