6 ms·

>Could you be more specific as to what you're imagining? sure, i'll put my favorite two. though you'll find much more detailed and thought-out versions of thes

• donmcronald 4mo ago
  > buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time Why should I pay continuously to prove I'm an adult? And those cards will be getting sold to kids faster than you can blink. I bet a lot of parents would buy them for their kids.
  • john_strinlai 4mo ago
    >And those cards will be getting sold to kids faster than you can blink. there's a reason i said 90% and not 100% effective. alcohol and tobacco get resold to kids, too.
    • fl4regun 4mo ago
      What makes you think this will be close to 90%? Unless these cards are expensive I don't see that happening.
      • john_strinlai 4mo ago
        >What makes you think this will be close to 90%? Unless these cards are expensive I don't see that happening. its obviously just an illustrative guess. but if the penalty of possessing the card is similar to underage possession of alcohol/tobacco, and larger penalties if a store/person is found providing a card to someone underage, i see no reason why it wouldnt have a similar success rate as alcohol/tobacco.
        • inigyou 4mo ago
          Why possess the card when you can just buy the UUID on the dark web
          • john_strinlai 4mo ago
            sure? i feel like i need to reemphasize the "not going for 100% effectiveness" thing again. hopefully some parent steps in if their kid is on the dark web trying to make purchases with their parent's credit card.
            • kbelder 4mo ago
              Well, yeah, I would just give them my code.
          • bilkow 4mo ago
            If they have access to the "dark web" they can already do anything that requires age verification there. In the same way you expect that the rule to "not sell UUIDs" wouldn't be respected there, I wouldn't expect other age-verification rules to be respected, no matter the verification method.
            • inigyou 4mo ago
              Well, it's rather harder to sell bottles of beer on the dark web than short text strings.
              • bilkow 4mo ago
                That is true, it is harder, although AFAIK people do sell all kinds of illegal things there.
          • triceratops 4mo ago
            Kids can buy drugs on the dark web too.
          • anigbrowl 4mo ago
      • palata 4mo ago
        Let's try it. If it doesn't help the kids, we can remove it I guess. Anything that doesn't accept this limitation becomes dystopian. The only viable age verification system is one that cannot be 100% effective, period.
  • CPLX 4mo ago
    Why should you pay for an internet connection, or a computing device with a screen? This isn't a serious counterargument.
    • fluoridation 4mo ago
      Because those things cost money to make and to maintain, whereas there's no intrinsic cost to prove one is an adult.
      • CPLX 4mo ago
        Yes there is. You need to pay for a drivers license or a passport and so on. So there is an intrinsic cost to prove who you are where you are from and what your birthday is already. You have to pay for all sorts of small things to participate in normal society. This isn't a serious criticism. By definition this is not a life critical thing, it's something that is procured in order to access specific services on the internet, which is not free.
        • fluoridation 4mo ago
          >You need to pay for a drivers license or a passport and so on. I have a government ID and I didn't pay for it. I can use it to travel to nearby countries in lieu of a passport. The assumption that IDs are necessarily non-free (to the issuee) is pretty funny to me. >it's something that is procured in order to access specific services on the internet, which is not free. The maintenance of the Internet is already paid for through ISP contracts.
          • CPLX 4mo ago
            I mean, if you really want to make the government subsidize an ID verification scheme or mandate that certain real-world locations provide age verification as a social service for everyone, that's fine. It's orthogonal to the discussion, though, which is about whether we should do it or not, because the costs here aren't significant and don't change the terms of the debate.
  • sdeframond 4mo ago
    > I bet a lot of parents would buy them for their kids. That changes the default from "anyone can do anything" to "gotta ask parents". Defaults matter at scale. It adds friction.
  • drdexebtjl 4mo ago
    > I bet a lot of parents would buy them for their kids. Good. I should be able to make judgement calls about what my children can or can’t access outside of school. It’s better if they do it under my supervision than against my back, aided by a predator whose only moat is lending their ID, or their face.
• utopiah 4mo ago
  > UUID card is non-identifying. Kids aren't going to trade Pokemon cards in the playground anymore...
  • choo-t 4mo ago
    Well, they could trade identifying ones too or even stollen ID cards if you want to go this way. They could also trade porn-filled thumb drive or old-school glossy paper magazine. There no way to prevent kid's exposure to stuff at a 100% success rate. There no way to avoid exposure completely
    • utopiah 4mo ago
      Indeed but you are the one who claimed it was not a hard problem. I don't think any one of us pushing back here on those claims do so for the heck of NOT finding a "solution", rather genuinely asking because so far it seems nobody did find such a solution without compromises that is in the end not worth it due to the flaw in said solution. The point isn't to be critical of your process, only of the claim that it's a trivial problem.
      • choo-t 4mo ago
        > Indeed but you are the one who claimed it was not a hard problem. Am I ?
        • utopiah 4mo ago
          Ah! My bad I didn't properly track authorship. I thought you were https://news.ycombinator.com/item?id=48645333 https://news.ycombinator.com/item?id=48645333
• cogman10 4mo ago
  And honestly, all these should ultimately just be done client side in the browser. After the browser has verified "User is x or user is over 21" there's no reason to then send that information to the website. Let websites issue a "window.isUserOver(16)" call once and then move forward based on the response to that query.
  • mminer237 4mo ago
    This is how California is legislating it—requiring the OS to let an admin set the user's age, then let browsers and through them, websites, to query that setting.
  • inigyou 4mo ago
    You can get their exact age by binary search.
    • ekr____ 4mo ago
      Typically these APIs are designed so you can't make arbitrary queries, but rather there are fixed age brackets.
      • inigyou 4mo ago
        Then it can't be bool isOver(int age)
  • Wowfunhappy 4mo ago
    This would require browser attestation, wouldn't it? Otherwise kids are just going to download a custom build of Chromium where `window.isUserOver(16)` is always `True`.
    • cogman10 4mo ago
      Some probably will. 99% of them don't even know what "Chromium" is. This doesn't have to be perfect.
• dana-s 4mo ago
  I'm just left wondering, how would that be different than buying a phone? Most kids also don't have money to spend on devices, that's all coming from adults, how would the UUID work any different? In my view it seems we'll just reach the current state as with phones.
• shevy-java 4mo ago
  > - websites issue content tags, browsers consume them, you enter your age into the OS during setup. Why would that be acceptable though? What if a user does not trust the operating system? Even Linux may not be safe in the future, what with age sniffing coming by Red Hat integrating it into system already. And Red Hat plans more - xorg is abandoned on purpose, for instance.
  • bryan_w 4mo ago
    If you don't trust your operating system, then I guess you can't operate
• autoexec 4mo ago
  > buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is non-identifying. This could be a good system if it's set up right. There's still some risk of being tracked if it isn't though. IDs could be linked to the cards at the time of purchase if retailers scan the drivers license, then scan the card creating a record that card #XXXXX was purchased using driver's license # XXXXX Even if retailers aren't scanning the drivers licenses and collecting data that way, the cards and codes on those cards can be tracked and traceable to a retailer. That's how things like calling cards have been tracked. Say for example someone uses the code on a card to access a website, the police can match the code that was used to the serial number of the card, look up which retailer that card was sold at, and can then access security camera footage at that retailer to identify who bought the card from that location. This would also let them passively generate lists of IP addresses/device IDs matched to websites and specific retail locations over time.
• palata 4mo ago
  > buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is non-identifying. It can be implemented in a privacy-preserving way online: your government gives you tokens that prove that you are above age and that they provably cannot track. That's the exact equivalent. I believe that the other measures (remote attestation and such, the ones we hate) come when we try to make absolutely sure that you don't give/sell that UUID to someone else. But IMO we should just forget about doing that. Just like an adult can, today, buy cigarettes and porn and give them to a kid.
  • euio757 4mo ago
    > and that they provably cannot track. That's not easily provable though. Any token given that way contains some amount of encrypted payload. That secret payload may contain uniquely tracking numbers. Even the encrypted payload itself, if treated as an opaque string, can be used for tracking if they decide to log it when they deliver it to you, and when the website where you use the token passes it back to the government auth service. You need to replicate the UX of a stack of pile of cards at the grocery store, that's not really possible in digital space.
    • palata 4mo ago
      > that's not really possible in digital space It is, with zero-knowledge proofs. > That's not easily provable though. It's exactly like end-to-end encryption: normal people cannot verify that it works, but they can use an open source implementation that is audited by independent cryptographers. Not sure what you mean by "easily". It's totally possible in practice.
• euio757 4mo ago
  > buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time Exactly, prepaid phone cards with point of sales activation (to eliminate large scale theft incentive) is nothing new. Once activated, the validity of the token can be like 6 months or one year, and at-most-once-per-domain schema can be managed by the issuing authority if they want. Instead of a 100 phone minutes, 300 phone minutes card you just buy "I'm over 16", "I'm over 18" cards. It's simple UX.
• account42 4mo ago
  > - buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is non-identifying. Until it is because the store keeps records of who they sold which cards to.