3 ms·

Any age verification should come with an OAUTH style government run API. The idea being you verify your ID with the government, and the service that required ag

Any age verification should come with an OAUTH style government run API. The idea being you verify your ID with the government, and the service that required age verification gets back a true or false for does this user meet this age requirement. That way the amount of data shared is kept to a minimum. The UK, and Brazil who passed a similar law, 'cheated' by just forcing private companies to figure it out.

Trekkie101-B 7mo ago
UK Gov sometimes likes to do things in very awkward ways, against any sort of worldly grain established. See the covid app. However my Apple ID verified me based on my account age, I didn't need to provide anything.
hedora 7mo ago
If the US had this, Trump would definitely be using it right now to send ICE to arrest people that said mean things about him on social media, didn't drop out of college, didn't bribe him enough, etc.
irusensei 7mo ago
Ironic that Brazil government tends to pay lip service to digital sovereignty while forcing their own citizens to handle their data to Zuckerberg and Peter Thiel.
xnorswap 7mo ago
Some kind of Digital ID? The UK government proposed that and was met by the usual resistance to it.
uyzstvqs 7mo ago
No, this is an absolutely terrible idea. You're suggesting a giant, centralized, government-run data silo, with all of your online activity tied to your real-world ID. This is far worse for privacy than any data broker, it's hard to even compare. Honestly I'd rather have private companies figure it out. Then at least you'll get multiple options, including from privacy-first companies. But that still sucks, and my preference strongly goes towards OS-level Age Indication. Just as effective in practice, 100% private and offline.
- iAMkenough 7mo ago
  Doesn't that exist in the U.S. already? DOGE worked to create the "one big, beautiful database" and now the federal government is buying information about citizens from data brokers.
- ApolloFortyNine 7mo ago
  >No, this is an absolutely terrible idea. You're suggesting a giant, centralized, government-run data silo, with all of your online activity tied to your real-world ID. This is far worse for privacy than any data broker, it's hard to even compare. Not all your online activity, even if they kept logs it would be something like 'this site asked for age verification, we said yes'. So they would have a list of sites, if they stored them and were allowed to store them. Which is something they can get from your ISP regardless. It could be used for bad sure, lots of things can. In my perfect world this wouldn't exist at all like it hasn't for 30+ years. But putting the burden on private companies was always going to create other avenues for issues.
  - Jigsy 7mo ago
    As someone from the UK, do you honestly believe the UK government would be happy with just "true or false" data?
- dpkirchner 7mo ago
  Companies may get multiple options but you and I and Joe average are going to have to submit PII to several vendors chosen by someone else, exactly like the credit bureau system but without the regulations they have to follow. The fact that the powers-that-be need to understand but choose not to is that what they want is literally impossible, even with mandatory government blood screenings to access computers. Anything short of requiring identification per POST is inadequate. This whole thing is a fools' errand and we must not give any ground.
stavros 7mo ago
The EU is already implementing this in the best way it's ever going to be implemented: https://digital-strategy.ec.europa.eu/en/policies/eu-age-verification https://digital-strategy.ec.europa.eu/en/policies/eu-age-ver... I really don't like this perfect law enforcement future, but this EU initiative is about the best design one can have.
- vaginaphobic 7mo ago
  [dead]
- subscribed 7mo ago
  Almost. Their apps will only work on Apple and Google-controlled phones. There are no plans to allow separate, standard AOSP attestation methods for Android. Google's crooked* Play Integrity will be the only one. *crooked because it confirms Android 8 are safe and with full integrity, even when they're rooted, full of malware and present spoofed certificate.
  - stavros 7mo ago
    Really? Ugh, that's terrible. Teaches me to hope.
  - lern_too_spel 7mo ago
    Their reference apps only work on those phones, but these aren't required: https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui/issues/287#issuecomment-3124658054 https://github.com/eu-digital-identity-wallet/eudi-app-andro... The user of Play Integrity can choose to just block Android 8.
OkayPhysicist 7mo ago
Fuck that. California's way is the absolute maximum that should be done: When accounts get created on an operating system, allow the user to provide a completely unproven age. Then that age should be the only age check. If the goal really is to just help parents prevent their kids from accessing inappropriate material, that's plenty. Anything else, and you're admitting the real goal is Big Brother style surveillance.
g947o 7mo ago
Now your government knows you are a registered user of PornHub. It will be fun when (not if) the database is leaked.
- lern_too_spel 7mo ago
  I don't think they meant literally Oauth but instead that you can get a verification request from the party that needs your age verified, get it signed by the government, and then send the assertion back to the relying party. It's not necessary for the government to send the signed verification request directly to Pornhub. It's not even necessary for the government to sign the assertion itself. A trusted device (like most consumer phones) could store the identity locally after government verification and then sign assertions itself after biometric or PIN verification, which is what most proposals look like.
  - g947o 7mo ago
    I am not holding my breath.
drnick1 7mo ago
Wrong, because then that government knows exactly what services you have accessed. It's a huge and extremely dangerous privacy violation. The real solution to the age verification problem is not to have one. The Internet has existed for over 30 years without it; it's solution to a problem that does not exist.
marcosdumay 7mo ago
> The UK, and Brazil who passed a similar law, 'cheated' by just forcing private companies to figure it out. At least on the Brazilian case, it's outright illegal for a private company to implement the thing you are describing. So, if the government doesn't provide the service, there isn't much for them to figure out.
karel-3d 6mo ago
In EU we have EIDAS, at least in some countries. It works. But mostly just for actual citizens.

Trekkie101-B 7mo ago

UK Gov sometimes likes to do things in very awkward ways, against any sort of worldly grain established. See the covid app. However my Apple ID verified me based on my account age, I didn't need to provide anything.

hedora 7mo ago

If the US had this, Trump would definitely be using it right now to send ICE to arrest people that said mean things about him on social media, didn't drop out of college, didn't bribe him enough, etc.

irusensei 7mo ago

Ironic that Brazil government tends to pay lip service to digital sovereignty while forcing their own citizens to handle their data to Zuckerberg and Peter Thiel.

xnorswap 7mo ago

Some kind of Digital ID? The UK government proposed that and was met by the usual resistance to it.

uyzstvqs 7mo ago

No, this is an absolutely terrible idea. You're suggesting a giant, centralized, government-run data silo, with all of your online activity tied to your real-world ID. This is far worse for privacy than any data broker, it's hard to even compare. Honestly I'd rather have private companies figure it out. Then at least you'll get multiple options, including from privacy-first companies. But that still sucks, and my preference strongly goes towards OS-level Age Indication. Just as effective in practice, 100% private and offline.

iAMkenough 7mo ago
Doesn't that exist in the U.S. already? DOGE worked to create the "one big, beautiful database" and now the federal government is buying information about citizens from data brokers.
ApolloFortyNine 7mo ago
>No, this is an absolutely terrible idea. You're suggesting a giant, centralized, government-run data silo, with all of your online activity tied to your real-world ID. This is far worse for privacy than any data broker, it's hard to even compare. Not all your online activity, even if they kept logs it would be something like 'this site asked for age verification, we said yes'. So they would have a list of sites, if they stored them and were allowed to store them. Which is something they can get from your ISP regardless. It could be used for bad sure, lots of things can. In my perfect world this wouldn't exist at all like it hasn't for 30+ years. But putting the burden on private companies was always going to create other avenues for issues.
- Jigsy 7mo ago
  As someone from the UK, do you honestly believe the UK government would be happy with just "true or false" data?
dpkirchner 7mo ago
Companies may get multiple options but you and I and Joe average are going to have to submit PII to several vendors chosen by someone else, exactly like the credit bureau system but without the regulations they have to follow. The fact that the powers-that-be need to understand but choose not to is that what they want is literally impossible, even with mandatory government blood screenings to access computers. Anything short of requiring identification per POST is inadequate. This whole thing is a fools' errand and we must not give any ground.

stavros 7mo ago

The EU is already implementing this in the best way it's ever going to be implemented: https://digital-strategy.ec.europa.eu/en/policies/eu-age-verification https://digital-strategy.ec.europa.eu/en/policies/eu-age-ver... I really don't like this perfect law enforcement future, but this EU initiative is about the best design one can have.

vaginaphobic 7mo ago
[dead]
subscribed 7mo ago
Almost. Their apps will only work on Apple and Google-controlled phones. There are no plans to allow separate, standard AOSP attestation methods for Android. Google's crooked* Play Integrity will be the only one. *crooked because it confirms Android 8 are safe and with full integrity, even when they're rooted, full of malware and present spoofed certificate.
- stavros 7mo ago
  Really? Ugh, that's terrible. Teaches me to hope.
- lern_too_spel 7mo ago
  Their reference apps only work on those phones, but these aren't required: https://github.com/eu-digital-identity-wallet/eudi-app-android-wallet-ui/issues/287#issuecomment-3124658054 https://github.com/eu-digital-identity-wallet/eudi-app-andro... The user of Play Integrity can choose to just block Android 8.

OkayPhysicist 7mo ago

Fuck that. California's way is the absolute maximum that should be done: When accounts get created on an operating system, allow the user to provide a completely unproven age. Then that age should be the only age check. If the goal really is to just help parents prevent their kids from accessing inappropriate material, that's plenty. Anything else, and you're admitting the real goal is Big Brother style surveillance.

g947o 7mo ago

Now your government knows you are a registered user of PornHub. It will be fun when (not if) the database is leaked.

lern_too_spel 7mo ago
I don't think they meant literally Oauth but instead that you can get a verification request from the party that needs your age verified, get it signed by the government, and then send the assertion back to the relying party. It's not necessary for the government to send the signed verification request directly to Pornhub. It's not even necessary for the government to sign the assertion itself. A trusted device (like most consumer phones) could store the identity locally after government verification and then sign assertions itself after biometric or PIN verification, which is what most proposals look like.
- g947o 7mo ago
  I am not holding my breath.

drnick1 7mo ago

Wrong, because then that government knows exactly what services you have accessed. It's a huge and extremely dangerous privacy violation. The real solution to the age verification problem is not to have one. The Internet has existed for over 30 years without it; it's solution to a problem that does not exist.

marcosdumay 7mo ago

> The UK, and Brazil who passed a similar law, 'cheated' by just forcing private companies to figure it out. At least on the Brazilian case, it's outright illegal for a private company to implement the thing you are describing. So, if the government doesn't provide the service, there isn't much for them to figure out.

karel-3d 6mo ago

In EU we have EIDAS, at least in some countries. It works. But mostly just for actual citizens.