8 ms·

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verificati

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general. Heck—in most cases, we can't even tell the difference between humans and bots anymore! And it's true that we basically accept that some bots will slip through the cracks—but identifying bots also strikes me as significantly easier than identifying children.

armchairhacker 4mo ago
Make unrestricted devices like alcohol: you need ID to buy (but the box containing the device you’re sold is indistinguishable from any other, so the device may have a UUID but it can’t be traced to your ID); kids caught with unrestricted devices in school have them confiscated; maybe fine parents, but I think discouragement and banning in schools is enough. Kids can have restricted devices, distinguished from unrestricted by appearance in a way that’s hard to fake.
- Wowfunhappy 4mo ago
  I don't know, treating general-purpose computers like alcohol seems a lot more dystopian to me. Does this extend to PC components? Can I build a machine and put Linux on it?
  - armchairhacker 4mo ago
    Do most kids have the ability and motivation to build their own machines? AFAIK you don’t need ID to buy juice, sugar, and yeast to make your own alcohol, so I think it should be the same for computer parts.
    - impure-aqua 4mo ago
      > Do most kids have the ability and motivation to build their own machines? I and pretty much everyone else in my childhood TeamSpeak server did at roughly 14 years of age.
      - armchairhacker 4mo ago
        Did the people in your Teamspeak server have issues with concentration and socialization like most social media addicts today?
  - intrasight 4mo ago
    > Can I build a machine and put Linux on it? Maybe for the next few years you'll be able to do that. Analogy: back in the day you could just build your own airplane and fly it around. There were no regulations.
  - solid_fuel 4mo ago
    > I don't know, treating general-purpose computers like alcohol seems a lot more dystopian to me Isn't this the logical end goal of basically every approach to "age verification", though? If you really want to control access to the internet, then you can't let people have a VPN or Tor, and if you don't want people to VPNs or Tor then you need to lock the device down.
    - Wowfunhappy 4mo ago
      Well, the alternative is that Facebook makes you scan a government photo ID before you can use it. Any sense of privacy is gone, but at least general purpose computing isn't outlawed.
- pibaker 4mo ago
  > kids caught with unrestricted devices in school have them confiscated This will surely fly on hacker news where the prevalent wisdom is to buy your kid an old thinkpad and install Linux.
  - armchairhacker 4mo ago
    But don’t bring it to school and use it in class! A teacher may confiscate this under the existing system. And of course parents can pick up the confiscated device. I agree that schools don’t provide enough challenge to students, so a student could be using the device to actually learn without an alternative, thus confiscating it would be wrong. But I think that would be rare, because I believe most schools today have Chromebooks which can access more than a lifetime’s worth of online resources in any subject, so the student can save whatever they need a thinkpad for at home. And it should be solved by giving those students Chromebooks, not letting other students use their phones during class (if a school confiscates phones but allow thinkpads I think that would also work well enough).
michael1999 4mo ago
Info-minimized oidc handshakes with certified identity providers could verify age-category of a user with no other information shared. Consider "log in with apple" as it is today. Depending on what you share, a relying website might not even get your name or email.
- inigyou 4mo ago
  The only way to know that is to trust Apple.
- bbminner 4mo ago
  Yes, that was my thought as well when i was visiting UK and reddit kept asking me to verify my age. It might be even more private and non-trackable than that - if "age.id.gov" central authority effectively "provides a new random user id" (implementation may vary and does not need to have a "literal username") every time you try to use it / log into a website that needs to verify your age - this way websites can not even track you across platforms. It seems like all the tech stack is there to implement a very simple and privacy-persevering solution. It does not even smell of state censorship because a website does not have to check your age if it decides to be "non compliant". Why isn't it implemented like that? Based on the comments it seems more like a "free-for-all implement-your-own-PPI-handling-thon". This will ofc make life harder for a some groups of people - like people without / limited access to IDs etc. And i do not even argue that the whole thing is necessary. But there seem to be vastly superior technical means to implement that, aren't there?
zug_zug 4mo ago
Sure here's one example of decentralizing it -- it's going to be overly simple just as a toy example to show how easy it could be: Whenever you want to prove your adult you go to "am I an adult.gov" and you use your credit card or whatever to prove you are an adult. At which point you get a 1-time 5-digit code that is UNIVERSAL TO EVERY SINGLE HUMAN and good for 1 hour (everybody who uses the site gets the same code that hour). Then when you want to look at porn or something, you use this code. Boom simple and done. There are even much better much more private techniques that use cryptography, and AI is happy to explain these graduate-degree level topics to you at your own pace. Of course there are situations where people steal things, and use deep-fakes, etc, but those exist in every model.
- akmiller 4mo ago
  Same code for all people for 1 hour and you don't think we'd immediately have rotating codes to pass the gate?
  - dpoloncsak 4mo ago
    I'd setup the .onion in a heartbeat. Take crypto donations, cash out in Monero
  - zug_zug 4mo ago
    I sure hope so. I think the only thing I actually have any concern about is phones and social media use for kids, and I think that has a much easier solution than any sorting of tracking-BS.
- malwrar 4mo ago
  Headline news: children infiltrate the universal adult one time password scheme for porn, parents panic! Turns out the 18 year olds started selling access to their younger friends, who resold it to their younger friends.
  - john_strinlai 4mo ago
    this happens with alcohol and tobacco every day. i cant think of the last time it reached headline news.
john_strinlai 4mo ago
>Could you be more specific as to what you're imagining? sure, i'll put my favorite two. though you'll find much more detailed and thought-out versions of these (and others) in the dozens of other giant threads on the same topic. - buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is non-identifying. - websites issue content tags, browsers consume them, you enter your age into the OS during setup.
- donmcronald 4mo ago
  > buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time Why should I pay continuously to prove I'm an adult? And those cards will be getting sold to kids faster than you can blink. I bet a lot of parents would buy them for their kids.
  - john_strinlai 4mo ago
    >And those cards will be getting sold to kids faster than you can blink. there's a reason i said 90% and not 100% effective. alcohol and tobacco get resold to kids, too.
    - fl4regun 4mo ago
      What makes you think this will be close to 90%? Unless these cards are expensive I don't see that happening.
      - john_strinlai 4mo ago
        >What makes you think this will be close to 90%? Unless these cards are expensive I don't see that happening. its obviously just an illustrative guess. but if the penalty of possessing the card is similar to underage possession of alcohol/tobacco, and larger penalties if a store/person is found providing a card to someone underage, i see no reason why it wouldnt have a similar success rate as alcohol/tobacco.
oliwarner 4mo ago
That's because you're treating AV as a system that must be 100% correct immediately. This isn't banking or an election. As soon as you loosen off the requirements to "reasonable effort", you can start looking at account age, facial features, social attestation, and include retrospective tools to revisit someone's verification if they get in and start acting like a child. Heuristically messy but far from impossible to demand a stronger form of verification if their original might have been borderline. The goal is broad coverage, not complete. Screening doesn't have to get 100% to have an effect.
- Wowfunhappy 4mo ago
  I understand it doesn't need to be 100% correct. But I think what you're describing is either (A) going to be very privacy invasive, (B) going to create problems for lots of adults, or (C) going to be precisely as effective as a checkbox saying "I agree I am over 18 years old".
  - oliwarner 4mo ago
    It's "social media". The whole thing is profiling for advertisers. The idea that there's privacy is laughable. There is a network effect as a child's peers stop using social media though. Make it inconvenient enough for enough for kids and they'll read a book, take up slam poetry or whatever it was kids did before our attention became currency.
Aaargh20318 4mo ago
The way identity wallets work: The government issues an eID to your wallet. The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID. The government signs individual attributes combined with the public key with the government private key. The government certificate containing the public key is, well, public. One of the attributes is ‘over_18’ (In the EU eID scheme countries can add other over_XX attributes if they want, but over_18 is mandatory). When a website wants to requests attributes, in this case the over_18 attribute, they send a request to the user’s wallet app, including a challenge. The wallet sends back a package including the government-signed attribute, which contains the device public key and the over_18 attribute plus a response to the challenge (proving the credential didn’t get transferred). The website only sees the ‘over_18’ attribute, which is backed by the government signature. They don’t see any other attributes (the wallet app shows in advance which attributes you are sharing). The government never sees which website wants to know if you’re 18+. Of course this is all a bit simplified, check OIDC4VCI and OIDC4VP for details. The only real issue is the wallet app and device binding. Because a compromised device could allow credentials to be transferred some form of attestation of device and wallet app is required. In practice this means no rooted/jailbroken phones.
- ninalanyon 4mo ago
  So now I have to have a mobile phone?
  - deleted 4mo ago
    [deleted]
  - pluralmonad 4mo ago
    And one you don't fully own/control. Fully owned devices will be unsupported, obviously.
    - petemill 4mo ago
netrap 4mo ago
Perfect is the enemy of the good, right? I mean a page header or some other simple means to identify "adult" vs not is good for most cases? Just thinking about it.. obviously it can be bypassed but is there a good enough?
lotu 4mo ago
Using existing parental controls parents could set their kids age and that could be used for the age controls. Could the parents let the kids around the age gate? Sure but they could do that even if a government ID and camera was required. This actually might be more effective than a lot of these systems because other adults could not let the kids use their IDs
- inigyou 4mo ago
  Existing parental controls don't work - new ones would have to be created.
lo_zamoyski 4mo ago
This is a classic case for one time ZKPs. Sure, you can't get around attestation, but the party that needs to verify that you meet age criteria doesn't need to know your age or other private information. I presume you're concerned by the attesting party's knowledge of both the signature and identify information. Yes, in principle these can be linked, but in practice, it may be difficult or made very difficult, and today, very little of our online activity is really anonymous anyway. It is generally not too difficult to infer identity based on the content someone generates and the bread crumbs they leave behind. Of course, if the intent is to use age verification as a wedge to monitor everyone, then it will be difficult politically to secure the protections needed to prevent that sort of data fusion.
blahaj 4mo ago
Cryptographically blinded age verification with a government signed digital ID
dfxm12 4mo ago
If you don't think a checkbox saying "I am 13 or older" is adequate, with all the behavioral tracking available to say Meta, they can tell well enough. OpenAI talks about this too: https://openai.com/index/our-approach-to-age-prediction/ https://openai.com/index/our-approach-to-age-prediction/ Knowing who someone is in general is different from having a photo of their face or government ID confirmation.
pyrale 4mo ago
you generate a random number and send it to website you want to visit. Website you want to visit generates a one-time private/public key for the purpose of this login attempt, hashes your random number, and sends the hash back to you. You connect to the government auth platform, auth yourself to your government, and ask them to sign the hash you received. You pass the signed hash as well as the original random number to the website you wanted to access (the original random number is used by the website to store the one-time key they generated for you). They can see it is signed by the government. They can see it is made with the hash they provided. You get access to whatever content you wanted. The website doesn't know who you are. The government doesn't know where you logged in. Sure, it won't hold up against collusion between website and government, but nothing would. the principles explained above are slight adaptations of PKCE authentication.
- LudwigNagasena 4mo ago
  > Sure, it won't hold up against collusion between website and government, but nothing would. Right, so it's just privacy theatre.
  - pyrale 4mo ago
    Not necessarily. Some sites have no interest in communicating your data to the government, unlike their 23019 affiliate ad programs. If your government is paying private third parties to collect data on you (hello USA), the issue is much wider, and nothing would protect you from such a government. Even without age verification, if the government is interested in spying on you, and the sites are willing to sell, they would gladly trade your IP and connection log.
- Ajedi32 4mo ago
  So now I have to get permission from the government to browse the web? And they can revoke that permission at any time? And we need a great firewall to block citizens from communicating with foreign websites that don't comply with this scheme? This idea is worse than facial scanning, by a lot. (Better idea is OS level parental controls combined with government-mandated content tags to let the OS know what content is child-safe.)
soperj 4mo ago
just do what they did in Leisure suit Larry, ask some skill testing questions that only someone older than 18 would know. Give them a short time to answer so they can't look it up.
codedokode 4mo ago
Yubikey tokens support attestation. You can sell Yubikey tokens at places inaccessible to minors, like liquor stores, and having a token proves that one is adult. Another way is implementing "parent mode" when OS allows only installing apps from a government-approved whitelist and access sites from a whitelist.
karussell 4mo ago
I think the German Personalausweis has an electronic ID function that does this: age verification without giving out other information like name etc. But the application chooses which information is requested and could/will request more. Unfortunately few know and use this information although the usage via NFC is not that complicated. Have used it successfully already a few times for banks, but including name information etc.
tarentel 4mo ago
A lot of these age verifications things have to do with "protecting children". If that's the end goal we don't really need to verify anyone's age. Apple/Google, any smart phone maker, should be forced to add proper parental controls. Parents should be able to control what apps can be used, what websites can be viewed, who the phone is able to contact. That doesn't require knowing my age, or anyone else's. Also, as an iOS developer, it's not my job to parent your child. The age ratings are clear on the app store, if you give your child unrestricted access to a phone that's on you, not me. If the OS doesn't have proper controls that's on Apple/Android, again, not my fault and not something I should be forced to police. Thanks to Texas, I can see roughly how old your kid is. I'm not supposed to keep that information though. ;) I'm sure everyone who makes app will comply with that and not use that information for any other purposes and you can bet Texas has the means to audit every app on the app store to make sure that they're complying. lol
ajsnigrutin 4mo ago
Easy, when you buy the device, during first setup, you set up the date of birth of the user. If the user is underage, the parent/guardian sets a password to unlock the device if needed before the user is 18. That device then sends "is_below_18" flag to whatever service wants it.
AnthonyMouse 4mo ago
The correct way to do this continues to be for sites to tag the content with some kind of rating and let the client device decide whether to show it based on how the user's account is configured. This requires no ID of any kind because the child's parent or teacher knows their age, and kids buying a device on their own is no more or less of a problem than kids getting some high school senior or homeless adult to lend them their ID.
paulsutter 4mo ago
One approach is for parents to establish certain devices as “under 18” (or 16 or 13), leaving it up to the judgment of parents.
oliwarner 4mo ago
Attestation from other services is a good option. I have Apple, Meta, Google, PayPal, eBay, Microsoft, Twitter/X and Steam accounts that —through age of account, and their own identity checks and purchase histories— could attest that I'm probably an adult. This obviously isn't a feature they offer currently, but could. Most are available as a federated OAuth IdP. You already entrust far more than an adult flag to these services so I doubt the news you like to touch yourself is going to be met with an emergency board meeting. But if that were a problem, would it be that hard to separate identity from end service with an intermediate AV condom service? I'd personally prefer to not add another leaky abstraction layer but that's me.

armchairhacker 4mo ago

Make unrestricted devices like alcohol: you need ID to buy (but the box containing the device you’re sold is indistinguishable from any other, so the device may have a UUID but it can’t be traced to your ID); kids caught with unrestricted devices in school have them confiscated; maybe fine parents, but I think discouragement and banning in schools is enough. Kids can have restricted devices, distinguished from unrestricted by appearance in a way that’s hard to fake.

Wowfunhappy 4mo ago
I don't know, treating general-purpose computers like alcohol seems a lot more dystopian to me. Does this extend to PC components? Can I build a machine and put Linux on it?
- armchairhacker 4mo ago
  Do most kids have the ability and motivation to build their own machines? AFAIK you don’t need ID to buy juice, sugar, and yeast to make your own alcohol, so I think it should be the same for computer parts.
  - impure-aqua 4mo ago
    > Do most kids have the ability and motivation to build their own machines? I and pretty much everyone else in my childhood TeamSpeak server did at roughly 14 years of age.
    - armchairhacker 4mo ago
      Did the people in your Teamspeak server have issues with concentration and socialization like most social media addicts today?
- intrasight 4mo ago
  > Can I build a machine and put Linux on it? Maybe for the next few years you'll be able to do that. Analogy: back in the day you could just build your own airplane and fly it around. There were no regulations.
- solid_fuel 4mo ago
  > I don't know, treating general-purpose computers like alcohol seems a lot more dystopian to me Isn't this the logical end goal of basically every approach to "age verification", though? If you really want to control access to the internet, then you can't let people have a VPN or Tor, and if you don't want people to VPNs or Tor then you need to lock the device down.
  - Wowfunhappy 4mo ago
    Well, the alternative is that Facebook makes you scan a government photo ID before you can use it. Any sense of privacy is gone, but at least general purpose computing isn't outlawed.
pibaker 4mo ago
> kids caught with unrestricted devices in school have them confiscated This will surely fly on hacker news where the prevalent wisdom is to buy your kid an old thinkpad and install Linux.
- armchairhacker 4mo ago
  But don’t bring it to school and use it in class! A teacher may confiscate this under the existing system. And of course parents can pick up the confiscated device. I agree that schools don’t provide enough challenge to students, so a student could be using the device to actually learn without an alternative, thus confiscating it would be wrong. But I think that would be rare, because I believe most schools today have Chromebooks which can access more than a lifetime’s worth of online resources in any subject, so the student can save whatever they need a thinkpad for at home. And it should be solved by giving those students Chromebooks, not letting other students use their phones during class (if a school confiscates phones but allow thinkpads I think that would also work well enough).

michael1999 4mo ago

Info-minimized oidc handshakes with certified identity providers could verify age-category of a user with no other information shared. Consider "log in with apple" as it is today. Depending on what you share, a relying website might not even get your name or email.

inigyou 4mo ago
The only way to know that is to trust Apple.
bbminner 4mo ago
Yes, that was my thought as well when i was visiting UK and reddit kept asking me to verify my age. It might be even more private and non-trackable than that - if "age.id.gov" central authority effectively "provides a new random user id" (implementation may vary and does not need to have a "literal username") every time you try to use it / log into a website that needs to verify your age - this way websites can not even track you across platforms. It seems like all the tech stack is there to implement a very simple and privacy-persevering solution. It does not even smell of state censorship because a website does not have to check your age if it decides to be "non compliant". Why isn't it implemented like that? Based on the comments it seems more like a "free-for-all implement-your-own-PPI-handling-thon". This will ofc make life harder for a some groups of people - like people without / limited access to IDs etc. And i do not even argue that the whole thing is necessary. But there seem to be vastly superior technical means to implement that, aren't there?

zug_zug 4mo ago

Sure here's one example of decentralizing it -- it's going to be overly simple just as a toy example to show how easy it could be: Whenever you want to prove your adult you go to "am I an adult.gov" and you use your credit card or whatever to prove you are an adult. At which point you get a 1-time 5-digit code that is UNIVERSAL TO EVERY SINGLE HUMAN and good for 1 hour (everybody who uses the site gets the same code that hour). Then when you want to look at porn or something, you use this code. Boom simple and done. There are even much better much more private techniques that use cryptography, and AI is happy to explain these graduate-degree level topics to you at your own pace. Of course there are situations where people steal things, and use deep-fakes, etc, but those exist in every model.

akmiller 4mo ago
Same code for all people for 1 hour and you don't think we'd immediately have rotating codes to pass the gate?
- dpoloncsak 4mo ago
  I'd setup the .onion in a heartbeat. Take crypto donations, cash out in Monero
- zug_zug 4mo ago
  I sure hope so. I think the only thing I actually have any concern about is phones and social media use for kids, and I think that has a much easier solution than any sorting of tracking-BS.
malwrar 4mo ago
Headline news: children infiltrate the universal adult one time password scheme for porn, parents panic! Turns out the 18 year olds started selling access to their younger friends, who resold it to their younger friends.
- john_strinlai 4mo ago
  this happens with alcohol and tobacco every day. i cant think of the last time it reached headline news.

john_strinlai 4mo ago

>Could you be more specific as to what you're imagining? sure, i'll put my favorite two. though you'll find much more detailed and thought-out versions of these (and others) in the dozens of other giant threads on the same topic. - buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is non-identifying. - websites issue content tags, browsers consume them, you enter your age into the OS during setup.

donmcronald 4mo ago
> buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time Why should I pay continuously to prove I'm an adult? And those cards will be getting sold to kids faster than you can blink. I bet a lot of parents would buy them for their kids.
- john_strinlai 4mo ago
  >And those cards will be getting sold to kids faster than you can blink. there's a reason i said 90% and not 100% effective. alcohol and tobacco get resold to kids, too.
  - fl4regun 4mo ago
    What makes you think this will be close to 90%? Unless these cards are expensive I don't see that happening.
    - john_strinlai 4mo ago
      >What makes you think this will be close to 90%? Unless these cards are expensive I don't see that happening. its obviously just an illustrative guess. but if the penalty of possessing the card is similar to underage possession of alcohol/tobacco, and larger penalties if a store/person is found providing a card to someone underage, i see no reason why it wouldnt have a similar success rate as alcohol/tobacco.

oliwarner 4mo ago

That's because you're treating AV as a system that must be 100% correct immediately. This isn't banking or an election. As soon as you loosen off the requirements to "reasonable effort", you can start looking at account age, facial features, social attestation, and include retrospective tools to revisit someone's verification if they get in and start acting like a child. Heuristically messy but far from impossible to demand a stronger form of verification if their original might have been borderline. The goal is broad coverage, not complete. Screening doesn't have to get 100% to have an effect.

Wowfunhappy 4mo ago
I understand it doesn't need to be 100% correct. But I think what you're describing is either (A) going to be very privacy invasive, (B) going to create problems for lots of adults, or (C) going to be precisely as effective as a checkbox saying "I agree I am over 18 years old".
- oliwarner 4mo ago
  It's "social media". The whole thing is profiling for advertisers. The idea that there's privacy is laughable. There is a network effect as a child's peers stop using social media though. Make it inconvenient enough for enough for kids and they'll read a book, take up slam poetry or whatever it was kids did before our attention became currency.

Aaargh20318 4mo ago

The way identity wallets work: The government issues an eID to your wallet. The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID. The government signs individual attributes combined with the public key with the government private key. The government certificate containing the public key is, well, public. One of the attributes is ‘over_18’ (In the EU eID scheme countries can add other over_XX attributes if they want, but over_18 is mandatory). When a website wants to requests attributes, in this case the over_18 attribute, they send a request to the user’s wallet app, including a challenge. The wallet sends back a package including the government-signed attribute, which contains the device public key and the over_18 attribute plus a response to the challenge (proving the credential didn’t get transferred). The website only sees the ‘over_18’ attribute, which is backed by the government signature. They don’t see any other attributes (the wallet app shows in advance which attributes you are sharing). The government never sees which website wants to know if you’re 18+. Of course this is all a bit simplified, check OIDC4VCI and OIDC4VP for details. The only real issue is the wallet app and device binding. Because a compromised device could allow credentials to be transferred some form of attestation of device and wallet app is required. In practice this means no rooted/jailbroken phones.

ninalanyon 4mo ago
So now I have to have a mobile phone?
- deleted 4mo ago
  [deleted]
- pluralmonad 4mo ago
  And one you don't fully own/control. Fully owned devices will be unsupported, obviously.
  - petemill 4mo ago

netrap 4mo ago

Perfect is the enemy of the good, right? I mean a page header or some other simple means to identify "adult" vs not is good for most cases? Just thinking about it.. obviously it can be bypassed but is there a good enough?

lotu 4mo ago

Using existing parental controls parents could set their kids age and that could be used for the age controls. Could the parents let the kids around the age gate? Sure but they could do that even if a government ID and camera was required. This actually might be more effective than a lot of these systems because other adults could not let the kids use their IDs

inigyou 4mo ago
Existing parental controls don't work - new ones would have to be created.

lo_zamoyski 4mo ago

This is a classic case for one time ZKPs. Sure, you can't get around attestation, but the party that needs to verify that you meet age criteria doesn't need to know your age or other private information. I presume you're concerned by the attesting party's knowledge of both the signature and identify information. Yes, in principle these can be linked, but in practice, it may be difficult or made very difficult, and today, very little of our online activity is really anonymous anyway. It is generally not too difficult to infer identity based on the content someone generates and the bread crumbs they leave behind. Of course, if the intent is to use age verification as a wedge to monitor everyone, then it will be difficult politically to secure the protections needed to prevent that sort of data fusion.

blahaj 4mo ago

Cryptographically blinded age verification with a government signed digital ID

dfxm12 4mo ago

If you don't think a checkbox saying "I am 13 or older" is adequate, with all the behavioral tracking available to say Meta, they can tell well enough. OpenAI talks about this too: https://openai.com/index/our-approach-to-age-prediction/ https://openai.com/index/our-approach-to-age-prediction/ Knowing who someone is in general is different from having a photo of their face or government ID confirmation.

pyrale 4mo ago

you generate a random number and send it to website you want to visit. Website you want to visit generates a one-time private/public key for the purpose of this login attempt, hashes your random number, and sends the hash back to you. You connect to the government auth platform, auth yourself to your government, and ask them to sign the hash you received. You pass the signed hash as well as the original random number to the website you wanted to access (the original random number is used by the website to store the one-time key they generated for you). They can see it is signed by the government. They can see it is made with the hash they provided. You get access to whatever content you wanted. The website doesn't know who you are. The government doesn't know where you logged in. Sure, it won't hold up against collusion between website and government, but nothing would. the principles explained above are slight adaptations of PKCE authentication.

LudwigNagasena 4mo ago
> Sure, it won't hold up against collusion between website and government, but nothing would. Right, so it's just privacy theatre.
- pyrale 4mo ago
  Not necessarily. Some sites have no interest in communicating your data to the government, unlike their 23019 affiliate ad programs. If your government is paying private third parties to collect data on you (hello USA), the issue is much wider, and nothing would protect you from such a government. Even without age verification, if the government is interested in spying on you, and the sites are willing to sell, they would gladly trade your IP and connection log.
Ajedi32 4mo ago
So now I have to get permission from the government to browse the web? And they can revoke that permission at any time? And we need a great firewall to block citizens from communicating with foreign websites that don't comply with this scheme? This idea is worse than facial scanning, by a lot. (Better idea is OS level parental controls combined with government-mandated content tags to let the OS know what content is child-safe.)

soperj 4mo ago

just do what they did in Leisure suit Larry, ask some skill testing questions that only someone older than 18 would know. Give them a short time to answer so they can't look it up.

codedokode 4mo ago

Yubikey tokens support attestation. You can sell Yubikey tokens at places inaccessible to minors, like liquor stores, and having a token proves that one is adult. Another way is implementing "parent mode" when OS allows only installing apps from a government-approved whitelist and access sites from a whitelist.

karussell 4mo ago

I think the German Personalausweis has an electronic ID function that does this: age verification without giving out other information like name etc. But the application chooses which information is requested and could/will request more. Unfortunately few know and use this information although the usage via NFC is not that complicated. Have used it successfully already a few times for banks, but including name information etc.

tarentel 4mo ago

A lot of these age verifications things have to do with "protecting children". If that's the end goal we don't really need to verify anyone's age. Apple/Google, any smart phone maker, should be forced to add proper parental controls. Parents should be able to control what apps can be used, what websites can be viewed, who the phone is able to contact. That doesn't require knowing my age, or anyone else's. Also, as an iOS developer, it's not my job to parent your child. The age ratings are clear on the app store, if you give your child unrestricted access to a phone that's on you, not me. If the OS doesn't have proper controls that's on Apple/Android, again, not my fault and not something I should be forced to police. Thanks to Texas, I can see roughly how old your kid is. I'm not supposed to keep that information though. ;) I'm sure everyone who makes app will comply with that and not use that information for any other purposes and you can bet Texas has the means to audit every app on the app store to make sure that they're complying. lol

ajsnigrutin 4mo ago

Easy, when you buy the device, during first setup, you set up the date of birth of the user. If the user is underage, the parent/guardian sets a password to unlock the device if needed before the user is 18. That device then sends "is_below_18" flag to whatever service wants it.

AnthonyMouse 4mo ago

The correct way to do this continues to be for sites to tag the content with some kind of rating and let the client device decide whether to show it based on how the user's account is configured. This requires no ID of any kind because the child's parent or teacher knows their age, and kids buying a device on their own is no more or less of a problem than kids getting some high school senior or homeless adult to lend them their ID.

paulsutter 4mo ago

One approach is for parents to establish certain devices as “under 18” (or 16 or 13), leaving it up to the judgment of parents.

oliwarner 4mo ago

Attestation from other services is a good option. I have Apple, Meta, Google, PayPal, eBay, Microsoft, Twitter/X and Steam accounts that —through age of account, and their own identity checks and purchase histories— could attest that I'm probably an adult. This obviously isn't a feature they offer currently, but could. Most are available as a federated OAuth IdP. You already entrust far more than an adult flag to these services so I doubt the news you like to touch yourself is going to be met with an emergency board meeting. But if that were a problem, would it be that hard to separate identity from end service with an intermediate AV condom service? I'd personally prefer to not add another leaky abstraction layer but that's me.