5 ms·

Government builds a website where you can log in using any government issued ID or using one of the many many many available services that hold your details alr

Government builds a website where you can log in using any government issued ID or using one of the many many many available services that hold your details already(at least in the UK nearly everyone will have a DLVA account, HMRC account, HMPO account, NHS account.....all of these are government services which we can only assume hold our data securely already). On that website, you can click "give me a verification code", it gives you a code that is single use and only valid 24 hours. You type that into whatever 18+ website you need to, they use a public API provided by the government to just check "yes this is a valid code and the user is 18" - bang, done, verified. The website knows nothing about you at all, except for the fact that you're 18. In fact, the UK government ALREADY HAS THIS. For the EU settlement scheme, you can give your employeer(or anyone else who needs it) a special magic code that they type in on the government website, and it just says "yet his person has the right to reside in the UK" without spilling any of your personal information at all. The code is single use and valid a limited amount of time. And you can do the same with your driving licence, where anyone can verify you hold a valid licence without actually seeing it or any details on it. Like, am I being stupid here? It seems like an almost trivial solution to the problem, especially given that it already exists for at least 2 services named above. And yes, I know people will say "oh but that requires the government having this data on you, and that's bad" or "but then the government will know you've authenticated with pornhub!". And yes, both of these are true - but on point 1 - like, I'd love some ideal situation where the government can simultaniously give me a passport or a driving licence AND not have any information about me at the same time, but that ain't happening, and on point 2 - yes, but that's still infinitely preferable to the current implementation, and it can be easily solved with legislation saying that the code authentication service doesn't log who requested verification, it just answers with yes/no and that's it.

Jabrov 4mo ago
The codes can trivially be shared in this case
- gambiting 4mo ago
  ...and? Just like a child can "trivially" ask an adult to buy them a beer. Who are these adults giving children their verification codes for adult websites?
  - Retr0id 4mo ago
    Asking adults for beer doesn't scale, code sharing can. If you want to crack down on code sharing, you'd have to start surveilling who is signing up to what.
    - gambiting 4mo ago
      So this solution is fine for proving your immigration status, getting employment or renting a house, but it's not good enough for browsing porn(to be a tiny bit flippant)? >>If you want to crack down on code sharing Right now, all the kid has to do is grab their parents passport while they are not home or asleep, scan it on their phone and they are in. It takes 30 seconds. With the codes they would either need to convince their parents to generate a code for them, or find someone online who will - which of these solutions seems less prone to abuse to you? Again, let's not let perfect be the enemy of the good.
    - triceratops 4mo ago
      > If you want to crack down on code sharing, you'd have to start surveilling who is signing up to what. Why? One code for one user account per site. If you're paranoid about privacy rotate codes and accounts weekly. As long as you can purchase the codes with cash in IRL stores the privacy impact is minimal.
    - palata 4mo ago
      > If you want to crack down on code sharing, you'd have to start surveilling who is signing up to what. Not at all. If you want to find who shares codes at scale, you just track that person. If someone sells hundreds of thousands of codes online, you can just buy one from them and you have proven that they do it. Again, if age verification is honestly about helping the kids, I don't think it has to be 100% efficient.
Retr0id 4mo ago
Every time I search something, I open a fresh private tab and google it. If I want to turn safe-search off, I'd have to go through this code verification flow for every single search. Aside from just being annoying, they'd have to implement strict rate limiting to prevent automated code sharing, so I'd soon end up waiting for a rate limit to expire before I can search anything. And "the government will know you've authenticated with pornhub" is extremely harmful, in my opinion.
- intended 4mo ago
  Sadly we got to this place because there are other harms that are occurring and those are forcing this conversation.
  - OkayPhysicist 4mo ago
    The "other harms" are made up fearmongering by rightwing cowards and incompetent parents.
    - intended 4mo ago
      Hah. I wish. I have personally had to remove NCII for teens and young adults. Grooming is a thing, self harm communities are a thing, as is sextortion.All of it at internet scale. And this ignores the parts where the platforms released features they knew from their own tests, were harmful to teens. It is convenient to dismiss them, because it makes it easier to hold positions that depend on them being minor harms.
      - account42 4mo ago
        > I have personally had to remove NCII for teens and young adults. Grooming is a thing, self harm communities are a thing, as is sextortion.All of it at internet scale. And even 100% effective age verification will not make a dent. > And this ignores the parts where the platforms released features they knew from their own tests, were harmful to teens. Those features are also harmful to adults. > It is convenient to dismiss them, because it makes it easier to hold positions that depend on them being minor harms. It's convenient to blow things out of proportion if it helps you implement other changes you want like mass-scale tracking.
OkayPhysicist 4mo ago
This means giving the government complete insight into your internet browsing. All they need to do is store a database table of handed out keys to ids. This is unacceptable tyranny on its face.
- gambiting 4mo ago
  >>This means giving the government complete insight into your internet browsing. ...how? All they know is you've authenticated with service X. And like I said, we can make legislation to say they are not allowed to keep the record of who authenticated. Besides, let's not let perfect be the enemy of the good - in the UK all ISPs are required to keep a full year of your browsing history, and 17 government agencies can access this data(including DEFRA - the agriculture agency lol). So like....the "the government will have a full history of your browsing" is a ship that sailed a few years ago. Obviously I don't agree with it, and I think we should be on the streets of London and protesting this, but here we are as a country. So like yeah, I get your point. But UK is particularily fucked on this point, let's not make it even more fucked with the way things currently are, the authentication can and should be done better.
Epa095 4mo ago
Why does the government need to know what pages you visit? It could just encode a string representing the date and 'above 18' and sign it with its private key. PH then just needs to verify it using the public key.
- gambiting 4mo ago
  Even better solution then. >>Why does the government need to know what pages you visit? In the UK the government already knows, but that's beside the point. It's another bad law that should have been fought against much more than it was.
- gambiting 4mo ago
  Actually, thinking about it some more - it has one major downside. You can't have a single use key this way.
  - Epa095 4mo ago
    Well the idea with the date/timestamp was that it would only be valid for X minutes, but if you are afraid that in the 10 minutes window it can be used multiple places you can add some salt to the process. PH pops up a page showing "Your secret word is: hamburgers. Provide access code below:". Age-verifier webpage asks for the secret word, and will create a json with "secret: hamburgers, claims: over_a18, date:2026..." and sign it with its private key, and this will be the code (encoded as a number). PH will verify that the code contains the secret "hamburgers", the claim and that its fresh enough (although this step is maybe not needed since it had the valid one-time secret).
    - gambiting 4mo ago
      Right, yeah I like that idea. I think that would actually work correctly and safely. Disregard my other comment on this :-)
palata 4mo ago
> but then the government will know you've authenticated with pornhub! If you do your cryptography right, the government will not know that you've authenticated with pornhub. That's the whole goddamn point of privacy-preserving age verification.
- gambiting 4mo ago
  On the other hand, you can't implement single use codes this way, right?
  - palata 4mo ago
    You can. Or maybe I don't get what you mean? It's possible for the government (or any entity, but when it comes to ID it feels natural that the government owns it) to verify your age (by verifying your identity) and give you a token that proves that you are above age, in such a way that the government cannot track you with this token and the website cannot identify you from this token. Using zero-knowledge proofs.
    - gambiting 4mo ago
      With my implementation, the government revokes the code after it's been verified once. If you want to verify elsewhere, you need to request a new code. How does that work with your implementation? A token given to you can be verified as legit by anyone using a public key, but there is no way to revoke it after a single use(because you have no way of knowing it's been used, by design).
      - palata 4mo ago
        The service (e.g. the porn website) keeps a list of used tokens and refuses to reuse them. You can use the same token on multiple websites, but then you leak metadata. As for the age verification "protection", I don't think it makes it worse, given that anyway someone could get a token and give it to a kid. Again, I don't think that the goal is to make it absolutely certain that no kid will ever access social media or porn. When you go to such extreme, you need dystopian technology and I don't think the juice is worth the squeeze. My opinion is that age verification may (maybe?) be a tool to make it slightly more inconvenient for kids to access some services. But I am not completely convinced that it is always desirable. Instead of accessing a mainstream porn website, they may end up downloading random stuff from the internet, including malware and possibly violent porn, which is probably worse. Social media is a real problem, but again... if a kid goes home and tell their parents that they are excluded because everybody else has TikTok, won't the parent get a token and install TikTok? Right now no parent wants their kids to use social media (or even have a smartphone), but they do it because all the other kids do, and kids need to conform.

Jabrov 4mo ago

The codes can trivially be shared in this case

gambiting 4mo ago
...and? Just like a child can "trivially" ask an adult to buy them a beer. Who are these adults giving children their verification codes for adult websites?
- Retr0id 4mo ago
  Asking adults for beer doesn't scale, code sharing can. If you want to crack down on code sharing, you'd have to start surveilling who is signing up to what.
  - gambiting 4mo ago
    So this solution is fine for proving your immigration status, getting employment or renting a house, but it's not good enough for browsing porn(to be a tiny bit flippant)? >>If you want to crack down on code sharing Right now, all the kid has to do is grab their parents passport while they are not home or asleep, scan it on their phone and they are in. It takes 30 seconds. With the codes they would either need to convince their parents to generate a code for them, or find someone online who will - which of these solutions seems less prone to abuse to you? Again, let's not let perfect be the enemy of the good.
  - triceratops 4mo ago
    > If you want to crack down on code sharing, you'd have to start surveilling who is signing up to what. Why? One code for one user account per site. If you're paranoid about privacy rotate codes and accounts weekly. As long as you can purchase the codes with cash in IRL stores the privacy impact is minimal.
  - palata 4mo ago
    > If you want to crack down on code sharing, you'd have to start surveilling who is signing up to what. Not at all. If you want to find who shares codes at scale, you just track that person. If someone sells hundreds of thousands of codes online, you can just buy one from them and you have proven that they do it. Again, if age verification is honestly about helping the kids, I don't think it has to be 100% efficient.

Retr0id 4mo ago

Every time I search something, I open a fresh private tab and google it. If I want to turn safe-search off, I'd have to go through this code verification flow for every single search. Aside from just being annoying, they'd have to implement strict rate limiting to prevent automated code sharing, so I'd soon end up waiting for a rate limit to expire before I can search anything. And "the government will know you've authenticated with pornhub" is extremely harmful, in my opinion.

intended 4mo ago
Sadly we got to this place because there are other harms that are occurring and those are forcing this conversation.
- OkayPhysicist 4mo ago
  The "other harms" are made up fearmongering by rightwing cowards and incompetent parents.
  - intended 4mo ago
    Hah. I wish. I have personally had to remove NCII for teens and young adults. Grooming is a thing, self harm communities are a thing, as is sextortion.All of it at internet scale. And this ignores the parts where the platforms released features they knew from their own tests, were harmful to teens. It is convenient to dismiss them, because it makes it easier to hold positions that depend on them being minor harms.
    - account42 4mo ago
      > I have personally had to remove NCII for teens and young adults. Grooming is a thing, self harm communities are a thing, as is sextortion.All of it at internet scale. And even 100% effective age verification will not make a dent. > And this ignores the parts where the platforms released features they knew from their own tests, were harmful to teens. Those features are also harmful to adults. > It is convenient to dismiss them, because it makes it easier to hold positions that depend on them being minor harms. It's convenient to blow things out of proportion if it helps you implement other changes you want like mass-scale tracking.

OkayPhysicist 4mo ago

This means giving the government complete insight into your internet browsing. All they need to do is store a database table of handed out keys to ids. This is unacceptable tyranny on its face.

gambiting 4mo ago
>>This means giving the government complete insight into your internet browsing. ...how? All they know is you've authenticated with service X. And like I said, we can make legislation to say they are not allowed to keep the record of who authenticated. Besides, let's not let perfect be the enemy of the good - in the UK all ISPs are required to keep a full year of your browsing history, and 17 government agencies can access this data(including DEFRA - the agriculture agency lol). So like....the "the government will have a full history of your browsing" is a ship that sailed a few years ago. Obviously I don't agree with it, and I think we should be on the streets of London and protesting this, but here we are as a country. So like yeah, I get your point. But UK is particularily fucked on this point, let's not make it even more fucked with the way things currently are, the authentication can and should be done better.

Epa095 4mo ago

Why does the government need to know what pages you visit? It could just encode a string representing the date and 'above 18' and sign it with its private key. PH then just needs to verify it using the public key.

gambiting 4mo ago
Even better solution then. >>Why does the government need to know what pages you visit? In the UK the government already knows, but that's beside the point. It's another bad law that should have been fought against much more than it was.
gambiting 4mo ago
Actually, thinking about it some more - it has one major downside. You can't have a single use key this way.
- Epa095 4mo ago
  Well the idea with the date/timestamp was that it would only be valid for X minutes, but if you are afraid that in the 10 minutes window it can be used multiple places you can add some salt to the process. PH pops up a page showing "Your secret word is: hamburgers. Provide access code below:". Age-verifier webpage asks for the secret word, and will create a json with "secret: hamburgers, claims: over_a18, date:2026..." and sign it with its private key, and this will be the code (encoded as a number). PH will verify that the code contains the secret "hamburgers", the claim and that its fresh enough (although this step is maybe not needed since it had the valid one-time secret).
  - gambiting 4mo ago
    Right, yeah I like that idea. I think that would actually work correctly and safely. Disregard my other comment on this :-)

palata 4mo ago

> but then the government will know you've authenticated with pornhub! If you do your cryptography right, the government will not know that you've authenticated with pornhub. That's the whole goddamn point of privacy-preserving age verification.

gambiting 4mo ago
On the other hand, you can't implement single use codes this way, right?
- palata 4mo ago
  You can. Or maybe I don't get what you mean? It's possible for the government (or any entity, but when it comes to ID it feels natural that the government owns it) to verify your age (by verifying your identity) and give you a token that proves that you are above age, in such a way that the government cannot track you with this token and the website cannot identify you from this token. Using zero-knowledge proofs.
  - gambiting 4mo ago
    With my implementation, the government revokes the code after it's been verified once. If you want to verify elsewhere, you need to request a new code. How does that work with your implementation? A token given to you can be verified as legit by anyone using a public key, but there is no way to revoke it after a single use(because you have no way of knowing it's been used, by design).
    - palata 4mo ago
      The service (e.g. the porn website) keeps a list of used tokens and refuses to reuse them. You can use the same token on multiple websites, but then you leak metadata. As for the age verification "protection", I don't think it makes it worse, given that anyway someone could get a token and give it to a kid. Again, I don't think that the goal is to make it absolutely certain that no kid will ever access social media or porn. When you go to such extreme, you need dystopian technology and I don't think the juice is worth the squeeze. My opinion is that age verification may (maybe?) be a tool to make it slightly more inconvenient for kids to access some services. But I am not completely convinced that it is always desirable. Instead of accessing a mainstream porn website, they may end up downloading random stuff from the internet, including malware and possibly violent porn, which is probably worse. Social media is a real problem, but again... if a kid goes home and tell their parents that they are excluded because everybody else has TikTok, won't the parent get a token and install TikTok? Right now no parent wants their kids to use social media (or even have a smartphone), but they do it because all the other kids do, and kids need to conform.