5 ms·

Show HN: Voice Age Verification

8 points by wentw0rth 4mo ago

I miss the old web. As a kid I could type in "a/s/l" in AOL messenger and chat with someone my own age, without worrying about the dangers that lurk on the web today. After seeing what happened to Omegle, a question stuck: is there a simple way to do age verification that both keeps people safe and doesn't contribute to a surveillance state? After a year of hard work, that question resulted in AGEWARDEN. Each part of the service puts people first. No tracking, nothing stored (it's more difficult these days to NOT collect data :smh:). Please give it a try if you have a moment https://agewarden.ai/demo https://agewarden.ai/demo. Feedback is very much welcomed. GG

Tiberium 4mo ago
I'll be honest: I don't have experience with audio stuff/age verification, but wouldn't it be far easier to bypass this than even face (live video) verification, let alone full KYC with ID? At that point it's not that much better than a "I'm over 18" button, or am I missing something? EDIT: The website itself partially answers my question: > Self-declaration, the "I am over 18" checkbox, is explicitly prohibited by every major regulator in the UK, EU, and Australia. But then: > Facial scanning works, but it builds infrastructure that outlasts the check. A system that estimates your age today can identify you tomorrow. Platforms that rolled it out met immediate backlash and reversals. Users do not trust platforms with their face. How would we trust your platform to not store voice fingerprints, then? (On a side note, all descriptions all LLM-written, but that's expected in 2026)
- wentw0rth 4mo ago
  Thanks for the comment/question: > wouldn't it be far easier to bypass this than even face (live video) verification... or am I missing something? Missing the experience of learning just how much information is in a clip of audio; replay/synthetic attack mitigation is baked in, and more cost-effective to run vs. video, and less creepy. The mission: make the process easy (and inexpensive) as possible so that people can be verified at scale, without giving away their personal data and being the product.
- wentw0rth 4mo ago
  Post edit/updated, let me track: > How would we trust your platform to not store voice fingerprints, then? This is a good question. Other than having it be more expensive to keep this data, and if it were true, destroy the company whose core tenant is literally that... you can't. If you have suggestions for an independent audit, more than happy to add that to our stack where applicable. When I say it's hard to not collect data, woof. Any fresh AWS account just LOVES to slurp it up by default.
cwmma 4mo ago
I (41 man with very deep voice) told it in a higher then normal voice that I was a kid, and it said I was under 18. I suspect if I was a kid that used a deep voice to say that I was an adult it would also fool it. No offense but this is probably worthless is an adversarial environment.
- cstever 4mo ago
  Reliable Age Verification is nearly impossible and your antecdote gives weight to that assertion. Your comment brought my mind to voice actors. They easily change their voices. Deep fakes also come to mind. So what is a solution? Parents. What about those that don't have parents? Surely they have guardians. Adults who guide the next generation instead of delegating them to technology.
  - wentw0rth 4mo ago
    > Your comment brought my mind to voice actors. They easily change their voices. Deep fakes also come to mind. Voice actors, deep fakes, replay attacks (recordings from a TV/computer/phone) - mitigated. As in my earlier comment where teen voices have a signature, these all have unique signatures as well. The ongoing part is staying up-to-date with the latest synthetic (deep fakes/AI generated) as those are getting better each day.
    - nohillside 4mo ago
      How do you mitigate kids recording their parent's voices and playing them back to the AI?
      - wentw0rth 4mo ago
        That would be considered a "replay attack" and recorded audio carries a unique signature: BLOCKED
- Tade0 4mo ago
  > I suspect if I was a kid that used a deep voice to say that I was an adult it would also fool it. There should exist frequencies impossible to reach for anyone but post-pubescent men. Of course that would make it teen-age verification at best.
dev213 4mo ago
at first I was a bit shocked at the price of $0.10/verification (having never implemented KYC before). But after looking it up, more traditional KYC/age verification services cost up to a couple euros per scan which is crazy to me. Never thought about the cost of such systems before.
- wentw0rth 4mo ago
  That's the nice thing about audio temporal vs. video, much cheaper.
lifeisgood99 4mo ago
ASL is literally a meme that everyone is an old male predator on the internet.
- wentw0rth 4mo ago
  LOL, it was BEFORE the sketchy times :')
noodlesUK 4mo ago
I think that if we are considering technical solutions to the social problems here, the answer is well understood by professionals working in age/ID verification. You allow someone to perform a more thorough check verifying your age and identity (such as the government or your smartphone vendor), and then you use a privacy preserving protocol to provide a proof of whatever attribute (such as age) you are trying to verify in the absence of the remaining personal data. This can be as simple as exposing a "is age over {16, 18, 19, 21, 25}" api in the OS or browser, or as complex as a ZKP as needed. What doesn't work is requiring each service to independently perform verification which leads to a massive expansion in the proliferation of personal data and is incompatible with the modern approaches to data protection. This is a solution that hopefully will cease to be relevant as soon as the remaining infrastructure is finished.
- pandoro 4mo ago
  Even more so considering that most, if not all countries already have age-verification infrastructure in-place for selling alcohol and tobacco (and other goods). Why not piggy-back on this? Go to a kiosk/shop selling controlled goods, pay a small fee to the vendor to get a one-use verification code that attests your age.
  - wentw0rth 4mo ago
    Love it. We've been playing around with other ideas that are not web related. As the tech improves, less data will be needed to infer age. Strange now, but setting up a microphone at a kiosk or providing a widget-less API for broader use-cases, is not a stretch for piggy-backing. Thank you for the comment.
  - dd8601fn 4mo ago
    Making someone get in the car and go somewhere to be able to use a website is a rough ask. Just a thought, maybe I could get a one-time code from my secretary of state website that provides only the age bracket information to the service provider’s age verification broker. - Don’t need to go anywhere. - Doesn’t provide age information to the service provider beyond “yes/no, allowed”. - Doesn’t tell the agency who knows your age what service you’re trying to use. - Broker doesn’t know any actual identity or service details, and can ideally be ZDR
Tiberium 4mo ago
(Not a lawyer, not an expert, just my possibly ignorant/wrong comment) I checked around a bit more, and this seems to directly contradict the HN title: https://agewarden.ai/customer-agreement https://agewarden.ai/customer-agreement > AGEWARDEN is an age estimation tool. It does not verify identity and does not guarantee 100% accuracy. Customer is responsible for determining whether AGEWARDEN satisfies the legal requirements applicable to its business and jurisdiction.
- wentw0rth 4mo ago
  Lawyers HIGHLY suggested the line; AGEWARDEN is > 95% accurate and on par with others in this space. If someone told me they had 100% accuracy with inference, I'd call them out. Thank YOU for calling it out :)
EPWN3D 4mo ago
How do you distinguish between a live person and a high-fidelity recording?
- wentw0rth 4mo ago
  Good question: regardless of the recording instrument (our lab has many microphones of varying degrees from low > high fidelity), a live person vs. recordings that are played back carry a unique signature.

8 points by wentw0rth 4mo ago

Tiberium 4mo ago

I'll be honest: I don't have experience with audio stuff/age verification, but wouldn't it be far easier to bypass this than even face (live video) verification, let alone full KYC with ID? At that point it's not that much better than a "I'm over 18" button, or am I missing something? EDIT: The website itself partially answers my question: > Self-declaration, the "I am over 18" checkbox, is explicitly prohibited by every major regulator in the UK, EU, and Australia. But then: > Facial scanning works, but it builds infrastructure that outlasts the check. A system that estimates your age today can identify you tomorrow. Platforms that rolled it out met immediate backlash and reversals. Users do not trust platforms with their face. How would we trust your platform to not store voice fingerprints, then? (On a side note, all descriptions all LLM-written, but that's expected in 2026)

wentw0rth 4mo ago
Thanks for the comment/question: > wouldn't it be far easier to bypass this than even face (live video) verification... or am I missing something? Missing the experience of learning just how much information is in a clip of audio; replay/synthetic attack mitigation is baked in, and more cost-effective to run vs. video, and less creepy. The mission: make the process easy (and inexpensive) as possible so that people can be verified at scale, without giving away their personal data and being the product.
wentw0rth 4mo ago
Post edit/updated, let me track: > How would we trust your platform to not store voice fingerprints, then? This is a good question. Other than having it be more expensive to keep this data, and if it were true, destroy the company whose core tenant is literally that... you can't. If you have suggestions for an independent audit, more than happy to add that to our stack where applicable. When I say it's hard to not collect data, woof. Any fresh AWS account just LOVES to slurp it up by default.

cwmma 4mo ago

I (41 man with very deep voice) told it in a higher then normal voice that I was a kid, and it said I was under 18. I suspect if I was a kid that used a deep voice to say that I was an adult it would also fool it. No offense but this is probably worthless is an adversarial environment.

cstever 4mo ago
Reliable Age Verification is nearly impossible and your antecdote gives weight to that assertion. Your comment brought my mind to voice actors. They easily change their voices. Deep fakes also come to mind. So what is a solution? Parents. What about those that don't have parents? Surely they have guardians. Adults who guide the next generation instead of delegating them to technology.
- wentw0rth 4mo ago
  > Your comment brought my mind to voice actors. They easily change their voices. Deep fakes also come to mind. Voice actors, deep fakes, replay attacks (recordings from a TV/computer/phone) - mitigated. As in my earlier comment where teen voices have a signature, these all have unique signatures as well. The ongoing part is staying up-to-date with the latest synthetic (deep fakes/AI generated) as those are getting better each day.
  - nohillside 4mo ago
    How do you mitigate kids recording their parent's voices and playing them back to the AI?
    - wentw0rth 4mo ago
      That would be considered a "replay attack" and recorded audio carries a unique signature: BLOCKED
Tade0 4mo ago
> I suspect if I was a kid that used a deep voice to say that I was an adult it would also fool it. There should exist frequencies impossible to reach for anyone but post-pubescent men. Of course that would make it teen-age verification at best.

dev213 4mo ago

at first I was a bit shocked at the price of $0.10/verification (having never implemented KYC before). But after looking it up, more traditional KYC/age verification services cost up to a couple euros per scan which is crazy to me. Never thought about the cost of such systems before.

wentw0rth 4mo ago
That's the nice thing about audio temporal vs. video, much cheaper.

lifeisgood99 4mo ago

ASL is literally a meme that everyone is an old male predator on the internet.

wentw0rth 4mo ago
LOL, it was BEFORE the sketchy times :')

noodlesUK 4mo ago

I think that if we are considering technical solutions to the social problems here, the answer is well understood by professionals working in age/ID verification. You allow someone to perform a more thorough check verifying your age and identity (such as the government or your smartphone vendor), and then you use a privacy preserving protocol to provide a proof of whatever attribute (such as age) you are trying to verify in the absence of the remaining personal data. This can be as simple as exposing a "is age over {16, 18, 19, 21, 25}" api in the OS or browser, or as complex as a ZKP as needed. What doesn't work is requiring each service to independently perform verification which leads to a massive expansion in the proliferation of personal data and is incompatible with the modern approaches to data protection. This is a solution that hopefully will cease to be relevant as soon as the remaining infrastructure is finished.

pandoro 4mo ago
Even more so considering that most, if not all countries already have age-verification infrastructure in-place for selling alcohol and tobacco (and other goods). Why not piggy-back on this? Go to a kiosk/shop selling controlled goods, pay a small fee to the vendor to get a one-use verification code that attests your age.
- wentw0rth 4mo ago
  Love it. We've been playing around with other ideas that are not web related. As the tech improves, less data will be needed to infer age. Strange now, but setting up a microphone at a kiosk or providing a widget-less API for broader use-cases, is not a stretch for piggy-backing. Thank you for the comment.
- dd8601fn 4mo ago
  Making someone get in the car and go somewhere to be able to use a website is a rough ask. Just a thought, maybe I could get a one-time code from my secretary of state website that provides only the age bracket information to the service provider’s age verification broker. - Don’t need to go anywhere. - Doesn’t provide age information to the service provider beyond “yes/no, allowed”. - Doesn’t tell the agency who knows your age what service you’re trying to use. - Broker doesn’t know any actual identity or service details, and can ideally be ZDR

Tiberium 4mo ago

(Not a lawyer, not an expert, just my possibly ignorant/wrong comment) I checked around a bit more, and this seems to directly contradict the HN title: https://agewarden.ai/customer-agreement https://agewarden.ai/customer-agreement > AGEWARDEN is an age estimation tool. It does not verify identity and does not guarantee 100% accuracy. Customer is responsible for determining whether AGEWARDEN satisfies the legal requirements applicable to its business and jurisdiction.

wentw0rth 4mo ago
Lawyers HIGHLY suggested the line; AGEWARDEN is > 95% accurate and on par with others in this space. If someone told me they had 100% accuracy with inference, I'd call them out. Thank YOU for calling it out :)

EPWN3D 4mo ago

How do you distinguish between a live person and a high-fidelity recording?

wentw0rth 4mo ago
Good question: regardless of the recording instrument (our lab has many microphones of varying degrees from low > high fidelity), a live person vs. recordings that are played back carry a unique signature.