5 ms·

It's kind of surprising that no-one has really come out with a proper privacy-preserving approach to this yet. It is clearly _possible_; there are reasonable-lo

It's kind of surprising that no-one has really come out with a proper privacy-preserving approach to this yet. It is clearly _possible_; there are reasonable-looking designs for this. But no-one's doing it; they're just collecting photos and IDs, and then leaking them all over the place.

Etheryte 9mo ago
No privacy is simpler and the simpler solution is cheaper. If there's no real incentive to go with another option, companies will go with the cheaper option.
jeltz 9mo ago
They do not want to solve the problem, they want to collect our IDs. If they would have wanted to actually solve it they would not have done this on legislations where it is not a requirement.
AJ007 9mo ago
It is only a matter of time before ID verification means the camera is always on watching the face of the person looking at the screen.
- octoberfranklin 9mo ago
  That's why I put black tape over my front-facing camera.
  - gentleman11 9mo ago
    Expect a visit feom ho.eland security 10 years from now
squeegmeister 9mo ago
https://www.apple.com/newsroom/2025/06/apple-expands-tools-to-help-parents-protect-kids-and-teens-online/?utm_source=chatgpt.com https://www.apple.com/newsroom/2025/06/apple-expands-tools-t... What are your thoughts on Apple's approach? You still have to provide your birthdate to apple. But after that, it only only ever shares your age range with other companies that request it, not your birthdate.
- frumplestlatz 9mo ago
  This is great, but if and only if it remains an opt-in choice that enables parents. There is a stark difference between enabling choice or compelling it. Somehow in the last 15 years, we have completely lost sight of agency-based ethics as a founding and fundamental principle of western liberalism. This has been replaced with harm-based ethics. Harm has no fixed definition. There is no stopping rule — when will we have eradicated enough harm? It’s declared by fiat by whoever has the means to compel and coerce — and harm inherent in that enforcement are ignored.
Sohcahtoa82 9mo ago
> It is clearly _possible_ Is it? I don't think it is. I truly don't believe that there's any possible way to verify someone's age without collecting ID from them.
- 0x3f 9mo ago
  Well you could have government-run cryptographically signed tokens. They're already in the business of holding ID data (i.e. they don't need to collect it and this wouldn't increase the attack surface). But assuming it has to be a private solution, you could do the same thing but make it a non-profit. Then at least _new_ services you wish to use don't need to collect your ID.
- rcxdude 9mo ago
  It's possible to (cryptpgraphically verifiably) split up the age verification and the knowledge of what the verification is for.
- davidczech 9mo ago
  It would seem like a naive solution would be some arrangement where Discord would ask for a proof-of-age from an official service ran by the State (which issues your ID)
- hiccup_socks 9mo ago
  many countries already have a working system mostly integrated, so yes, i would say it is possible. the government should issue physical tokens that are sold wherever you can buy booze or smokes. when you login to a service that needs age verification, you type in the code from your age token. its pretty cheap, its low-tech, we are already accepting of showing id to a store clerk privacy-wise, we generally trust the enforcement mechanisms around smoking/drinking already, it would be easy to expand existing laws to accommodate selling them/punishing misuse.
orthogonal_cube 9mo ago
As others have said, it’s obvious that no real attempts have been made by anyone to create a privacy-focused solution because the end goal is to collect photo IDs. Occasionally in my free time I have been tinkering with a certificate-based solution that could fulfill this sort of need for age verification. It’s not the most robust idea but it’s simple enough using most of what we already have. Creating a minimal protocol which doesn’t share actual identifying information nor metadata of the site you’re accessing is trivial. If I can make an 80% solution in less than 100 hours of my free time then some groups with more money and intelligence could propose a dead-simple and easy-to-adopt solution just as easily.
triceratops 9mo ago
Here's my solution: https://news.ycombinator.com/item?id=46447282 https://news.ycombinator.com/item?id=46447282 The problem is privacy activists and free speech activists (though there's some overlap between the two they aren't the same) oppose age verification by any means since it has the potential to infringe on both ever so slightly. Meanwhile age verification gates are being demanded and thrown up all over the Internet at a frightening pace. So we get only the maximal data collection solutions implemented by people who don't give a shit about privacy or free speech. And the mass surveillance cheerleaders egg them on. If privacy and free speech activists understood that a proactive, privacy-preserving approach to age verification is the best outcome we'd be better off.
- frumplestlatz 9mo ago
  > ever so slightly It’s not “slightly”. They’ll start with claiming to protect people under 18 from obviously problematic content — porn, grooming, etc. It won’t stop there. The scope creep will extend to expressing or reading “incorrect” or “dangerous” views. They’ll probably call some of it “hate speech”, but hate speech is whatever the people in power say it is; on X, “cisgender” is designated as a slur and gets your post censored. The slippery slope fallacy is only a fallacy if the slope isn’t slippery — “think of the children” is a wedge bad actors are once again trying to use to open the floodgates of censorship. They don’t even need to target adults; if you control what children can see and express, you have enormous control over all future generations of voters.
  - tavavex 9mo ago
    I agree, but the powers that be loathe the phrase "hate speech". I'm betting the next encroachment will be on "violence", "terrorism" or even Russian-style "promotion of nontraditional values".
  - triceratops 9mo ago
    It's already happening. What's your alternative? Not VPNs because every jurisdiction and website will eventually have equivalent laws or terms of service.
deleted 9mo ago
[deleted]
vikkymelani 9mo ago
[dead]
Seattle3503 9mo ago
mDLs support selective disclosure of age.
gentleman11 9mo ago
They dont want it to be private. They want to profile you and sell your data

Etheryte 9mo ago

No privacy is simpler and the simpler solution is cheaper. If there's no real incentive to go with another option, companies will go with the cheaper option.

jeltz 9mo ago

They do not want to solve the problem, they want to collect our IDs. If they would have wanted to actually solve it they would not have done this on legislations where it is not a requirement.

AJ007 9mo ago

It is only a matter of time before ID verification means the camera is always on watching the face of the person looking at the screen.

octoberfranklin 9mo ago
That's why I put black tape over my front-facing camera.
- gentleman11 9mo ago
  Expect a visit feom ho.eland security 10 years from now

squeegmeister 9mo ago

https://www.apple.com/newsroom/2025/06/apple-expands-tools-to-help-parents-protect-kids-and-teens-online/?utm_source=chatgpt.com https://www.apple.com/newsroom/2025/06/apple-expands-tools-t... What are your thoughts on Apple's approach? You still have to provide your birthdate to apple. But after that, it only only ever shares your age range with other companies that request it, not your birthdate.

frumplestlatz 9mo ago
This is great, but if and only if it remains an opt-in choice that enables parents. There is a stark difference between enabling choice or compelling it. Somehow in the last 15 years, we have completely lost sight of agency-based ethics as a founding and fundamental principle of western liberalism. This has been replaced with harm-based ethics. Harm has no fixed definition. There is no stopping rule — when will we have eradicated enough harm? It’s declared by fiat by whoever has the means to compel and coerce — and harm inherent in that enforcement are ignored.

Sohcahtoa82 9mo ago

> It is clearly _possible_ Is it? I don't think it is. I truly don't believe that there's any possible way to verify someone's age without collecting ID from them.

0x3f 9mo ago
Well you could have government-run cryptographically signed tokens. They're already in the business of holding ID data (i.e. they don't need to collect it and this wouldn't increase the attack surface). But assuming it has to be a private solution, you could do the same thing but make it a non-profit. Then at least _new_ services you wish to use don't need to collect your ID.
rcxdude 9mo ago
It's possible to (cryptpgraphically verifiably) split up the age verification and the knowledge of what the verification is for.
davidczech 9mo ago
It would seem like a naive solution would be some arrangement where Discord would ask for a proof-of-age from an official service ran by the State (which issues your ID)
hiccup_socks 9mo ago
many countries already have a working system mostly integrated, so yes, i would say it is possible. the government should issue physical tokens that are sold wherever you can buy booze or smokes. when you login to a service that needs age verification, you type in the code from your age token. its pretty cheap, its low-tech, we are already accepting of showing id to a store clerk privacy-wise, we generally trust the enforcement mechanisms around smoking/drinking already, it would be easy to expand existing laws to accommodate selling them/punishing misuse.

orthogonal_cube 9mo ago

As others have said, it’s obvious that no real attempts have been made by anyone to create a privacy-focused solution because the end goal is to collect photo IDs. Occasionally in my free time I have been tinkering with a certificate-based solution that could fulfill this sort of need for age verification. It’s not the most robust idea but it’s simple enough using most of what we already have. Creating a minimal protocol which doesn’t share actual identifying information nor metadata of the site you’re accessing is trivial. If I can make an 80% solution in less than 100 hours of my free time then some groups with more money and intelligence could propose a dead-simple and easy-to-adopt solution just as easily.

triceratops 9mo ago

Here's my solution: https://news.ycombinator.com/item?id=46447282 https://news.ycombinator.com/item?id=46447282 The problem is privacy activists and free speech activists (though there's some overlap between the two they aren't the same) oppose age verification by any means since it has the potential to infringe on both ever so slightly. Meanwhile age verification gates are being demanded and thrown up all over the Internet at a frightening pace. So we get only the maximal data collection solutions implemented by people who don't give a shit about privacy or free speech. And the mass surveillance cheerleaders egg them on. If privacy and free speech activists understood that a proactive, privacy-preserving approach to age verification is the best outcome we'd be better off.

frumplestlatz 9mo ago
> ever so slightly It’s not “slightly”. They’ll start with claiming to protect people under 18 from obviously problematic content — porn, grooming, etc. It won’t stop there. The scope creep will extend to expressing or reading “incorrect” or “dangerous” views. They’ll probably call some of it “hate speech”, but hate speech is whatever the people in power say it is; on X, “cisgender” is designated as a slur and gets your post censored. The slippery slope fallacy is only a fallacy if the slope isn’t slippery — “think of the children” is a wedge bad actors are once again trying to use to open the floodgates of censorship. They don’t even need to target adults; if you control what children can see and express, you have enormous control over all future generations of voters.
- tavavex 9mo ago
  I agree, but the powers that be loathe the phrase "hate speech". I'm betting the next encroachment will be on "violence", "terrorism" or even Russian-style "promotion of nontraditional values".
- triceratops 9mo ago
  It's already happening. What's your alternative? Not VPNs because every jurisdiction and website will eventually have equivalent laws or terms of service.

deleted 9mo ago

[deleted]

vikkymelani 9mo ago

[dead]

Seattle3503 9mo ago

mDLs support selective disclosure of age.

gentleman11 9mo ago

They dont want it to be private. They want to profile you and sell your data