5 ms·

Yes, this is the part of the issue that is so frequently ignored: Anonymous age verification schemes are easily defeated through proxying because there wouldn't

Yes, this is the part of the issue that is so frequently ignored: Anonymous age verification schemes are easily defeated through proxying because there wouldn't be any consequences for selling your tokens. "Install this app on your phone and we'll pay you $1 per day" and it will mint your anonymous identity tokens and send them off to kids who want to buy them. If there's no way to track the tokens, there is no possibility of negative consequences. So the schemes always start introducing features to reduce the anonymity of the tokens or make them more trackable in some way: > The highest friction version of this is that the credential ties to a real world identity somehow; maybe locked behind legal barriers, etc., but if a minor is caught using someone's credential, then the person whose credential they are using can be investigated, and, if necessary, charged with a crime Which requires that these identity tokens not be anonymous age-verification credentials. They become a traceable identity token tied to your government-issued ID.

DennisP 4mo ago
> They become a traceable identity token Not if you use a challenge-response protocol where the client returns a zero-knowledge proof of age, where the proof incorporates a random string sent by the website. The traceable stuff is private information that the website never sees. If a minor is caught with it, then law enforcement has local access to the minor's hardware and can probably view the private data. At that point, the private key can be put on a public revocation list. The zero-knowledge proof can include a proof that you're not on the revocation list. Once you've been revoked, you have to go through the hassle of setting this all up again, which might be enough incentive to keep it reasonably secure.
- pastel8739 4mo ago
  This doesn’t stop the scheme the parent proposes, where adults install some proxy on their device and challenges are responded to on the parent device. Then the private key never leaves the parent device and all the child device has is the proxy software, which could be set up to not log any identifier of the key that it used
  - 7e 4mo ago
    [flagged]
    - pastel8739 4mo ago
      How so?
      - LoganDark 4mo ago
        Presumably, if you have a trusted application on a trusted device, the identifier was installed in a trusted way, the device is in trusted possession and the device won't be given to anyone else, trusted computing may be able, in certain cases, to make it more difficult for a remote minor to use the identifier.
        aleph_minus_one 4mo ago
        > in certain cases, to make it more difficult for a remote minor to use the identifier Just offer the user some money if he installs some "trusted" app for age verification token sharing.
      - iamnothere 4mo ago
        They are implying the use of trusted computing with proprietary software to ensure that only users on fully “trusted” (locked down) devices are allowed to access network resources.
    - mindslight 4mo ago
      The same way a lobotomy fixes a headache.
      - deleted 4mo ago
        [deleted]
    - franga2000 4mo ago
      Trusted computing is the biggest threat to privacy and liberty of them all!
- spwa4 4mo ago
  > Not if you use a challenge-response protocol where the client returns a zero-knowledge proof of age, where the proof incorporates a random string sent by the website. Obviously it does. These $1 per-day apps are 24/7 online and so challenges can simply be proxied just the same as tokens. > ... law enforcement has local access to the minor's hardware ... This is a large part of what people, in practice, want to prevent using this scheme. > Once you've been revoked, you have to go through the hassle of setting this all up again, which might be enough incentive to keep it reasonably secure ... States want to know who to punish when this happens. Which also details how this is defeated: you can't revoke the token, because that makes getting a conviction near-impossible and it exposes the states to counterclaims. The people who install such forwarding apps don't have money for the court to charge, and they can't take away their identification apps (which these will be, obviously) because that's the cheapest way for states to communicate with them. Unless you build this into the base layer of the internet (which European networks like minitel did, by the way, with France telecom graciously checking it for free. Free for the state, of course. YOU paid per packet) > ... to keep it reasonably secure ... Oh and "reasonably secure" won't cut it. Someone committed suicide after a message was posted, and they're "reasonably secure" who it came from? You see the problem, I hope.
  - DennisP 4mo ago
    Are you saying such proxying apps exist now? Can you link a source for me? Regarding my scheme: The only way law enforcement should have access is if they show up and get the phone in their possession, with a warrant. Which could happen any time some teenager posts something without realizing it identifies them. If the teenager has your full credentials, that's when law enforcement sees who you are, and can take whatever action we deem appropriate. I would think just revocation if you might have been hacked, more severe if it's clear you shared on purpose. Revoking credentials doesn't interfere with the person using the app for other purposes, or with any prosecution, and criminal prosecution doesn't rely on the perp having money; quite the opposite in fact. If you install a proxying app for the challenge-response, you're installing an untrustworthy app from a criminal to take payment for a criminal scheme, with risk of prosecution if that criminal gets caught. Nothing in society is perfectly secure. There are all sorts of ways that we allow some crimes and tragedies to happen because we know that preventing them would be even worse. There are good reasons that courts have long protected privacy and anonymous speech, even though we could solve more crimes without those protections.
- Aurornis 4mo ago
  > If a minor is caught with it, then law enforcement has local access to the minor's hardware and can probably view the private data. And then what? You think the police are going to make a case out of getting a token blacklisted or start an investigation into the person who the token came from? Also confiscate their devices as part of the investigation? I guarantee that the token source will be someone in another state or another country or just a stolen ID being used to sell their tokens. I can’t believe we’re getting to the point where we’re talking about sending the police to deal with cases where a minor is suspected of, what, accessing social media? To confiscate their device and do forensic analysis of the tokens on it? Do you realize how insane this is getting? How does anyone think this is feasible, let alone a good idea?
  - DennisP 4mo ago
    I'm saying a system like this is preferable to attaching our real identities to everything we do online, as countries are attempting right now. We can verify age without losing privacy or anonymous speech. It's still my preference to have no verification at all. On the internet, nobody should know you're a dog.
    - Aurornis 4mo ago
      > I'm saying a system like this is preferable to attaching our real identities to everything we do online, as countries are attempting right now. We can verify age without losing privacy or anonymous speech. The problem with your hypothetical was that you casually introduced the police as an enforcement mechanism for cases of a minor accessing an over-18 website. The implication is that the physical police are now involved in our access of websites, and you’re saying the tokens involved in us accessing websites will have some evidence that they can use in the investigation of that access. This is why we keep saying that the anonymous token schemes don’t preserve privacy. It always turns into a slippery slope of adding escape hatches to the anonymity to enforce violations. The very implication that the police are going to be tasked with going out and confiscating devices to investigate suspected age token violations is an indicator of how far the window has shifted on Internet privacy.
hacker_homie 4mo ago
I thought a solution to this would be to use a physical smartcard to store the certificate(perhaps on your government ID). if the protocol is a challenge/response and the private key never leaves the card it would make proxying without the physical card more difficult.
- pastel8739 4mo ago
  If the smart cards required some human input to perform a signature maybe this could work. Otherwise there is nothing stopping someone from selling use of their card via some proxy software
  - ruszki 4mo ago
    Is this type of problem even solvable?
    - ligne 4mo ago
      I mean Netflix haven't managed to solve password sharing so,
- wolvoleo 4mo ago
  Yeah great idea, having to get out your government ID every time you want to use a website.
  - prmoustache 4mo ago
    A certificate could be anonymous and the website would only need to verify it against the born_before_2008_root_cert in 2026. You could issue has many certs as you want and all would have a validity of 1 year so that websites only have to install at the maximum 2 root certs.
    - faeyanpiraat 4mo ago
      The “2008” part hit me hard
7e 4mo ago
Trusted computing solves this problem handily.
grey-area 4mo ago
The tokens could be tied to the device and Apple account by a provider like Apple, in fact you don’t need to issue tokens, only provide a web api that Apple and other browser providers support, which attests age. This is certainly something that can be solved technically if we want.
- dvdkon 4mo ago
  It sounds like your scheme would only allow browsing the "adult web" on locked-down, unmodified devices running government-approved software. Frankly, that's worse than even requiring ID.
  - metalman 4mo ago
    what you say which is the real thing, is the total institutionalisation of everything, the very wet dream of beurocrats everywhere, and of course done because "they have no choice", and are free to claim a pure lack of any motive or underlying agenda, and the vicious cycle of "just doing there job" enters our world, again.
  - grey-area 4mo ago
    I’m just pointing out that it is in fact technically possible to lock things down. Whether we should or not is a separate discussion.
lukan 4mo ago
We are talking about porn here. And the internet will be always full of it - and that can only be prevented by controlling all of it, or have each state have a golden firewall. All of these solutions seem very complicated, for little benefit. So a anonymous age verification scheme, fine with me. But making it more complicatdd, because dark entities could capture and resell tokens .. seems a step in the direction of madness.
- wwweston 4mo ago
  Crusades against sexually explicit material are certainly popular in some places. But these days I see a lot more talk about the developmental effects of parasocial media on kids. There’s a whole segment of buy-in there that didn’t exist before.
  - wing-_-nuts 4mo ago
    I don't see where I should sacrifice my freedoms to remain anonymous on the internet or MUCH more importantly, have control over my hardware and software just because parents can't do their job
    - wwweston 4mo ago
      Oh I’m not saying that pervasive mandated identity verification is good. I think people should be skeptical about its benefits, very wary about its downsides, presume bad actors are involved, and make proponents fight for every inch of buy in, no matter what their stated motivations are. I also think that holding important ground involves understanding the terms of the argument, including the problems people say they’re trying to solve.
miki123211 4mo ago
There is a way to prevent this (or at least slow it down), but that way requires device integrity protection. With integrity protection, tokens can only be minted with a government app, driven by both biometrics and physical human hands touching the physical screen. There's no way to do it in the background. Without it, you can indeed have a single activist mint 10 billion tokens and give them out for free, defeating the entire scheme. There's a CAP-style triangle here. You can have age assurance and anonymity but lose the ability to run your own software, have age assurance and device control but lose anonymity (via traditional ID checks, which don't require IP in theory), or have anonymity and device control but lose age assurance.
- pibaker 4mo ago
  What you conveniently forgot to mention is this means the death of open general purpose computing. No more rooted devices, no more self built PCs. You go buy a government approved device and run the government approved OS preinstalled and the moment you deviate from the government approved happy path you are booted off the internet.
  - lordfrito 4mo ago
    I'm a fan of separating the trusted compute levels for commercial and non-commercial uses/sides of the internet. I think we have to move in this direction. As it stands today, doing business on ebay/craigslist/etc isn't that much different than doing it in a back alley in the bad part of town. Generally a bad idea but YMMV if you keep your wits about you. Of course it's your right to do business that way, but no one in their right mind thinks it's acceptable to do global commerce that way. Commerce relies on legally enforceable contracts (both paper and EULAs), which ultimately rely on identity to be enforced. It's a bug, not a feature, that someone on the internet can steal my identity to purchase a product in my name and have it shipped wherever they want. It's a feature, not a bug, that my bank asks me for photo ID before I empty my account in person. I'm not allowed to access banking computers, except occasionally and from within in a sandbox with proper credentials (ATM card for example). If, in the future my bank needs to do their compute inside my house on my phone, then it seems fair that there should be walls that keep me outside of their trusted compute. That said, I am 100% behind keeping open purpose general computing free and available. Rooted devices, self built PCs etc all of it. I love it, saying this as a person who grew up building their own PCs and programming from a young age. I think that we all should be able to access the non-commercial side of the internet in any way we want, a true public square, warts, gutters and all. Hobbyists can do whatever they like as long as it doesn't touch commercial systems. As I see it, the problem for most of us is that the social/fun side of the internet has largely been captured by commercial interests. Anything with a EULA should be considered a commercial site, since you're legally bound by a contract using it. As it stands today all the fun things on the internet would require enforced identity. Maybe having a separate walled off "commercial internet with identity enforcement" will finally open the public's eyes as to the ramifications of the digital world we've built. And also allow us to individually take a stand and push back against the commercial interests through our daily choices of what sites we visit. Basically voting with your ID chip instead of your pocketbook. You can still do business in the gutter if you want to, but for the normies it will be easier for them to spot when they're in a back alley. And it gives parents options for keeping kids off of the anonymous side as as well. I do think a Reddit with identity would be a much less toxic place. As long as the brave adventurers among us can still access the digital gutters like 4chan and other message boards.
w4der 4mo ago
But could you not set up a system where you need to go get (for free) a limited use token at a physical location, or have them mailed to your home, and they have a rough geographical lock? If a bunch of those tokens start appearing in random locations, it is a good indication that someone is reselling them to minors? I'm not saying this is idiot proof, but what could go wrong?

DennisP 4mo ago

> They become a traceable identity token Not if you use a challenge-response protocol where the client returns a zero-knowledge proof of age, where the proof incorporates a random string sent by the website. The traceable stuff is private information that the website never sees. If a minor is caught with it, then law enforcement has local access to the minor's hardware and can probably view the private data. At that point, the private key can be put on a public revocation list. The zero-knowledge proof can include a proof that you're not on the revocation list. Once you've been revoked, you have to go through the hassle of setting this all up again, which might be enough incentive to keep it reasonably secure.

pastel8739 4mo ago
This doesn’t stop the scheme the parent proposes, where adults install some proxy on their device and challenges are responded to on the parent device. Then the private key never leaves the parent device and all the child device has is the proxy software, which could be set up to not log any identifier of the key that it used
- 7e 4mo ago
  [flagged]
  - pastel8739 4mo ago
    How so?
    - LoganDark 4mo ago
      Presumably, if you have a trusted application on a trusted device, the identifier was installed in a trusted way, the device is in trusted possession and the device won't be given to anyone else, trusted computing may be able, in certain cases, to make it more difficult for a remote minor to use the identifier.
      - aleph_minus_one 4mo ago
        > in certain cases, to make it more difficult for a remote minor to use the identifier Just offer the user some money if he installs some "trusted" app for age verification token sharing.
    - iamnothere 4mo ago
      They are implying the use of trusted computing with proprietary software to ensure that only users on fully “trusted” (locked down) devices are allowed to access network resources.
  - mindslight 4mo ago
    The same way a lobotomy fixes a headache.
    - deleted 4mo ago
      [deleted]
  - franga2000 4mo ago
    Trusted computing is the biggest threat to privacy and liberty of them all!
spwa4 4mo ago
> Not if you use a challenge-response protocol where the client returns a zero-knowledge proof of age, where the proof incorporates a random string sent by the website. Obviously it does. These $1 per-day apps are 24/7 online and so challenges can simply be proxied just the same as tokens. > ... law enforcement has local access to the minor's hardware ... This is a large part of what people, in practice, want to prevent using this scheme. > Once you've been revoked, you have to go through the hassle of setting this all up again, which might be enough incentive to keep it reasonably secure ... States want to know who to punish when this happens. Which also details how this is defeated: you can't revoke the token, because that makes getting a conviction near-impossible and it exposes the states to counterclaims. The people who install such forwarding apps don't have money for the court to charge, and they can't take away their identification apps (which these will be, obviously) because that's the cheapest way for states to communicate with them. Unless you build this into the base layer of the internet (which European networks like minitel did, by the way, with France telecom graciously checking it for free. Free for the state, of course. YOU paid per packet) > ... to keep it reasonably secure ... Oh and "reasonably secure" won't cut it. Someone committed suicide after a message was posted, and they're "reasonably secure" who it came from? You see the problem, I hope.
- DennisP 4mo ago
  Are you saying such proxying apps exist now? Can you link a source for me? Regarding my scheme: The only way law enforcement should have access is if they show up and get the phone in their possession, with a warrant. Which could happen any time some teenager posts something without realizing it identifies them. If the teenager has your full credentials, that's when law enforcement sees who you are, and can take whatever action we deem appropriate. I would think just revocation if you might have been hacked, more severe if it's clear you shared on purpose. Revoking credentials doesn't interfere with the person using the app for other purposes, or with any prosecution, and criminal prosecution doesn't rely on the perp having money; quite the opposite in fact. If you install a proxying app for the challenge-response, you're installing an untrustworthy app from a criminal to take payment for a criminal scheme, with risk of prosecution if that criminal gets caught. Nothing in society is perfectly secure. There are all sorts of ways that we allow some crimes and tragedies to happen because we know that preventing them would be even worse. There are good reasons that courts have long protected privacy and anonymous speech, even though we could solve more crimes without those protections.
Aurornis 4mo ago
> If a minor is caught with it, then law enforcement has local access to the minor's hardware and can probably view the private data. And then what? You think the police are going to make a case out of getting a token blacklisted or start an investigation into the person who the token came from? Also confiscate their devices as part of the investigation? I guarantee that the token source will be someone in another state or another country or just a stolen ID being used to sell their tokens. I can’t believe we’re getting to the point where we’re talking about sending the police to deal with cases where a minor is suspected of, what, accessing social media? To confiscate their device and do forensic analysis of the tokens on it? Do you realize how insane this is getting? How does anyone think this is feasible, let alone a good idea?
- DennisP 4mo ago
  I'm saying a system like this is preferable to attaching our real identities to everything we do online, as countries are attempting right now. We can verify age without losing privacy or anonymous speech. It's still my preference to have no verification at all. On the internet, nobody should know you're a dog.
  - Aurornis 4mo ago
    > I'm saying a system like this is preferable to attaching our real identities to everything we do online, as countries are attempting right now. We can verify age without losing privacy or anonymous speech. The problem with your hypothetical was that you casually introduced the police as an enforcement mechanism for cases of a minor accessing an over-18 website. The implication is that the physical police are now involved in our access of websites, and you’re saying the tokens involved in us accessing websites will have some evidence that they can use in the investigation of that access. This is why we keep saying that the anonymous token schemes don’t preserve privacy. It always turns into a slippery slope of adding escape hatches to the anonymity to enforce violations. The very implication that the police are going to be tasked with going out and confiscating devices to investigate suspected age token violations is an indicator of how far the window has shifted on Internet privacy.

hacker_homie 4mo ago

I thought a solution to this would be to use a physical smartcard to store the certificate(perhaps on your government ID). if the protocol is a challenge/response and the private key never leaves the card it would make proxying without the physical card more difficult.

pastel8739 4mo ago
If the smart cards required some human input to perform a signature maybe this could work. Otherwise there is nothing stopping someone from selling use of their card via some proxy software
- ruszki 4mo ago
  Is this type of problem even solvable?
  - ligne 4mo ago
    I mean Netflix haven't managed to solve password sharing so,
wolvoleo 4mo ago
Yeah great idea, having to get out your government ID every time you want to use a website.
- prmoustache 4mo ago
  A certificate could be anonymous and the website would only need to verify it against the born_before_2008_root_cert in 2026. You could issue has many certs as you want and all would have a validity of 1 year so that websites only have to install at the maximum 2 root certs.
  - faeyanpiraat 4mo ago
    The “2008” part hit me hard

7e 4mo ago

Trusted computing solves this problem handily.

grey-area 4mo ago

The tokens could be tied to the device and Apple account by a provider like Apple, in fact you don’t need to issue tokens, only provide a web api that Apple and other browser providers support, which attests age. This is certainly something that can be solved technically if we want.

dvdkon 4mo ago
It sounds like your scheme would only allow browsing the "adult web" on locked-down, unmodified devices running government-approved software. Frankly, that's worse than even requiring ID.
- metalman 4mo ago
  what you say which is the real thing, is the total institutionalisation of everything, the very wet dream of beurocrats everywhere, and of course done because "they have no choice", and are free to claim a pure lack of any motive or underlying agenda, and the vicious cycle of "just doing there job" enters our world, again.
- grey-area 4mo ago
  I’m just pointing out that it is in fact technically possible to lock things down. Whether we should or not is a separate discussion.

lukan 4mo ago

We are talking about porn here. And the internet will be always full of it - and that can only be prevented by controlling all of it, or have each state have a golden firewall. All of these solutions seem very complicated, for little benefit. So a anonymous age verification scheme, fine with me. But making it more complicatdd, because dark entities could capture and resell tokens .. seems a step in the direction of madness.

wwweston 4mo ago
Crusades against sexually explicit material are certainly popular in some places. But these days I see a lot more talk about the developmental effects of parasocial media on kids. There’s a whole segment of buy-in there that didn’t exist before.
- wing-_-nuts 4mo ago
  I don't see where I should sacrifice my freedoms to remain anonymous on the internet or MUCH more importantly, have control over my hardware and software just because parents can't do their job
  - wwweston 4mo ago
    Oh I’m not saying that pervasive mandated identity verification is good. I think people should be skeptical about its benefits, very wary about its downsides, presume bad actors are involved, and make proponents fight for every inch of buy in, no matter what their stated motivations are. I also think that holding important ground involves understanding the terms of the argument, including the problems people say they’re trying to solve.

miki123211 4mo ago

There is a way to prevent this (or at least slow it down), but that way requires device integrity protection. With integrity protection, tokens can only be minted with a government app, driven by both biometrics and physical human hands touching the physical screen. There's no way to do it in the background. Without it, you can indeed have a single activist mint 10 billion tokens and give them out for free, defeating the entire scheme. There's a CAP-style triangle here. You can have age assurance and anonymity but lose the ability to run your own software, have age assurance and device control but lose anonymity (via traditional ID checks, which don't require IP in theory), or have anonymity and device control but lose age assurance.

pibaker 4mo ago
What you conveniently forgot to mention is this means the death of open general purpose computing. No more rooted devices, no more self built PCs. You go buy a government approved device and run the government approved OS preinstalled and the moment you deviate from the government approved happy path you are booted off the internet.
- lordfrito 4mo ago
  I'm a fan of separating the trusted compute levels for commercial and non-commercial uses/sides of the internet. I think we have to move in this direction. As it stands today, doing business on ebay/craigslist/etc isn't that much different than doing it in a back alley in the bad part of town. Generally a bad idea but YMMV if you keep your wits about you. Of course it's your right to do business that way, but no one in their right mind thinks it's acceptable to do global commerce that way. Commerce relies on legally enforceable contracts (both paper and EULAs), which ultimately rely on identity to be enforced. It's a bug, not a feature, that someone on the internet can steal my identity to purchase a product in my name and have it shipped wherever they want. It's a feature, not a bug, that my bank asks me for photo ID before I empty my account in person. I'm not allowed to access banking computers, except occasionally and from within in a sandbox with proper credentials (ATM card for example). If, in the future my bank needs to do their compute inside my house on my phone, then it seems fair that there should be walls that keep me outside of their trusted compute. That said, I am 100% behind keeping open purpose general computing free and available. Rooted devices, self built PCs etc all of it. I love it, saying this as a person who grew up building their own PCs and programming from a young age. I think that we all should be able to access the non-commercial side of the internet in any way we want, a true public square, warts, gutters and all. Hobbyists can do whatever they like as long as it doesn't touch commercial systems. As I see it, the problem for most of us is that the social/fun side of the internet has largely been captured by commercial interests. Anything with a EULA should be considered a commercial site, since you're legally bound by a contract using it. As it stands today all the fun things on the internet would require enforced identity. Maybe having a separate walled off "commercial internet with identity enforcement" will finally open the public's eyes as to the ramifications of the digital world we've built. And also allow us to individually take a stand and push back against the commercial interests through our daily choices of what sites we visit. Basically voting with your ID chip instead of your pocketbook. You can still do business in the gutter if you want to, but for the normies it will be easier for them to spot when they're in a back alley. And it gives parents options for keeping kids off of the anonymous side as as well. I do think a Reddit with identity would be a much less toxic place. As long as the brave adventurers among us can still access the digital gutters like 4chan and other message boards.

w4der 4mo ago

But could you not set up a system where you need to go get (for free) a limited use token at a physical location, or have them mailed to your home, and they have a rough geographical lock? If a bunch of those tokens start appearing in random locations, it is a good indication that someone is reselling them to minors? I'm not saying this is idiot proof, but what could go wrong?