17 ms·

I am now waiting for Gruber (daringfireball.net) to post another rant about how terrible EU regulation is. Zero-knowledge proofs are the way to go for this typ

by jwr 7mo ago

I am now waiting for Gruber (daringfireball.net) to post another rant about how terrible EU regulation is. Zero-knowledge proofs are the way to go for this type of thing, I find it mind-boggling that the US lets itself be bamboozled into complete lack of privacy.

cosmos0072 7mo ago
I am from EU, and contrary to age verification laws in general. My stance is that if somebody is a minor, his/her/their parents/tutors/legal guardian are responsible for what they can/cannot do online, and that the mechanism to enforce that is parental control on devices. Having said that, open-source zero-knowledge proofs are infinitely less evil (I refuse to say "better") than commercial cloud-based age monitoring baked into every OS
- croes 7mo ago
  You could make the same case for parental control as evil. "You‘re reading about evolution! Not in my house"
  - cosmos0072 7mo ago
    Parents already have a lot of control on children' education. Examples: most children believe in the same religion as their parents, and can visit friends and places only if/when allowed by their parents. This is simply extending the same level of control to the internet. Government-mandated restrictions are completely another level.
    - croes 7mo ago
      Who controls your age if you try to buy alcohol. Who controls your age if you want to see an R-rated movie? This is simply extending the same level of control to the internet. More control for parents is a completely different level.
      - applfanboysbgon 7mo ago
        Disingenuous, but I'm sure you know that and were being intentionally so. The government is not using alcohol age laws as a justification to place a camera in your bedroom to make sure you aren't sneaking booze, but it is using internet age laws as a justification to surveil your entire life in a world which is becoming increasingly digital-mandatory to participate in government services or the economy. Nobody had a problem with internet age laws when "are you over 13? yes/no" was legally sufficient.
        croes 7mo ago
        You‘re missing the point > Having said that, open-source zero-knowledge proofs are infinitely less evil (I refuse to say "better") than commercial cloud-based age monitoring baked into every OS Parent prefers more control by parents over zero-knowledge proof
        applfanboysbgon 7mo ago
        If that was your point, I don't think your previous comment did a very good job of making it at all. I do think parental controls can be and are abused for evil, but they're still better than the alternative. Zero-knowledge proof is not an alternative, and to suggest that it is is misunderstanding the situation. These laws are proposed and funded by people who want complete surveillance of the population. Zero-knowledge proof is, therefore, explicitly contrary to the goal and will never be implemented under any circumstances. Suggesting that it can be muddies the issue and tricks people into supporting legislation that exists only to be used against them. In a benevolent dictatorship, sure, go for a zero-knowledge proof verification as your solution. In the reality of democracy, where politicians are corporate puppets who cloak surveillance laws in "think of the children" to rally support from the masses, we need to convince people to see through the lie and reject the proposals outright while reassuring them that they can protect the children themselves via parental controls. You will never be able to sufficiently inform 50.1% of the population of any country of what zero-knowledge proof even means, let alone convince them to support age verification laws but strictly conditional on ZKP requirements. That level of nuance is far too much to ask of millions of people who are not technically-informed, and idealism needs to give way to pragmatism if we wish to avoid the worst-case scenario.
    - edgyquant 7mo ago
      I have personally worked with parents trying to prevent their children from using social media and it’s nearly impossible. Kids are almost always more tech savvy than their parents and unlike smoking it’s nearly impossible to tell a child is doing so without watching them 100% of the time.
- tasuki 7mo ago
  > My stance is that if somebody is a minor, his/her/their parents/tutors/legal guardian are responsible for what they can/cannot do online As a parent, sure, that is my stance as well. What... what other stances are there even? How would they work?
  - Markoff 7mo ago
    ignore parent, outsource parenting to gov verification authority TBH many parents done exactly that by giving phones/tablet already to kids in strollers
    - graemep 7mo ago
      The latter is true, but we cannot regulate the vast majority of parents on the basis of the worst.
  - pjc50 7mo ago
    The steelman argument is that parents are not necessarily up to date on the technology, and cannot reasonably be expected to supervise teenagers 24/7 up to the age of 18. Compare movie ratings or alcohol laws, for example: there's a non-parental obligation on third parties not to provide alcohol to children or let them in to R18 showings. But the implementation matters, and almost all of these bills internationally are being done in bad faith by coordinated big-money groups against technologically illiterate and reactionary populist governments. (if we really want to get into an argument, there's what the UK calls "Gillick competence": the ability of children to seek medical treatment without the knowledge and against the will of their parents)
    - _heimdall 7mo ago
      That steelman still stands on a core assumption that its both the state's responsibility and right to step in and parent on everyone's behalf. Maybe a majority of people today agree with that, but I know I don't and I never hear that assumption debated directly.
      - 7mo ago
- himata4113 7mo ago
  Yes! This is the way, give parents the ABILITY to advertise the users age to browsers, apps and everything in between. Only target cooperations, do not target open source projects. Fine websites for not using this API (ex: porn sites). Assume an adult if not present.
  - idiotsecant 7mo ago
    This is a great solution to the stated problem. The issue is that nobody is actually trying to solve the stated problem. This is a terrible solution to the real 'problem' which is the lack of surveillance power and information control.
    - simion314 7mo ago
      >This is a great solution to the stated problem. The issue is that nobody is actually trying to solve the stated problem. This is a terrible solution to the real 'problem' which is the lack of surveillance power and information control. So on the Sony consoles I created an account for my child and guess what they have implemented some stuff to block children from adult content on some stuff. So if Big Tech would actually want to prevent laws to be created could make it easy for a parent to setup the account for a child (most children this days have mobile stuff and consoles so they could start with those), we just need the browsers to read the age flag from the OS and put it in a header, then the websites owners can respect that flag. I know that someone would say that some clever teen would crack their locked down windows/linux to change the flag but this is a super rare case, we should start with the 99% cases, mobile phones and consoles are already locked down so an OS API that tells the browser if this is an child account and a browser header would solve the issue, most porn websites or similar adult sites would have no reason not to respect this header , it would make their job easier then say Steam having to always popup a birth date thing when a game is mature.
      - himata4113 7mo ago
        That's why I suggested kernel enforced security (simple syscall) that applications could implement and are incredibly hard to spoof / create tools and workarounds for, but I got downvoted to hell. Permission restricted registry entry (already exists) and a syscall that reads it (already exists) for windows and a file that requires sudo to edit (already exists) and a syscall to read it (already exists). Works on every distro automatically as well including android phones since they run the linux kernel anyway. Apple can figure it out and they already have appleid.
- heavyset_go 7mo ago
  > Having said that, open-source zero-knowledge proofs are infinitely less evil (I refuse to say "better") than commercial cloud-based age monitoring baked into every OS To be honest, I worry that the framing of this legislation and ZKP generally presents a false dichotomy, where second-option bias[1] prevails because of the draconian first option. There's always another option: don't implement age verification laws at all. App and website developers shouldn't be burdened with extra costly liability to make sure someone's kids don't read a curse word, parents can use the plethora of parental controls on the market if they're that worried. [1] https://rationalwiki.org/wiki/Appeal_to_the_minority#Second-option_bias https://rationalwiki.org/wiki/Appeal_to_the_minority#Second-...
  - verisimi 7mo ago
    > There's always another option: don't implement age verification laws at all. Where do you go to vote for this option?
  - ndriscoll 7mo ago
    > App and website developers shouldn't be burdened with extra costly liability Why not? Physical businesses have liability if they provide age restricted items to children. As far as I know, strip clubs are liable for who enters. Selling alcohol to a child carries personal criminal liability for store clerks. Assuming society decides to restrict something from children, why should online businesses be exempt? On who should be responsible, parents or businesses, historically the answer has been both. Parents have decision making authority. Businesses must not undermine that by providing service to minors.
    - MSFT_Edging 7mo ago
      > Physical businesses have liability if they provide age restricted items to children. These are often clear cut. They're physical controlled items. Tobacco, alcohol, guns, physical porn, and sometimes things like spray paint. The internet is not. There are people who believe discussions about human sexuality (ie "how do I know if I'm gay?") should be age restricted. There are people who believe any discussion about the human form should be age restricted. What about discussions of other forms of government? Plenty would prefer their children not be able to learn about communism from anywhere other than the Victims of Communism Memorial Foundation. The landscape of age restricting information is infinitely more complex than age restricting physical items. This complexity enables certain actors to censor wide swaths of information due to a provider's fear of liability. This is closer to a law that says "if a store sells an item that is used to damage property whatsoever, they are liable", so now the store owner must fear the full can of soda could be used to break a window.
- teekert 7mo ago
  "mechanism to enforce that is parental control on devices." Meh, I use it, but it's super annoying and I think that with my Daughter I'll take a different approach (but it will be some years before that is relevant). On Android: The kid can easily go on Snapchat (after approval of install of course, and then you can just see their "friends") before Pokemon Go (just a pain to get working, it keeps presenting some borked version which led to a lot of confusion at first). I just lied about his age in a bunch of places at some point. Snapchat is horrible and sick from our experiences in the first week. On Windows: It's a curated set of websites (and no FireFox) or access to everything. It's not even workable for just school. Granting kids access to our own minercraft servers: My god, I felt dirty about what the other parents had to go through to enable that.
  - epiccoleman 7mo ago
    > Granting kids access to our own minercraft servers: My god, I felt dirty about what the other parents had to go through to enable that. This is a hobby horse of mine to the point that coworkers probably wish I'd just stfu about Minecraft - but holy shit is it crazy how many different things you need to get right to get kids playing together. I genuinely have no idea how parents without years of "navigating technical bullshit" experience ever manage to make it happen. Juggling Microsoft accounts, Nintendo accounts, menu-diving through one of 37 different account details pages , Xbox accounts, GamePass subscriptions - it's just fucking crazy!
    - teekert 7mo ago
      I always wonder about this. I read most dialogs (as I do) but man, the sanity of most people must require that they just next next next this stuff right? Perhaps they even let their kids do it instead.
      - bcrosby95 7mo ago
        If you're using something like a fire tablet and you set them up as a kids account that's not how it works. If you next through everything your kid cannot play minecraft online, not even on your own little private server. Getting an actual kids account to work online with minecraft involves setting the right permissions across 2-4 websites and 1-3 companies. I think it took me around 4 hours of trial and error to get it working.
- lynx97 7mo ago
  Same here, EU citizen who thinks parents should do some parenting, after all. However, try to confront "modern" parents with your position. Many of them will fight you immediately, because they think the state is supposed to do their work... Its a very concerning development.
- Pxtl 7mo ago
  > My stance is that if somebody is a minor, his/her/their parents/tutors/legal guardian are responsible for what they can/cannot do online, and that the mechanism to enforce that is parental control on devices. Imho there is a place for regulation in that, actually. Devices that parents are managing as child devices could include an OS API and browser HTTP header for "hey is this a child?" These devices are functionally adminned by the parent so the owner of the device is still in control, just not the user. Just like the cookie thing - these things should all be HTTP headers. "This site is requesting your something, do you want to send it? Y/N [X] remember my choice." Do that for GPS, browser fingerprint, off-domain tracking cookies (not the stupid cookie banner), adulthood information, etc. It would be perfectly reasonable for the EU to legislate that. "OS and browsers are required to offer an API to expose age verification status of the client, and the device is required to let an administrative user set it, and provide instructions to parents on how to lock down a device such that their child user's device will be marked as a child without the ability for the child to change it". Either way, though, I'm far more worried about children being radicalized online by political extremists than I am about them occasionally seeing a penis. And a lot of radicalizing content is not considered "adult".
- soulofmischief 7mo ago
  I'll go further. As a human being, I am responsible for myself. I grew up in an extremely abusive, impoverished, cult-like religious home where anything not approved by White Jesus was disallowed. I owe everything about who I am today to learning how to circumvent firewalls and other forms of restriction. I would almost certainly be dead if I hadn't learned to socialize and program on the web despite it being strictly forbidden at home. Most of my interests, politics and personality were forged at 2am, as quiet as possible, browsing the web on live discs. I now support myself through those interests. We're so quick to forget that kids are people, too. And today, they often know how to safely navigate the internet better than their aging caretakers who have allowed editorial "news" and social media to warp their minds. Even for people who think they're really doing a good thing by supporting these kinds of insane laws that are designed to restrict our 1A rights: the road to hell is paved with good intentions.
  - duskdozer 7mo ago
    This is obviously where it's going to go, at least in the US. Things that are non-religious, non-Christian especially, pro-LGBT, and similar will be disproportionately pulled under "adult content" to ensure that children are not able to be exposed to unapproved ideas during formative years.
    - soulofmischief 7mo ago
      Exactly. Having lived through it already, I know what it did to me and I would never wish that upon another child. The internet saved me from being a religious, colonial, racist piece of shit like the rest of my family.
      - rustystump 7mo ago
        [flagged]
        soulofmischief 7mo ago
        Did you have an actual point to make or did you just choose two random words and hurl an insult with zero context? Were you looking for an actual discussion or is this all you had to offer?
- module1973 7mo ago
  that is correct the parents are meant to pass on morals and parent the child. If the parents fall through, there is the community such as church, neighbors, schools etc. The absolute last resort is government or law enforcement intervention, and this should be considered an extreme situation. But as John Adams noted, "Our Constitution was made only for a moral and religious people" -- in other words, all these laws start to rip at the seams when the fabric of society, the people who make up the society no longer have morals. But I appreciate this article in general, we need to fight against mass surveilance at all costs.
  - pixl97 7mo ago
    >all these laws start to rip at the seams when the fabric of society, the people who make up the society no longer have morals Morals like owning slaves, right? A moral system that requires everyone to be white Christian males isn't a moral system, it's a theocracy.
axegon_ 7mo ago
Though the EU is at large keeping it's composure with this. My only criticism towards the EU as an EU citizen is how slow and bureaucratic the EU is and that decisions that should be made on the fly are dragged on forever. That said, government agencies have been doing a terrible job at keeping the private information of citizens safe. But it is nowhere nearly as bad as the US. My best childhood friend died in very questionable circumstances in 2009 in the US in very questionable circumstances. He had a US citizenship and we never really found out what had happened(to the point where we never really got any definitive proof that he had died). But that didn't stop me from trying and I was blown away by the fact that I could log into a US government website, register with a burner mail, pay 2 bucks with an anonymous gift credit/debit card and get a scanned copy of his death certificate in my email. And I didn't even have to provide his passport/id/anything. Just his name. Point is, the US has been terrible at privacy for as long as I can remember. It is probably worse now with Facebook and Ellison holding TikTok.
- pjc50 7mo ago
  The critical thing is not so much "Americans" as "big money". Big Russian money is also a threat. Big Chinese money .. well, there's a bit of that about, but it doesn't seem to have shown up at the legislation influencing layer.
  - axegon_ 7mo ago
    Oh, that's a different topic: as someone from and living in eastern Europe, there's not a single doubt in my mind that the biggest threat to any civilization is russia by a long shot. The alarming part is that the current US administration hasn't got a single clue of history, suffers from chronic incompetence and the whole superiority complex and fanboying russia as a consequence - those pose a threat. In the context of the conversation, the incompetence is arguably the biggest facepalm moment.
    - lionkor 7mo ago
      > the biggest threat to any civilization is russia Surely you meant this as hyperbole, right? If not, I would love your reasoning as to why its a bigger threat than literally anything and anyone else.
mrob 7mo ago
Zero-knowledge proofs are unworkable for age verification because they can't prevent use of somebody else's credentials.
- a022311 7mo ago
  The same argument could be said for other age verification methods. Nothing stops a kid from getting their older cousin to verify their identity for something and it will never be possible to prevent this.
  - mrob 7mo ago
    The people proposing these laws presumably think imperfect enforcement is better than no enforcement at all. In the non-zero-knowledge case, it's possible to revoke falsely shared credentials.
    - Aurornis 7mo ago
      > In the non-zero-knowledge case, it's possible to revoke falsely shared credentials. In a true zero-knowledge system sharing falsely shared credentials becomes easy because it’s untraceable. If the proof has no knowledge attached, you can’t conclude who used their credentials on a website that generates proof-of-age tokens on demand for visitors.
      - mrob 7mo ago
        Yes, that's exactly why it can't work.
  - gzread 7mo ago
    The one where the root user can enable parental controls requires the kid to know their parent's password or save up to buy their own device.
    - iamnothere 7mo ago
      Oh no, a $20 Walmart phone, how will they ever afford it. (Note, this is why they won’t stop at the CA bill.)
choo-t 7mo ago
Even with ZKP this is still highly problematic, it create difficulty for undocumented people to access the web, create ton of phishing opportunity, reinforce censorship on most site (as they will now all need to be minor compliant or need age verification), reinforce the chilling effect and make the web even less crawlable/archivable (or you need to give a valid citizen ID to your crawler/archiver). With no proof it will protect anyone from proven harm.
- gruez 7mo ago
  >it create difficulty for undocumented people to access the web Why is this such a sticking point in US politics? If the "undocumented" people aren't supposed to be in the country in the first place, why should rest of society cater to them? Even if you're against age verification for other reasons, dragging in the immigration angle is just going to alienate the other half of the population who don't share your view on undocumented people, and is a great way to turn a non-partisan issue into a partisan one. It's kind of like campaigning for medicare for all, and then listing "free abortions and gender affirming surgery" as one of the arguments for it.
  - ryandrake 7mo ago
    There are many ways to not have a state or national ID document in the USA. You might simply not have a driver license or passport. That's totally legal. You might be in the country temporarily for business or as a tourist. The constitution applies to all of these people.
    - gruez 7mo ago
      >There are many ways to not have a state or national ID document in the USA. You might simply not have a driver license or passport. That's totally legal. Great, frame it as "poor people without IDs" or whatever, not "undocumented", which in the current political discourse is basically the left's version of the term "illegal immigrant". >You might be in the country temporarily for business or as a tourist. The constitution applies to all of these people. The constitutional right to... watch 18+ videos on youtube while in the US?
attila-lendvai 7mo ago
it's not about protecting children. that's only the PR. once you get this you stop asking why the tech details are the way they are.
- edgyquant 7mo ago
  Counterpoint: yes it is
  - officeplant 7mo ago
    Countercounterpoint: It's privacy destruction creep and it always has been.
    - gzread 7mo ago
      Countercountercounterpoint: did you actually read the California age "verification" law?
      - officeplant 7mo ago
        Countercountercountercounterpoint: Yes and like every other age verification scheme in the US the underlying idea is privacy erosion. With a side serving of censorship given most dev's can't be bothered to implement these age verification schemes into their software so users might just end up gated out of applications if their OS goes through with this nonsense. Other states are even worse, creating another way to have your buddy buddy lobbyist folks fire up a new business opportunity to make money as a verification service.
        gzread 7mo ago
        Type in the number 30 to disable gating
keybored 7mo ago
Two billion in lobbying. And the conclusion is that regulation is the problem?
gzread 7mo ago
No, the way to go is the California way. The device owner (root user) can enter the age of the user. Restrictions are applied based on that. Nothing is verified.
- EmbarrassedHelp 7mo ago
  That way should be paired with "adult by default". So that No age data means adult.
totetsu 7mo ago
Seeming as this affect everyone .. Is there anything like and Open Collective .. grassroots consortium, to put together strong sensible zero-knowledge proof based policy examples that could be given to law-makers instead of this shadowy surveillance Trojan horse nonsense?
- EmbarrassedHelp 7mo ago
  The real answer is that there is no solution to the problem other than what basically amounts to better parental controls.
jmyeet 7mo ago
Not sure what the Gruber thing is about. I guess I lack context. But on ZKP, I will agree but add this: The only authority that can be trusted to do age verification is the government. You know, those people who give you birth certificates, passports, SSNs, driver's licenses, etc. The idea that parental supervision here is sufficient has been shown to be wholly inadequate. I'm sorry but that train has sailed. Age verification is coming. It's just a question of who does it and what form it takes. Take Youtube, for example. I think it should work like this: 1. If you're not of sufficient age, you simply don't see comments. At all; 2. Minors shouldn't see ads. At all; 3. Videos deemed to have age-restricted content should be visible; 4. If you're not logged in, you're treated as an age-restricted user; and 5. Viewing via a VPN means you need age verification regardless of your country of origin. It's not perfect. It doesn't have to be.
ori_b 7mo ago
The way to go for this kind of thing is to not go for this kind of thing at all.
zoobab 7mo ago
"how terrible EU regulation is" Judges in other countries (Texas) found out this kind of law was a violation of the Free Speech. Since when Free Speech do not apply to -16y old? Made laws are made, then killed by courts later one.
alecco 7mo ago
You are missing the point. The real purpose is to control the Internet and free speech. They've been trying this for ages. Now the excuse is protecting children. Soon terrorism will be back. And don't forget aոtisеmіtism, too. Not exactly a good moment for this particular caste of politicians/elites to pretend they care about children's well-being!
- everdrive 7mo ago
  The internet we grew up with is nearly gone. For my part I've downloaded most of what I want and am trying to move more towards physical books. I think in the future, the internet could be a lot like cable TV. The value it brings is not worth the costs it imposes.
Aurornis 7mo ago
> Zero-knowledge proofs are the way to go for this type of thing, The benefit of zero-knowledge proofs is that the hide information about the ID and who it belongs to. That’s also a limitation for how useful they are as an ID check mechanism. At the extreme, it reduces to “this user has access to an ID of someone 18+”. If there is truly a zero-knowledge construction using cryptographic primitives then the obvious next step is for someone to create an ad-supported web site where you click a button and they generate a zero-knowledge token from their ID for you to use. Zero knowledge means it can’t be traced back to them. The entire system is defeated. This always attracts the rebuttal of “there will always be abuse, so what?” but when abuse becomes 1-click and accessible to every child who can Google, it’s not a little bit of abuse. It’s just security theater. So the real cryptographic ID implementations make compromises to try to prevent this abuse. You might be limited to 3 tokens at a time and you have to request them from a central government mechanism which can log requests for rate limiting purposes. That’s better but the zero-knowledge part is starting to be weakened and now your interactions with private services require an interaction with a government server. It’s just not a simple problem that can be solved with cryptographic primitives while also achieving the actual ID goals of these laws.
EmbarrassedHelp 7mo ago
Zero-knowledge proofs are only anonymous in theory if you ignore the issue of requiring a third party, and the issue of implementations. And according to the EU Identity Wallet's documentation, the EU's planned system requires highly invasive age verification to obtain 30 single use, easily trackable tokens that expire after 3 months. It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". You have to blindly trust that the tokens will not be tracked, which is a total no-go for privacy. These massive privacy issues have all been raised on their Github, and the team behind the wallet have been ignoring them.

by jwr 7mo ago

cosmos0072 7mo ago

I am from EU, and contrary to age verification laws in general. My stance is that if somebody is a minor, his/her/their parents/tutors/legal guardian are responsible for what they can/cannot do online, and that the mechanism to enforce that is parental control on devices. Having said that, open-source zero-knowledge proofs are infinitely less evil (I refuse to say "better") than commercial cloud-based age monitoring baked into every OS

croes 7mo ago
You could make the same case for parental control as evil. "You‘re reading about evolution! Not in my house"
- cosmos0072 7mo ago
  Parents already have a lot of control on children' education. Examples: most children believe in the same religion as their parents, and can visit friends and places only if/when allowed by their parents. This is simply extending the same level of control to the internet. Government-mandated restrictions are completely another level.
  - croes 7mo ago
    Who controls your age if you try to buy alcohol. Who controls your age if you want to see an R-rated movie? This is simply extending the same level of control to the internet. More control for parents is a completely different level.
    - applfanboysbgon 7mo ago
      Disingenuous, but I'm sure you know that and were being intentionally so. The government is not using alcohol age laws as a justification to place a camera in your bedroom to make sure you aren't sneaking booze, but it is using internet age laws as a justification to surveil your entire life in a world which is becoming increasingly digital-mandatory to participate in government services or the economy. Nobody had a problem with internet age laws when "are you over 13? yes/no" was legally sufficient.
      - croes 7mo ago
        You‘re missing the point > Having said that, open-source zero-knowledge proofs are infinitely less evil (I refuse to say "better") than commercial cloud-based age monitoring baked into every OS Parent prefers more control by parents over zero-knowledge proof
        applfanboysbgon 7mo ago
        If that was your point, I don't think your previous comment did a very good job of making it at all. I do think parental controls can be and are abused for evil, but they're still better than the alternative. Zero-knowledge proof is not an alternative, and to suggest that it is is misunderstanding the situation. These laws are proposed and funded by people who want complete surveillance of the population. Zero-knowledge proof is, therefore, explicitly contrary to the goal and will never be implemented under any circumstances. Suggesting that it can be muddies the issue and tricks people into supporting legislation that exists only to be used against them. In a benevolent dictatorship, sure, go for a zero-knowledge proof verification as your solution. In the reality of democracy, where politicians are corporate puppets who cloak surveillance laws in "think of the children" to rally support from the masses, we need to convince people to see through the lie and reject the proposals outright while reassuring them that they can protect the children themselves via parental controls. You will never be able to sufficiently inform 50.1% of the population of any country of what zero-knowledge proof even means, let alone convince them to support age verification laws but strictly conditional on ZKP requirements. That level of nuance is far too much to ask of millions of people who are not technically-informed, and idealism needs to give way to pragmatism if we wish to avoid the worst-case scenario.
  - edgyquant 7mo ago
    I have personally worked with parents trying to prevent their children from using social media and it’s nearly impossible. Kids are almost always more tech savvy than their parents and unlike smoking it’s nearly impossible to tell a child is doing so without watching them 100% of the time.
tasuki 7mo ago
> My stance is that if somebody is a minor, his/her/their parents/tutors/legal guardian are responsible for what they can/cannot do online As a parent, sure, that is my stance as well. What... what other stances are there even? How would they work?
- Markoff 7mo ago
  ignore parent, outsource parenting to gov verification authority TBH many parents done exactly that by giving phones/tablet already to kids in strollers
  - graemep 7mo ago
    The latter is true, but we cannot regulate the vast majority of parents on the basis of the worst.
- pjc50 7mo ago
  The steelman argument is that parents are not necessarily up to date on the technology, and cannot reasonably be expected to supervise teenagers 24/7 up to the age of 18. Compare movie ratings or alcohol laws, for example: there's a non-parental obligation on third parties not to provide alcohol to children or let them in to R18 showings. But the implementation matters, and almost all of these bills internationally are being done in bad faith by coordinated big-money groups against technologically illiterate and reactionary populist governments. (if we really want to get into an argument, there's what the UK calls "Gillick competence": the ability of children to seek medical treatment without the knowledge and against the will of their parents)
  - _heimdall 7mo ago
    That steelman still stands on a core assumption that its both the state's responsibility and right to step in and parent on everyone's behalf. Maybe a majority of people today agree with that, but I know I don't and I never hear that assumption debated directly.
    - 7mo ago
himata4113 7mo ago
Yes! This is the way, give parents the ABILITY to advertise the users age to browsers, apps and everything in between. Only target cooperations, do not target open source projects. Fine websites for not using this API (ex: porn sites). Assume an adult if not present.
- idiotsecant 7mo ago
  This is a great solution to the stated problem. The issue is that nobody is actually trying to solve the stated problem. This is a terrible solution to the real 'problem' which is the lack of surveillance power and information control.
  - simion314 7mo ago
    >This is a great solution to the stated problem. The issue is that nobody is actually trying to solve the stated problem. This is a terrible solution to the real 'problem' which is the lack of surveillance power and information control. So on the Sony consoles I created an account for my child and guess what they have implemented some stuff to block children from adult content on some stuff. So if Big Tech would actually want to prevent laws to be created could make it easy for a parent to setup the account for a child (most children this days have mobile stuff and consoles so they could start with those), we just need the browsers to read the age flag from the OS and put it in a header, then the websites owners can respect that flag. I know that someone would say that some clever teen would crack their locked down windows/linux to change the flag but this is a super rare case, we should start with the 99% cases, mobile phones and consoles are already locked down so an OS API that tells the browser if this is an child account and a browser header would solve the issue, most porn websites or similar adult sites would have no reason not to respect this header , it would make their job easier then say Steam having to always popup a birth date thing when a game is mature.
    - himata4113 7mo ago
      That's why I suggested kernel enforced security (simple syscall) that applications could implement and are incredibly hard to spoof / create tools and workarounds for, but I got downvoted to hell. Permission restricted registry entry (already exists) and a syscall that reads it (already exists) for windows and a file that requires sudo to edit (already exists) and a syscall to read it (already exists). Works on every distro automatically as well including android phones since they run the linux kernel anyway. Apple can figure it out and they already have appleid.
heavyset_go 7mo ago
> Having said that, open-source zero-knowledge proofs are infinitely less evil (I refuse to say "better") than commercial cloud-based age monitoring baked into every OS To be honest, I worry that the framing of this legislation and ZKP generally presents a false dichotomy, where second-option bias[1] prevails because of the draconian first option. There's always another option: don't implement age verification laws at all. App and website developers shouldn't be burdened with extra costly liability to make sure someone's kids don't read a curse word, parents can use the plethora of parental controls on the market if they're that worried. [1] https://rationalwiki.org/wiki/Appeal_to_the_minority#Second-option_bias https://rationalwiki.org/wiki/Appeal_to_the_minority#Second-...
- verisimi 7mo ago
  > There's always another option: don't implement age verification laws at all. Where do you go to vote for this option?
- ndriscoll 7mo ago
  > App and website developers shouldn't be burdened with extra costly liability Why not? Physical businesses have liability if they provide age restricted items to children. As far as I know, strip clubs are liable for who enters. Selling alcohol to a child carries personal criminal liability for store clerks. Assuming society decides to restrict something from children, why should online businesses be exempt? On who should be responsible, parents or businesses, historically the answer has been both. Parents have decision making authority. Businesses must not undermine that by providing service to minors.
  - MSFT_Edging 7mo ago
    > Physical businesses have liability if they provide age restricted items to children. These are often clear cut. They're physical controlled items. Tobacco, alcohol, guns, physical porn, and sometimes things like spray paint. The internet is not. There are people who believe discussions about human sexuality (ie "how do I know if I'm gay?") should be age restricted. There are people who believe any discussion about the human form should be age restricted. What about discussions of other forms of government? Plenty would prefer their children not be able to learn about communism from anywhere other than the Victims of Communism Memorial Foundation. The landscape of age restricting information is infinitely more complex than age restricting physical items. This complexity enables certain actors to censor wide swaths of information due to a provider's fear of liability. This is closer to a law that says "if a store sells an item that is used to damage property whatsoever, they are liable", so now the store owner must fear the full can of soda could be used to break a window.
teekert 7mo ago
"mechanism to enforce that is parental control on devices." Meh, I use it, but it's super annoying and I think that with my Daughter I'll take a different approach (but it will be some years before that is relevant). On Android: The kid can easily go on Snapchat (after approval of install of course, and then you can just see their "friends") before Pokemon Go (just a pain to get working, it keeps presenting some borked version which led to a lot of confusion at first). I just lied about his age in a bunch of places at some point. Snapchat is horrible and sick from our experiences in the first week. On Windows: It's a curated set of websites (and no FireFox) or access to everything. It's not even workable for just school. Granting kids access to our own minercraft servers: My god, I felt dirty about what the other parents had to go through to enable that.
- epiccoleman 7mo ago
  > Granting kids access to our own minercraft servers: My god, I felt dirty about what the other parents had to go through to enable that. This is a hobby horse of mine to the point that coworkers probably wish I'd just stfu about Minecraft - but holy shit is it crazy how many different things you need to get right to get kids playing together. I genuinely have no idea how parents without years of "navigating technical bullshit" experience ever manage to make it happen. Juggling Microsoft accounts, Nintendo accounts, menu-diving through one of 37 different account details pages , Xbox accounts, GamePass subscriptions - it's just fucking crazy!
  - teekert 7mo ago
    I always wonder about this. I read most dialogs (as I do) but man, the sanity of most people must require that they just next next next this stuff right? Perhaps they even let their kids do it instead.
    - bcrosby95 7mo ago
      If you're using something like a fire tablet and you set them up as a kids account that's not how it works. If you next through everything your kid cannot play minecraft online, not even on your own little private server. Getting an actual kids account to work online with minecraft involves setting the right permissions across 2-4 websites and 1-3 companies. I think it took me around 4 hours of trial and error to get it working.
lynx97 7mo ago
Same here, EU citizen who thinks parents should do some parenting, after all. However, try to confront "modern" parents with your position. Many of them will fight you immediately, because they think the state is supposed to do their work... Its a very concerning development.
Pxtl 7mo ago
> My stance is that if somebody is a minor, his/her/their parents/tutors/legal guardian are responsible for what they can/cannot do online, and that the mechanism to enforce that is parental control on devices. Imho there is a place for regulation in that, actually. Devices that parents are managing as child devices could include an OS API and browser HTTP header for "hey is this a child?" These devices are functionally adminned by the parent so the owner of the device is still in control, just not the user. Just like the cookie thing - these things should all be HTTP headers. "This site is requesting your something, do you want to send it? Y/N [X] remember my choice." Do that for GPS, browser fingerprint, off-domain tracking cookies (not the stupid cookie banner), adulthood information, etc. It would be perfectly reasonable for the EU to legislate that. "OS and browsers are required to offer an API to expose age verification status of the client, and the device is required to let an administrative user set it, and provide instructions to parents on how to lock down a device such that their child user's device will be marked as a child without the ability for the child to change it". Either way, though, I'm far more worried about children being radicalized online by political extremists than I am about them occasionally seeing a penis. And a lot of radicalizing content is not considered "adult".
soulofmischief 7mo ago
I'll go further. As a human being, I am responsible for myself. I grew up in an extremely abusive, impoverished, cult-like religious home where anything not approved by White Jesus was disallowed. I owe everything about who I am today to learning how to circumvent firewalls and other forms of restriction. I would almost certainly be dead if I hadn't learned to socialize and program on the web despite it being strictly forbidden at home. Most of my interests, politics and personality were forged at 2am, as quiet as possible, browsing the web on live discs. I now support myself through those interests. We're so quick to forget that kids are people, too. And today, they often know how to safely navigate the internet better than their aging caretakers who have allowed editorial "news" and social media to warp their minds. Even for people who think they're really doing a good thing by supporting these kinds of insane laws that are designed to restrict our 1A rights: the road to hell is paved with good intentions.
- duskdozer 7mo ago
  This is obviously where it's going to go, at least in the US. Things that are non-religious, non-Christian especially, pro-LGBT, and similar will be disproportionately pulled under "adult content" to ensure that children are not able to be exposed to unapproved ideas during formative years.
  - soulofmischief 7mo ago
    Exactly. Having lived through it already, I know what it did to me and I would never wish that upon another child. The internet saved me from being a religious, colonial, racist piece of shit like the rest of my family.
    - rustystump 7mo ago
      [flagged]
      - soulofmischief 7mo ago
        Did you have an actual point to make or did you just choose two random words and hurl an insult with zero context? Were you looking for an actual discussion or is this all you had to offer?
module1973 7mo ago
that is correct the parents are meant to pass on morals and parent the child. If the parents fall through, there is the community such as church, neighbors, schools etc. The absolute last resort is government or law enforcement intervention, and this should be considered an extreme situation. But as John Adams noted, "Our Constitution was made only for a moral and religious people" -- in other words, all these laws start to rip at the seams when the fabric of society, the people who make up the society no longer have morals. But I appreciate this article in general, we need to fight against mass surveilance at all costs.
- pixl97 7mo ago
  >all these laws start to rip at the seams when the fabric of society, the people who make up the society no longer have morals Morals like owning slaves, right? A moral system that requires everyone to be white Christian males isn't a moral system, it's a theocracy.

axegon_ 7mo ago

Though the EU is at large keeping it's composure with this. My only criticism towards the EU as an EU citizen is how slow and bureaucratic the EU is and that decisions that should be made on the fly are dragged on forever. That said, government agencies have been doing a terrible job at keeping the private information of citizens safe. But it is nowhere nearly as bad as the US. My best childhood friend died in very questionable circumstances in 2009 in the US in very questionable circumstances. He had a US citizenship and we never really found out what had happened(to the point where we never really got any definitive proof that he had died). But that didn't stop me from trying and I was blown away by the fact that I could log into a US government website, register with a burner mail, pay 2 bucks with an anonymous gift credit/debit card and get a scanned copy of his death certificate in my email. And I didn't even have to provide his passport/id/anything. Just his name. Point is, the US has been terrible at privacy for as long as I can remember. It is probably worse now with Facebook and Ellison holding TikTok.

pjc50 7mo ago
The critical thing is not so much "Americans" as "big money". Big Russian money is also a threat. Big Chinese money .. well, there's a bit of that about, but it doesn't seem to have shown up at the legislation influencing layer.
- axegon_ 7mo ago
  Oh, that's a different topic: as someone from and living in eastern Europe, there's not a single doubt in my mind that the biggest threat to any civilization is russia by a long shot. The alarming part is that the current US administration hasn't got a single clue of history, suffers from chronic incompetence and the whole superiority complex and fanboying russia as a consequence - those pose a threat. In the context of the conversation, the incompetence is arguably the biggest facepalm moment.
  - lionkor 7mo ago
    > the biggest threat to any civilization is russia Surely you meant this as hyperbole, right? If not, I would love your reasoning as to why its a bigger threat than literally anything and anyone else.

mrob 7mo ago

Zero-knowledge proofs are unworkable for age verification because they can't prevent use of somebody else's credentials.

a022311 7mo ago
The same argument could be said for other age verification methods. Nothing stops a kid from getting their older cousin to verify their identity for something and it will never be possible to prevent this.
- mrob 7mo ago
  The people proposing these laws presumably think imperfect enforcement is better than no enforcement at all. In the non-zero-knowledge case, it's possible to revoke falsely shared credentials.
  - Aurornis 7mo ago
    > In the non-zero-knowledge case, it's possible to revoke falsely shared credentials. In a true zero-knowledge system sharing falsely shared credentials becomes easy because it’s untraceable. If the proof has no knowledge attached, you can’t conclude who used their credentials on a website that generates proof-of-age tokens on demand for visitors.
    - mrob 7mo ago
      Yes, that's exactly why it can't work.
- gzread 7mo ago
  The one where the root user can enable parental controls requires the kid to know their parent's password or save up to buy their own device.
  - iamnothere 7mo ago
    Oh no, a $20 Walmart phone, how will they ever afford it. (Note, this is why they won’t stop at the CA bill.)

choo-t 7mo ago

Even with ZKP this is still highly problematic, it create difficulty for undocumented people to access the web, create ton of phishing opportunity, reinforce censorship on most site (as they will now all need to be minor compliant or need age verification), reinforce the chilling effect and make the web even less crawlable/archivable (or you need to give a valid citizen ID to your crawler/archiver). With no proof it will protect anyone from proven harm.

gruez 7mo ago
>it create difficulty for undocumented people to access the web Why is this such a sticking point in US politics? If the "undocumented" people aren't supposed to be in the country in the first place, why should rest of society cater to them? Even if you're against age verification for other reasons, dragging in the immigration angle is just going to alienate the other half of the population who don't share your view on undocumented people, and is a great way to turn a non-partisan issue into a partisan one. It's kind of like campaigning for medicare for all, and then listing "free abortions and gender affirming surgery" as one of the arguments for it.
- ryandrake 7mo ago
  There are many ways to not have a state or national ID document in the USA. You might simply not have a driver license or passport. That's totally legal. You might be in the country temporarily for business or as a tourist. The constitution applies to all of these people.
  - gruez 7mo ago
    >There are many ways to not have a state or national ID document in the USA. You might simply not have a driver license or passport. That's totally legal. Great, frame it as "poor people without IDs" or whatever, not "undocumented", which in the current political discourse is basically the left's version of the term "illegal immigrant". >You might be in the country temporarily for business or as a tourist. The constitution applies to all of these people. The constitutional right to... watch 18+ videos on youtube while in the US?

attila-lendvai 7mo ago

it's not about protecting children. that's only the PR. once you get this you stop asking why the tech details are the way they are.

edgyquant 7mo ago
Counterpoint: yes it is
- officeplant 7mo ago
  Countercounterpoint: It's privacy destruction creep and it always has been.
  - gzread 7mo ago
    Countercountercounterpoint: did you actually read the California age "verification" law?
    - officeplant 7mo ago
      Countercountercountercounterpoint: Yes and like every other age verification scheme in the US the underlying idea is privacy erosion. With a side serving of censorship given most dev's can't be bothered to implement these age verification schemes into their software so users might just end up gated out of applications if their OS goes through with this nonsense. Other states are even worse, creating another way to have your buddy buddy lobbyist folks fire up a new business opportunity to make money as a verification service.
      - gzread 7mo ago
        Type in the number 30 to disable gating

keybored 7mo ago

Two billion in lobbying. And the conclusion is that regulation is the problem?

gzread 7mo ago

No, the way to go is the California way. The device owner (root user) can enter the age of the user. Restrictions are applied based on that. Nothing is verified.

EmbarrassedHelp 7mo ago
That way should be paired with "adult by default". So that No age data means adult.

totetsu 7mo ago

Seeming as this affect everyone .. Is there anything like and Open Collective .. grassroots consortium, to put together strong sensible zero-knowledge proof based policy examples that could be given to law-makers instead of this shadowy surveillance Trojan horse nonsense?

EmbarrassedHelp 7mo ago
The real answer is that there is no solution to the problem other than what basically amounts to better parental controls.

jmyeet 7mo ago

Not sure what the Gruber thing is about. I guess I lack context. But on ZKP, I will agree but add this: The only authority that can be trusted to do age verification is the government. You know, those people who give you birth certificates, passports, SSNs, driver's licenses, etc. The idea that parental supervision here is sufficient has been shown to be wholly inadequate. I'm sorry but that train has sailed. Age verification is coming. It's just a question of who does it and what form it takes. Take Youtube, for example. I think it should work like this: 1. If you're not of sufficient age, you simply don't see comments. At all; 2. Minors shouldn't see ads. At all; 3. Videos deemed to have age-restricted content should be visible; 4. If you're not logged in, you're treated as an age-restricted user; and 5. Viewing via a VPN means you need age verification regardless of your country of origin. It's not perfect. It doesn't have to be.

ori_b 7mo ago

The way to go for this kind of thing is to not go for this kind of thing at all.

zoobab 7mo ago

"how terrible EU regulation is" Judges in other countries (Texas) found out this kind of law was a violation of the Free Speech. Since when Free Speech do not apply to -16y old? Made laws are made, then killed by courts later one.

alecco 7mo ago

You are missing the point. The real purpose is to control the Internet and free speech. They've been trying this for ages. Now the excuse is protecting children. Soon terrorism will be back. And don't forget aոtisеmіtism, too. Not exactly a good moment for this particular caste of politicians/elites to pretend they care about children's well-being!

everdrive 7mo ago
The internet we grew up with is nearly gone. For my part I've downloaded most of what I want and am trying to move more towards physical books. I think in the future, the internet could be a lot like cable TV. The value it brings is not worth the costs it imposes.

Aurornis 7mo ago

> Zero-knowledge proofs are the way to go for this type of thing, The benefit of zero-knowledge proofs is that the hide information about the ID and who it belongs to. That’s also a limitation for how useful they are as an ID check mechanism. At the extreme, it reduces to “this user has access to an ID of someone 18+”. If there is truly a zero-knowledge construction using cryptographic primitives then the obvious next step is for someone to create an ad-supported web site where you click a button and they generate a zero-knowledge token from their ID for you to use. Zero knowledge means it can’t be traced back to them. The entire system is defeated. This always attracts the rebuttal of “there will always be abuse, so what?” but when abuse becomes 1-click and accessible to every child who can Google, it’s not a little bit of abuse. It’s just security theater. So the real cryptographic ID implementations make compromises to try to prevent this abuse. You might be limited to 3 tokens at a time and you have to request them from a central government mechanism which can log requests for rate limiting purposes. That’s better but the zero-knowledge part is starting to be weakened and now your interactions with private services require an interaction with a government server. It’s just not a simple problem that can be solved with cryptographic primitives while also achieving the actual ID goals of these laws.

EmbarrassedHelp 7mo ago

Zero-knowledge proofs are only anonymous in theory if you ignore the issue of requiring a third party, and the issue of implementations. And according to the EU Identity Wallet's documentation, the EU's planned system requires highly invasive age verification to obtain 30 single use, easily trackable tokens that expire after 3 months. It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". You have to blindly trust that the tokens will not be tracked, which is a total no-go for privacy. These massive privacy issues have all been raised on their Github, and the team behind the wallet have been ignoring them.