This keeps coming up and we keep having the same debates about what Age Verification isn't.
For the folks in the back row:
Age Verification isn't about Kids or Censorship, It's about Surveillance
Age Verification isn't about Kids or Censorship, It's about Surveillance
Age Verification isn't about Kids or Censorship, It's about Surveillance
Without even reaching for my tinfoil hat, the strategy at work here is clear [0 1 2]. If we have to know that you're not a minor, then we also have to know who you are so we can make any techniques to obfuscate that illegal. By turning this from "keep an eye on your kids" to "prove you're not a kid" they've created the conditions to make privacy itself illegal.
VPNs are next. Then PGP. Then anything else that makes it hard for them to know who you are, what you say, and who you say it to.
Please, please don't fall into the trap and start discussing whether or not this is going to be effective to protect kids. It isn't, and that isn't the point.
As much as you (and I as well) don't want age verification to involve discussion about kids' access to content because we're more concerned about the surveillance push riding the popularity of that, repeating "it isn't about kids" loudly 3 times doesn't make the (extremely large) group of people pushing age verification for kids disappear.
Telling that larger group their interest just isn't part of the conversation at all excludes _you_ from the conversation rather than changing the focus of the conversation to the other downsides instead of the primary interest others might have.
There are also, concerningly IMO, an extremely large amount of people willing to accept severe surveillance or privacy downsides so long as it helps achieve the goal about kids. To them, the same would in reverse would be "why are you talking about surveillance, the real issue is the kids. Say it 3 times loud, for those in the back!" and the conversation gets nowhere because it's just people saying how they won't talk to anyone who disagrees what concerns should be considered.
> There are also, concerningly IMO, an extremely large amount of people willing to accept severe surveillance or privacy downsides so long as it helps achieve the goal about kids.
I’m alive. Nice to meet you.
I “accept severe surveillance”, not in the sense that I agree with it, but because I know that it already exists and has existed and that people that are against it are screaming into the wind. Many large and small countries have long histories of surveillance.
It’s not that you shouldn’t try to enforce privacy, in fact, the law requires it if you in some cases, and it’s a good idea in others.
I’m certainly not against the EFF standing up for the rights of everyone not to be severely surveilled.
But, realistically, the public cannot easily anonymize our activity and data. And if you try to do so, you’re painting yourself as a target.
If you were trying to keep your country safe, wouldn’t you like the ability to infiltrate any major cloud, SaaS app, social media platform, bank, government, VPN/internal network, and OS?
Similarly, if you were a big data or security company wouldn’t you also do everything you could to know everything it is to know about a person if you had the means and time and it made sense for your business?
Following, if you were to have that power as a government, business, or other organization, wouldn’t it be critical to ensure that you restricted its use to ensure it wasn’t abused to the point that you’d lose it, even though the reality would be that you probably don’t have time to keep it as safe as you need to?
I “accept severe surveillance” not because I promote it or want it, but because I understand how the world works and what it does.
All these things will pass. If you have the focus and the mental capacity to do what is good, then do it. It likely helped the world in some way to learn about KGB wiretaps. But, in the U.S., as far as I can tell, the backlash against the CIA and NSA was just used for political gain and then to replace those that didn’t agree with the current administration. Was that helpful? And who are we really being manipulated by when we attack ourselves and install destabilizing leaders?
Chances of being manipulated and attacking yourselves would diminish quite a bit if those tasked with surveillance wouldn't be blinded by the pursuit of as much data as they can get their hands on. Yes, knowing everything there is to know about a person can be helpful to a point, but if you had the means and time there is literally no business where it makes sense to pre-emptively collect every bit of data on such a single person. To do so in regard to multiple people or more will have a crippling effect on gaining insight and understanding of relevant information. Having a vast knowledge-base is a huge waste of resources when it impairs your capacity to convert what you know into what would be wise. There's really no need to infiltrate anything and everything to know what needs to be known, and it will save a whole lot of distraction and data fatigue.
People eager to have such a vast trove of data at their fingertips lack patience and focus to develop skills to use their access responsibly - having them around is counterproductive and dangerous in any business where intelligence is key.
So, no. I would actually prefer to try and keep my country safe, thus any desire to infiltrate anything, anywhere, anytime would be irrational, and most likely an early warning signalling an onset of dementia, delirium or any similarly debilitating condition. It should certainly exclude me from working with highly sensitive data, unless you are in the business of making my country less safe.
This is a fairly defeatist approach to the issue (read that as a statement of fact, not an accusation or argument). The problem with taking this stance, for many people, is that you’re giving a mouse a cookie, except the cookie is marginally more and more control over your life in the form of the ability to control what you see, what communities you’re allowed to engage with, and what you’re allowed to do online.
This battle for online privacy and control is just that, a battle, and you are correct that it is not a fair fight. But engaging and pushing back, through advocacy, speaking out, and acts of noncompliance does three things:
First, it slows the progress of these measures and thus limits the amount of control over our lives we give up, hopefully until some more politically friendly people come to power.
Second, it provides a barometer (via its effectiveness) for assessing the state of that fight, and how dire it is becoming.
Finally, people voicing their concerns about these laws gives information that helps inform more powerful and potentially altruistic advocates with more resources (such as the EFF) in how those resources should be allocated.
Maybe those aren’t good reasons for you, and that’s okay. Lots of people just want to browse twitter and see sports scores and they don’t really care if they have to show ID to do that. For anybody else reading this though, there are lots of reasons why your involvement and engagement in this issue should not stop with “that’s just how the world works”.
The issue here for me has always been about the difference between treating a symptom and treating the illness.
Excessive surveillance is necessary when you cannot convince people of the merits of your politics or morals on their own and need to use the power of the State to intimidate and control their access.
For the issue on minors, if you have a child (guilty here) you are obligated to actively raise and educate them on the nature of the world. For access to online interactions this doesn’t necessarily only mean active limits (as one might judge appropriate for the child), but also teaching them that people do not always have positive intent, and anonymity leads to lack of consequence, and consequently potentially antisocial behavior.
A person’s exposure to these issues are not limited to interactions online. We are taught to be suspicious of strangers offering candy from the back of panel vans. We are taught to look both ways when entering a roadway.
The people demanding the right to limit what people can say and who they can talk to do so under the guise of protecting children, but these tools are too prone to the potential for abuse. In the market of ideas it’s better (and arguably safer, if not significantly more challenging) to simply outcompete with your own.
I read it more as "give the mouse a cookie because it's already getting crumbs"
These types of arguments are quite common due to how beneficial they are for authoritarian. People forget that authoritarians don't need a lot of supporters, but they do need a lot of people to be apathetic or feel defeated. With that in place even a very small group can exert great power. Which also tends to make their power appear larger than it is, in order to create that feedback loop
> If you were trying to keep your country safe, wouldn’t you like the ability to infiltrate any major cloud, SaaS app, social media platform, bank, government, VPN/internal network, and OS?
No!
In fact, the opposite!
If I have keys then so do my enemies! I want that shit locked down as much as possible because I don't want others infiltrating.
Personally if I was the president I would direct the NSA to pen test our own networks and work with companies to resolve any issues. I would make this a major priority in fact. I don't want them to be vulnerable or subject to blackmail.
Is it annoying I can't get in and watch them? Sure. But you can't have both.
Everyone is adults here and get trust. Plus, I'm the government. If I have legitimate belief they're acting illegally I have the power to get in anyways. It's just shower, requiring courts who keep my power in check
I suppose it depends on how much else you want to see. E.g. the recent discussion on Australia's social media band for teens https://news.ycombinator.com/item?id=46208348 has ~1500 comments covering nearly every possible angle I could have conceived and some positions I'm not sure I would have even been able to imagine. Focusing on about the kids is a popular position in threads like that, and one of the top 5 top level comments is even an example of "I care about the kids and don't want to discuss how it should be about these other things".
And the Internet also consists in large part of bots talking to bots. This is not to say that some people won't always promulgate the "Won't somebody please think of the children?" argument every time an expansion of the surveillance state apparatus is in question, but rather to say that we should not take for granted that every bad opinion we see online is one deeply held by any real people.
Age Verification is about Kids and Censorship: to track them and censor them
Age Verification is about Kids: giving it to companies who will keep it as safe as they've kept your identity, email, and other information.
Age Verification is about Kids and Censorship: taking control from you and giving it to corporations and government.
Age Verification is about Kids and Censorship: to keep them on their platforms so they can profit from them
Age Verification isn't just about Kids: it's also about tracking you
I don't know why we want to put children's data online. I don't want cameras in the kids rooms to verify their face, that camera will be used by others. That camera will be used to do the very thing they claim it is to protect against. I don't want the kids online, easily meeting with pedos, pretending to be kids or otherwise. I don't want kids data online for those people to use it to harm them. I don't want kid's data being leaked and exposed forever. To create lasting damage that will follow then the rest of their lives.
The road to hell is paved with good intentions. The devil uses this to fool you. Seriously, y'all gonna trust your kids' data with the people in the Epstein list? Why would you let a fox guard the chicken coop?
"Age Verification is about suppressing the 'undesirable' for kids, but also for you". I.e. having to share your personal identity for that taboo (but legal and harmless) sex site (or whatever someone in power might not approve of) sure is going to make you think twice and may even kill many smaller instances withojt making them illegal outright.
It may not sound bad in a single example, but eventually there is something you like that is fine but gets added to the list.
"group of people pushing age verification for kids disappear."
Parents need to parent then, but the amount that will are still larger than the people who want mass surveillance because they can't be arsed to raise their kids.
If they are too lazy to raise their kids, they don't have the energy to push the nanny state forward.
Parenting is, and always has been, a collective responsibility. We made it illegal to sell alcohol to kids, instead of just complaining that parents weren't teaching them not to drink it.
> Parenting is, and always has been, a collective responsibility.
No, it isn't, and no it hasn't. Other people have always been involved in the upbringing of children, but responsibility for parenting has never belonged to anyone other than parents.
And the others involved have always been individuals operating within the bounds of direct trust relations with parents and children -- extended family members, neighbors, friends etc. -- and not strangers enforcing rules promulgated by other strangers.
The social context in which parenting takes place is "family", not "political state".
This take is really detached from reality, I get down voted for this whenever I ask, but do you have kids? If not sorry, but your opinion means nothing.
We all exist in a society and (as the other comment says) it take society to raise kids. I don't want a society where as a parent I have to fight against shitty parents and the potential immaturity of my kids (they are too young right now thank god) to stop them watching porn as a 11yo or other inappropriate gifts from internet "culture".
Setting some reasonable standards for what content kids should consume provides parents with cover when trying to raise their children well. Its the reason movies have age gates, and strip clubs and many other things not on the internet.
> This take is really detached from reality, I get down voted for this whenever I ask, but do you have kids? If not sorry, but your opinion means nothing.
The reason you get down voted is likely because you are neither sorry nor correct. Just because someone doesn't have children does not mean their opinion of technology that affects them just the same is invalid. You will get better results engaging others in meaningful debate without dehumanizing folks simply because they aren't like you.
> Your sci-fi distopia flash fiction is compelling, but not actually on topic in this discussion.
> "Think of the children" is weaponized for censorious purposes, but also the harms of social media are well documented (unlike many of the other moral panics fuelled by this phrase).
> I'm not sure a blanket under-16s ban on all social media is the right answer, but there are really good reasons why people support this that you need to engage with to have a useful discussion here.
So basically for everyone even with modest pattern recognition abilities the template used here should be crystal clear, which goes along the lines of
- I'm kinda with you (even though you are stupid and emotion-driven);
- But your point is totally invalid because you should be humiliated by the sheer number of your opponents, which renders you small and negligible;
- Your opponents have very good reasons to support any fascism that is able to address their reaction to prefabricated problems with prefabricated solutions, and you've got to support that too if you want to be heard.
I'm pretty sure these threads are chock full of shills, because one can't rob people of freedom without significant narraive steering efforts.
The first comment is a real example of what I was saying about seeing the reverse situation - when it's someone you disagree with it becomes obvious how dangerous it is to say other views/ideas are not supposed to be part of the conversation. zthe other comments are ones I'f personally disagree with, but that's precisely the kind if discourse which needs to be engaged with instead of ignored if one has any concerns around fascism taking hold.
Also, I don't want to give the impression the only path here is to placate the other concerns/interest. That does work very well if you can, but the main point is just avoid this idea declaring anny other ideas out of the conversation because you disagree with them and only want people to talk about what you like. That doesn't help, you want to convince people to see the reasons you do not to ignore them.
If you ever feel there are threads with shills, take the time to send an email to hn@ycombinator.com with the parts in question. This isn't just some platitude people say here, they've really hopped right on it, triggered action, and got back to me every time I've emailed.
I would much rather have laws that require that certain kinds of websites return machine-readable headers describing what kind of content is on them, and then browsers, web proxies, etc. could be configured by parents, schools, etc. to block undesirable sites.
> 1. Most of the dollar costs of making it all happen will be paid by the people who actually need/use the feature.
> 2. No toxic Orwellian panopticon.
> 3. Key enforcement falls into a realm non-technical parents can actually observe and act upon: What device is little Timmy holding?
> 4. Every site in the world will not need a monthly update to handle Elbonia's rite of manhood on the 17th lunar year to make it permitted to see bare ankles. Instead, parents of that region/religion can download their own damn plugin.
This is the exact argument that we had in the 1990s about content on television, and the solution ended up being exactly this -- TV networks started attaching ratings to their broadcasts, and TV sets started including "v-chips" that could be turned on and configured to block content that matched certain ratings.
Once that solution was in place, the argument was settled, and the people trying to push for censorship in pursuit of ulterior motives didn't have a leg to stand on.
And really, a locally running AI could make that assessment pretty easily even if it isn't declared. No need to destroy the whole world's privacy. Unless that was the goal to begin with, obviously.
It's been illegal to sell porn to minors since approximately forever. If that is constitutional (not saying it is, but I'd be surprised if it wasn't since it's such an established practice), then I don't see how requiring age verification on porn sites wouldn't be. Requiring health warnings might be another matter, though. Not sure about that.
No, it's still illegal in most places to knowingly distribute pornography to minors - the law in my state starts;
> A person who sells, gives away or in any way furnishes to a person under the age of 18 years a book, pamphlet, or other printed paper or other thing, containing obscene language, or obscene prints, pictures, figures or descriptions tending to corrupt the morals of youth
People are complacent. Even me, even you. We're not going to get off our 21st-century comforts asses and actually do anything to disrupt anything.
At best I may avoid using products from certain companies until I really have to, like Google and Microsoft's AIs, or clear cookies after signing into YouTube so it doesn't sign you into everything else, or write a comment here and there about how some Apple APIs like the iCloud Keychain allow Facebook etc to track you across devices and reinstalls, but I'm not ever going bother doing anything more that would actually challenge all this dystopian fuckiness.
Like many mention in other comments on this post, it's possible to implement using ZKPs. There are likely other methods that would be effective without compromising privacy. None of them are part of the Age Verification discussion because kids are not the actual point of Age Verification.
When I say "if we have to know you're not a kid, we have to know who you are" I'm not stating an actual truth, but the argument as it is playing out politically.
> None of them are part of the Age Verification discussion because kids are not the actual point of Age Verification.
The EU age verification solution says implementations SHOULD implement[1] their ZKP protocol[2]. Not linking it to the user is stated as an explicit goal:
Unlinkability: The goal of the solution is to prevent user profiling and tracking by avoiding linkable transactions. Initially, the solution will rely on batch issuance to protect users from colluding RPs. Zero-Knowledge Proof (ZKP) mechanisms will be considered to offer protection. More details are provided in Section 7.
Is there a good explanation of how ZKPs prevent attestation providers (which presumably know your identity) from linking an issued proof back to you if, for example, the website elects to store it? I can wrap my head around RSA and ECC and PKI, but I haven't managed to make sense of this yet.
Assuming that's even a goal, of course. The cited paragraph mentions RPs (the websites, from what I understand), but makes no mention of attestation providers.
This is, of course, very technical, but here is how it works at a high level.
In the non-ZKP presentation, the "holder" (phone) sends the credential to the relying party (website), and the RP executes some verification algorithm. In the ZK presentation, the holder executes the verification algorithm and sends to the RP a proof that the algorithm was executed correctly.
The "proof" has this magical property that it reveals nothing other than the check passed. (You will have to take on faith that such proofs exist.) In particular, if the check was the predicate "I have a signature by ISSUER on HASH, and SHA256(DOCUMENT)==HASH, and DOCUMENT["age_gt_18"]=TRUE", anybody looking at the proof cannot infer ISSUER, HASH, DOCUMENT, or HASH, or nothing else really. "Cannot infer" means that the proof is some random object and all HASH, DOCUMENT, ISSUER, etc. that satisfy the predicate are equally likely, assuming that the randomness used in the proof is private to the holder. Moreover, a generating a proof uses fresh randomness each time, so given two proofs of the same statement, you still cannot tell whether they come from the same ISSUER, HASH, DOCUMENT, ...
Excellent question. More generally, what prevents me from copying the credential and giving it to somebody else?
The currently favored approach works like this. The DOCUMENT contains a device public key DPK. The corresponding secret key is stored in some secure hardware on the phone, designed so that I (or malware or whatever) cannot extract the secret key from the secure hardware. Think of it as a yubikey or something, but embedded in the phone. Every presentation flow will demand that the secure element produce a signature of a random challenge from the RP under the secret key of the secure hardware. In the ZKP presentation, the ZKP prover produces a proof that this signature verifies correctly, without disclosing the secret key of the secure hardware.
In your example, the parent could give the phone to the kid. However, in current incarnations, the secure hardware refuses to generate a signature unless unlocked by some kind of biometric identification, e.g. fingerprint. The fingerprint never leaves the secure hardware.
How does the issuer (e.g. the republic of France) know that DOCUMENT is bound to a given fingerprint? This is still under discussion, but as a first bid, a French citizen goes to city hall with his phone and obtains DOCUMENT after producing a fingerprint on the citizen's phone (as opposed to a device belonging to the republic of France). You can imagine other mechanisms based on physical tokens (yubikeys or embedded chips in credit cards, or whatever). Other proposals involve taking pictures compared against a picture stored in DOCUMENT. As always, one needs to be clear about the threat model.
In all these proposals the biometric identification unlocks the secure hardware into signing a nonce. The biometrics themselves are not part of the proof and are not sent to the relying party or to the issuer.
Another excellent question. The current answer in the EU seems to be "you need a phone". My preferred answer (despite being one of the Google guys who designed the ZKP mechanism) would be that the government sends you some sort of plastic card with a chip that does not tie you to a phone. Still fighting that battle.
Yes. However, at some point there needs to be some unforgeable piece of hardware that prevents copying the document. I am a big fan of yubikeys and I wish everybody used them, but the reality is that people lose them way more often than they lose their phone.
> How does the issuer (e.g. the republic of France) know that DOCUMENT is bound to a given fingerprint? This is still under discussion, but as a first bid, a French citizen goes to city hall with his phone and obtains DOCUMENT after producing a fingerprint on the citizen's phone (as opposed to a device belonging to the republic of France).
Are you saying that someone goes to city hall, shows ID, and gets a DOCUMENT that certifies age, but doesn't link back to the person's identity? And it's married to a fingerprint in front of the person checking ID?
Is there a limit on how many times someone can get a DOCUMENT? If not, it'll become a new variation of fake id and eventually there's going to be an effort to crack down on misuse. If yes, what happens if I get unlucky and lose / break my phone limit + 1 times? Do I get locked out of the world? The only way I can imagine limiting abuse and collateral damage at the same time is to link an identity to a DOCUMENT somehow which makes the whole ZKP thing moot.
I'd be more worried about the politics though. There's no way any government on the planet is going to keep a system like that limited to simple age verification. Eventually there's going to be enough pretense to expand the system and block "non-compliant" sites. Why not use the same DOCUMENT to prove age to buy beer? Sanity for guns? Loyalty for food?
What happens if the proof gets flipped to run the other direction and a DOCUMENT is needed to prove you're a certified journalist? Any sources without certification can be blocked and the ZKP aspect doesn't matter at that point because getting the DOCUMENT will be risky if you're a dissenter. Maybe there's an interview. Maybe there's a background check. Has your phone ever shown up near a protest?
It's just like the Android announcement that developers need to identify themselves to distribute apps, even via side loading. The ultimate goal is to force anyone publishing content to identify themselves because then it's possible to use the government and legal system to crush dissenting views.
Big tech caused most of the problems and now they're going to provide the solution with more technology, more cost, and less freedom which is basically what they've been doing for the last 2 decades so it's not a surprise.
I somewhat understand your argument about how to prevent misuse, but I'd say one could do that by embedding the key in an ID card and someone will have to connect the ID card to the phone/computer (e.g. via NFC). So obviously you can pretend you lost your ID card and get a new one, but I would say that you can only do that so often until someone will get suspicious, just as if you would ask for a new passport every couple of months someone would start asking you some serious questions.
Regarding using the document to buy beer, that's already done, you need to provide ID. I also hope you being asked to provide ID for buying guns, but then again I'm not from the US, so I have quite a different opinion on gun ownership.
All that said though, we are currently watching some of the most significant civil rights abuses by authorities, all without any ID system and people are worried about age verification? If the government wants to abuse their power they don't need an ID system, they just look at your social media profile at the border.
This post is restricted to the context of the European Union and is intended to be factual.
The EU age verification app is intended to be a pilot to the EU Digital Identity Wallet (EUDIW), which EU law requires to be deployed everywhere in Europe by the end of 2026. (Thus your "worry" is in fact the explicit plan of record.)
The EUDIW will store more attributes than age. Think of it as a digital form of a passport (with name, address, etc.). The exact set of attributes is determined by local laws.
Thus, the DOCUMENT that you obtain is tied to you, and of course the state knows what is in the DOCUMENT since the state creates the document in the first place.
The state does not generate proofs. The phone generates proofs. Given a proof (and only the proof), nobody can associate the proof to the phone or to you.
Now I switch to less factual statements, which are still approximately correct.
Why would you trust the wallet software not to phone home to the state or us (Google)? The EUDIW regulations require that the wallet software be open source. However, states will only issue DOCUMENT to their own certified wallet software---you cannot just take the open source and recompile it, since the state won't issue DOCUMENT to your uncertified wallet. (Maybe your gym will issue a gym membership to your raspberry pi wallet, since it's not a big deal.)
The reason for this strictness is that the EUDIW is intended for official or semi-official uses. For example, you can open a bank account with it, or use it as ID to get a mortgage. The bank must by law accept DOCUMENT, the state guarantees that DOCUMENT is correct, and you get better privacy than handling over a piece of plastic that is then photocopied by who knows whom. This is the tradeoff of the current EU law. It would be inappropriate for this kind of official, passport-like documents to store attributes such as your profession (journalist or whatever), and nobody is talking about it.
Thanks for replying to me. I'm having a tough time understanding how it's zero knowledge, but also tied to a person's identity. At some point I'm going to try to read the manuscript you linked to someone else, but I started skimming it and I'll be lucky if I understand a tiny fraction of it.
> The state does not generate proofs. The phone generates proofs. Given a proof (and only the proof), nobody can associate the proof to the phone or to you.
I get that part. I visit a website and it basically asks me to prove my DOCUMENT has an attestation for age and my phone generates the proof. The part I don't get yet is how it proves the issuer.
> However, states will only issue DOCUMENT to their own certified wallet software---you cannot just take the open source and recompile it, since the state won't issue DOCUMENT to your uncertified wallet.
I don't get why that would matter. I think of it in terms of proving you have a signed DOCUMENT (like a signed executable), but that concept doesn't work for a proof with a subset of data in the DOCUMENT. The wallet can't be trusted either, can it? What would stop me from running a proxy to tamper with the responses?
> Why would you trust the wallet software not to phone home to the state or us (Google)?
To be honest, I don't and I think calling certified wallets "tamper proof" is incorrect. They're tamper proof from the perspective of the users, but the designers, maintainers, policy makers can "tamper" at will.
> For example, you can open a bank account with it, or use it as ID to get a mortgage.
This starts to get into the biggest issue for me. As an average person, all I know is that I have this DOCUMENT with all my vital personal information on it and some of that information can be sent to a 3rd party that asks for it. Because it's such a complex technical system I have no way of understanding what's happening or verifying I'm only sending the information I expect them to be asking for. If it's a permission system like we have on phones, that's broken. People have been conditioned to think they need to click yes on everything or things won't work. I'd worry that suddenly people will be giving away vital information without even knowing.
> you get better privacy than handling over a piece of plastic that is then photocopied by who knows whom
On a technical level, that's right. On the level of an average person understanding what information they're handing over and how it's being used (or potentially misused), that's wrong. I understand perfectly what I'm handing over when I give someone my credit card or drivers license. A digital ID system is basically opaque to me.
We have to put 100% faith in a few companies; Google, Apple, etc.. We need to trust they're acting in good faith and getting the implementation perfect. The saying is trust but verify, but what happens when the system is so complex that not enough people can verify it does what it says, or, more importantly, that policy makers aren't giving classified orders that force the handful of certified wallets to change the way things work?
The technology is very cool. When I see documents like that manuscript you linked I'm envious. I wish I could understand the math well enough to conceptualize the whole system. I think there's a ton of value in leveraging technology to modernize identity. I also have no doubt the people working on the implementation are acting in good faith. Flat out though, I don't trust the institutions. There's always someone willing to act in bad faith for one reason or another.
I think it's important to understand there's a difference between analog verification systems and digital verification systems. If someone is checking my ID or comparing my face to pictures in a book of banned patrons, that has a natural limit on the scalability. Once things are digital, all bets are off. Think of the difference between a manager banning someone from a single store vs facial recognition being used to ban someone from every store in a chain. Digital IDs could very well be the next step up where people can be banned from participating in society.
Also think about the difference between fingerprint unlock for releasing a digital ID vs Face ID. With a fingerprint, you're creating a limit on what people will tolerate in terms of the number of times their ID is queried. With Face ID, people will tolerate a much larger volume. If the biometric ID is cached and allows multiple uses of a digital ID within X minutes, the number goes even higher. With a watch that's unlocked until you take it off your wrist, it's unlimited.
So, if you're working on these systems, consider there's more than just an algorithm and the implementation can leverage what the average person will tolerate to act as a bit of a check on the system. The fingerprint unlocking above is a good example where 1 fingerprint scan = 1 proof. People can understand that. Please don't build a system that allows for continuous identification.
Thanks for trying to explain some of the goals and how the system actually works. It's really hard to separate the politics from the technology, because they can't be separated, but I find it helps to have a better understanding of the technology as it helps when trying to focus on pragmatic concerns.
> Eventually there's going to be enough pretense to expand the system and block "non-compliant" sites. Why not use the same DOCUMENT to prove age to buy beer? Sanity for guns? Loyalty for food?
You're not wrong to be concerned about those impulses, but I think this is getting into "perfect is the enemy of good" territory.
A really authoritarian government isn't going to make an effort to misuse the system that way: They'll tear it down entirely and go back to worse-alternatives which we already use, where they do know all parties involved and exactly when and what was being checked.
I think a parent should be able to give their kid access if they deem their kid mature enough. If the kid can handle social media without it becoming an addiction or a self-esteem issue or similar, then it would generally be a net positive. For example, social media may include YouTube which has a lot of educational content. Why hold the kid back?
the more I think about it, the more I feel like I need someone with deep knowledge to explain ZKPs to me.
So like, we've got this algorithm that gets sent our way and we run it and that provides kind of a cryptographic hash or whatever. But if we're running the algorithm ourselves what's to stop us from lying? Where does the 'proof' come from? What's the check that it's running and why do we inherently trust the source it's checking?
I’m not exactly sure about ZKPs but for age verification the “proof” can come from the government but in such a way that the web service doesn’t know anything more than whether an assertion is true, and the government doesn’t know anything more than you wanted to verify some assertion.
This is a simplified method for age verification:
I want to buy alcohol from my phone and need to prove I’m over 18. SickBooze.com asks me for proof by generating a request to assert “age >= 18”.
My phone signs this request with my own private key, and forwards it to the government server.
The government verifies my signature against a public key I previously submitted to them, checks my age data in their own register of residents, and finally signs the request with one of their private keys.
My phone receives the signed response and forwards it back to SickBooze.com, which can verify the government’s signature offline against a cached list of public keys. Now they can sell me alcohol.
- the “request” itself is anonymous and doesn’t contain any identifying information unless that is what you intended to verify
- the government doesn’t know what service I used, nor why I used it, they only know that I needed to verify an assertion about my age
- the web service I used doesn’t know my identity, they don’t even know my exact age, they just know that an assertion about being >= 18 is true.
> the government [...] only know[s] that I needed to verify an assertion about my age
This is problematic if a majority of things needing age verification are looked down upon; for example, insurance companies would love to know what people don't do things needing age and therefore don't buy alcohol (at least not online).
The first question is how would the insurance find out that you are doing lots of things requiring age verification? The only body that could tell them is the government, while a distrust in the government can be healthy, I think this is the least thing to worry about, the government typically knows already much more damaging things than how often you ask for age verification.
Moreover, that would only work if there are relatively few things that require age verification and it needs more than just being looked down upon, i.e. while alcohol buying might be interesting information for insurances, watching porn is likely less interesting. Even worse, if the insurance can't distinguish between porn and alcohol (which they can't by design even if the government would give them the information about how often you ask for age verification).
Here is a hopefully simple example of how this ZKP thing may even be possible. Imagine that you give me a Sudoku puzzle. I solve it, and then I want to prove to you that I have solved it without telling you the solution. It sounds impossible, but here is one way to do it.
I compute the solution. I randomly scramble the digits 1-9 and I put the scrambled solution in a 9x9 array of lock boxes on a table. I have the keys to the 81 locks but I am not giving you the key yet. You randomly ask me to open either 1) one random row chosen by you; 2) one random column chosen by you; 3) one random 3x3 block chosen by you; or 4) the cells corresponding to the original puzzle you posed to me. In total you have 28 possibilities, and assume that you choose them with equal probability. You tell me what you want and I open the corresponding lockboxes. You verify that the opened lock boxes are consistent with me knowing a solution, e.g. all numbers in a row are distinct, the 3x3 block consists of distinct numbers, etc. If I am cheating, then at least one of your 28 choices will be inconsistent, and you catch me with probability 1/28, so if we repeat this game 1000 times, and I don't know the solution, you will catch me with probability at least 1-(1/28)^1000 which is effectively 1. However, every time we repeat the game, I pick a different random scrambling of the integers 1-9, so you don't learn anything about the solution.
All of ZKP is a fancy way to 1) encode arbitrary computations in this sort of protocol, and 2) amplify the probability of success via clever error-correction tricks.
The other thing you need to know is that the protocol I described requires interaction (I lock the boxes and you tell me which ones to open), but there is a way to remove the interaction. Observe that in the Sudoku game above, all you are doing is flipping random coins and sending them to me. Of course you cannot let me pick the random coins, but if we agree that the random coins are just the SHA256 hash of what I told you, or something else similarly unpredictable, then you will be convinced of the proof even if the "coins" are something that I compute myself by using SHA256. This is called the "Fiat-Shamir transformation".
How do we implement the lock boxes? I tell you SHA256(NONCE, VALUE) where the NONCE is chosen by me. Given the hash you cannot compute VALUE. To open the lock box, I tell you NONCE and VALUE, which you believe under the assumption that I cannot find a collision in SHA256.
> How do we implement the lock boxes? I tell you SHA256(NONCE, VALUE) where the NONCE is chosen by me. Given the hash you cannot compute VALUE. To open the lock box, I tell you NONCE and VALUE, which you believe under the assumption that I cannot find a collision in SHA256.
That's the bit I was missing! The prover pre-registers the scrambled solution, so they can't cheat by making up values that fit the constraints.
Yes. The whole trick is a delicate balance between 1) committing to enough information that uniquely pins down the solution, assuming that one can open all the lock boxes, and 2) not opening too many lock boxes so that the verifier does not learn the solution.
One thing to keep in mind when reading about any "ZKP protocol" is that on its own the term has the same inherent vagueness as "end-to-end encrypted" - especially when like here there are more than two parties concerned to solve a single verification.
What information is not disclosed to whom? In what way is it ZK?
One example is Googles "zero-knowledge age verification" where AFAICT, Google still has full insight into all the sensitive data and metadata. It's not like they inherently need to be the designated middleman but that is how the scheme is designed. Therefore I find it ingeniously marketed. A bit like saying "Facebook Messenger protects all your messages with end-to-end encryption", which is arguably technically true but misleading and not an honest statement.
> same inherent vagueness as "end-to-end encrypted"
Recent HN discussion example: How Kohler Inc. has a toilet feces analysis camera with "end to end encrypted", except they're one of the ends so it is deceptive advertising.
If privacy is an explicit goal, why isn't it a MUST? Why even bother with the initial batch issuance phase? And what's stopping them from silently adopting a batch size of 1?
> Why even bother with the initial batch issuance phase?
This is a solution that requires non-trivial interaction between many paries.
It seems very reasonable to want to get the parties started on the implementation so they can iron out issues in the infrastructure they're building while they work on the details of the ZKP aspects.
Yeah, getting into the car with the guy holding the gun doesn't become okay because you have a great argument you're waiting to use down the road. He's already got the gun out.
We should have started arguing when he just said he had a gun, indoors, in the crowd. We shouldn't have quietly walked outside at his demand. But that all happened. Here we are now, at the car, and he's got the gun out, and he's saying "get in", and we're probably not going to win from here -- but pal, it's time to start arguing. Or better yet, fighting back hard.
Because that car isn't going anywhere we want to be. We absolutely can not get in the car right now, and just plan to argue the point later. It doesn't matter how right the argument is at all.
The thing is that as far as I can tell, a ZKP of age involves a state or similar attestor to issue an ID/waller that can be querried for age without revealing identity.
But attestor has to have certainty about the age of the person it issues IDs to. That raises obvious questions.
What states are going to accept private attestors? What states are going accept other states as attestors? What state won't start using its issues ID/Wallet for any purpose it sees fit?
This system seems likely to devolve national Internets only populated by those IDs. That can all happen with ZKPs not being broken.
The simplest possible such method? Single-use age verification codes, generated and validated by the government, sold on physical scratch cards with in-store verification of ID, piggybacking on the infrastructure we already use for selling alcohol and cigarettes.
This would be far easier to implement for websites too. You'd just have a single, unauthenticated API endpoint which, given a code, tells you if the code is valid (and marks it as used). Integrating with such an API is about 1 day of work for a competent dev. Even open, non-profit platforms like Mastodon could easily implement such a mechanism.
Scratch cards wouldn't have to be the only way of getting such codes. THe vast majority of people could just generate them in their banking app or whatever (which would still be far more privacy friendly than the current ID verification mechanisms).
> Are you aware of any age verification systems that do not have this property?
As I understand it, it's the goal of OpenID4VP[1][2]. Using it a site can request to know if the user is over 18 say, and the user can return proof of just that one claim, I'm over 18, without sharing identifying information.
The new EU age verification solution[3] builds on this for example.
Can't read the specs at the moment, but what prevents the age verification service and the age-gated website from coluding and de-anonymizing your porn use?
With zero-knowledge-proofs the age verification could look like this: you go to whatever age verification service and get a certificate that says you're over the age of 18 (which you only need to do once or at least once per whatever expiry period). You then go to the age-gated website and they ask for proof. You generate (on your own device) a zero-knowledge proof that you have the certificate, but neither the website nor the verification service can determine which certificate it is, and in fact the verification service doesn't even know you've used the certificate.
Haven't either had time to fully wrap my head around the details.
At least in the EU solution they say there would be multiple attestation serivices the user could choose to use. So that would be technically better than nothing.
2) Cigarette vending machines accept VISA cards and government IDs and they're offline.
3) A medium-sized social media network required photos (not scans) of GovIDs, where only year of birth and validity date need to visible. The rest could be blacked out physically.
4) You can guess users' age and only request solid proof only for those you are unsure about.
The problem is that we technical users think of a one-size-fits-all technical approach that works, without a single fail, for all global users. That is bound to fail.
It is only a law and you can break it big time or small time. Reddit's approach might proof way too weak, it'll be fined and given a year to improve. Others might leave the market. Others will be too strict and struggle to get users. Others might have weak enforcement and keep a low profile forever. Others will start small, below the radar and explode in popularity and then enforcement will have to improve.
You can also request identity and then delete it. (Yes, some will fail to delete and get hacked.)
Giving Facebook a free pass is stupid. They're selling your age cohort "10-11" within 0.0037ms for 0.$0003 to the highest bidder on their ad platform.
To make this more concrete: There are a lot of "legally sanctioned" government actions happening in the US right now that are pretty dubious. That includes digging up old laws and giving them spicy new interpretations that legal experts agree are an abuse of power and not in the intent of the original law.
Some of these are getting batted down by judges, so right now the category of "legal" is especially vague. That's why I phrased it like that.
But also, we see cops just straight up stalking people using government tools. So that's another reason to be concerned about "legal" government actions.
I am someone who is very privacy focused. I've literally never had a social media account on any platform and I'm 42. From day one of facebook, I never wanted my information online. Like many here, I'm deeply concerned about privacy and surveillance.
In real life, we think age verification is a good thing. Kids shouldn't buy porn. Teenagers shouldn't get into bars. etc... There has to be room somewhere for reasonable discussion about making sure children do not have access to things they shouldn't. I think it's important to note, that complete dismissal of this idea only turns away your allies and hurts our cause in the long run.
I think the equivocation of online and real life is a massive mistake. When you go into a grocery store you are constantly on CCTV. Does that mean when you shop on Amazon them recording you via webcam should be considered? Obviously not. The restrictions in real life are temporary. If you try to buy port, go into a bar, etc you are asked for ID and they look at it and hand it back. They don't take your ID, your picture and store it forever and then sell information about you to other people.
The concern about children is aimed at the wrong target. Instead of targeting everyone it would make far more sense to target the platforms. With Roblox having a pedo problem the company should face punishment. That will actually get them to change their ways. However all these massive platforms are major donors to politicians so the chance of that happening is low to none.
> They don't take your ID, your picture and store it forever and then sell information about you to other people.
It would not surprise me in the least if there are brick-and-mortar businesses doing this, especially larger companies in jurisdictions (such as the majority of the United States) with weak/nonexistent privacy protections.
They don't need to. If you bought something with a card they just store that - let the data brokerage handle connecting it with actual ID cards and other elements of your identity.
But yeah, walmart is for sure logging their transactions and selling the data. It's practically free money.
> In real life, we think age verification is a good thing. Kids shouldn't buy porn. Teenagers shouldn't get into bars. etc...
These are not equivalent, I don't have to scan my face, upload my ID and share my personal biometric data with various 3rd parties, who will sell and leak my data, every time I want to look at porn or sip a beer.
Also, there are countries where teenagers can drink and go to pubs, and society hasn't crumbled. We also have several generations of young adults with access to porn, and the sky didn't fall.
Maybe we shouldn't use the government to implement a "papers, please" process just to use and post on the internet, maybe we should instead legislate the root cause of the problem: algorithmic optimization and manipulation. That way everyone benefits, not just kids, and we won't have to scan our faces to look at memes on Reddit.
> These are not equivalent, I don't have to scan my face, upload my ID and share my personal biometric data with various 3rd parties, who will sell and leak my data, every time I want to look at porn or sip a beer
Oh man, you must just not go out much anymore. I’ve seen a lot of bars with full blown facial scanners next to their bouncer.
In the online world you can’t make sure of anything. Florida for instance requires age verification for porn sites. Guess how many mainstream sites not based in the US are completely ignoring the law and guess how many others are easily accessible via a VPN? If you guessed the sum total of both is less than 100%, you would be wrong - and even that is tilted toward sites that just ignored it.
The one thing you can control is your childs access through their device using parental controls.
I can absolutely guarantee you that any teenager can easily get access to weed, cigarettes and alcohol despite the laws and definitely can use a VPN. It only takes one smart kid to show them how.
> I can absolutely guarantee you that any teenager can easily get access to weed, cigarettes and alcohol
Is you argument then that we shouldn't age gate those things in reality either? Would you suggest that teenagers smoke and drink just as much as they would have had it been legal to sell to minors?
Laws don't just exist to stop you, they also exist to shape society. They exist as signals for what we deem appropriate behavior.
So we make meaningless laws that inconsistently enforced? What do you think happens when little Johnny is caught with weed in his car in a 95% White high income school district vs little Jerome in a 95% Black school district?
Also how much “shaping of society” do you expect to happen when you pass a law that no one respects?
How many kids do you think a law is going to stop from going to the porn sites that completely ignored the law?
How many kids say “I really want to smoke weed but it’s illegally so I won’t do it”?
My guy, this is making the opposite argument from what you think:
"On the illegal market, no one is checking IDs before selling marijuana. When and where cannabis is illegal, high schoolers often sell cannabis to their peers. In contrast, licensed cannabis stores have overwhelming compliance with age-gating."
It has indeed not increased the cannabis use of kids, but that would also still be illegal. That study is an argument that age gating works.
In real life the situation is different. When I buy alcohol, someone looks at my drivers licence, does not make a copy of it, forgets it quickly, and cannot tie it to other information about me. As soon as it's online and it's copies, I can't tell what happens on anyone else's servers. I don't want any company knowing my actual name and location, then that can be tied to more data, which is what Google etc have been trying to do for years but this would just completely fast track that. I would in theory be fine with something where it never leaves my computer, but that is obviously impossible.
Not sure if you've bought alcohol lately, but at most large grocers near me, they're scanning licenses now instead of just verifying the birth date - and I'm pretty confident those scans aren't just checking the birthdate and then deleting all record of the interaction..
Not sure where you are but no one has ever done that to me. I usually would go through self checkouts so someone just comes over, takes a quick look at my drivers licence, and puts in their employee id into the machine to authorise it.
I'm in the midwest, but at several large chains with hundreds of locations, even at the self-checkout when you buy booze, it flashes the little 'attendant needed' sign, the person comes over, scans their badge, takes your ID to do a 1 second look, and then scans it on the same barcode reader you use for your box of cereal.
They can deny you service at any time, but it's unlikely they will do so if you present a valid ID, even if it's not machine-readable. Not every driver license can be easily scanned, so in that respect it's no different from a passport.
So then this is an easy problem. Issue liquor stores a terminal. Liquor guy checks licenses. If you're an adult, the clerk presses a button. A public key is generated and uploaded to a public list. You get a private key that shows you're an adult and is not tied to you. Regular laws that apply to liquor also apply to this private key QR code... You cannot give it to a minor or sell it without a license.
To view adult content, use the code to sign a thing. Content company sees the signed code, verifies against the public list and sends the content.
Privacy preserved, no adult content to kids... Easy.
A lot of the proposals don't involve you sending your drivers license or "other information" to anyone. The site in question asks you to verify with a trusted third party (usually a government entity), and that trusted third party only provides then with the end result of the validation.
> which is what Google etc have been trying to do for years but this would just completely fast track that.
Excuse me? They have done that for years. There's nothing to "fast track" here. Big Tech already implemented surveillance.
How many of those proposals do not have a government-mandated app as a spider in the middle of the web, which is aware of all the apps and websites you try to visit which ask for validation?
I'm not dismissing that idea. It is a perfectly reasonable thing to think about, part of why we have age verification techniques that already work well in critical places like online vape shops.
I'm even willing to talk about the possibility that we could use more robust systems deployed more broadly. A lot of folks here are talking about ZKPs in this regard, and that's not a bad idea at all.
The issue I'm trying to sound the horn on is that the current push for AF in the US and EU has nothing to do with kids. I think you could put together a working group on ZKPs and Age Verification, write up a paper and run experiments, and when you bring it to the lawmakers they're gonna say something to the tune of:
"yeah but that's not trustworthy enough and too technical for people to understand so we're just going to serve legal notices to VPN providers instead to tell them that they can't anymore"
...or something to that tune. I'm not a mind reader, I've just read the reports (by lawmakers) mentioning VPNs as an "area of concern".
This is a political gambit and not a new one. The more we treat the current issue as having anything to do with protecting kids the more we legitimize what is an obvious grift.
> The issue I'm trying to sound the horn on is that the current push for AF in the US and EU has nothing to do with kids. I think you could put together a working group on ZKPs and Age Verification, write up a paper and run experiments, and when you bring it to the lawmakers they're gonna say something to the tune of:
The EU is currently doing large-scale field tries of the EU Digital Identity Wallet, which they have been working on for several years. It uses ZKPs for age verification. They expect to roll it out to the public near the end of 2026.
I appreciate the mention - i had not yet heard of this EU DIW thing. That said, I can't find any resources on it that mention the use of ZKPs. Could you share a link?
Ya got me. Nevermind that the DSA (which I have read, in part) and the DIW (new to me) are different things, and that one does not mention the other [0]. Also the DSA is happening now while the Wallet thing isn't rolled out.
There are actual discussions about VPN regulation in relation to AV in the US [1]. The UK's OSA [2] is blatant about the need to violate encryption. Australia's OSA [3] has also come under criticism for precisely the things I'm talking about. Is it a stretch to extend this reasoning to the EU's incredibly similar legislation? Honk my nose if you must but I don't think so.
Here's the thing - I don't want you to listen to me, or anyone else on the internet, as an 'expert'. Verify your information personally, even when you trust it.
> In real life, we think age verification is a good thing.
Ok. In real life, do we think having agents from the government and corporations following you everywhere, writing down your every move and word, is a good thing? Or rather, what kind of crime would one have to have committed, so that they would only be allowed out in public with surveillance agents trailing them everywhere?
If HN is social media, then so are PHPBB, NNTP, BBS, etc. and the term loses its semantic relevance.
My heuristic is that social media focuses on particular people, regardless of what they're talking about. In contrast, forums (like HN) focus on a particular topic, regardless of who's talking about it.
Doesn't matter what you want it to mean. What matters is what those in power want it to mean. It's very easy to stretch the definition to cover all sites where people can post content for strangers to see, or stretch it even wider to all digital media where people can interact with a social group.
AFAIK nobody here is. The point is that with relevance to the current discussion on potential future age-verification laws, only the widest definition matters, because that's what's at risk.
> Age Verification isn't about Kids or Censorship, It's about Surveillance
We know this because, instead of putting easy-to-use parental controls on new devices sold (and making it easy to install on old ones) with good defaults [1], they didn't even try that, and went directly for the most privacy-hostile solution.
[1] So lazy parents with whatever censorship the government thinks is appropriate for kids, while involved parents can alter the filtering, or remove the software entirely.
Parental control software has existed for decades. It hasn't worked.
Over 70% of teenagers <18 today have watched porn [1]. We all know (many from experience) that kids easily get around whatever restrictions adults put on their computers. We all know the memes about "click here if you're 18" being far less effective than "click here if you're not a robot."
Yes, there were other ways of trying to solve the problem. Governments could've mandated explicit websites (which includes a lot of mainstream social media these days) include the RTA rating tag instead of it being a voluntary thing, which social media companies still would've fought; and governments could've also mandated all devices come with parental control software to actually enforce that tag, which still would've been decried as overreach and possibly would've been easily circumventable for anyone who knows what they're doing (including kids).
But at the end of the day, there was a legitimate problem, and governments are trying to solve the problem, ulterior motives aside. It's not legal for people to have sex on the street in broad daylight (and even that would arguably be healthier for society than growing up on staged porn is). This argument is much more about whether it's healthy for generations to be raised on porn than many detractors want to admit.
> Over 70% of teenagers <18 today have watched porn [1]. We all know (many from experience) that kids easily get around whatever restrictions adults put on their computers. We all know the memes about "click here if you're 18" being far less effective than "click here if you're not a robot."
And we all turned out fine I might add. In fact there's a lot more attention to consent and respect for women than 20 years ago.
Of course not counting the toxic masculine far right but that doesn't have anything to do with porn but everything with hate.
Absolutely not. You might personally feel like (or want to tell yourself that) porn didn't negatively affect you. I can tell you with certainty that porn negatively affected my social and sexual development. (I was literally afraid to physically open my mouth around girls when I was 10 years old because of porn.)
> Of course not counting the toxic masculine far right but that doesn't have anything to do with porn but everything with hate.
There are plenty of pipelines between porn and "toxic masculinity."
“Ease of access” and “easy access to the most depraved shit you can think of that’s out there” is what changed. That is what is wrong and why many people feel we need to find some way to control that access.
The Internet didn’t come along until I was well into adulthood. Think about what porn access looked like in the late ‘70s and ‘80s. As a teen we were “lucky” if by some rare miracle a friend stole their dad’s Playboy, Penthouse, or Hustler and stashed it in the woods (couldn’t risk your parents finding it under your mattress) for us dudes to learn the finer points of female anatomy. In a week it would be washed out from the elements with nary a nipple to be seen. Those magazines (even hustler) was soft compared to what a few clicks can find today. Basically you got degrees of nudity back then, but we appreciated it.
Hardcore video was very rare to see as a horny teen kid in the ‘80s. Most porn movies was still pretty well confined to theaters, but advent of VHS meant (again by sheer luck) you had to have a friend whose parents happened to be in to it, who had rented or bought a video, it was in the house and accessible, all the adults had to be gone from the house so you could hurry up and watch a few minutes on the family’s one TV with a VCR. You needed to build in viewing time along with rewind time to hide your tracks.
Now…parents just leave the room for a few minutes and a willing kid with a couple of clicks could be watching something far beyond the most hardcore thing I saw as a teen.
I doubt that the porn in the 70s was less bad than the porn today. Legal CSAM was being sold openly so what makes you think that it was more tame than modern stuff?
The fact is that as difficult as it was to get, you got a hold of it and watched it. Why would 'ease of access' make any difference if you didn't have easy access and got it anyway?
Are you implying that perhaps 15-25 mins worth of porn video total throughout all of someone’s teenage years due to such rare access of the material would have a similar emotional and mental impact as having the ability to see that much daily for years as is possible now?
There could have been years between the opportunities we had. I don’t think you conceptualize just how infrequent the opportunity would present itself.
For instance [1]. I am speaking out of experience, as a GenZ person who has been first introduced to the entire world of sex and porn at EIGHT years old. I myself feel it has harmed my brain in ways which I'll likely never fully understand.
A couple of comments above, you said: “Why would 'ease of access' make any difference if you didn't have easy access and got it anyway”
So exactly what is the target of the “difference” you are referring to then here? You are referencing a differential in something…if not psychological impact from the viewing of said material…what would that something be?
Person 1: "People are exposed to many more chemicals now than in the 70s, and they smell worse"
Person 2: "I don't think that they actually smell worse, and people were still exposed to chemicals in the 70s, so why would it make a difference?"
Person 1: "Are you saying that the health effects of chemical exposure are lessened because they are exposed to some chemicals as opposed to a lot of chemicals?"
Person 1 is using a claim that is not proven by their statements to make Person 2 responsible for a claim they never conceded was true.
Person 2 is disputing that Person 1's mechanisms make a difference not that their conclusion is valid.
In this case Person 2 has no duty to prove that bathing in it is fine or that getting exposed to a small drop is dangerous.
If Person 1 is claiming that there are harmful effects, they are required to prove that they exist and explain why bathing in it causes those effects while being exposed to it otherwise does not.
Person 2 has no duty to prove anything (or to enter the conversation at all), but Person 2 isn't going to convince anyone of their viewpoint by choosing not to attempt to prove their point. By choosing to say "not my problem," Person 2 is accepting liability for not attempting to change their opponent's minds if/when they get out-voted on the issue in the real world, as is currently happening.
But it's been illegal to peddle porn to minors for much longer than it's been illegal to peddle social media, so it's a good proxy for how effective our current efforts are.
The approximate substitute-good for porn is actual sex, which parents generally stop teens from doing. The substitute-good for social media is talking to people in person, which parents are generally happy with.
Sorry, but if you would actually read my post, you would notice that I am not proposing that it should merely "exist", but that it should come enabled by default on all new devices.
My point is that being enabled by default on all new devices 1) would also be fought by people very similar to you (if not you specifically), and 2) would not be effective if the enabled-by-default software is not effective, which would also require additional work that you and people like you would fight.
I do agree it could be done. I disagree with your characterization that it would be easy/easier, or that the current age verification efforts are entirely nefarious and not actually trying to work the problem.
Dude, parents don't want their kids wading through porn and whatever social media throws at them before they are even teenagers.
Childless digital nomad privacy freaks are a minority, age gates are coming. I don't care that they will never be 100%, if it provides cover for parents to stop their kids consuming trash internet "culture" until they are more mature they are already a great benefit to socitey.
If it's really that difficult for parents to engage their children and parent them, maybe that says more about a society that doesn't prepare parents for parenthood than it does about those who don't have children.
There is no "good parenting" fix that will keep children from trying to access inappropriate content, forums where unhealthy conversation takes place, pornography, and worse. Being a good parent does not and cannot remove the curiosity, temptation, and ability to access bad content. This is a problem with the human condition, not bad parenting.
As a parent myself (and, I hope, a good one), I have found it very difficult to effectively monitor and limit my children's ability to access these things. And I have more facility with technology than the average parent. It's a complex and frustrating problem and the stakes are high.
I see this argument repeated over and over on HN, with 0 evidence for it. Any
"evidence" people cite is usually of the "politicians are evil, so this should be obvious by definition" kind, sometimes of the "they tried x in the past, so surely some unrelated y they're trying to pass in the future is also about x" kind.
I haven't seen a single leak, a single admission from somebody trying to pass a law like this, that surveillance is actually the goal here. There are far too many politicians trying to pass laws like these, in very different countries across the world, for some kind of giant global conspiracy to stay undetected.
> There are far too many politicians trying to pass laws like these, in very different countries across the world, for some kind of giant global conspiracy to stay undetected.
This is today's top agrument! "There are far too many gangsters each operating in their own district for some kind of notion of organized crime to be credible".
You don't need conspiracy, you need the incentives.
The state always thinks of self-preservation. Any bureaucrat is aligned to this goal by getting the benefits from the state. So, the more power it has over its citizens, which is the first threat it, the more safe it is and the less opinions of citizens matter.
Understanding this, every citizen must think carefully about giving away more power to the state.
Just because it's about surveillance doesn't mean it's a bad thing?
The fact that you need a driver's licence to drive a car, or a document to identify yourself to open a bank account is also surveillance. Yet it seems perfectly reasonable?
Age verification is absolutely about kids. It’s also being used (or hijacked into) a vehicle for people who want increased surveillance.
There is a ton of evidence that there are harms to unrestricted online access for kids and teens (the book The Anxious Generation is cultural touchstone for this topic at this point). There is a real, well reasoned, and valid movement to do something about this problem.
The solutions proposed aren’t always well targeted and are often hijacked by the pro-surveillance movement, but it’s important to call out that these solutions aren’t well targeted instead of declaring the age verification push isn’t addressing a real problem and constituency.
As many others have mentioned in this thread and others, there are ways - effective and straightforward ways - that we could be protecting our kids from the harms that come with the www.
The harms are real. The solution is a Surveillance Wolf wearing a dead Save The Kids Sheep(tm).
Solutions that might work - RTA headers [0]. More robust parental controls. Not this reimagining of the rules of the internet in service of a fairly vague and ineffective goal. It's like the whole AV concept was designed not to work in the current context at all - almost as if that was the point.
Perhaps I'm going a little out on a limb. I don't think I am - but quick, tell me you need to know where I'm dialing from without asking me where I'm dialing in from.
Yes all those things are great, but you'll notice that instead of explaining this to the non-technical crowd, technology focused privacy concerned individuals rarely attempt to educate about how these could work. Instead they simply seem to be against any sort of control on what children watch online.
Given that it's also coming from a bunch of tech males, it comes across as extraordinarily creepy. This is not hard to understand.
If I believed that the efforts in question were in earnest, I would absolutely be talking through the finer points of how to do it right. I don't believe that, though. The veneer of legitimacy here is paper thin - we start with a very weatherbeaten conservative war drum (think of the children!) and immediately jump into "let's ruin privacy for everyone and I totally promise this isn't another Cambridge Analytica".
The thing is that when it starts being about the kids it means the bottom 90% has entered the internet and you should be away because it is already lost.
I wonder if there's something like internet accelerationism - push things like having friends or watching movies online off the cliff as soon as possible.
Unfortunately The Anxious Generation is a very well-written house of cards built on questionable studies [1] and its success is simply a reflection of the fact it capitalizes on the trendiest moral panic of our times.
Social media is akin to violent video games in the 2000s, tv addiction in the 90s, santanic heavy metal in 80s, and even 'bicycle face' in the 1890s bicycle craze.
Jonathan Haidt seems extremely earnest and thoughtful, but unfortunately being lovingly catapulted to fame for being the guy who affirms everyones gut reaction to change (moral panic)...makes it extremely difficult financially, emotionally and socially for him to steelman the opposite side of that thing.
Even if he hadn't compiled a bunch of suspect research from pre-2010 to make his claims, the field of Psychology is at the center of the replication crisis and is objectively its worst offender. Pyschology studies published in prestigious academic journals have been found to replicate only 36% of the time. [2]
I'd be OK with an "I am a child" header mandated by law to be respected by service providers (eg. "adult sites" must not permit a client setting the header to proceed). On the client side, mandate that consumer devices that might reasonably be expected to be used by children (every smartphone, tablet, smart TV, etc) have parental controls that set the header. Leave it to parents to set the controls. Perhaps even hold parents culpable for not doing so, as a minimum supervision requirement, just as one may hold parents culpable for neglecting their children in other ways.
Forcing providers to divine the age of the user, or requiring an adult's identity to verify that they are not a child, is backwards, for all the reasons pointed out. But that's not the only way to "protect the children". Relying on a very minimal level of parental supervision of device use should be fine; we already expect far more than that in non-technology areas.
A server header exists to say something is adult and could be used for user-generated content as well. [1] It just needs legislation and an afternoon from interns at assorted companies. It's not perfect, nothing is but could easily trigger existing parental controls and parental controls that could be added back into user agents. No third parties required. I think I've beat this horse into dust [2] so I should just hire kvetchers to politely remind congress at this point.
I like the first part of the idea, which is the header. Heck, even enable it by default. As long as the tracking of the toggle isn't a thing its a perfect compromise. While we're at it, respecting do not track headers would also be nice.
This completely leaves it up to the families / parents to control and gives some level of compliance to make the effort worth while.
There may even be a way to generate enough noise with the request to prevent any forms of tracking. This sort of thing should really be isolated in that way to prevent potential abuses via data brokers by way of sale of the information
As long as the tracking of the toggle isn't a thing its a perfect compromise.
This concept does not involve any tracking if implemented as designed. The user agent detects the RTA header and triggers parental controls if enabled. Many sites already voluntarily self label. [1] Careful how far one drills down as these sites are NSFW and some may be malicious.
They tried this years ago with ICRA and others. Long gone, but it worked by the webmaster adding metadata to self classify a site. Browsers and other agents could then allow/deny after inspecting the tags.
I remember labeling all my sites with PICS ICRA using the header generator. For my SFW sites it was mostly straight forward. For my adult forum it was a pain in the ass. My forum members managed to come up with so many categories that the header at some point should have just said "ALL THE THINGS AND THINGS YOU DID NOT KNOW EXIST" hahaha... I can see why adoption was low. There were a couple of browsers that recognized ICRA PICS for a little while but there were no laws to make it stick.
That's why I am pleased with RTA. Just add one header, done. Most admins and developers could do that in their sleep.
If we must do something like this, I think a good solution would be an optional server header that describes the types of objectionable content that may be present (including “none”). Browsers on child devices from mainstream vendors would refuse to display any “unrated” resources without the header, and would block any resources that parents deem age-inappropriate, with strict but fair default settings that can be overridden. Adult browsers would be unaffected. Legislatures could attempt to craft laws against intentionally miscategorized sites, as doing this would be intentionally targeting kids with adult content.
There is no perfect solution that avoids destroying the internet, but this would be a pretty good solution that shelters kids from accidentally entering adult areas, and it doesn’t harm adult internet users. It also avoids sending out information about the user’s age since filtering happens on the client device.
It was derided as a "system for mass censorship", and got shot down. In hindsight a mistake, and it should have been implemented - it was completely voluntary by the user.
It’s close, but I see why it failed. There’s no need to include licensing/rights management in there. Also this was before pervasive HTTPS, so it would have been possible for governments and ISPs to snoop the info and possibly block it. If it could be limited to just content ratings, and kept private behind SSL, this isn’t a bad approach.
But this also needs some kind of guarantee that lawmakers won’t try to force it on FOSS projects that want to operate outside the system. And that companies like Google won’t use EEE to gradually expand this header into other areas and eventually cut off consenting adults who want to operate outside this system. I’m not sure if it is possible to get those guarantees.
> Perhaps even hold parents culpable for not doing so, as a minimum supervision requirement
Even the idea of prosecuting parents for allowing their child to access 'information,' no matter what that information is, just sounds like asking for 1984-style insanity.
A good rule of thumb when creating laws: imagine someone with opposite political views from yours applying said law at their discretion (because it will happen at some point!).
Another good question to ask yourself: is this really a severe enough problem that government needs to apply authoritarian control via its monopoly on violence to try to solve? Or is it just something I'm abstractly worried about because some pseudo-intellectuals are doing media tours to try to sell books by inciting moral panic?
As with every generation who is constantly worried about what "kids these days" are up to, it's highly highly likely the kids will be fine.
The worrying is a good instinct, but when it becomes an irrational media hysteria (the phase we're in for the millennial generation who've had kids and are becoming their parents), it creates perverse incentives and leads to dumb outcomes.
The truth is the young are more adaptable than the old. It's the adults we need to worry about.
> Even the idea of prosecuting parents for allowing their child to access 'information,' no matter what that information is, just sounds like asking for 1984-style insanity.
This assumes an absolutist approach to enforcement, which I did not advocate and is not a fundamental part of my proposed solution. In any case, the law already has to make a subjective decision in non-technology areas. It would be no different here. Courts would be able to consider the surrounding context, and over time set precedents for what does and does not cross the bar in a way that society considers acceptable.
But what if we didn't collectively spend $billions of dollars and hundreds of thousands of hours battling with money, lobbyists, lawyers, judges and political campaigns over what is largely a moral panic?
What could humanity do instead with all that time and resources?
I know the US is a nation built by lawyers, for lawyers, but this is both its best strength and worst weakness. Sometimes it's in everyones best interest to accept the additional risks individually as opposed to bubble wrapping everything in legislation and expanding the scope of the corrupt lawyer-industrial complex.
Maybe the lawyers could use the extra time fixing something actually important like healthcare or education instead.
It would be possible to make a website which proxies other sites, but strips this header, right (maybe with some added ads)?
If so I would expect such sites to appear, and the only way to secure a child device is to have a whitelist of webpages (to avoid the proxies), putting us back close to where we are today.
Such sites would be illegal if not sharing the header back from the source website and be banned as much as adult websites incorrectly setting this header. It’s not a real problem.
Making them illegal does not fix it. There will be a indefinite whack-a-mole game which is very hard to solve without draconian control over the Internet.
The problem is that it's easy to make, easy to deploy, easy to make money on, and a single site opens up the whole Internet. It will happen even if it's illegal.
Compare this to adult webpages setting the header. They will probably be quite willing to do so, since they want to make their money legally, and there is probably little money in serving to kids anyway. And even if a single out of thousand adult webpages refuses, it still only opens that single site.
It's actually hard to understand on "which" side you're on, but a charitable interpretation is that you're arguing that there are no perfect solutions, hence a simple and minimal non-invasive method will probably have the same effect as a complex and invasive method. That is, both methods will add enough friction that children who don't know what they're missing won't bother and the ones who can't do without, will choose every conceivable method to get around the restrictions.
Worrying about the latter makes no sense, because they are sort of like organized crime. People still take drugs even though they are illegal.
I think the idea is that the manufacturers are culpable for making a parental restriction mode that's set-and-forget and not easily thwarted from inside the mode and parents are culpable for declining to set it.
Which I still don't love, but is at least more fair.
It could be added at the router? The child's computer could be identified and this header added, in a MITM situation... but, maybe that would be easy to defeat, by replacing the cert on the client? Not my area of expertise... really just asking...
There's no reason to hold the parents culpable. It would be up to the device manufacturer to ensure that this isn't possible on a system that has parental controls enabled. This is already a solved problem - see how MDM solutions do it, and see Apple's ban on alternative browsers.
It's not even necessary to block parents from giving their children Linux desktops or whatever. It'll largely solve the problem if parents are merely expected to enable parental controls on devices that have the capability.
I am a Russian proxy site, I make requests for you without the header. I serve you the content because I don't care about following American laws.
Alternatively, just use an older browser that doesn't serve the header.
If anything, you'd want the reverse. A header that serves as a disclaimer saying "I'm an adult, you can serve me anything" and then the host would only serve if the browser sends that header. And you'd have to turn it on through the settings/parental controls.
Now, this doesn't handle the proxy situation. You could still have a proxy site that served the request with the header for you, but there's not much you can do about that regardless.
My only gripe here is the idea of "perhaps hold the parents culpable." I'm not opposed to the idea, but what sucks is we are ultimately all paying the cost of it going wrong. The idea that we can shunt that away to a few irresponsible people is just demonstrably not the case.
Worse, it leads to situations where society seems to want to flat out be kid free in many ways. With families reportedly afraid to let their kids walk to and from school unsupervised.
I don't know an answer, mind. So this is where I have a gripe with no real answer. :(
The presumption that it's not a matter of the parents' prerogative whether to decide whether the child's access should be restricted or not -- and treating the parents as accountable to someone else's standards of what is or is not appropriate for their own children -- is itself objectionable.
What content is appropriate for children is properly up to their parents themselves, not to the government or to some nebulous concept of "society". If parent's choose not to set such a flag on their children's devices, then that means that they're choosing to allow their children to access content without restriction, and that's what defines what is OK for their children to access.
The role of parent has been being diminished by society every year that goes by. I frequently remind my local school system of their role in my children's lives are and what my role in their lives are. They seem to need very frequent reminders.
Add to that, clearly those "bad parents" are the result of bad parenting in the first place, so really it's the grand parents that are to blame...
Wait, those grand parents also had bad models to work with, so really it's the great grandparents that were to blame...
No, wait, it was the society that they grew up in that encouraged poor behaviour toward them, and forced them to react by taking on toxic behaviours. We all should pay because we all actively contribute to the world around us, and that includes being silent when we see bad things happening.
>Worse, it leads to situations where society seems to want to flat out be kid free in many ways. With families reportedly afraid to let their kids walk to and from school unsupervised.
Less the false dichotomy, and more the stickiness of each of those options. To your point (I think), those aren't the only options available, but people do seem to be attracted quite heavily to them.
I was referencing the towns that have called the cops because there were some unsupervised kids in a park. I comfort myself by saying this isn't nearly as common as the fear mongers online would have you think. That there are cases it happens still worries me.
Note that I'm not even necessarily worried about cops getting called. Quite the contrary, I am fine with the idea of cops having a more constant presence around parks and such. I do worry about people that get up in arms about how things are too unsafe for kids to be let outside. If that is the case, what can we do to make it safe?
> 1) Given that it just says you're a "child", how does that work across jurisdictions where the adult age may not be 18?
It's a client-side flag saying "treat this request as coming from a child (whatever that means to you)". I don't follow what the jurisdiction concern is.
[EDIT] Oooooh you mean if a child is legally 18 where the server is, but 16 where the client is. But the header could be un-set for a 5-year-old, too, so I don't think that much matters. The idea would be to empower parents to set a policy that flags requests from their kids as coming from a child. If they fail to do that, I suppose that'd be on them.
The concern is that websites have no way to tell the actual age in this scenario so you'd be potentially inconveniencing and/or blocking legitimate users (according to the server jurisdiction's rules)
It doesn't seem sufficient, and would probably lead to age verification laws anyway.
Say you're a parent, with child, living in country A where someone becomes an adult when they're 18. Once the child is 18, they'll use their own devices/browsers/whatever, and the flag is no longer set. But before that, the flag is set.
Now in country B or in country C it doesn't matter that the age of becoming an adult is 15 and 30. Because the flag is set locally on the clients device, all they need to do is block requests with the flag, and assume it's faithful. Then other parents in country B or country C set/unset the flag on their devices when it's appropriate.
No need to tell actual ages, and a way for services to say "this is not for children", and parents are still responsible for their own children. Sounds actually pretty OK to me.
Except that if you're in country B, which has a law that says "you may not make information available to children that discloses that Santa Claus is made up," and the age of becoming an adult in your country is 18 -- knowing that a person accessing your site from country A is an adult in country A (which means, say, ≥ 16) is not sufficient to comply with the law.
I’m not sure why the age of majority in the region of the server would be relevant. The user is not traveling to that region, the laws protecting them should be the laws in their own region.
I don't know if "should" is intended as a moral statement or a regulatory statement, but it's not at all unusual for server operators to need to comply with laws in the country in which they are operating…
> 1) Given that it just says you're a "child", how does that work across jurisdictions where the adult age may not be 18?
So namespace it then. "I'm a child as defined by the $country_code government". It's no more of a challenge than what identity-based age verification already needs to do.
> 2) It seems like it could be abused by fingerprinters, ad services, and even hostile websites that want to show inappropriate content to children.
This is still strictly better than identify-based age verification. Hostile or illegal sites can already do this anyway. Adding a single boolean flag which a large proportion of users are expected to have set isn't adding any significant fingerprinting information.
Any time law-makers claim that a law is meant to protect children you can guarantee that the safety of children had almost nothing to do with it. This is all a push to normalize digital ID (to protect the children!); once normalized it will become mandatory.
I always ask myself who wins with these laws (well, any law really). so far, the only winner seems to be the government and data collectors. It seems these laws are intended to collect leverage in the long run.
I'd argue that this is negligible for data collectors and governments. Governments already know who you are and what sites you vist for 99.99% of the population. Data collectors already know who you are and have a pretty good idea of the sites you vist.
What unique information is this going to give the government and data collectors to abuse? Lets establish one case that both affects average people and is "bad" and not waste time discussing things that only affect a tiny minority of privacy minded people.
Keep in mind the law states a platform must provide multiple ways to reasonably verify a user is older than 16. No mention of giving the specific user age or requiring govt id
I feel like the EFF has stretched a bit far on this one. They need to be advocating for good solutions, not portraying age verification as fundamentally about surveillance and censorship.
As many are pointing out zero knowledge proofs exist and resolve most of the issues they are referring to. And it doesn't have to be complex. A government (or bank, or anybody that has an actual reason to know your identity) provided service that mints a verifiable one time code the user can plug into a web site is very simple and probably sufficient. Pretty standard PKI can do it.
The real battle to be lost here is that uploading actual identity to random web sites becomes normalised. Or worse, governments have to know what web sites you are going to. That's what needs to be fought against.
> They need to be advocating for good solutions, not
No, fighting back against horrible proposals does not require suggesting an alternative proposal to the alleged problem. That only serves to benefit the malicious actors proposing the bad thing in the first place, the hope that we'll settle on something Not As Bad.
Thank god for the EFF and their everlasting fight to stop these nonsense internet laws. I'm glad they don't waste their time on "well how about this" solutions. The middle ground will never be enough for the proponents of surveillance, and will always be an incremental loss for the victims.
There are overwhelming dichotomous portrayals in this debate which gives me pause because there are entities who benefit from both sides of this debate, but neither would benefit with a sensible privacy-preserving solution.
So instead of advocating for those sensible and workable solutions, the discussions are always centred on either blocking any attempt at reform while hyperventilating about vague authoritarianism or a similarly vague need to protect the innocent.
Meanwhile in the world of smartphone data providers, social media networks, and the meta/googles of the world: they all know your personal information and identity up to the wazoo - and have far more information on every one of you than what is possessed by your own governments (well except for the governments that are also buying up that data.)
So let me be clear, the gate is open, the horse has bolted - recapturing your privacy is where attention should be focused in this debate... even if it's bad for shareholders.
> Meanwhile in the world of smartphone data providers, social media networks, and the meta/googles of the world: they all know your personal information and identity up to the wazoo - and have far more information on every one of you than what is possessed by your own governments (well except for the governments that are also buying up that data.)
This is where I'm concerned too. We are seeing a proliferation of third party verification services that I have to interact with and that have no real obligations to citizens, because their customer is the website.
I'd like to see governments step in as semi-trusted third parties to provide primitives that allow us to bootstrap some sort of anonymous verification system. By semi-trusted, I mean trusted to provide attestations like "This person is a US citizen over the age of 18" but not necessarily trusted with an access log of all our websites.
What good solutions are there that prevent the age verification service and the website from comparing notes (because Big Brother told them to) and figuring out who you are and what you're doing?
If they voluntarily collude then yes, you can't avoid that. It's like third party cookies - once two parties collude it's game over. But that just outlines a situation where the user's chosen trusted service is hostile to their interests and they need to find one that isn't.
If Big Brother starts mandating the collusion - then yes, there's a hill to die on. But in some ways that's the point here. There are hills to die on - this just isn't it. And if you pick the wrong hill then you already died so you are losing the ones that really mattered. If the EFF pointed out to everyone that there is a privacy preserving answer to the core issue that is driving this, they could then mount a strong defense for the part that is truly problematic, since it isn't actually required to solve the problem.
This is only hypothetical for government ID's, but in theory government IDs could provide pairwise pseudonymous identifiers with services. Your ID with a single service is stable, but it is different with each service.
No, it's a question about how a government would break cryptographic protocols, or force others to.
If the identifiers are pseudonyms, if the government compelled someone to share their user IDs, all the government would see are basically a bunch of UUIDs keyed to that provider.
So what specific actions are you talking about. What is your threat model?
The reality is that even countries that have digital IDs like Belgium which would be 1 of the many requirements of implementing such a zero-knowledge system are pushing for surveillance heavy legislation right now.
Once a system is in place that infringes on rights nobody will modify it to give citizens more rights.
Yep this is the first time I've disagreed with the EFF on anything civil liberties related.
My view is that there's no reason why we can't come together and come up with a rating system for websites (through HTTP headers, there are already a couple proposals, the RTA header and another W3C proposal).
Once a website just sends a header saying this is adult only content, what YOU as a user do with it is up to you. You could restrict it at the OS level (which is another thing we ALREADY have).
This would match the current system, which allows households to set their devices to block whatever they want, and the devices get metadata from the content producers.
I have to imagine porn sites don’t want an underage audience either.
So I think they would voluntarily state that their content is adult only.
This isn’t rocket science. We’ve rated content for decades. We simply can’t be obtuse about this and throw our hands up and do nothing because we can’t tell if obvious things like porn are adult only content the way we’ve done on every other medium.
I'm just waiting for governments to start requiring OS makers to verify identity on consumer phone/laptop/console devices before you can use them.
After all, they can legitimately claim it solves much of the issues with other verification schemes - no need to trust third party sites or apps, lower risk of phishing, easier to implement internationally and with foreign nationals, etc.
Of course, the downside (for individuals) is it would take just one legal tweak or pressure from the government to destroy anonymity for good.
Why do you think there's a global push all at once for this? Anyway I'll order a bunch of cheap USB Sticks, load them up with porn and gore and drop them at school yards at night then. If we do that enough we can make using USB Devices require ID Soon enough.
I have a friend attempting to solve this. He's basically creating oauth for age verification. You sign up with his service and verify your age. After that it works similarly to oauth, but instead of return your identity, it just returns your age.
It's not a perfect solution, as he would still know who you are, but it's built in a way where you create a token locally to pass to the site that includes your age, and that site passes it to his site, which verifies the signature. So he knows who you are but not what sites you visit, and the sites know your age but not who you are.
When I read the title I hoped that EFF was going to do exactly that.
There’s also a way to improve it: Sell “age verification cards” in physical stores. Just like they are verifying that minors aren’t buying alcohol or cigarettes, they can verify that these cards are bought only by grown ups. Sure wouldn’t be perfect but it greatly improves anonymity and especially in paid-for adult services can be used as a payment method so repeat verification will happen for top ups.
Why don't we have zero-knowledge age verification?
One actor verifies ages - and they only need to do so once. Sites give users a key tied to their user account to run by their verifier, who returns another key that attests to their verified age encoded for that specific site, to give back to the site.
The site doesn't know anything about the user, but their user login info. The verifier doesn't know anything about what sites are being visited.
This would seem to address the issues, without creating the pervasive privacy and security problems of every age verifying site creating database of people's government id's, faces, and other personal information.
It also seems like a way out of the legal/legislatorial battle. Which otherwise, is going to be an immortal hydra.
I would trust the EFF to run something like this. Open source. With only one-way encrypted/hashed personal info stored at their end.
(I am not a cryptographic expert. But I believe mechanisms like this are straightforward stuff at this point.)
> Because it's not about age verification, it's about setting up infrastructure to enable incremental enchroachment on privacy.
Yes. You are emphasizing a reason it would be a good idea.
Sideline the ulterior/hidden motive. Or at a minimum, force it into the open, where it has less of a chance. (Ulterior motives are kept quiet for a reason.)
> Fun fact: many ZK identity solutions run centralized provers and can be subpoenaed. Need to use something that generates proofs client-side.
Subpoenas are one of the many privacy problems solved by this.
If there is no log of your real identity tied to visiting a site, there is nothing to hack or subpoena.
A verifier can report you got keys validated. But they don't know what sites they were for.
Sites can ensure users are vetted for age. Without knowing who they are.
This is such a classic cryptography scenario, I don't know how it isn't being pushed to the center of this debate. Anything that reduces the practical tension between divisive goal posts is going to have practical benefit, and make worst case legislation much less likely.
I think you're suggesting a centralized actor to verify the age of users which is problematic on multiple accounts. Practicality, privacy, enforcement, liability to coercion/corruption, and so on. This might be a wild take, but I think platforms could do a lot more to help with moderation to prevent child predators. Instead of just being okay with them finding outside avenues to converse with their victims through their platform, maybe use those algorithms to detect and prevent it in the first place, whether or not said child predators are whales for your platform or not.
Why they don't use zero knowledge proof? Also question for the USA constitution experts, is this considered a violation of free speech? The article is not clear on this.
"Free Speech" in the American legal sense (1st Amendment to the Constitution) applies to government prohibition on speech, with a particular emphasis on political speech.
It doesn't prevent one person from prohibiting speech... I can tell a pastor to stop preaching on my lawn. But, the government cannot tell a pastor not to preach in the publicly-owned town square (generally, there are exceptions).
There are arguments that certain online forums are effectively "town squares in the internet age" (Twitter in particular, at least pre-Musk). But, I always found that analogy to fall apart - twitter (or whatever online forum) is more like an op-ed section in a newspaper, IMO. And newspapers don't have to publish every op-ed that gets submitted.
Also, the 1st Amendment does not protect you from the consequences of your speech. I can call my boss an asshole to his face legally - and he can fire me (generally, there are labor protections and exceptions).
Some proposed implementation do this. Without the requirement there is no chance of your ID or age being leaked, with zero knowledge proof, there is a chance they leak but can be made small, potentially arbitrarily so. Other implementations come with larger risks.
Zero knowledge proof is either trivially defeated by re-using the same credentials or doesn't have useful privacy guarantees. There really isn't an in-between here for something like age verification.
The idea is that e.g. the government would give you an app that lives on your phone. When you apply for the app you provide some documents to prove your age, but you don't say anything about what sites you plan to visit. When you want to visit an age-restricted site you use the app to generate a proof that you have it, but the site doesn't learn anything more than that, and the government doesn't learn that you used the app.
It's funny because the same "perfect is the enemy of good" argument is used both to criticize age verification in the first place (why bother if it isn't perfect) but then also to dismiss proprosals to implement it better (why bother if they don't perfectly fix the problem).
No. It's mostly that the proposed age verification schemes have fundamental problems that disqualify them from being considered "good" and none of the "better" implementations fix those problems at all.
Age verification in general is not intended to defend against people lying or using stolen credentials. If you’re 13 but know the password to your dead grandpa’s account and the website in question has no idea he’s dead, there’s no way to defend against that, with or without a ZKP.
What the ZKP does is let you limit the information the site collects to the fact that you are under 18, and nothing else. It’s an application of the principle of least privilege. It lets you give the website that one fact without revealing your name, birthdate, address, browsing history, and all your other private data.
What prevents one kid in a friend group or in a school from sharing the same identifier?
After all - if it doesn't share anything other than a guarantee of the "age" of someone who is authenticating with the website then how would the website know there's re-use of identifiers?
- If I can do a zero knowledge proof once per day against someone who is under age, I can eventually determine their birthday.
- If I can do a zero knowledge proof with an arbitrary age, I can eventually determine anyone's birthday.
- If the only time people need to verify their age is to visit some site that they'd rather not anyone know they visit and that requires showing identity - even if it's 100% secure, a good share of people will balk simply because they do not believe it is secure or creating a chilling effect on speech.
- If the site that verifies identity is only required for porn, then it has a list of every single person who views porn. If the site that verifies identity is contacted every time age has to be re-registered, then it knows how often people view porn.
- If the site that verifies identity is a simple website and the population has been trained that uploading identity documents is totally normal, then you open yourself up to phishing attacks.
- If the site that verifies identity is not secure or keeps records, then anyone can have the list (via subpoena or hacking).
- If the protocol ever exchanges any unique identifier from the site that verifies your identity and the site that verifies identity keeps records, then one may piece together, via subpoena (or government espionage, hacking) every site you visit.
Frankly, the fact that everyone promoting these systems hasn't admitted there are any potential security risks should be like an air raid siren going off in people's heads.
And at the end of all of this, none of it will prevent access to a child. Between VPNs, sharing accounts, getting older siblings/friends to do age verification for them, sites in jurisdictions that simply don't care, the darkweb, copying the token/cert/whatever from someone else, proxying age verification requests to an older sibling/rando, etc. there are way, way too many ways around it.
So one must ask, why does taking all this risk for so little reward make any sense?
(IANAL) That demonstrates the opposite: that's a voluntary system with no force of law behind it—the private sector "self-regulating" itself, if you will.
The film rating systems were created under threat of legislation in the first half of the 20th century (so, in lieu of actual legislation). The transformative 1st Amendment rulings of the Warren Court would have made such laws unconstitutional after the 1960's, but the dynamic that created these codes predates that—predates the modern judicial interpretation of the 1st Amendment.
Because safeguarding user privacy is not a goal. Scoring political points with "think of the children" agendas, while getting kickbacks from companies salivating at the opportunity to gather even more personal data, is.
Onlyfans is legal prostitution so we need to protect that. Better to regulate the entire internet with taking your rights than question why it's allowed.
No, its legal (in some jurisdictions) pornography. Prostitution on the platform, as well as whatever the legal status is in the set of jurisdictions involved, is also, from what I understand, explicitly against the platform ToS.
I will say that it's a weird legal distinction in many states that paying someone to have sex is illegal unlessss.... you record it and sell the recording. Then it's legal.
Way to split hairs. Something being against the ToS can still be legal.
Prostitution obviously cannot physically happen on an online platform, but it sure is a convenient way to advertise and attract customers, and serve as the payment processor.
> Way to split hairs. Something being against the ToS can still be legal.
Well, no, violating a binding legal agreement is illegal.
> Prostitution obviously cannot physically happen on an online platform, but it sure is a convenient way to advertise and attract customers, and serve as the payment processor.
Which is explicilty prohibited by the law in many places OF operates, and judging from the number of people who are creators on the platform I've seen complaining about people jeopardizing their status with the platform by soliciting it on the platform, also by the actively-enforced terms of the platform. OF is simply not “legal prostitution”, and it is ridiculous to describe it that way
> Well, no, violating a binding legal agreement is illegal.
Not touching the rest of this thread's arguments, but that isn't really true. Breaking ToS, or any other contract, is not "illegal"-- it's not a crime. It opens you up to civil (not criminal) penalties if the other party sues, but that's it.
Not to mention people lose accounts because someone reported them as underage, and now they don't want to fully dox themselves over this. Who can blame them considering discord's own support ticket system was hacked which included people who had to validate their age.
What they should do instead is invest in technology that can do age verification while protecting privacy. This is obviously a required piece of technology. It is not acceptable for children to grow up on the Internet and easily access pornography by simply going to a website. Imagine letting your children loose in a city where they can wander in and out of peep shows without friction.
While the "required piece of technology" aspect is debatable, there is certainly enough demand for it that it is going to happen in one way or another.
So I agree that instead of fighting some change that I think is inevitable, they should make it so that it works in the most privacy-conscious way possible. And I mean with real technical solutions, like an open-source app or browser extension you can download, a proof-of-concept server for age verification, etc... using the best crypto has to offer.
And yet this has been the system for the last 35 years and somehow the sky didn't fall.
Either you're old enough to understand what porn is and have desires to consume it in which case you won't be scarred by it and don't need protection from it, or your not in which case you won't seek it out. You need id checks for alcohol because people too young to consume it want it, and given how much teens drink and how not a problem lower drinking ages are in other countries even that claim is somewhat dubious.
Not true; kids too young to understand porn can stumble across it, or find it because they searched for it simply because they heard about it from their friends. I'm not saying they'll be harmed by it (most of them won't be), but there will always be a small percentage of people who find a certain thing and then go on to get harmed by that thing. That doesn't mean the rest of us should have to jump through hoops to responsibly use that thing.
I wouldnt just say "they can", the average first exposure to porn is ~10, so "they do". And this isnt some spicy magazine the issue with internet porn is that it's an intense supranormal stimuli relative to, say, a handful of images of which you have to do a ton of effort (and ID checks) to get more. Internet porn today is multi-tab, rapid desensitization requiring escalation in content, and an increase in young Porn-induced Erectile Dysfunction -- an element why ED drugs are being pushed on younger people these days (besides the socially sick trend of objectifying people by their size and "performance"). Some believe the Australian jewel beetle story is basically playing out with Men these days leading them to not go through the right motions to become successful and find a mate.
I'm sure i'll get downvoted into oblivion by skeptics, but there is a good amount of reasons to believe this is true. Your brain on porn by gary wilson is a good starting point for the ideas, and then to dig deeper if you are inclined to fact check.
Well I have to imagine any downvotes will come because most of this is pseudoscience. But you seem like you're replying in good faith so it's all good to me.
* There is some research that the age of first exposure to porn is lower and there's speculation that this might affect attitudes towards sex in teens but there's nothing conclusive.
* YourBrainOnPorn is most charitably a misreading of scientific literature juxtaposed with people's personal experiences of porn becoming an issue in their lives, but is probably more accurately pseudoscience manufacturing a specific narrative by citing studies that don't actually support their conclusions but are banking on people not actually checking. It's "The Body Remembers" bullshit all over again.
* Porn Induced ED isn't a medical condition and was made up by NoFap. There is an increase in ED prescriptions among young people but there's no evidence whatsoever that this is connected to porn and is much more plausible that there's just less stigma about it, it's just easier to get using an app, and more people are using it for enhancement and performance anxiety rather than ED.
* And there's this awkward problem that men actually care about size and performance significantly more than women do so this objectification angle is a bit silly. Like these two things aren't even in the top 5 of priorities for women's sexual partners. And uhh… can confirm personally as a woman. Larger becomes painful faster than most guys think and my ability to climax is more mental than physical. I've had more than one friend go home with a guy pull down his pants and laugh being like, "wow but also that's not gonna fit."
* I'm not even touching the beetles thing.
And look a ridiculous number of people bought into The Body Remembers and it's still going to be years and years to shake the public out of that one. I don't expect this to be any different. The good news is, outside of a few people with an unhealthy relationship with porn, that in general things are actually fine. Whole generations aren't being addicted to and made impotent by porn.
> Whole generations aren't being addicted to and made impotent by porn.
They literally are. Mostly men, though, so you might not really get it.
> There is an increase in ED prescriptions among young people but there's no evidence whatsoever that this is connected to porn and is much more plausible that there's just less stigma about it,
Yes, just like cancer rates and mental illnesses. The number increases aren't real, we're just getting better at detecting it. Surely, nothing ever gets worse in the world. /s
You're right, though, that most of this is pseudoscience. Most of the "problem" with porn is psychological, rather than strictly physical, and psychology is generally pseudoscience.
The push for age verification must be about something else. There are good solutions to this, but they are ignored. Its always about some complex setup leaking information all over the place. It must be either ignorance or indeed about surveillance, as many here think it is.
Shameless plug: I wrote about hash chains some time ago. They are a nice and simple solution to age verification. https://spredehagl.com/2025-07-14/
The reality is that it's probably mostly about incompetence and lazyness. And tight purses of course.
When some country parliament decides to mandate age verification, it's really easy and lazy for them to just say "verify ages and do it reliably!" and stop at that. As a result, the services affected don't really have a choice to go towards those horrible solutions of scaning our faces or IDs or both and all the issues around that.
What should happen rather is "we'll build a system for age verification that is privacy focused and all you sites that are adult only will have to use it or any other system we deem acceptable" But this requires effort on the part of the government doing the law. And money.
Yes, wellknown solutions have a strong grip on you. In this case it is unfortunate.
I know that the preparations for eIDAS 2.0 (the European thing) did contain many good parts. Taking inspiration from SSI. So at that point their specifications were rather good. I havent kept up with it for almost one year now, so that might have changed.
I would be happy if we just moved to a way we could more realistically enable audits of information flow in our lives. I don't, necessarily, want to restrict my kids consumptions. It does worry me that I don't know how to teach them to audit all of the information that is being exposed to them. Or worse, collected about them.
I'm not entirely sure what you mean by 'audit', but teach them critical thinking, and show them the strategies the media uses to manipulates them. Teach them there's often more than 1 side to a story.
Things like this will give them a huge advantage in not being manipulated and lied to.
To explain it like budgeting. You can forward plan what you will spend money on. But you also need to be able to see where all of your money went. This is nigh impossible with data flow, nowadays.
I'd be comfortable with it having large segments of "uncategorized." But right now, if I scan over to my ISP to see how much data I have used for the month, I have little to no help in saying how much of that was what.
Ah okay. I think this would probably be pretty tricky, security-wise, no? One of my first thoughts that might help would be writing a simple tool that parses history from your browsers to categorize it. Other than that, there are things like https://activitywatch.net/ (which seems to have a desktop and Android version)
Yeah, just writing out the idea, I would imagine I should be able to see a lot of this with my router?
Again, I get that that will be a lot I have to write off as "uncategorized." I'm not even trying to drive all telemetry down to zero. I'm comfortable knowing that my HVAC may send diagnostic stuff in, as an example. But it seems kind of crazy to me that this is not something that is often discussed? Do I just miss those discussions?
If age check is truly anonymous/zero-knowledge, as in the requester can't identify me, the issuer can't link me to the attestation... why wouldn't someone start selling age verified accounts? Easy money for some 18yo.
I wonder what the psychological effect of having little or no privacy would do to people. Are we all going to be paranoid schizophrenics? How would a world of paranoid schizophrenics work? How insane are world events going to be from that point on?
China is an example of this. Somewhere that, according to the UN's data, executed "undesirable" people with such gusto that it incidentally decreased the organ donor waitlist time so low that it couldn't be explained by any other factor.
"Perfect" security is only attainable with zero dissent, zero individuality, zero privacy, and zero freedom.
Paranoid, maybe. Schizophrenics? No. Firstly, "paranoid schizophrenia" is an outdated diagnosis. Paranoia is a common symptom of schizophrenia, but schizophrenics exhibiting paranoia are not considered to have separate mental illness from those who are not. Secondly, schizophrenia is not caused simply by psychological stress, and is associated with a large cluster of positive and negative symptoms, with paranoia being only one of them.
Generally speaking, I share the HN consensus on age verification laws. But, there is a real problem with kid's unfettered internet access. Just think about all the adults who are hopelessly addicted to social media. The negative affects are amplified when it comes to developing minds.
My SO has been teaching for nearly 20 years now, and mental health in kids has fallen off a cliff in the last two decades. I could fill this page with online bullying stories. Some of which, are especially cruel. Half her students are on medication for anxiety. It's out of control, honestly.
That said, I don't know how to solve it. It's easy to put this on the parents, but that's not the answer. Otherwise, it would be solved already. Some don't care. Some don't have the time to care because they're trying to keep the lights on, and dinner on the table. And, some simply think it doesn't apply to them or their children. Parents on HN are hyper-aware of this sort of thing, but that's definitely the minority.
I know a family that would be most folks least likely candidate for something bad to happen online. Single income, relatively well off, the parent at home has an eye on the kids 24/7. And, if you met the kids, you would most likely qualify them as "good kids". Without going into detail, their life was turned upside down because one of the kids was "joking around" online.
Again, I don't know what the answer to the problem is. Clearly, age verification laws are a veiled attempt to both collect and control data. And, EFF's emphasis on advertising restrictions as a solution, seems off the mark. There's more to it than that. Idk, this shit makes me want to log off permanently, and pretend it's 1992.
Is the EFF captured? This is a resource against misguided laws but what's a law they'd actually approve of? This entire resource is boring defense of the status quo.
Asking for a year of birth is the best solution and always will be. Once kids are old enough to figure that out you're not going to stop them from much.
No but this is exactly why I don't want this to become law. However yes if it does become law I will avoid it.
It is a big slippery slope aimed at destroying anonimity on the internet. Even if first attempts are privacy-preserving, it could still break the use of double accounts for example, something which I also use widely.
The net got too big, the 90% got in because of facebook and google, and automated bots took over from there.
Either we create the fix, or the feds take it over. we need to sever the idea of a global internet. per-country and allied nations only.
anonymous cert-chain verified ID stored on device. problem fixed.
"SAN FRANCISCO-With ill-advised and dangerous age verification laws proliferating across the United States and around the world, creating surveillance and censorship regimes that will be used to harm both youth and adults, the Electronic Frontier Foundation has launched a new resource hub that will sort through the mess and help"
The surveillance and censorship system is built, administered and maintained by Silicon Valley companies who have adopted this as their "business model". "Monetising" surveillance of other peoples' noncommercial internet use
These Silicon Valley companies have been surveilling internet subscribers for over a decade, relentlessly connecting online identity to offline identity, hell bent on knowing who is accessing what webpage on what website, where they live, what they are interested in, and so on, building detailed advertising profiles (including the age of the ad target) tied to IP addresses, then selling the subscribers out to advertisers and collecting obscene profits (and killing media organisations that hire journalists in the process)
Now these companies are being forced to share some of the data they collect and store
Gosh, who would have forseen such an outcome
These laws are targeting the Silicon Valley companies, not internet subscribers
But the companies want to spin it as an attack on subscribers
The truth is the companies have been attacking subscriber privacy and attempting to gatekeep internet publication^1 for over a decade, in the name of advertising and obscene profits
1. Discourage subscribers from publishing websites and encourage them to create pages on the company's website instead. Centralise internet publication, collect data, perform surveillance and serve advertisements
I am disappointed to find no mentions of zero knowledge proofs or any other indications that we wont have to trust anyone with this task.
We have the technology to do age verification without revealing any more information to the site and without the verification authority finding out what sites we are browsing. However, most people are ignorant of it.
If we don't push for the use of privacy preserving technology we wont get it and we will get more tracking. You cannot defeat age verification on the internet, age verification is already a feature of our culture. The only way out is to ensure that privacy preserving technologies are mandated.
> we must fight back to protect the internet that we know and love.
This is not compelling. The internet I know and love has been dying for a long time for unrelated reasons. The new internet that is replacing that one is an internet that I very much do not love and would be totally ok to see lots of it get harder to access.
The parts where traffic generates money for the kind of people who would think putting an advertisement on a screen on someone's home refrigerator is an acceptable thing to do (morally, not legally or whatever).
Parents have complete control of the Chat/Porn server and since the orgasmatron necessarily has all your desires stored in its LLM (Large Lust Model) it trivially knows your age and will lock you out.
And internet porn can be banned regardless of age. (that's only half sarcastically said).
Demand for home Large Lust Models and orgasmatrons will soar. You heard it here first. Opportunity for entrepreneurs. And these home-based products are the only way to keep porn away from kids (if parents don't care now, they never will) and to maintain privacy on the internet.
Every place where I've worked in I.T., the rule was "No porn downloading at work. Porn belongs in the home." (especially in the days of slow home modems)
And to be really enforceable, all offshore sites would have to agree to the scheme, including certain Russian ones who are glad to pollute our children's and adults' minds with porn, propaganda and conspiracy theories.
Lastly: There always was and will be media. Micro-SD cards now? If not phones, thrift store picture frames and RPi's. "Porn finds a way."
I think sadly, this is a lost battle in public opinion. And the gambling of digital assets on Roblox and other casino-like website is also starting to get public attention, and will turn public opinion further.
The CNIL gave up 3 years ago, and gave guidelines, you can read about it here [0]. At the time it read like "How well, we tried, we said it is incompatible with privacy and the GDPR multiple times, we insist one more time that giving tools to parents is the only privacy-safe solution despite obvious problems, but since your fucking law will pass, so the best we can do is to draw guidelines, and present solutions and how to implement them correctly".
I think the EFF should do the same. That's just how it is. Define solutions you'll agree with. Fight the fight on chat control and other stuff where the public opinion can be changed, this is too late, and honestly, if it's done well,it might be fine.
If the first implementation is correct, we will have to fight to maintain the statu quo, which in a conservative society, is the easiest, especially when no other solution have been tested. If it's not, we will have to fight to make it correct, then fight to maintain it, and both are harder. the EFF should reluctantly agree and draft the technical solution themselves.
online age verification is disingenuous and a pretext to give governments the hard coded technical option to regulate speech and association.
there's a great game being played out by these users of force against the advocates of desire. everything about the bureaucracies pushing digital ID is unwanted. this isnt about age verification tech, its about illegitimate power for unwanted people who are actuated by forcing their will on others.
we should treat these actions with the open disgust they deserve.
Realistically all but the largest sites are going to contract out age verification to third parties. There will probably be verification companies that will have a wide range of verifications.
In Switzerland you are forced to receive an SMS code to your phone on every portal in every public space everywhere to establish your identity on every network. No SMS = No public wifi anywhere in Switzerland.
That's a funny choice, I thought Europe was done with SMS. I can see this 1-to-1 mapping with other cellphone derived messaging like Whatsapp, etc being an issue for privacy but it's certainly possible to have multiple phones.
I believe cyber cafes in India must verify identity via ID before allowing internet access and maintain logs, browsing history, etc. for at least one year.
I understand this is a technology forum, frequented mostly by liberal adults, who built a lot of their internet nous on totally free internet of 90s and 00s. I am one of them.
Equally, I think insisting that there must be no controls to internet access whatsoever is not right either. There is now plenty of evidence that eg. social media are very harmful to teenagers - and frankly, before I noticed, going on FB got me depressed each time I did it at one point. And as a parent, you realise how little control you have over your children's tech access. Case in point - my kids seem to have access to very poorly locked down iPads at school. I complained, but they frankly don't understand.
We all accept kids can't buy alcohol and cigarettes, even if that encroaches on their freedom. But or course flashing an ID when you're over 18 is not very privacy-invading.
Likewise, I think it is much better to discuss better means of effecting these access controls. As some comments here mention, there are e.g. zero knowledge proofs.
I'm sure I'll be told it's all a sham to collect data and it's not about kids. And maybe. But I care about kids not having access to TikTok and Pornhub. So I'd rather make the laws better than moan about how terrible it is to limit access to porn and dopamine shots.
This keeps coming up and we keep having the same debates about what Age Verification isn't.
For the folks in the back row:
Age Verification isn't about Kids or Censorship, It's about Surveillance
Age Verification isn't about Kids or Censorship, It's about Surveillance
Age Verification isn't about Kids or Censorship, It's about Surveillance
Without even reaching for my tinfoil hat, the strategy at work here is clear [0 1 2]. If we have to know that you're not a minor, then we also have to know who you are so we can make any techniques to obfuscate that illegal. By turning this from "keep an eye on your kids" to "prove you're not a kid" they've created the conditions to make privacy itself illegal.
VPNs are next. Then PGP. Then anything else that makes it hard for them to know who you are, what you say, and who you say it to.
Please, please don't fall into the trap and start discussing whether or not this is going to be effective to protect kids. It isn't, and that isn't the point.
0 https://www.eff.org/deeplinks/2025/11/lawmakers-want-ban-vpn...
1 https://www.techradar.com/vpn/vpn-privacy-security/vpn-usage...
2 https://hansard.parliament.uk/Lords/2025-09-15/debates/57714...
As much as you (and I as well) don't want age verification to involve discussion about kids' access to content because we're more concerned about the surveillance push riding the popularity of that, repeating "it isn't about kids" loudly 3 times doesn't make the (extremely large) group of people pushing age verification for kids disappear.
Telling that larger group their interest just isn't part of the conversation at all excludes _you_ from the conversation rather than changing the focus of the conversation to the other downsides instead of the primary interest others might have.
There are also, concerningly IMO, an extremely large amount of people willing to accept severe surveillance or privacy downsides so long as it helps achieve the goal about kids. To them, the same would in reverse would be "why are you talking about surveillance, the real issue is the kids. Say it 3 times loud, for those in the back!" and the conversation gets nowhere because it's just people saying how they won't talk to anyone who disagrees what concerns should be considered.
I'm sure those people exist, I just never happen to see anything they write online nor meet any of them in real life.
> There are also, concerningly IMO, an extremely large amount of people willing to accept severe surveillance or privacy downsides so long as it helps achieve the goal about kids.
I’m alive. Nice to meet you.
I “accept severe surveillance”, not in the sense that I agree with it, but because I know that it already exists and has existed and that people that are against it are screaming into the wind. Many large and small countries have long histories of surveillance.
It’s not that you shouldn’t try to enforce privacy, in fact, the law requires it if you in some cases, and it’s a good idea in others.
I’m certainly not against the EFF standing up for the rights of everyone not to be severely surveilled.
But, realistically, the public cannot easily anonymize our activity and data. And if you try to do so, you’re painting yourself as a target.
If you were trying to keep your country safe, wouldn’t you like the ability to infiltrate any major cloud, SaaS app, social media platform, bank, government, VPN/internal network, and OS?
Similarly, if you were a big data or security company wouldn’t you also do everything you could to know everything it is to know about a person if you had the means and time and it made sense for your business?
Following, if you were to have that power as a government, business, or other organization, wouldn’t it be critical to ensure that you restricted its use to ensure it wasn’t abused to the point that you’d lose it, even though the reality would be that you probably don’t have time to keep it as safe as you need to?
I “accept severe surveillance” not because I promote it or want it, but because I understand how the world works and what it does.
All these things will pass. If you have the focus and the mental capacity to do what is good, then do it. It likely helped the world in some way to learn about KGB wiretaps. But, in the U.S., as far as I can tell, the backlash against the CIA and NSA was just used for political gain and then to replace those that didn’t agree with the current administration. Was that helpful? And who are we really being manipulated by when we attack ourselves and install destabilizing leaders?
Chances of being manipulated and attacking yourselves would diminish quite a bit if those tasked with surveillance wouldn't be blinded by the pursuit of as much data as they can get their hands on. Yes, knowing everything there is to know about a person can be helpful to a point, but if you had the means and time there is literally no business where it makes sense to pre-emptively collect every bit of data on such a single person. To do so in regard to multiple people or more will have a crippling effect on gaining insight and understanding of relevant information. Having a vast knowledge-base is a huge waste of resources when it impairs your capacity to convert what you know into what would be wise. There's really no need to infiltrate anything and everything to know what needs to be known, and it will save a whole lot of distraction and data fatigue.
People eager to have such a vast trove of data at their fingertips lack patience and focus to develop skills to use their access responsibly - having them around is counterproductive and dangerous in any business where intelligence is key.
So, no. I would actually prefer to try and keep my country safe, thus any desire to infiltrate anything, anywhere, anytime would be irrational, and most likely an early warning signalling an onset of dementia, delirium or any similarly debilitating condition. It should certainly exclude me from working with highly sensitive data, unless you are in the business of making my country less safe.
This is a fairly defeatist approach to the issue (read that as a statement of fact, not an accusation or argument). The problem with taking this stance, for many people, is that you’re giving a mouse a cookie, except the cookie is marginally more and more control over your life in the form of the ability to control what you see, what communities you’re allowed to engage with, and what you’re allowed to do online.
This battle for online privacy and control is just that, a battle, and you are correct that it is not a fair fight. But engaging and pushing back, through advocacy, speaking out, and acts of noncompliance does three things:
First, it slows the progress of these measures and thus limits the amount of control over our lives we give up, hopefully until some more politically friendly people come to power.
Second, it provides a barometer (via its effectiveness) for assessing the state of that fight, and how dire it is becoming.
Finally, people voicing their concerns about these laws gives information that helps inform more powerful and potentially altruistic advocates with more resources (such as the EFF) in how those resources should be allocated.
Maybe those aren’t good reasons for you, and that’s okay. Lots of people just want to browse twitter and see sports scores and they don’t really care if they have to show ID to do that. For anybody else reading this though, there are lots of reasons why your involvement and engagement in this issue should not stop with “that’s just how the world works”.
The issue here for me has always been about the difference between treating a symptom and treating the illness.
Excessive surveillance is necessary when you cannot convince people of the merits of your politics or morals on their own and need to use the power of the State to intimidate and control their access.
For the issue on minors, if you have a child (guilty here) you are obligated to actively raise and educate them on the nature of the world. For access to online interactions this doesn’t necessarily only mean active limits (as one might judge appropriate for the child), but also teaching them that people do not always have positive intent, and anonymity leads to lack of consequence, and consequently potentially antisocial behavior.
A person’s exposure to these issues are not limited to interactions online. We are taught to be suspicious of strangers offering candy from the back of panel vans. We are taught to look both ways when entering a roadway.
The people demanding the right to limit what people can say and who they can talk to do so under the guise of protecting children, but these tools are too prone to the potential for abuse. In the market of ideas it’s better (and arguably safer, if not significantly more challenging) to simply outcompete with your own.
These types of arguments are quite common due to how beneficial they are for authoritarian. People forget that authoritarians don't need a lot of supporters, but they do need a lot of people to be apathetic or feel defeated. With that in place even a very small group can exert great power. Which also tends to make their power appear larger than it is, in order to create that feedback loop
In fact, the opposite!
If I have keys then so do my enemies! I want that shit locked down as much as possible because I don't want others infiltrating.
Personally if I was the president I would direct the NSA to pen test our own networks and work with companies to resolve any issues. I would make this a major priority in fact. I don't want them to be vulnerable or subject to blackmail.
Is it annoying I can't get in and watch them? Sure. But you can't have both.
Everyone is adults here and get trust. Plus, I'm the government. If I have legitimate belief they're acting illegally I have the power to get in anyways. It's just shower, requiring courts who keep my power in check
I suppose it depends on how much else you want to see. E.g. the recent discussion on Australia's social media band for teens https://news.ycombinator.com/item?id=46208348 has ~1500 comments covering nearly every possible angle I could have conceived and some positions I'm not sure I would have even been able to imagine. Focusing on about the kids is a popular position in threads like that, and one of the top 5 top level comments is even an example of "I care about the kids and don't want to discuss how it should be about these other things".
We're all in bubbles. But it's good to expand them when you recognize you're in one.
And the Internet also consists in large part of bots talking to bots. This is not to say that some people won't always promulgate the "Won't somebody please think of the children?" argument every time an expansion of the surveillance state apparatus is in question, but rather to say that we should not take for granted that every bad opinion we see online is one deeply held by any real people.
How about the majority of the recent thread about the Australian social media ban?
BTW the Australian law says it's illegal for a platform to require government ID for age verification.
Write to your legislators/representatives.
Honestly, it is the only thing that you can do, apart from voting and talking to people in your near environment.
Is it a good solution, and always likely to work? No, absolutely not.
But is a hell of a lot better than doing nothing or sharing social media posts, which is frankly as effective as screaming into your pillow at home.
For the folks in the back row:
Age Verification is about Kids and Censorship: to track them and censor them
Age Verification is about Kids: giving it to companies who will keep it as safe as they've kept your identity, email, and other information.
Age Verification is about Kids and Censorship: taking control from you and giving it to corporations and government.
Age Verification is about Kids and Censorship: to keep them on their platforms so they can profit from them
Age Verification isn't just about Kids: it's also about tracking you
I don't know why we want to put children's data online. I don't want cameras in the kids rooms to verify their face, that camera will be used by others. That camera will be used to do the very thing they claim it is to protect against. I don't want the kids online, easily meeting with pedos, pretending to be kids or otherwise. I don't want kids data online for those people to use it to harm them. I don't want kid's data being leaked and exposed forever. To create lasting damage that will follow then the rest of their lives.
The road to hell is paved with good intentions. The devil uses this to fool you. Seriously, y'all gonna trust your kids' data with the people in the Epstein list? Why would you let a fox guard the chicken coop?
Hear, hear! I'll add another:
"Age Verification is about suppressing the 'undesirable' for kids, but also for you". I.e. having to share your personal identity for that taboo (but legal and harmless) sex site (or whatever someone in power might not approve of) sure is going to make you think twice and may even kill many smaller instances withojt making them illegal outright.
It may not sound bad in a single example, but eventually there is something you like that is fine but gets added to the list.
"group of people pushing age verification for kids disappear."
Parents need to parent then, but the amount that will are still larger than the people who want mass surveillance because they can't be arsed to raise their kids.
If they are too lazy to raise their kids, they don't have the energy to push the nanny state forward.
Parenting is, and always has been, a collective responsibility. We made it illegal to sell alcohol to kids, instead of just complaining that parents weren't teaching them not to drink it.
> Parenting is, and always has been, a collective responsibility.
No, it isn't, and no it hasn't. Other people have always been involved in the upbringing of children, but responsibility for parenting has never belonged to anyone other than parents.
And the others involved have always been individuals operating within the bounds of direct trust relations with parents and children -- extended family members, neighbors, friends etc. -- and not strangers enforcing rules promulgated by other strangers.
The social context in which parenting takes place is "family", not "political state".
This take is really detached from reality, I get down voted for this whenever I ask, but do you have kids? If not sorry, but your opinion means nothing.
We all exist in a society and (as the other comment says) it take society to raise kids. I don't want a society where as a parent I have to fight against shitty parents and the potential immaturity of my kids (they are too young right now thank god) to stop them watching porn as a 11yo or other inappropriate gifts from internet "culture".
Setting some reasonable standards for what content kids should consume provides parents with cover when trying to raise their children well. Its the reason movies have age gates, and strip clubs and many other things not on the internet.
> This take is really detached from reality, I get down voted for this whenever I ask, but do you have kids? If not sorry, but your opinion means nothing.
The reason you get down voted is likely because you are neither sorry nor correct. Just because someone doesn't have children does not mean their opinion of technology that affects them just the same is invalid. You will get better results engaging others in meaningful debate without dehumanizing folks simply because they aren't like you.
And now compare this comment with another comment (https://news.ycombinator.com/item?id=46228900) I got in yet another "let's save children from the Internet" thread:
> Your sci-fi distopia flash fiction is compelling, but not actually on topic in this discussion.
> "Think of the children" is weaponized for censorious purposes, but also the harms of social media are well documented (unlike many of the other moral panics fuelled by this phrase).
> I'm not sure a blanket under-16s ban on all social media is the right answer, but there are really good reasons why people support this that you need to engage with to have a useful discussion here.
So basically for everyone even with modest pattern recognition abilities the template used here should be crystal clear, which goes along the lines of
- I'm kinda with you (even though you are stupid and emotion-driven);
- But your point is totally invalid because you should be humiliated by the sheer number of your opponents, which renders you small and negligible;
- Your opponents have very good reasons to support any fascism that is able to address their reaction to prefabricated problems with prefabricated solutions, and you've got to support that too if you want to be heard.
I'm pretty sure these threads are chock full of shills, because one can't rob people of freedom without significant narraive steering efforts.
The real problem with these people is they always just end up supporting pedophiles, so all their zealous justice is really moot.
The first comment is a real example of what I was saying about seeing the reverse situation - when it's someone you disagree with it becomes obvious how dangerous it is to say other views/ideas are not supposed to be part of the conversation. zthe other comments are ones I'f personally disagree with, but that's precisely the kind if discourse which needs to be engaged with instead of ignored if one has any concerns around fascism taking hold.
Also, I don't want to give the impression the only path here is to placate the other concerns/interest. That does work very well if you can, but the main point is just avoid this idea declaring anny other ideas out of the conversation because you disagree with them and only want people to talk about what you like. That doesn't help, you want to convince people to see the reasons you do not to ignore them.
If you ever feel there are threads with shills, take the time to send an email to hn@ycombinator.com with the parts in question. This isn't just some platitude people say here, they've really hopped right on it, triggered action, and got back to me every time I've emailed.
I would much rather have laws that require that certain kinds of websites return machine-readable headers describing what kind of content is on them, and then browsers, web proxies, etc. could be configured by parents, schools, etc. to block undesirable sites.
Recycling a post about reasons to do it that way:
> 1. Most of the dollar costs of making it all happen will be paid by the people who actually need/use the feature.
> 2. No toxic Orwellian panopticon.
> 3. Key enforcement falls into a realm non-technical parents can actually observe and act upon: What device is little Timmy holding?
> 4. Every site in the world will not need a monthly update to handle Elbonia's rite of manhood on the 17th lunar year to make it permitted to see bare ankles. Instead, parents of that region/religion can download their own damn plugin.
This is the exact argument that we had in the 1990s about content on television, and the solution ended up being exactly this -- TV networks started attaching ratings to their broadcasts, and TV sets started including "v-chips" that could be turned on and configured to block content that matched certain ratings.
Once that solution was in place, the argument was settled, and the people trying to push for censorship in pursuit of ulterior motives didn't have a leg to stand on.
And really, a locally running AI could make that assessment pretty easily even if it isn't declared. No need to destroy the whole world's privacy. Unless that was the goal to begin with, obviously.
Politicians in Washington State is proposing not just age verification but also health warnings on adult websites. How is either constitutional?
https://www.xbiz.com/news/294260/washington-av-bill-jumps-on...
It's been illegal to sell porn to minors since approximately forever. If that is constitutional (not saying it is, but I'd be surprised if it wasn't since it's such an established practice), then I don't see how requiring age verification on porn sites wouldn't be. Requiring health warnings might be another matter, though. Not sure about that.
Does the “sell” part matter - like is it simply that the sale to minors can be regulated? If it is free isn’t it just transmission of information?
No, it's still illegal in most places to knowingly distribute pornography to minors - the law in my state starts;
> A person who sells, gives away or in any way furnishes to a person under the age of 18 years a book, pamphlet, or other printed paper or other thing, containing obscene language, or obscene prints, pictures, figures or descriptions tending to corrupt the morals of youth
I wonder how it relates to the health warnings on tobacco products?
People are complacent. Even me, even you. We're not going to get off our 21st-century comforts asses and actually do anything to disrupt anything.
At best I may avoid using products from certain companies until I really have to, like Google and Microsoft's AIs, or clear cookies after signing into YouTube so it doesn't sign you into everything else, or write a comment here and there about how some Apple APIs like the iCloud Keychain allow Facebook etc to track you across devices and reinstalls, but I'm not ever going bother doing anything more that would actually challenge all this dystopian fuckiness.
> If we have to know that you're not a minor, then we also have to know who you are
That is untrue
Are you aware of any age verification systems that do not have this property?
(This includes being robust against law enforcement action, legal or otherwise.)
Like many mention in other comments on this post, it's possible to implement using ZKPs. There are likely other methods that would be effective without compromising privacy. None of them are part of the Age Verification discussion because kids are not the actual point of Age Verification.
When I say "if we have to know you're not a kid, we have to know who you are" I'm not stating an actual truth, but the argument as it is playing out politically.
> None of them are part of the Age Verification discussion because kids are not the actual point of Age Verification.
The EU age verification solution says implementations SHOULD implement[1] their ZKP protocol[2]. Not linking it to the user is stated as an explicit goal:
Unlinkability: The goal of the solution is to prevent user profiling and tracking by avoiding linkable transactions. Initially, the solution will rely on batch issuance to protect users from colluding RPs. Zero-Knowledge Proof (ZKP) mechanisms will be considered to offer protection. More details are provided in Section 7.
[1]: https://ageverification.dev/av-doc-technical-specification/d...
[2]: https://ageverification.dev/av-doc-technical-specification/d...
Is there a good explanation of how ZKPs prevent attestation providers (which presumably know your identity) from linking an issued proof back to you if, for example, the website elects to store it? I can wrap my head around RSA and ECC and PKI, but I haven't managed to make sense of this yet.
Assuming that's even a goal, of course. The cited paragraph mentions RPs (the websites, from what I understand), but makes no mention of attestation providers.
This is, of course, very technical, but here is how it works at a high level.
In the non-ZKP presentation, the "holder" (phone) sends the credential to the relying party (website), and the RP executes some verification algorithm. In the ZK presentation, the holder executes the verification algorithm and sends to the RP a proof that the algorithm was executed correctly.
The "proof" has this magical property that it reveals nothing other than the check passed. (You will have to take on faith that such proofs exist.) In particular, if the check was the predicate "I have a signature by ISSUER on HASH, and SHA256(DOCUMENT)==HASH, and DOCUMENT["age_gt_18"]=TRUE", anybody looking at the proof cannot infer ISSUER, HASH, DOCUMENT, or HASH, or nothing else really. "Cannot infer" means that the proof is some random object and all HASH, DOCUMENT, ISSUER, etc. that satisfy the predicate are equally likely, assuming that the randomness used in the proof is private to the holder. Moreover, a generating a proof uses fresh randomness each time, so given two proofs of the same statement, you still cannot tell whether they come from the same ISSUER, HASH, DOCUMENT, ...
If it's not linked to an identity, why can't a kid use a parent's key?
Excellent question. More generally, what prevents me from copying the credential and giving it to somebody else?
The currently favored approach works like this. The DOCUMENT contains a device public key DPK. The corresponding secret key is stored in some secure hardware on the phone, designed so that I (or malware or whatever) cannot extract the secret key from the secure hardware. Think of it as a yubikey or something, but embedded in the phone. Every presentation flow will demand that the secure element produce a signature of a random challenge from the RP under the secret key of the secure hardware. In the ZKP presentation, the ZKP prover produces a proof that this signature verifies correctly, without disclosing the secret key of the secure hardware.
In your example, the parent could give the phone to the kid. However, in current incarnations, the secure hardware refuses to generate a signature unless unlocked by some kind of biometric identification, e.g. fingerprint. The fingerprint never leaves the secure hardware.
How does the issuer (e.g. the republic of France) know that DOCUMENT is bound to a given fingerprint? This is still under discussion, but as a first bid, a French citizen goes to city hall with his phone and obtains DOCUMENT after producing a fingerprint on the citizen's phone (as opposed to a device belonging to the republic of France). You can imagine other mechanisms based on physical tokens (yubikeys or embedded chips in credit cards, or whatever). Other proposals involve taking pictures compared against a picture stored in DOCUMENT. As always, one needs to be clear about the threat model.
In all these proposals the biometric identification unlocks the secure hardware into signing a nonce. The biometrics themselves are not part of the proof and are not sent to the relying party or to the issuer.
So adults are required to own a phone to prove their age?
Can I log into an age gated service at a library without a phone?
Another excellent question. The current answer in the EU seems to be "you need a phone". My preferred answer (despite being one of the Google guys who designed the ZKP mechanism) would be that the government sends you some sort of plastic card with a chip that does not tie you to a phone. Still fighting that battle.
I guess owning some computer should be fine as a requirement? It just should not be tied to the US megacorps. A web app perhaps?
Yes. However, at some point there needs to be some unforgeable piece of hardware that prevents copying the document. I am a big fan of yubikeys and I wish everybody used them, but the reality is that people lose them way more often than they lose their phone.
Thanks for answering, I appreciate it.
> How does the issuer (e.g. the republic of France) know that DOCUMENT is bound to a given fingerprint? This is still under discussion, but as a first bid, a French citizen goes to city hall with his phone and obtains DOCUMENT after producing a fingerprint on the citizen's phone (as opposed to a device belonging to the republic of France).
Are you saying that someone goes to city hall, shows ID, and gets a DOCUMENT that certifies age, but doesn't link back to the person's identity? And it's married to a fingerprint in front of the person checking ID?
Is there a limit on how many times someone can get a DOCUMENT? If not, it'll become a new variation of fake id and eventually there's going to be an effort to crack down on misuse. If yes, what happens if I get unlucky and lose / break my phone limit + 1 times? Do I get locked out of the world? The only way I can imagine limiting abuse and collateral damage at the same time is to link an identity to a DOCUMENT somehow which makes the whole ZKP thing moot.
I'd be more worried about the politics though. There's no way any government on the planet is going to keep a system like that limited to simple age verification. Eventually there's going to be enough pretense to expand the system and block "non-compliant" sites. Why not use the same DOCUMENT to prove age to buy beer? Sanity for guns? Loyalty for food?
What happens if the proof gets flipped to run the other direction and a DOCUMENT is needed to prove you're a certified journalist? Any sources without certification can be blocked and the ZKP aspect doesn't matter at that point because getting the DOCUMENT will be risky if you're a dissenter. Maybe there's an interview. Maybe there's a background check. Has your phone ever shown up near a protest?
It's just like the Android announcement that developers need to identify themselves to distribute apps, even via side loading. The ultimate goal is to force anyone publishing content to identify themselves because then it's possible to use the government and legal system to crush dissenting views.
Big tech caused most of the problems and now they're going to provide the solution with more technology, more cost, and less freedom which is basically what they've been doing for the last 2 decades so it's not a surprise.
I somewhat understand your argument about how to prevent misuse, but I'd say one could do that by embedding the key in an ID card and someone will have to connect the ID card to the phone/computer (e.g. via NFC). So obviously you can pretend you lost your ID card and get a new one, but I would say that you can only do that so often until someone will get suspicious, just as if you would ask for a new passport every couple of months someone would start asking you some serious questions.
Regarding using the document to buy beer, that's already done, you need to provide ID. I also hope you being asked to provide ID for buying guns, but then again I'm not from the US, so I have quite a different opinion on gun ownership.
All that said though, we are currently watching some of the most significant civil rights abuses by authorities, all without any ID system and people are worried about age verification? If the government wants to abuse their power they don't need an ID system, they just look at your social media profile at the border.
This post is restricted to the context of the European Union and is intended to be factual.
The EU age verification app is intended to be a pilot to the EU Digital Identity Wallet (EUDIW), which EU law requires to be deployed everywhere in Europe by the end of 2026. (Thus your "worry" is in fact the explicit plan of record.)
The EUDIW will store more attributes than age. Think of it as a digital form of a passport (with name, address, etc.). The exact set of attributes is determined by local laws.
Thus, the DOCUMENT that you obtain is tied to you, and of course the state knows what is in the DOCUMENT since the state creates the document in the first place.
The state does not generate proofs. The phone generates proofs. Given a proof (and only the proof), nobody can associate the proof to the phone or to you.
Now I switch to less factual statements, which are still approximately correct.
Why would you trust the wallet software not to phone home to the state or us (Google)? The EUDIW regulations require that the wallet software be open source. However, states will only issue DOCUMENT to their own certified wallet software---you cannot just take the open source and recompile it, since the state won't issue DOCUMENT to your uncertified wallet. (Maybe your gym will issue a gym membership to your raspberry pi wallet, since it's not a big deal.)
The reason for this strictness is that the EUDIW is intended for official or semi-official uses. For example, you can open a bank account with it, or use it as ID to get a mortgage. The bank must by law accept DOCUMENT, the state guarantees that DOCUMENT is correct, and you get better privacy than handling over a piece of plastic that is then photocopied by who knows whom. This is the tradeoff of the current EU law. It would be inappropriate for this kind of official, passport-like documents to store attributes such as your profession (journalist or whatever), and nobody is talking about it.
Thanks for replying to me. I'm having a tough time understanding how it's zero knowledge, but also tied to a person's identity. At some point I'm going to try to read the manuscript you linked to someone else, but I started skimming it and I'll be lucky if I understand a tiny fraction of it.
> The state does not generate proofs. The phone generates proofs. Given a proof (and only the proof), nobody can associate the proof to the phone or to you.
I get that part. I visit a website and it basically asks me to prove my DOCUMENT has an attestation for age and my phone generates the proof. The part I don't get yet is how it proves the issuer.
> However, states will only issue DOCUMENT to their own certified wallet software---you cannot just take the open source and recompile it, since the state won't issue DOCUMENT to your uncertified wallet.
I don't get why that would matter. I think of it in terms of proving you have a signed DOCUMENT (like a signed executable), but that concept doesn't work for a proof with a subset of data in the DOCUMENT. The wallet can't be trusted either, can it? What would stop me from running a proxy to tamper with the responses?
> Why would you trust the wallet software not to phone home to the state or us (Google)?
To be honest, I don't and I think calling certified wallets "tamper proof" is incorrect. They're tamper proof from the perspective of the users, but the designers, maintainers, policy makers can "tamper" at will.
> For example, you can open a bank account with it, or use it as ID to get a mortgage.
This starts to get into the biggest issue for me. As an average person, all I know is that I have this DOCUMENT with all my vital personal information on it and some of that information can be sent to a 3rd party that asks for it. Because it's such a complex technical system I have no way of understanding what's happening or verifying I'm only sending the information I expect them to be asking for. If it's a permission system like we have on phones, that's broken. People have been conditioned to think they need to click yes on everything or things won't work. I'd worry that suddenly people will be giving away vital information without even knowing.
> you get better privacy than handling over a piece of plastic that is then photocopied by who knows whom
On a technical level, that's right. On the level of an average person understanding what information they're handing over and how it's being used (or potentially misused), that's wrong. I understand perfectly what I'm handing over when I give someone my credit card or drivers license. A digital ID system is basically opaque to me.
We have to put 100% faith in a few companies; Google, Apple, etc.. We need to trust they're acting in good faith and getting the implementation perfect. The saying is trust but verify, but what happens when the system is so complex that not enough people can verify it does what it says, or, more importantly, that policy makers aren't giving classified orders that force the handful of certified wallets to change the way things work?
The technology is very cool. When I see documents like that manuscript you linked I'm envious. I wish I could understand the math well enough to conceptualize the whole system. I think there's a ton of value in leveraging technology to modernize identity. I also have no doubt the people working on the implementation are acting in good faith. Flat out though, I don't trust the institutions. There's always someone willing to act in bad faith for one reason or another.
I think it's important to understand there's a difference between analog verification systems and digital verification systems. If someone is checking my ID or comparing my face to pictures in a book of banned patrons, that has a natural limit on the scalability. Once things are digital, all bets are off. Think of the difference between a manager banning someone from a single store vs facial recognition being used to ban someone from every store in a chain. Digital IDs could very well be the next step up where people can be banned from participating in society.
Also think about the difference between fingerprint unlock for releasing a digital ID vs Face ID. With a fingerprint, you're creating a limit on what people will tolerate in terms of the number of times their ID is queried. With Face ID, people will tolerate a much larger volume. If the biometric ID is cached and allows multiple uses of a digital ID within X minutes, the number goes even higher. With a watch that's unlocked until you take it off your wrist, it's unlimited.
So, if you're working on these systems, consider there's more than just an algorithm and the implementation can leverage what the average person will tolerate to act as a bit of a check on the system. The fingerprint unlocking above is a good example where 1 fingerprint scan = 1 proof. People can understand that. Please don't build a system that allows for continuous identification.
Thanks for trying to explain some of the goals and how the system actually works. It's really hard to separate the politics from the technology, because they can't be separated, but I find it helps to have a better understanding of the technology as it helps when trying to focus on pragmatic concerns.
> Eventually there's going to be enough pretense to expand the system and block "non-compliant" sites. Why not use the same DOCUMENT to prove age to buy beer? Sanity for guns? Loyalty for food?
You're not wrong to be concerned about those impulses, but I think this is getting into "perfect is the enemy of good" territory.
A really authoritarian government isn't going to make an effort to misuse the system that way: They'll tear it down entirely and go back to worse-alternatives which we already use, where they do know all parties involved and exactly when and what was being checked.
I think a parent should be able to give their kid access if they deem their kid mature enough. If the kid can handle social media without it becoming an addiction or a self-esteem issue or similar, then it would generally be a net positive. For example, social media may include YouTube which has a lot of educational content. Why hold the kid back?
the more I think about it, the more I feel like I need someone with deep knowledge to explain ZKPs to me.
So like, we've got this algorithm that gets sent our way and we run it and that provides kind of a cryptographic hash or whatever. But if we're running the algorithm ourselves what's to stop us from lying? Where does the 'proof' come from? What's the check that it's running and why do we inherently trust the source it's checking?
I’m not exactly sure about ZKPs but for age verification the “proof” can come from the government but in such a way that the web service doesn’t know anything more than whether an assertion is true, and the government doesn’t know anything more than you wanted to verify some assertion.
This is a simplified method for age verification:
I want to buy alcohol from my phone and need to prove I’m over 18. SickBooze.com asks me for proof by generating a request to assert “age >= 18”.
My phone signs this request with my own private key, and forwards it to the government server.
The government verifies my signature against a public key I previously submitted to them, checks my age data in their own register of residents, and finally signs the request with one of their private keys.
My phone receives the signed response and forwards it back to SickBooze.com, which can verify the government’s signature offline against a cached list of public keys. Now they can sell me alcohol.
- the “request” itself is anonymous and doesn’t contain any identifying information unless that is what you intended to verify
- the government doesn’t know what service I used, nor why I used it, they only know that I needed to verify an assertion about my age
- the web service I used doesn’t know my identity, they don’t even know my exact age, they just know that an assertion about being >= 18 is true.
> the government [...] only know[s] that I needed to verify an assertion about my age
This is problematic if a majority of things needing age verification are looked down upon; for example, insurance companies would love to know what people don't do things needing age and therefore don't buy alcohol (at least not online).
The first question is how would the insurance find out that you are doing lots of things requiring age verification? The only body that could tell them is the government, while a distrust in the government can be healthy, I think this is the least thing to worry about, the government typically knows already much more damaging things than how often you ask for age verification.
Moreover, that would only work if there are relatively few things that require age verification and it needs more than just being looked down upon, i.e. while alcohol buying might be interesting information for insurances, watching porn is likely less interesting. Even worse, if the insurance can't distinguish between porn and alcohol (which they can't by design even if the government would give them the information about how often you ask for age verification).
I would throw in Privacy Pass [1], just in case the government and SickBooze.com can exchange info.
Sadly, it‘s still hard to explain how exactly it works, but conceptually simpler than arbitrary ZKPs.
[1]: https://privacypass.github.io/
Excellent, clear example.
I am someone with "deep knowledge", but HN is not the proper place for this discussion. See https://people.cs.georgetown.edu/jthaler/ProofsArgsAndZK.htm... for the gory details.
Here is a hopefully simple example of how this ZKP thing may even be possible. Imagine that you give me a Sudoku puzzle. I solve it, and then I want to prove to you that I have solved it without telling you the solution. It sounds impossible, but here is one way to do it. I compute the solution. I randomly scramble the digits 1-9 and I put the scrambled solution in a 9x9 array of lock boxes on a table. I have the keys to the 81 locks but I am not giving you the key yet. You randomly ask me to open either 1) one random row chosen by you; 2) one random column chosen by you; 3) one random 3x3 block chosen by you; or 4) the cells corresponding to the original puzzle you posed to me. In total you have 28 possibilities, and assume that you choose them with equal probability. You tell me what you want and I open the corresponding lockboxes. You verify that the opened lock boxes are consistent with me knowing a solution, e.g. all numbers in a row are distinct, the 3x3 block consists of distinct numbers, etc. If I am cheating, then at least one of your 28 choices will be inconsistent, and you catch me with probability 1/28, so if we repeat this game 1000 times, and I don't know the solution, you will catch me with probability at least 1-(1/28)^1000 which is effectively 1. However, every time we repeat the game, I pick a different random scrambling of the integers 1-9, so you don't learn anything about the solution.
All of ZKP is a fancy way to 1) encode arbitrary computations in this sort of protocol, and 2) amplify the probability of success via clever error-correction tricks.
The other thing you need to know is that the protocol I described requires interaction (I lock the boxes and you tell me which ones to open), but there is a way to remove the interaction. Observe that in the Sudoku game above, all you are doing is flipping random coins and sending them to me. Of course you cannot let me pick the random coins, but if we agree that the random coins are just the SHA256 hash of what I told you, or something else similarly unpredictable, then you will be convinced of the proof even if the "coins" are something that I compute myself by using SHA256. This is called the "Fiat-Shamir transformation".
How do we implement the lock boxes? I tell you SHA256(NONCE, VALUE) where the NONCE is chosen by me. Given the hash you cannot compute VALUE. To open the lock box, I tell you NONCE and VALUE, which you believe under the assumption that I cannot find a collision in SHA256.
> How do we implement the lock boxes? I tell you SHA256(NONCE, VALUE) where the NONCE is chosen by me. Given the hash you cannot compute VALUE. To open the lock box, I tell you NONCE and VALUE, which you believe under the assumption that I cannot find a collision in SHA256.
That's the bit I was missing! The prover pre-registers the scrambled solution, so they can't cheat by making up values that fit the constraints.
Yes. The whole trick is a delicate balance between 1) committing to enough information that uniquely pins down the solution, assuming that one can open all the lock boxes, and 2) not opening too many lock boxes so that the verifier does not learn the solution.
One thing to keep in mind when reading about any "ZKP protocol" is that on its own the term has the same inherent vagueness as "end-to-end encrypted" - especially when like here there are more than two parties concerned to solve a single verification.
What information is not disclosed to whom? In what way is it ZK?
One example is Googles "zero-knowledge age verification" where AFAICT, Google still has full insight into all the sensitive data and metadata. It's not like they inherently need to be the designated middleman but that is how the scheme is designed. Therefore I find it ingeniously marketed. A bit like saying "Facebook Messenger protects all your messages with end-to-end encryption", which is arguably technically true but misleading and not an honest statement.
> same inherent vagueness as "end-to-end encrypted"
Recent HN discussion example: How Kohler Inc. has a toilet feces analysis camera with "end to end encrypted", except they're one of the ends so it is deceptive advertising.
https://news.ycombinator.com/item?id=46129476
If privacy is an explicit goal, why isn't it a MUST? Why even bother with the initial batch issuance phase? And what's stopping them from silently adopting a batch size of 1?
> Why even bother with the initial batch issuance phase?
This is a solution that requires non-trivial interaction between many paries.
It seems very reasonable to want to get the parties started on the implementation so they can iron out issues in the infrastructure they're building while they work on the details of the ZKP aspects.
Okay but then if a ZKP solution is presented, that's calling their bluff. They now have one less excuse for surveillance.
EDIT: Actually do one better - tell them that for 16+ websites, you're actually protecting teenagers by keeping them anonymous.
Yeah, getting into the car with the guy holding the gun doesn't become okay because you have a great argument you're waiting to use down the road. He's already got the gun out.
We should have started arguing when he just said he had a gun, indoors, in the crowd. We shouldn't have quietly walked outside at his demand. But that all happened. Here we are now, at the car, and he's got the gun out, and he's saying "get in", and we're probably not going to win from here -- but pal, it's time to start arguing. Or better yet, fighting back hard.
Because that car isn't going anywhere we want to be. We absolutely can not get in the car right now, and just plan to argue the point later. It doesn't matter how right the argument is at all.
The thing is that as far as I can tell, a ZKP of age involves a state or similar attestor to issue an ID/waller that can be querried for age without revealing identity.
But attestor has to have certainty about the age of the person it issues IDs to. That raises obvious questions.
What states are going to accept private attestors? What states are going accept other states as attestors? What state won't start using its issues ID/Wallet for any purpose it sees fit?
This system seems likely to devolve national Internets only populated by those IDs. That can all happen with ZKPs not being broken.
That is how states work.
The simplest possible such method? Single-use age verification codes, generated and validated by the government, sold on physical scratch cards with in-store verification of ID, piggybacking on the infrastructure we already use for selling alcohol and cigarettes.
This would be far easier to implement for websites too. You'd just have a single, unauthenticated API endpoint which, given a code, tells you if the code is valid (and marks it as used). Integrating with such an API is about 1 day of work for a competent dev. Even open, non-profit platforms like Mastodon could easily implement such a mechanism.
Scratch cards wouldn't have to be the only way of getting such codes. THe vast majority of people could just generate them in their banking app or whatever (which would still be far more privacy friendly than the current ID verification mechanisms).
Sure it's possible, but are there implementations in use that meet this criterion?
Because if there aren't, then it matters substantially less whether they're possible.
You may be confusing the UKOSA (which is about surveillance) with the concept of age verification more generally.
> the argument as it is playing out politically.
The law does not mandate identity, so your argument does not hold.
> Are you aware of any age verification systems that do not have this property?
As I understand it, it's the goal of OpenID4VP[1][2]. Using it a site can request to know if the user is over 18 say, and the user can return proof of just that one claim, I'm over 18, without sharing identifying information.
The new EU age verification solution[3] builds on this for example.
[1]: https://openid.net/specs/openid-4-verifiable-presentations-1...
[2]: https://docs.walt.id/concepts/data-exchange-protocols/openid...
[3]: https://ageverification.dev/
Can't read the specs at the moment, but what prevents the age verification service and the age-gated website from coluding and de-anonymizing your porn use?
With zero-knowledge-proofs the age verification could look like this: you go to whatever age verification service and get a certificate that says you're over the age of 18 (which you only need to do once or at least once per whatever expiry period). You then go to the age-gated website and they ask for proof. You generate (on your own device) a zero-knowledge proof that you have the certificate, but neither the website nor the verification service can determine which certificate it is, and in fact the verification service doesn't even know you've used the certificate.
Haven't either had time to fully wrap my head around the details.
At least in the EU solution they say there would be multiple attestation serivices the user could choose to use. So that would be technically better than nothing.
1) Large social media companies know you better than your friends. That has been known for 10 years and they're way better now: https://www.nytimes.com/2015/01/20/science/facebook-knows-yo...
2) Cigarette vending machines accept VISA cards and government IDs and they're offline.
3) A medium-sized social media network required photos (not scans) of GovIDs, where only year of birth and validity date need to visible. The rest could be blacked out physically.
4) You can guess users' age and only request solid proof only for those you are unsure about.
The problem is that we technical users think of a one-size-fits-all technical approach that works, without a single fail, for all global users. That is bound to fail.
It is only a law and you can break it big time or small time. Reddit's approach might proof way too weak, it'll be fined and given a year to improve. Others might leave the market. Others will be too strict and struggle to get users. Others might have weak enforcement and keep a low profile forever. Others will start small, below the radar and explode in popularity and then enforcement will have to improve.
You can also request identity and then delete it. (Yes, some will fail to delete and get hacked.)
Giving Facebook a free pass is stupid. They're selling your age cohort "10-11" within 0.0037ms for 0.$0003 to the highest bidder on their ad platform.
How about:
https://blog.google/technology/safety-security/opening-up-ze...
I have one: https://news.ycombinator.com/item?id=46223051
GNU Taler has an age-verification extension.
Cool trick to tie in the libertarian idea of protecting yourself from legally sanctioned government actions.
To make this more concrete: There are a lot of "legally sanctioned" government actions happening in the US right now that are pretty dubious. That includes digging up old laws and giving them spicy new interpretations that legal experts agree are an abuse of power and not in the intent of the original law.
Some of these are getting batted down by judges, so right now the category of "legal" is especially vague. That's why I phrased it like that.
But also, we see cops just straight up stalking people using government tools. So that's another reason to be concerned about "legal" government actions.
Nothing to do with libertarianism.
I am someone who is very privacy focused. I've literally never had a social media account on any platform and I'm 42. From day one of facebook, I never wanted my information online. Like many here, I'm deeply concerned about privacy and surveillance.
In real life, we think age verification is a good thing. Kids shouldn't buy porn. Teenagers shouldn't get into bars. etc... There has to be room somewhere for reasonable discussion about making sure children do not have access to things they shouldn't. I think it's important to note, that complete dismissal of this idea only turns away your allies and hurts our cause in the long run.
I think the equivocation of online and real life is a massive mistake. When you go into a grocery store you are constantly on CCTV. Does that mean when you shop on Amazon them recording you via webcam should be considered? Obviously not. The restrictions in real life are temporary. If you try to buy port, go into a bar, etc you are asked for ID and they look at it and hand it back. They don't take your ID, your picture and store it forever and then sell information about you to other people.
The concern about children is aimed at the wrong target. Instead of targeting everyone it would make far more sense to target the platforms. With Roblox having a pedo problem the company should face punishment. That will actually get them to change their ways. However all these massive platforms are major donors to politicians so the chance of that happening is low to none.
> They don't take your ID, your picture and store it forever and then sell information about you to other people.
It would not surprise me in the least if there are brick-and-mortar businesses doing this, especially larger companies in jurisdictions (such as the majority of the United States) with weak/nonexistent privacy protections.
They don't need to. If you bought something with a card they just store that - let the data brokerage handle connecting it with actual ID cards and other elements of your identity.
But yeah, walmart is for sure logging their transactions and selling the data. It's practically free money.
> In real life, we think age verification is a good thing. Kids shouldn't buy porn. Teenagers shouldn't get into bars. etc...
These are not equivalent, I don't have to scan my face, upload my ID and share my personal biometric data with various 3rd parties, who will sell and leak my data, every time I want to look at porn or sip a beer.
Also, there are countries where teenagers can drink and go to pubs, and society hasn't crumbled. We also have several generations of young adults with access to porn, and the sky didn't fall.
Maybe we shouldn't use the government to implement a "papers, please" process just to use and post on the internet, maybe we should instead legislate the root cause of the problem: algorithmic optimization and manipulation. That way everyone benefits, not just kids, and we won't have to scan our faces to look at memes on Reddit.
> These are not equivalent, I don't have to scan my face, upload my ID and share my personal biometric data with various 3rd parties, who will sell and leak my data, every time I want to look at porn or sip a beer
Oh man, you must just not go out much anymore. I’ve seen a lot of bars with full blown facial scanners next to their bouncer.
In the online world you can’t make sure of anything. Florida for instance requires age verification for porn sites. Guess how many mainstream sites not based in the US are completely ignoring the law and guess how many others are easily accessible via a VPN? If you guessed the sum total of both is less than 100%, you would be wrong - and even that is tilted toward sites that just ignored it.
The one thing you can control is your childs access through their device using parental controls.
I can absolutely guarantee you that any teenager can easily get access to weed, cigarettes and alcohol despite the laws and definitely can use a VPN. It only takes one smart kid to show them how.
> I can absolutely guarantee you that any teenager can easily get access to weed, cigarettes and alcohol
Is you argument then that we shouldn't age gate those things in reality either? Would you suggest that teenagers smoke and drink just as much as they would have had it been legal to sell to minors?
Laws don't just exist to stop you, they also exist to shape society. They exist as signals for what we deem appropriate behavior.
So we make meaningless laws that inconsistently enforced? What do you think happens when little Johnny is caught with weed in his car in a 95% White high income school district vs little Jerome in a 95% Black school district?
Also how much “shaping of society” do you expect to happen when you pass a law that no one respects?
How many kids do you think a law is going to stop from going to the porn sites that completely ignored the law?
How many kids say “I really want to smoke weed but it’s illegally so I won’t do it”?
Laws that nobody respects lead to lack of respect for the law as a whole.
> How many kids say “I really want to smoke weed but it’s illegally so I won’t do it”?
I think it's generally accepted that marijuana use increases after legalization. So yes.
You would think so, but DARE increased adolescent usage of some drugs while having little to no effect on others.
Turns out being illegal isn't as much of a disincentive as being uncool. If your parents are smoking it...
Nancy Reagan: Don’t sniff glue to get high.
Kids: You can sniff glue and get high!!!
We have newer and more relevant data than DARE.
Not according to the CDC with kids
https://www.mpp.org/issues/legalization/adult-use-legalizati...
My guy, this is making the opposite argument from what you think:
"On the illegal market, no one is checking IDs before selling marijuana. When and where cannabis is illegal, high schoolers often sell cannabis to their peers. In contrast, licensed cannabis stores have overwhelming compliance with age-gating."
It has indeed not increased the cannabis use of kids, but that would also still be illegal. That study is an argument that age gating works.
You would be surprised to know that illegal weed sells still happen where it’s legal because it’s cheaper.
But even if that wasn’t the case, underage cigarette smoking has been rampant forever
In real life the situation is different. When I buy alcohol, someone looks at my drivers licence, does not make a copy of it, forgets it quickly, and cannot tie it to other information about me. As soon as it's online and it's copies, I can't tell what happens on anyone else's servers. I don't want any company knowing my actual name and location, then that can be tied to more data, which is what Google etc have been trying to do for years but this would just completely fast track that. I would in theory be fine with something where it never leaves my computer, but that is obviously impossible.
Not sure if you've bought alcohol lately, but at most large grocers near me, they're scanning licenses now instead of just verifying the birth date - and I'm pretty confident those scans aren't just checking the birthdate and then deleting all record of the interaction..
Not sure where you are but no one has ever done that to me. I usually would go through self checkouts so someone just comes over, takes a quick look at my drivers licence, and puts in their employee id into the machine to authorise it.
I'm in the midwest, but at several large chains with hundreds of locations, even at the self-checkout when you buy booze, it flashes the little 'attendant needed' sign, the person comes over, scans their badge, takes your ID to do a 1 second look, and then scans it on the same barcode reader you use for your box of cereal.
Pro tip: those scanners probably don't work with passports, so a human must still eyeball your passport to verify that you're old enough.
They can probably just deny you service at that point.
They can deny you service at any time, but it's unlikely they will do so if you present a valid ID, even if it's not machine-readable. Not every driver license can be easily scanned, so in that respect it's no different from a passport.
So then this is an easy problem. Issue liquor stores a terminal. Liquor guy checks licenses. If you're an adult, the clerk presses a button. A public key is generated and uploaded to a public list. You get a private key that shows you're an adult and is not tied to you. Regular laws that apply to liquor also apply to this private key QR code... You cannot give it to a minor or sell it without a license.
To view adult content, use the code to sign a thing. Content company sees the signed code, verifies against the public list and sends the content.
Privacy preserved, no adult content to kids... Easy.
A lot of the proposals don't involve you sending your drivers license or "other information" to anyone. The site in question asks you to verify with a trusted third party (usually a government entity), and that trusted third party only provides then with the end result of the validation.
> which is what Google etc have been trying to do for years but this would just completely fast track that.
Excuse me? They have done that for years. There's nothing to "fast track" here. Big Tech already implemented surveillance.
How many of those proposals do not have a government-mandated app as a spider in the middle of the web, which is aware of all the apps and websites you try to visit which ask for validation?
I'm not dismissing that idea. It is a perfectly reasonable thing to think about, part of why we have age verification techniques that already work well in critical places like online vape shops.
I'm even willing to talk about the possibility that we could use more robust systems deployed more broadly. A lot of folks here are talking about ZKPs in this regard, and that's not a bad idea at all.
The issue I'm trying to sound the horn on is that the current push for AF in the US and EU has nothing to do with kids. I think you could put together a working group on ZKPs and Age Verification, write up a paper and run experiments, and when you bring it to the lawmakers they're gonna say something to the tune of:
"yeah but that's not trustworthy enough and too technical for people to understand so we're just going to serve legal notices to VPN providers instead to tell them that they can't anymore"
...or something to that tune. I'm not a mind reader, I've just read the reports (by lawmakers) mentioning VPNs as an "area of concern".
This is a political gambit and not a new one. The more we treat the current issue as having anything to do with protecting kids the more we legitimize what is an obvious grift.
> The issue I'm trying to sound the horn on is that the current push for AF in the US and EU has nothing to do with kids. I think you could put together a working group on ZKPs and Age Verification, write up a paper and run experiments, and when you bring it to the lawmakers they're gonna say something to the tune of:
The EU is currently doing large-scale field tries of the EU Digital Identity Wallet, which they have been working on for several years. It uses ZKPs for age verification. They expect to roll it out to the public near the end of 2026.
I appreciate the mention - i had not yet heard of this EU DIW thing. That said, I can't find any resources on it that mention the use of ZKPs. Could you share a link?
https://ageverification.dev/av-doc-technical-specification/d...
[flagged]
Ya got me. Nevermind that the DSA (which I have read, in part) and the DIW (new to me) are different things, and that one does not mention the other [0]. Also the DSA is happening now while the Wallet thing isn't rolled out.
There are actual discussions about VPN regulation in relation to AV in the US [1]. The UK's OSA [2] is blatant about the need to violate encryption. Australia's OSA [3] has also come under criticism for precisely the things I'm talking about. Is it a stretch to extend this reasoning to the EU's incredibly similar legislation? Honk my nose if you must but I don't think so.
Here's the thing - I don't want you to listen to me, or anyone else on the internet, as an 'expert'. Verify your information personally, even when you trust it.
0 - https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:32...
1 -https://www.eff.org/deeplinks/2025/11/lawmakers-want-ban-vpn...
2 - https://www.legislation.gov.uk/ukpga/2023/50/contents
3 - https://en.wikipedia.org/wiki/Online_Safety_Amendment
FWIW, not that it matters, the proper acronyms are EUDI (EU Digital Itentity) and EUDIW (EUDI Wallet). DIW is not used.
How does age verification work for online vape shops?
> In real life, we think age verification is a good thing.
Ok. In real life, do we think having agents from the government and corporations following you everywhere, writing down your every move and word, is a good thing? Or rather, what kind of crime would one have to have committed, so that they would only be allowed out in public with surveillance agents trailing them everywhere?
I don't, but society clearly does. We're already there.
All chutzpah is built upon brazen assertion of desired outcome as already achieved.
Hate to break it to you, you're on social media right now.
If HN is social media, then so are PHPBB, NNTP, BBS, etc. and the term loses its semantic relevance.
My heuristic is that social media focuses on particular people, regardless of what they're talking about. In contrast, forums (like HN) focus on a particular topic, regardless of who's talking about it.
Doesn't matter what you want it to mean. What matters is what those in power want it to mean. It's very easy to stretch the definition to cover all sites where people can post content for strangers to see, or stretch it even wider to all digital media where people can interact with a social group.
> Doesn't matter what you want it to mean. What matters is what those in power want it to mean.
I was replying to a discussion between two HN users, who were using conflicting definitions of the term. AFAIK they are not "those in power".
> AFAIK they are not "those in power".
AFAIK nobody here is. The point is that with relevance to the current discussion on potential future age-verification laws, only the widest definition matters, because that's what's at risk.
> Age Verification isn't about Kids or Censorship, It's about Surveillance
We know this because, instead of putting easy-to-use parental controls on new devices sold (and making it easy to install on old ones) with good defaults [1], they didn't even try that, and went directly for the most privacy-hostile solution.
[1] So lazy parents with whatever censorship the government thinks is appropriate for kids, while involved parents can alter the filtering, or remove the software entirely.
Parental control software has existed for decades. It hasn't worked.
Over 70% of teenagers <18 today have watched porn [1]. We all know (many from experience) that kids easily get around whatever restrictions adults put on their computers. We all know the memes about "click here if you're 18" being far less effective than "click here if you're not a robot."
Yes, there were other ways of trying to solve the problem. Governments could've mandated explicit websites (which includes a lot of mainstream social media these days) include the RTA rating tag instead of it being a voluntary thing, which social media companies still would've fought; and governments could've also mandated all devices come with parental control software to actually enforce that tag, which still would've been decried as overreach and possibly would've been easily circumventable for anyone who knows what they're doing (including kids).
But at the end of the day, there was a legitimate problem, and governments are trying to solve the problem, ulterior motives aside. It's not legal for people to have sex on the street in broad daylight (and even that would arguably be healthier for society than growing up on staged porn is). This argument is much more about whether it's healthy for generations to be raised on porn than many detractors want to admit.
[1] https://www.psychologytoday.com/us/blog/raising-kind-kids/20...
> Over 70% of teenagers <18 today have watched porn [1]. We all know (many from experience) that kids easily get around whatever restrictions adults put on their computers. We all know the memes about "click here if you're 18" being far less effective than "click here if you're not a robot."
And we all turned out fine I might add. In fact there's a lot more attention to consent and respect for women than 20 years ago.
Of course not counting the toxic masculine far right but that doesn't have anything to do with porn but everything with hate.
> And we all turned out fine I might add.
Absolutely not. You might personally feel like (or want to tell yourself that) porn didn't negatively affect you. I can tell you with certainty that porn negatively affected my social and sexual development. (I was literally afraid to physically open my mouth around girls when I was 10 years old because of porn.)
> Of course not counting the toxic masculine far right but that doesn't have anything to do with porn but everything with hate.
There are plenty of pipelines between porn and "toxic masculinity."
Is porn the biggest problem here? What I've seen points the finger at social media as the worst offender for youth mental health.
Also, access to porn isn't new with the internet. When we cleared out my grandpa's house we had to pry open a desk that was chock full of hustlers.
> access to porn isn't new with the internet
“Ease of access” and “easy access to the most depraved shit you can think of that’s out there” is what changed. That is what is wrong and why many people feel we need to find some way to control that access.
The Internet didn’t come along until I was well into adulthood. Think about what porn access looked like in the late ‘70s and ‘80s. As a teen we were “lucky” if by some rare miracle a friend stole their dad’s Playboy, Penthouse, or Hustler and stashed it in the woods (couldn’t risk your parents finding it under your mattress) for us dudes to learn the finer points of female anatomy. In a week it would be washed out from the elements with nary a nipple to be seen. Those magazines (even hustler) was soft compared to what a few clicks can find today. Basically you got degrees of nudity back then, but we appreciated it.
Hardcore video was very rare to see as a horny teen kid in the ‘80s. Most porn movies was still pretty well confined to theaters, but advent of VHS meant (again by sheer luck) you had to have a friend whose parents happened to be in to it, who had rented or bought a video, it was in the house and accessible, all the adults had to be gone from the house so you could hurry up and watch a few minutes on the family’s one TV with a VCR. You needed to build in viewing time along with rewind time to hide your tracks.
Now…parents just leave the room for a few minutes and a willing kid with a couple of clicks could be watching something far beyond the most hardcore thing I saw as a teen.
I doubt that the porn in the 70s was less bad than the porn today. Legal CSAM was being sold openly so what makes you think that it was more tame than modern stuff?
The fact is that as difficult as it was to get, you got a hold of it and watched it. Why would 'ease of access' make any difference if you didn't have easy access and got it anyway?
Are you implying that perhaps 15-25 mins worth of porn video total throughout all of someone’s teenage years due to such rare access of the material would have a similar emotional and mental impact as having the ability to see that much daily for years as is possible now?
There could have been years between the opportunities we had. I don’t think you conceptualize just how infrequent the opportunity would present itself.
I'm not making any claims about mental or emotional impacts, you are. What are they?
For instance [1]. I am speaking out of experience, as a GenZ person who has been first introduced to the entire world of sex and porn at EIGHT years old. I myself feel it has harmed my brain in ways which I'll likely never fully understand.
[1] https://eprints.qut.edu.au/217360/1/__qut.edu.au_Documents_S...
A couple of comments above, you said: “Why would 'ease of access' make any difference if you didn't have easy access and got it anyway”
So exactly what is the target of the “difference” you are referring to then here? You are referencing a differential in something…if not psychological impact from the viewing of said material…what would that something be?
Person 1: "People are exposed to many more chemicals now than in the 70s, and they smell worse"
Person 2: "I don't think that they actually smell worse, and people were still exposed to chemicals in the 70s, so why would it make a difference?"
Person 1: "Are you saying that the health effects of chemical exposure are lessened because they are exposed to some chemicals as opposed to a lot of chemicals?"
Person 1 is using a claim that is not proven by their statements to make Person 2 responsible for a claim they never conceded was true.
Person 2 is disputing that Person 1's mechanisms make a difference not that their conclusion is valid.
Person 1: I once or twice got a small drop of a dangerous chemical on my skin in 1982
Person 2: I bathe in that same chemical for 30 minutes every single day. It’s no different than 1982. The risk of harm is the same.
In this case Person 2 has no duty to prove that bathing in it is fine or that getting exposed to a small drop is dangerous.
If Person 1 is claiming that there are harmful effects, they are required to prove that they exist and explain why bathing in it causes those effects while being exposed to it otherwise does not.
Person 2 has no duty to prove anything (or to enter the conversation at all), but Person 2 isn't going to convince anyone of their viewpoint by choosing not to attempt to prove their point. By choosing to say "not my problem," Person 2 is accepting liability for not attempting to change their opponent's minds if/when they get out-voted on the issue in the real world, as is currently happening.
Ok then, enjoy your bath. Hopefully it’s fine.
But it's been illegal to peddle porn to minors for much longer than it's been illegal to peddle social media, so it's a good proxy for how effective our current efforts are.
The approximate substitute-good for porn is actual sex, which parents generally stop teens from doing. The substitute-good for social media is talking to people in person, which parents are generally happy with.
> Parental control software has existed for decades. It hasn't worked.
How would you know whether it has worked or not? Wouldn't the relevant criteria be up to parents themselves?
It's also already illegal to send porn to a minor. Porn companies that transmit porn to minors are already committing a sex crime.
It might as well not be illegal if there's no way to prosecute it, and the pre-age-verification status quo was that there was no way to prosecute it.
> has existed
Sorry, but if you would actually read my post, you would notice that I am not proposing that it should merely "exist", but that it should come enabled by default on all new devices.
My point is that being enabled by default on all new devices 1) would also be fought by people very similar to you (if not you specifically), and 2) would not be effective if the enabled-by-default software is not effective, which would also require additional work that you and people like you would fight.
I do agree it could be done. I disagree with your characterization that it would be easy/easier, or that the current age verification efforts are entirely nefarious and not actually trying to work the problem.
Dude, parents don't want their kids wading through porn and whatever social media throws at them before they are even teenagers.
Childless digital nomad privacy freaks are a minority, age gates are coming. I don't care that they will never be 100%, if it provides cover for parents to stop their kids consuming trash internet "culture" until they are more mature they are already a great benefit to socitey.
If it's really that difficult for parents to engage their children and parent them, maybe that says more about a society that doesn't prepare parents for parenthood than it does about those who don't have children.
There is no "good parenting" fix that will keep children from trying to access inappropriate content, forums where unhealthy conversation takes place, pornography, and worse. Being a good parent does not and cannot remove the curiosity, temptation, and ability to access bad content. This is a problem with the human condition, not bad parenting.
As a parent myself (and, I hope, a good one), I have found it very difficult to effectively monitor and limit my children's ability to access these things. And I have more facility with technology than the average parent. It's a complex and frustrating problem and the stakes are high.
How do you know this?
I see this argument repeated over and over on HN, with 0 evidence for it. Any "evidence" people cite is usually of the "politicians are evil, so this should be obvious by definition" kind, sometimes of the "they tried x in the past, so surely some unrelated y they're trying to pass in the future is also about x" kind.
I haven't seen a single leak, a single admission from somebody trying to pass a law like this, that surveillance is actually the goal here. There are far too many politicians trying to pass laws like these, in very different countries across the world, for some kind of giant global conspiracy to stay undetected.
Plain ignorance seems far easier to believe.
> There are far too many politicians trying to pass laws like these, in very different countries across the world, for some kind of giant global conspiracy to stay undetected.
This is today's top agrument! "There are far too many gangsters each operating in their own district for some kind of notion of organized crime to be credible".
You don't need conspiracy, you need the incentives.
The state always thinks of self-preservation. Any bureaucrat is aligned to this goal by getting the benefits from the state. So, the more power it has over its citizens, which is the first threat it, the more safe it is and the less opinions of citizens matter.
Understanding this, every citizen must think carefully about giving away more power to the state.
[dead]
[dead]
Just because it's about surveillance doesn't mean it's a bad thing?
The fact that you need a driver's licence to drive a car, or a document to identify yourself to open a bank account is also surveillance. Yet it seems perfectly reasonable?
Age verification is absolutely about kids. It’s also being used (or hijacked into) a vehicle for people who want increased surveillance.
There is a ton of evidence that there are harms to unrestricted online access for kids and teens (the book The Anxious Generation is cultural touchstone for this topic at this point). There is a real, well reasoned, and valid movement to do something about this problem.
The solutions proposed aren’t always well targeted and are often hijacked by the pro-surveillance movement, but it’s important to call out that these solutions aren’t well targeted instead of declaring the age verification push isn’t addressing a real problem and constituency.
As many others have mentioned in this thread and others, there are ways - effective and straightforward ways - that we could be protecting our kids from the harms that come with the www.
The harms are real. The solution is a Surveillance Wolf wearing a dead Save The Kids Sheep(tm).
Solutions that might work - RTA headers [0]. More robust parental controls. Not this reimagining of the rules of the internet in service of a fairly vague and ineffective goal. It's like the whole AV concept was designed not to work in the current context at all - almost as if that was the point.
Perhaps I'm going a little out on a limb. I don't think I am - but quick, tell me you need to know where I'm dialing from without asking me where I'm dialing in from.
0 - https://www.rtalabel.org/index.php
Yes all those things are great, but you'll notice that instead of explaining this to the non-technical crowd, technology focused privacy concerned individuals rarely attempt to educate about how these could work. Instead they simply seem to be against any sort of control on what children watch online.
Given that it's also coming from a bunch of tech males, it comes across as extraordinarily creepy. This is not hard to understand.
If I believed that the efforts in question were in earnest, I would absolutely be talking through the finer points of how to do it right. I don't believe that, though. The veneer of legitimacy here is paper thin - we start with a very weatherbeaten conservative war drum (think of the children!) and immediately jump into "let's ruin privacy for everyone and I totally promise this isn't another Cambridge Analytica".
The thing is that when it starts being about the kids it means the bottom 90% has entered the internet and you should be away because it is already lost.
I wonder if there's something like internet accelerationism - push things like having friends or watching movies online off the cliff as soon as possible.
Unfortunately The Anxious Generation is a very well-written house of cards built on questionable studies [1] and its success is simply a reflection of the fact it capitalizes on the trendiest moral panic of our times.
Social media is akin to violent video games in the 2000s, tv addiction in the 90s, santanic heavy metal in 80s, and even 'bicycle face' in the 1890s bicycle craze.
Jonathan Haidt seems extremely earnest and thoughtful, but unfortunately being lovingly catapulted to fame for being the guy who affirms everyones gut reaction to change (moral panic)...makes it extremely difficult financially, emotionally and socially for him to steelman the opposite side of that thing.
Even if he hadn't compiled a bunch of suspect research from pre-2010 to make his claims, the field of Psychology is at the center of the replication crisis and is objectively its worst offender. Pyschology studies published in prestigious academic journals have been found to replicate only 36% of the time. [2]
1. https://reason.com/video/2024/04/02/the-bad-science-behind-j...
2. https://en.wikipedia.org/wiki/Reproducibility_Project
People are ignoring reality and thinking that kids and teenagers won't be smart enough to type "XXX" into piratebay and download a torrent client.
Yet another comment following the template described in https://news.ycombinator.com/item?id=46242184
I'd be OK with an "I am a child" header mandated by law to be respected by service providers (eg. "adult sites" must not permit a client setting the header to proceed). On the client side, mandate that consumer devices that might reasonably be expected to be used by children (every smartphone, tablet, smart TV, etc) have parental controls that set the header. Leave it to parents to set the controls. Perhaps even hold parents culpable for not doing so, as a minimum supervision requirement, just as one may hold parents culpable for neglecting their children in other ways.
Forcing providers to divine the age of the user, or requiring an adult's identity to verify that they are not a child, is backwards, for all the reasons pointed out. But that's not the only way to "protect the children". Relying on a very minimal level of parental supervision of device use should be fine; we already expect far more than that in non-technology areas.
A server header exists to say something is adult and could be used for user-generated content as well. [1] It just needs legislation and an afternoon from interns at assorted companies. It's not perfect, nothing is but could easily trigger existing parental controls and parental controls that could be added back into user agents. No third parties required. I think I've beat this horse into dust [2] so I should just hire kvetchers to politely remind congress at this point.
[1] - https://news.ycombinator.com/item?id=46152074
[2] - https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
I like the first part of the idea, which is the header. Heck, even enable it by default. As long as the tracking of the toggle isn't a thing its a perfect compromise. While we're at it, respecting do not track headers would also be nice.
This completely leaves it up to the families / parents to control and gives some level of compliance to make the effort worth while.
There may even be a way to generate enough noise with the request to prevent any forms of tracking. This sort of thing should really be isolated in that way to prevent potential abuses via data brokers by way of sale of the information
As long as the tracking of the toggle isn't a thing its a perfect compromise.
This concept does not involve any tracking if implemented as designed. The user agent detects the RTA header and triggers parental controls if enabled. Many sites already voluntarily self label. [1] Careful how far one drills down as these sites are NSFW and some may be malicious.
[1] - https://www.shodan.io/search?query=RTA-5042-1996-1400-1577-R...
They tried this years ago with ICRA and others. Long gone, but it worked by the webmaster adding metadata to self classify a site. Browsers and other agents could then allow/deny after inspecting the tags.
https://sk.sagepub.com/ency/edvol/childmedia/chpt/internet-c...
I remember labeling all my sites with PICS ICRA using the header generator. For my SFW sites it was mostly straight forward. For my adult forum it was a pain in the ass. My forum members managed to come up with so many categories that the header at some point should have just said "ALL THE THINGS AND THINGS YOU DID NOT KNOW EXIST" hahaha... I can see why adoption was low. There were a couple of browsers that recognized ICRA PICS for a little while but there were no laws to make it stick.
That's why I am pleased with RTA. Just add one header, done. Most admins and developers could do that in their sleep.
If we must do something like this, I think a good solution would be an optional server header that describes the types of objectionable content that may be present (including “none”). Browsers on child devices from mainstream vendors would refuse to display any “unrated” resources without the header, and would block any resources that parents deem age-inappropriate, with strict but fair default settings that can be overridden. Adult browsers would be unaffected. Legislatures could attempt to craft laws against intentionally miscategorized sites, as doing this would be intentionally targeting kids with adult content.
There is no perfect solution that avoids destroying the internet, but this would be a pretty good solution that shelters kids from accidentally entering adult areas, and it doesn’t harm adult internet users. It also avoids sending out information about the user’s age since filtering happens on the client device.
This exists: https://en.wikipedia.org/wiki/Platform_for_Internet_Content_...
It was derided as a "system for mass censorship", and got shot down. In hindsight a mistake, and it should have been implemented - it was completely voluntary by the user.
It’s close, but I see why it failed. There’s no need to include licensing/rights management in there. Also this was before pervasive HTTPS, so it would have been possible for governments and ISPs to snoop the info and possibly block it. If it could be limited to just content ratings, and kept private behind SSL, this isn’t a bad approach.
But this also needs some kind of guarantee that lawmakers won’t try to force it on FOSS projects that want to operate outside the system. And that companies like Google won’t use EEE to gradually expand this header into other areas and eventually cut off consenting adults who want to operate outside this system. I’m not sure if it is possible to get those guarantees.
> Perhaps even hold parents culpable for not doing so, as a minimum supervision requirement
Even the idea of prosecuting parents for allowing their child to access 'information,' no matter what that information is, just sounds like asking for 1984-style insanity.
A good rule of thumb when creating laws: imagine someone with opposite political views from yours applying said law at their discretion (because it will happen at some point!).
Another good question to ask yourself: is this really a severe enough problem that government needs to apply authoritarian control via its monopoly on violence to try to solve? Or is it just something I'm abstractly worried about because some pseudo-intellectuals are doing media tours to try to sell books by inciting moral panic?
As with every generation who is constantly worried about what "kids these days" are up to, it's highly highly likely the kids will be fine.
The worrying is a good instinct, but when it becomes an irrational media hysteria (the phase we're in for the millennial generation who've had kids and are becoming their parents), it creates perverse incentives and leads to dumb outcomes.
The truth is the young are more adaptable than the old. It's the adults we need to worry about.
> Even the idea of prosecuting parents for allowing their child to access 'information,' no matter what that information is, just sounds like asking for 1984-style insanity.
This assumes an absolutist approach to enforcement, which I did not advocate and is not a fundamental part of my proposed solution. In any case, the law already has to make a subjective decision in non-technology areas. It would be no different here. Courts would be able to consider the surrounding context, and over time set precedents for what does and does not cross the bar in a way that society considers acceptable.
But what if we didn't collectively spend $billions of dollars and hundreds of thousands of hours battling with money, lobbyists, lawyers, judges and political campaigns over what is largely a moral panic?
What could humanity do instead with all that time and resources?
I know the US is a nation built by lawyers, for lawyers, but this is both its best strength and worst weakness. Sometimes it's in everyones best interest to accept the additional risks individually as opposed to bubble wrapping everything in legislation and expanding the scope of the corrupt lawyer-industrial complex.
Maybe the lawyers could use the extra time fixing something actually important like healthcare or education instead.
And surprisingly when the law makes such decisions, it seems to affect little Jerome more than little Johnny.
You have way too much faith in the fairness of the court system.
It would be possible to make a website which proxies other sites, but strips this header, right (maybe with some added ads)?
If so I would expect such sites to appear, and the only way to secure a child device is to have a whitelist of webpages (to avoid the proxies), putting us back close to where we are today.
Such sites would be illegal if not sharing the header back from the source website and be banned as much as adult websites incorrectly setting this header. It’s not a real problem.
Making them illegal does not fix it. There will be a indefinite whack-a-mole game which is very hard to solve without draconian control over the Internet.
The problem is that it's easy to make, easy to deploy, easy to make money on, and a single site opens up the whole Internet. It will happen even if it's illegal.
Compare this to adult webpages setting the header. They will probably be quite willing to do so, since they want to make their money legally, and there is probably little money in serving to kids anyway. And even if a single out of thousand adult webpages refuses, it still only opens that single site.
It's actually hard to understand on "which" side you're on, but a charitable interpretation is that you're arguing that there are no perfect solutions, hence a simple and minimal non-invasive method will probably have the same effect as a complex and invasive method. That is, both methods will add enough friction that children who don't know what they're missing won't bother and the ones who can't do without, will choose every conceivable method to get around the restrictions.
Worrying about the latter makes no sense, because they are sort of like organized crime. People still take drugs even though they are illegal.
I'm not sure that making parents legally culpable for their kids being smart enough to download a new browser is LESS government intrusion.
I think the idea is that the manufacturers are culpable for making a parental restriction mode that's set-and-forget and not easily thwarted from inside the mode and parents are culpable for declining to set it.
Which I still don't love, but is at least more fair.
It could be added at the router? The child's computer could be identified and this header added, in a MITM situation... but, maybe that would be easy to defeat, by replacing the cert on the client? Not my area of expertise... really just asking...
There's no reason to hold the parents culpable. It would be up to the device manufacturer to ensure that this isn't possible on a system that has parental controls enabled. This is already a solved problem - see how MDM solutions do it, and see Apple's ban on alternative browsers.
It's not even necessary to block parents from giving their children Linux desktops or whatever. It'll largely solve the problem if parents are merely expected to enable parental controls on devices that have the capability.
I am a Russian proxy site, I make requests for you without the header. I serve you the content because I don't care about following American laws.
Alternatively, just use an older browser that doesn't serve the header.
If anything, you'd want the reverse. A header that serves as a disclaimer saying "I'm an adult, you can serve me anything" and then the host would only serve if the browser sends that header. And you'd have to turn it on through the settings/parental controls.
Now, this doesn't handle the proxy situation. You could still have a proxy site that served the request with the header for you, but there's not much you can do about that regardless.
> I am a Russian proxy site, I make requests for you without the header. I serve you the content because I don't care about following American laws.
That's no different to a law mandating identification-based age verification though. A site in a different jurisdiction can ignore that just the same.
Right. This isn't something we can completely solve with legislation or technology.
My only gripe here is the idea of "perhaps hold the parents culpable." I'm not opposed to the idea, but what sucks is we are ultimately all paying the cost of it going wrong. The idea that we can shunt that away to a few irresponsible people is just demonstrably not the case.
Worse, it leads to situations where society seems to want to flat out be kid free in many ways. With families reportedly afraid to let their kids walk to and from school unsupervised.
I don't know an answer, mind. So this is where I have a gripe with no real answer. :(
The presumption that it's not a matter of the parents' prerogative whether to decide whether the child's access should be restricted or not -- and treating the parents as accountable to someone else's standards of what is or is not appropriate for their own children -- is itself objectionable.
What content is appropriate for children is properly up to their parents themselves, not to the government or to some nebulous concept of "society". If parent's choose not to set such a flag on their children's devices, then that means that they're choosing to allow their children to access content without restriction, and that's what defines what is OK for their children to access.
The role of parent has been being diminished by society every year that goes by. I frequently remind my local school system of their role in my children's lives are and what my role in their lives are. They seem to need very frequent reminders.
Thank you for your well written take.
Add to that, clearly those "bad parents" are the result of bad parenting in the first place, so really it's the grand parents that are to blame...
Wait, those grand parents also had bad models to work with, so really it's the great grandparents that were to blame...
No, wait, it was the society that they grew up in that encouraged poor behaviour toward them, and forced them to react by taking on toxic behaviours. We all should pay because we all actively contribute to the world around us, and that includes being silent when we see bad things happening.
>Worse, it leads to situations where society seems to want to flat out be kid free in many ways. With families reportedly afraid to let their kids walk to and from school unsupervised.
I'm not seeing the correlation / causation here.
Not sure, but I think the earlier post is implying a (false) dichotomy between:
A. "Your kid is not my problem"
B. "Your kid is everyone's problem"
Less the false dichotomy, and more the stickiness of each of those options. To your point (I think), those aren't the only options available, but people do seem to be attracted quite heavily to them.
I was referencing the towns that have called the cops because there were some unsupervised kids in a park. I comfort myself by saying this isn't nearly as common as the fear mongers online would have you think. That there are cases it happens still worries me.
Note that I'm not even necessarily worried about cops getting called. Quite the contrary, I am fine with the idea of cops having a more constant presence around parks and such. I do worry about people that get up in arms about how things are too unsafe for kids to be let outside. If that is the case, what can we do to make it safe?
Okay, so the HTTP header idea seems like it would have two issues:
1) Given that it just says you're a "child", how does that work across jurisdictions where the adult age may not be 18?
2) It seems like it could be abused by fingerprinters, ad services, and even hostile websites that want to show inappropriate content to children.
> 1) Given that it just says you're a "child", how does that work across jurisdictions where the adult age may not be 18?
It's a client-side flag saying "treat this request as coming from a child (whatever that means to you)". I don't follow what the jurisdiction concern is.
[EDIT] Oooooh you mean if a child is legally 18 where the server is, but 16 where the client is. But the header could be un-set for a 5-year-old, too, so I don't think that much matters. The idea would be to empower parents to set a policy that flags requests from their kids as coming from a child. If they fail to do that, I suppose that'd be on them.
The concern is that websites have no way to tell the actual age in this scenario so you'd be potentially inconveniencing and/or blocking legitimate users (according to the server jurisdiction's rules)
It doesn't seem sufficient, and would probably lead to age verification laws anyway.
No, it doesn't seem like that be a problem.
Say you're a parent, with child, living in country A where someone becomes an adult when they're 18. Once the child is 18, they'll use their own devices/browsers/whatever, and the flag is no longer set. But before that, the flag is set.
Now in country B or in country C it doesn't matter that the age of becoming an adult is 15 and 30. Because the flag is set locally on the clients device, all they need to do is block requests with the flag, and assume it's faithful. Then other parents in country B or country C set/unset the flag on their devices when it's appropriate.
No need to tell actual ages, and a way for services to say "this is not for children", and parents are still responsible for their own children. Sounds actually pretty OK to me.
Except that if you're in country B, which has a law that says "you may not make information available to children that discloses that Santa Claus is made up," and the age of becoming an adult in your country is 18 -- knowing that a person accessing your site from country A is an adult in country A (which means, say, ≥ 16) is not sufficient to comply with the law.
I’m not sure why the age of majority in the region of the server would be relevant. The user is not traveling to that region, the laws protecting them should be the laws in their own region.
> why
> should
I don't know if "should" is intended as a moral statement or a regulatory statement, but it's not at all unusual for server operators to need to comply with laws in the country in which they are operating…
> 1) Given that it just says you're a "child", how does that work across jurisdictions where the adult age may not be 18?
So namespace it then. "I'm a child as defined by the $country_code government". It's no more of a challenge than what identity-based age verification already needs to do.
> 2) It seems like it could be abused by fingerprinters, ad services, and even hostile websites that want to show inappropriate content to children.
This is still strictly better than identify-based age verification. Hostile or illegal sites can already do this anyway. Adding a single boolean flag which a large proportion of users are expected to have set isn't adding any significant fingerprinting information.
Any time law-makers claim that a law is meant to protect children you can guarantee that the safety of children had almost nothing to do with it. This is all a push to normalize digital ID (to protect the children!); once normalized it will become mandatory.
I always ask myself who wins with these laws (well, any law really). so far, the only winner seems to be the government and data collectors. It seems these laws are intended to collect leverage in the long run.
The internet, with verifiable identities, is the greatest system to collect kompromat that one could ask for.
Parents? Children? Schools?
I'd argue that this is negligible for data collectors and governments. Governments already know who you are and what sites you vist for 99.99% of the population. Data collectors already know who you are and have a pretty good idea of the sites you vist.
What unique information is this going to give the government and data collectors to abuse? Lets establish one case that both affects average people and is "bad" and not waste time discussing things that only affect a tiny minority of privacy minded people.
Keep in mind the law states a platform must provide multiple ways to reasonably verify a user is older than 16. No mention of giving the specific user age or requiring govt id
Well, you just answered brilliantly to your own question. You nailed it.
Leaving room for someone to give me convincing evidence to the contrary. I didn't expect any, though.
It also lets someone who knows more than I to elaborate with more depth.
Agreed, I just wanted to say I agree with your sentiment.
When they made smoke alarms mandatory in schools, it was only for selling smoke alarms! /s
[flagged]
That’s not the argument you think it is
https://www.consumermedsafety.org/safety-articles/how-childr...
You're conflating protecting children with "protect the children!".
Required reading: https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...
I feel like the EFF has stretched a bit far on this one. They need to be advocating for good solutions, not portraying age verification as fundamentally about surveillance and censorship.
As many are pointing out zero knowledge proofs exist and resolve most of the issues they are referring to. And it doesn't have to be complex. A government (or bank, or anybody that has an actual reason to know your identity) provided service that mints a verifiable one time code the user can plug into a web site is very simple and probably sufficient. Pretty standard PKI can do it.
The real battle to be lost here is that uploading actual identity to random web sites becomes normalised. Or worse, governments have to know what web sites you are going to. That's what needs to be fought against.
> They need to be advocating for good solutions, not
No, fighting back against horrible proposals does not require suggesting an alternative proposal to the alleged problem. That only serves to benefit the malicious actors proposing the bad thing in the first place, the hope that we'll settle on something Not As Bad.
Thank god for the EFF and their everlasting fight to stop these nonsense internet laws. I'm glad they don't waste their time on "well how about this" solutions. The middle ground will never be enough for the proponents of surveillance, and will always be an incremental loss for the victims.
There are overwhelming dichotomous portrayals in this debate which gives me pause because there are entities who benefit from both sides of this debate, but neither would benefit with a sensible privacy-preserving solution.
So instead of advocating for those sensible and workable solutions, the discussions are always centred on either blocking any attempt at reform while hyperventilating about vague authoritarianism or a similarly vague need to protect the innocent.
Meanwhile in the world of smartphone data providers, social media networks, and the meta/googles of the world: they all know your personal information and identity up to the wazoo - and have far more information on every one of you than what is possessed by your own governments (well except for the governments that are also buying up that data.)
So let me be clear, the gate is open, the horse has bolted - recapturing your privacy is where attention should be focused in this debate... even if it's bad for shareholders.
> Meanwhile in the world of smartphone data providers, social media networks, and the meta/googles of the world: they all know your personal information and identity up to the wazoo - and have far more information on every one of you than what is possessed by your own governments (well except for the governments that are also buying up that data.)
This is where I'm concerned too. We are seeing a proliferation of third party verification services that I have to interact with and that have no real obligations to citizens, because their customer is the website.
I'd like to see governments step in as semi-trusted third parties to provide primitives that allow us to bootstrap some sort of anonymous verification system. By semi-trusted, I mean trusted to provide attestations like "This person is a US citizen over the age of 18" but not necessarily trusted with an access log of all our websites.
What good solutions are there that prevent the age verification service and the website from comparing notes (because Big Brother told them to) and figuring out who you are and what you're doing?
If they voluntarily collude then yes, you can't avoid that. It's like third party cookies - once two parties collude it's game over. But that just outlines a situation where the user's chosen trusted service is hostile to their interests and they need to find one that isn't.
If Big Brother starts mandating the collusion - then yes, there's a hill to die on. But in some ways that's the point here. There are hills to die on - this just isn't it. And if you pick the wrong hill then you already died so you are losing the ones that really mattered. If the EFF pointed out to everyone that there is a privacy preserving answer to the core issue that is driving this, they could then mount a strong defense for the part that is truly problematic, since it isn't actually required to solve the problem.
> If they voluntarily collude then yes, you can't avoid that.
You may accept this. Others will not.
> But that just outlines a situation where the user's chosen trusted service is hostile to their interests and they need to find one that isn't.
Just?
This is only hypothetical for government ID's, but in theory government IDs could provide pairwise pseudonymous identifiers with services. Your ID with a single service is stable, but it is different with each service.
They imagined a scenario where the state ordered 2 companies to identify users. How would replacing 1 company with the state improve this?
What would the state force you to do in this case?
Is your question about what authoritarian states do with information about everyone's private lives?
No, it's a question about how a government would break cryptographic protocols, or force others to.
If the identifiers are pseudonyms, if the government compelled someone to share their user IDs, all the government would see are basically a bunch of UUIDs keyed to that provider.
So what specific actions are you talking about. What is your threat model?
Age verification is about government overreach surveillance and censorship. That’s it.
The reality is that even countries that have digital IDs like Belgium which would be 1 of the many requirements of implementing such a zero-knowledge system are pushing for surveillance heavy legislation right now.
Once a system is in place that infringes on rights nobody will modify it to give citizens more rights.
Yep this is the first time I've disagreed with the EFF on anything civil liberties related.
My view is that there's no reason why we can't come together and come up with a rating system for websites (through HTTP headers, there are already a couple proposals, the RTA header and another W3C proposal).
Once a website just sends a header saying this is adult only content, what YOU as a user do with it is up to you. You could restrict it at the OS level (which is another thing we ALREADY have).
This would match the current system, which allows households to set their devices to block whatever they want, and the devices get metadata from the content producers.
No ID checks needed.
> My view is that there's no reason why we can't come together and come up with a rating system for websites
There's no way everybody will agree what constitutes "adult only content," therefore there's no way to come up with a rating for websites.
I have to imagine porn sites don’t want an underage audience either.
So I think they would voluntarily state that their content is adult only.
This isn’t rocket science. We’ve rated content for decades. We simply can’t be obtuse about this and throw our hands up and do nothing because we can’t tell if obvious things like porn are adult only content the way we’ve done on every other medium.
I'm just waiting for governments to start requiring OS makers to verify identity on consumer phone/laptop/console devices before you can use them.
After all, they can legitimately claim it solves much of the issues with other verification schemes - no need to trust third party sites or apps, lower risk of phishing, easier to implement internationally and with foreign nationals, etc.
Of course, the downside (for individuals) is it would take just one legal tweak or pressure from the government to destroy anonymity for good.
If you haven't figured out this is a push by the WEF for digital identity and an end of anonymity on the internet you can't be helped. They are LITERALLY saying it out loud https://nitter.net/JimFergusonUK/status/1988514762896855155
Why do you think there's a global push all at once for this? Anyway I'll order a bunch of cheap USB Sticks, load them up with porn and gore and drop them at school yards at night then. If we do that enough we can make using USB Devices require ID Soon enough.
I have a friend attempting to solve this. He's basically creating oauth for age verification. You sign up with his service and verify your age. After that it works similarly to oauth, but instead of return your identity, it just returns your age.
It's not a perfect solution, as he would still know who you are, but it's built in a way where you create a token locally to pass to the site that includes your age, and that site passes it to his site, which verifies the signature. So he knows who you are but not what sites you visit, and the sites know your age but not who you are.
When I read the title I hoped that EFF was going to do exactly that.
There’s also a way to improve it: Sell “age verification cards” in physical stores. Just like they are verifying that minors aren’t buying alcohol or cigarettes, they can verify that these cards are bought only by grown ups. Sure wouldn’t be perfect but it greatly improves anonymity and especially in paid-for adult services can be used as a payment method so repeat verification will happen for top ups.
On a related note I HATE how when I go buy alcohol they have to scan my ID here.
Potentially having to participate in marketing schemes for a beer?? Its not worth it.
There should also be a read only ID method with more watermarking validation or something.
I dont trust them POS with my info.
Why don't we have zero-knowledge age verification?
One actor verifies ages - and they only need to do so once. Sites give users a key tied to their user account to run by their verifier, who returns another key that attests to their verified age encoded for that specific site, to give back to the site.
The site doesn't know anything about the user, but their user login info. The verifier doesn't know anything about what sites are being visited.
This would seem to address the issues, without creating the pervasive privacy and security problems of every age verifying site creating database of people's government id's, faces, and other personal information.
It also seems like a way out of the legal/legislatorial battle. Which otherwise, is going to be an immortal hydra.
I would trust the EFF to run something like this. Open source. With only one-way encrypted/hashed personal info stored at their end.
(I am not a cryptographic expert. But I believe mechanisms like this are straightforward stuff at this point.)
Because it's not about age verification, it's about setting up infrastructure to enable incremental enchroachment on privacy.
Fun fact: many ZK identity solutions run centralized provers and can be subpoenaed. Need to use something that generates proofs client-side.
> Because it's not about age verification, it's about setting up infrastructure to enable incremental enchroachment on privacy.
Yes. You are emphasizing a reason it would be a good idea.
Sideline the ulterior/hidden motive. Or at a minimum, force it into the open, where it has less of a chance. (Ulterior motives are kept quiet for a reason.)
> Fun fact: many ZK identity solutions run centralized provers and can be subpoenaed. Need to use something that generates proofs client-side.
Subpoenas are one of the many privacy problems solved by this.
If there is no log of your real identity tied to visiting a site, there is nothing to hack or subpoena.
A verifier can report you got keys validated. But they don't know what sites they were for.
Sites can ensure users are vetted for age. Without knowing who they are.
This is such a classic cryptography scenario, I don't know how it isn't being pushed to the center of this debate. Anything that reduces the practical tension between divisive goal posts is going to have practical benefit, and make worst case legislation much less likely.
I think you're suggesting a centralized actor to verify the age of users which is problematic on multiple accounts. Practicality, privacy, enforcement, liability to coercion/corruption, and so on. This might be a wild take, but I think platforms could do a lot more to help with moderation to prevent child predators. Instead of just being okay with them finding outside avenues to converse with their victims through their platform, maybe use those algorithms to detect and prevent it in the first place, whether or not said child predators are whales for your platform or not.
There could be several verifiers. You pick the one you trust the most.
Or you pick three verifiers of your choice who you coordinate between to get verified, without knowing who each other are.
Why they don't use zero knowledge proof? Also question for the USA constitution experts, is this considered a violation of free speech? The article is not clear on this.
"Free Speech" in the American legal sense (1st Amendment to the Constitution) applies to government prohibition on speech, with a particular emphasis on political speech.
It doesn't prevent one person from prohibiting speech... I can tell a pastor to stop preaching on my lawn. But, the government cannot tell a pastor not to preach in the publicly-owned town square (generally, there are exceptions).
There are arguments that certain online forums are effectively "town squares in the internet age" (Twitter in particular, at least pre-Musk). But, I always found that analogy to fall apart - twitter (or whatever online forum) is more like an op-ed section in a newspaper, IMO. And newspapers don't have to publish every op-ed that gets submitted.
Also, the 1st Amendment does not protect you from the consequences of your speech. I can call my boss an asshole to his face legally - and he can fire me (generally, there are labor protections and exceptions).
> Why they don't use zero knowledge proof?
Some proposed implementation do this. Without the requirement there is no chance of your ID or age being leaked, with zero knowledge proof, there is a chance they leak but can be made small, potentially arbitrarily so. Other implementations come with larger risks.
> "is this considered a violation of free speech?"
There were major Supreme Court rulings on the topic recently, see
https://news.ycombinator.com/item?id=44397799 ("US Supreme Court Upholds Texas Porn ID Law (wired.com)"—5 months ago, 212 comments)
https://en.wikipedia.org/wiki/Free_Speech_Coalition_v._Paxto...
Zero knowledge proof is either trivially defeated by re-using the same credentials or doesn't have useful privacy guarantees. There really isn't an in-between here for something like age verification.
The idea is that e.g. the government would give you an app that lives on your phone. When you apply for the app you provide some documents to prove your age, but you don't say anything about what sites you plan to visit. When you want to visit an age-restricted site you use the app to generate a proof that you have it, but the site doesn't learn anything more than that, and the government doesn't learn that you used the app.
> the government would give you an app that lives on your phone
And you don’t see a problem with this part?
It's funny because the same "perfect is the enemy of good" argument is used both to criticize age verification in the first place (why bother if it isn't perfect) but then also to dismiss proprosals to implement it better (why bother if they don't perfectly fix the problem).
No. It's mostly that the proposed age verification schemes have fundamental problems that disqualify them from being considered "good" and none of the "better" implementations fix those problems at all.
The problem is that it isn't even good. It falls squarely in the realm of "we must do something. This is something. Therefore we must do it."
Age verification in general is not intended to defend against people lying or using stolen credentials. If you’re 13 but know the password to your dead grandpa’s account and the website in question has no idea he’s dead, there’s no way to defend against that, with or without a ZKP.
What the ZKP does is let you limit the information the site collects to the fact that you are under 18, and nothing else. It’s an application of the principle of least privilege. It lets you give the website that one fact without revealing your name, birthdate, address, browsing history, and all your other private data.
What prevents one kid in a friend group or in a school from sharing the same identifier?
After all - if it doesn't share anything other than a guarantee of the "age" of someone who is authenticating with the website then how would the website know there's re-use of identifiers?
- If I can do a zero knowledge proof once per day against someone who is under age, I can eventually determine their birthday.
- If I can do a zero knowledge proof with an arbitrary age, I can eventually determine anyone's birthday.
- If the only time people need to verify their age is to visit some site that they'd rather not anyone know they visit and that requires showing identity - even if it's 100% secure, a good share of people will balk simply because they do not believe it is secure or creating a chilling effect on speech.
- If the site that verifies identity is only required for porn, then it has a list of every single person who views porn. If the site that verifies identity is contacted every time age has to be re-registered, then it knows how often people view porn.
- If the site that verifies identity is a simple website and the population has been trained that uploading identity documents is totally normal, then you open yourself up to phishing attacks.
- If the site that verifies identity is not secure or keeps records, then anyone can have the list (via subpoena or hacking).
- If the protocol ever exchanges any unique identifier from the site that verifies your identity and the site that verifies identity keeps records, then one may piece together, via subpoena (or government espionage, hacking) every site you visit.
Frankly, the fact that everyone promoting these systems hasn't admitted there are any potential security risks should be like an air raid siren going off in people's heads.
And at the end of all of this, none of it will prevent access to a child. Between VPNs, sharing accounts, getting older siblings/friends to do age verification for them, sites in jurisdictions that simply don't care, the darkweb, copying the token/cert/whatever from someone else, proxying age verification requests to an older sibling/rando, etc. there are way, way too many ways around it.
So one must ask, why does taking all this risk for so little reward make any sense?
> is this considered a violation of free speech?
Not in principle
See the limits on curse words on TV. Or MPAA ratings for movies.
> "MPAA ratings for movies"
(IANAL) That demonstrates the opposite: that's a voluntary system with no force of law behind it—the private sector "self-regulating" itself, if you will.
The film rating systems were created under threat of legislation in the first half of the 20th century (so, in lieu of actual legislation). The transformative 1st Amendment rulings of the Warren Court would have made such laws unconstitutional after the 1960's, but the dynamic that created these codes predates that—predates the modern judicial interpretation of the 1st Amendment.
https://en.wikipedia.org/wiki/Hays_Code (history background)
https://en.wikipedia.org/wiki/Motion_Picture_Association_fil... ("The MPA rating system is a voluntary scheme that is not enforced by law")
There is only a limit of curse words on over the air TV under the theory that the airwaves belong to the public.
Because safeguarding user privacy is not a goal. Scoring political points with "think of the children" agendas, while getting kickbacks from companies salivating at the opportunity to gather even more personal data, is.
Onlyfans is legal prostitution so we need to protect that. Better to regulate the entire internet with taking your rights than question why it's allowed.
> Onlyfans is legal prostitution
No, its legal (in some jurisdictions) pornography. Prostitution on the platform, as well as whatever the legal status is in the set of jurisdictions involved, is also, from what I understand, explicitly against the platform ToS.
I will say that it's a weird legal distinction in many states that paying someone to have sex is illegal unlessss.... you record it and sell the recording. Then it's legal.
Way to split hairs. Something being against the ToS can still be legal.
Prostitution obviously cannot physically happen on an online platform, but it sure is a convenient way to advertise and attract customers, and serve as the payment processor.
> Way to split hairs. Something being against the ToS can still be legal.
Well, no, violating a binding legal agreement is illegal.
> Prostitution obviously cannot physically happen on an online platform, but it sure is a convenient way to advertise and attract customers, and serve as the payment processor.
Which is explicilty prohibited by the law in many places OF operates, and judging from the number of people who are creators on the platform I've seen complaining about people jeopardizing their status with the platform by soliciting it on the platform, also by the actively-enforced terms of the platform. OF is simply not “legal prostitution”, and it is ridiculous to describe it that way
> Well, no, violating a binding legal agreement is illegal.
Not touching the rest of this thread's arguments, but that isn't really true. Breaking ToS, or any other contract, is not "illegal"-- it's not a crime. It opens you up to civil (not criminal) penalties if the other party sues, but that's it.
Illegal means not legal. Not criminal.
Not to mention people lose accounts because someone reported them as underage, and now they don't want to fully dox themselves over this. Who can blame them considering discord's own support ticket system was hacked which included people who had to validate their age.
What they should do instead is invest in technology that can do age verification while protecting privacy. This is obviously a required piece of technology. It is not acceptable for children to grow up on the Internet and easily access pornography by simply going to a website. Imagine letting your children loose in a city where they can wander in and out of peep shows without friction.
While the "required piece of technology" aspect is debatable, there is certainly enough demand for it that it is going to happen in one way or another.
So I agree that instead of fighting some change that I think is inevitable, they should make it so that it works in the most privacy-conscious way possible. And I mean with real technical solutions, like an open-source app or browser extension you can download, a proof-of-concept server for age verification, etc... using the best crypto has to offer.
It's funny to me that porn does not have more age verification than just "Yes, I promise I'm 18+" (or whatever).
If I go to the liquor store, I can't just promise "I'm 21+"
If I go to vote, I can't just promise I'm 16+
If I go to buy a lottery ticket I cant just promise...
I think I made my point.
And yet this has been the system for the last 35 years and somehow the sky didn't fall.
Either you're old enough to understand what porn is and have desires to consume it in which case you won't be scarred by it and don't need protection from it, or your not in which case you won't seek it out. You need id checks for alcohol because people too young to consume it want it, and given how much teens drink and how not a problem lower drinking ages are in other countries even that claim is somewhat dubious.
Not true; kids too young to understand porn can stumble across it, or find it because they searched for it simply because they heard about it from their friends. I'm not saying they'll be harmed by it (most of them won't be), but there will always be a small percentage of people who find a certain thing and then go on to get harmed by that thing. That doesn't mean the rest of us should have to jump through hoops to responsibly use that thing.
I wouldnt just say "they can", the average first exposure to porn is ~10, so "they do". And this isnt some spicy magazine the issue with internet porn is that it's an intense supranormal stimuli relative to, say, a handful of images of which you have to do a ton of effort (and ID checks) to get more. Internet porn today is multi-tab, rapid desensitization requiring escalation in content, and an increase in young Porn-induced Erectile Dysfunction -- an element why ED drugs are being pushed on younger people these days (besides the socially sick trend of objectifying people by their size and "performance"). Some believe the Australian jewel beetle story is basically playing out with Men these days leading them to not go through the right motions to become successful and find a mate.
I'm sure i'll get downvoted into oblivion by skeptics, but there is a good amount of reasons to believe this is true. Your brain on porn by gary wilson is a good starting point for the ideas, and then to dig deeper if you are inclined to fact check.
ok /rant.
Well I have to imagine any downvotes will come because most of this is pseudoscience. But you seem like you're replying in good faith so it's all good to me.
* There is some research that the age of first exposure to porn is lower and there's speculation that this might affect attitudes towards sex in teens but there's nothing conclusive.
* YourBrainOnPorn is most charitably a misreading of scientific literature juxtaposed with people's personal experiences of porn becoming an issue in their lives, but is probably more accurately pseudoscience manufacturing a specific narrative by citing studies that don't actually support their conclusions but are banking on people not actually checking. It's "The Body Remembers" bullshit all over again.
* Porn Induced ED isn't a medical condition and was made up by NoFap. There is an increase in ED prescriptions among young people but there's no evidence whatsoever that this is connected to porn and is much more plausible that there's just less stigma about it, it's just easier to get using an app, and more people are using it for enhancement and performance anxiety rather than ED.
* And there's this awkward problem that men actually care about size and performance significantly more than women do so this objectification angle is a bit silly. Like these two things aren't even in the top 5 of priorities for women's sexual partners. And uhh… can confirm personally as a woman. Larger becomes painful faster than most guys think and my ability to climax is more mental than physical. I've had more than one friend go home with a guy pull down his pants and laugh being like, "wow but also that's not gonna fit."
* I'm not even touching the beetles thing.
And look a ridiculous number of people bought into The Body Remembers and it's still going to be years and years to shake the public out of that one. I don't expect this to be any different. The good news is, outside of a few people with an unhealthy relationship with porn, that in general things are actually fine. Whole generations aren't being addicted to and made impotent by porn.
I just wanted to say I appreciate your overtly good faith reply :)
> Whole generations aren't being addicted to and made impotent by porn.
They literally are. Mostly men, though, so you might not really get it.
> There is an increase in ED prescriptions among young people but there's no evidence whatsoever that this is connected to porn and is much more plausible that there's just less stigma about it,
Yes, just like cancer rates and mental illnesses. The number increases aren't real, we're just getting better at detecting it. Surely, nothing ever gets worse in the world. /s
You're right, though, that most of this is pseudoscience. Most of the "problem" with porn is psychological, rather than strictly physical, and psychology is generally pseudoscience.
The push for age verification must be about something else. There are good solutions to this, but they are ignored. Its always about some complex setup leaking information all over the place. It must be either ignorance or indeed about surveillance, as many here think it is.
Shameless plug: I wrote about hash chains some time ago. They are a nice and simple solution to age verification. https://spredehagl.com/2025-07-14/
The reality is that it's probably mostly about incompetence and lazyness. And tight purses of course.
When some country parliament decides to mandate age verification, it's really easy and lazy for them to just say "verify ages and do it reliably!" and stop at that. As a result, the services affected don't really have a choice to go towards those horrible solutions of scaning our faces or IDs or both and all the issues around that.
What should happen rather is "we'll build a system for age verification that is privacy focused and all you sites that are adult only will have to use it or any other system we deem acceptable" But this requires effort on the part of the government doing the law. And money.
Yes, wellknown solutions have a strong grip on you. In this case it is unfortunate.
I know that the preparations for eIDAS 2.0 (the European thing) did contain many good parts. Taking inspiration from SSI. So at that point their specifications were rather good. I havent kept up with it for almost one year now, so that might have changed.
ITT: HN discussing whether and how to pull up the ladder on free youth.
Would be great if EFF also sets up a phone verification hub.
https://news.ycombinator.com/item?id=45989890
back in the day the worst thing you could do in a blog or channel was to self identify as female, as you would get flooded
i am a child header = i am verifying myself as valid target header
has anyone realized that whatever at all the "good" guys do, the "bad" guys will abuse it.
we need canaries [bots with child header], to get a metric on any increase of attempted crimes vs a child.
I would be happy if we just moved to a way we could more realistically enable audits of information flow in our lives. I don't, necessarily, want to restrict my kids consumptions. It does worry me that I don't know how to teach them to audit all of the information that is being exposed to them. Or worse, collected about them.
I'm not entirely sure what you mean by 'audit', but teach them critical thinking, and show them the strategies the media uses to manipulates them. Teach them there's often more than 1 side to a story.
Things like this will give them a huge advantage in not being manipulated and lied to.
To explain it like budgeting. You can forward plan what you will spend money on. But you also need to be able to see where all of your money went. This is nigh impossible with data flow, nowadays.
I'd be comfortable with it having large segments of "uncategorized." But right now, if I scan over to my ISP to see how much data I have used for the month, I have little to no help in saying how much of that was what.
Ah okay. I think this would probably be pretty tricky, security-wise, no? One of my first thoughts that might help would be writing a simple tool that parses history from your browsers to categorize it. Other than that, there are things like https://activitywatch.net/ (which seems to have a desktop and Android version)
Yeah, just writing out the idea, I would imagine I should be able to see a lot of this with my router?
Again, I get that that will be a lot I have to write off as "uncategorized." I'm not even trying to drive all telemetry down to zero. I'm comfortable knowing that my HVAC may send diagnostic stuff in, as an example. But it seems kind of crazy to me that this is not something that is often discussed? Do I just miss those discussions?
If age check is truly anonymous/zero-knowledge, as in the requester can't identify me, the issuer can't link me to the attestation... why wouldn't someone start selling age verified accounts? Easy money for some 18yo.
Here's how schools should deal with the social media problem:
Make children write down what they got out of social media, every time they use it.
Maybe then it will sink down that it basically offers close to zero actual benefit.
I wonder what the psychological effect of having little or no privacy would do to people. Are we all going to be paranoid schizophrenics? How would a world of paranoid schizophrenics work? How insane are world events going to be from that point on?
China is an example of this. Somewhere that, according to the UN's data, executed "undesirable" people with such gusto that it incidentally decreased the organ donor waitlist time so low that it couldn't be explained by any other factor.
"Perfect" security is only attainable with zero dissent, zero individuality, zero privacy, and zero freedom.
"Involuntary organ harvesting[3][4][5] was once legal on criminals, but outlawed in 2015"
https://en.wikipedia.org/wiki/Organ_transplantation_in_China
You think you have privacy?
At best, you go back and forth between no privacy, a heavily condition privacy. At best.
Let’s take privacy back, but that’s a big process.
If you haven’t internalized surveillance, start working on it!
https://news.ycombinator.com/item?id=24627363
> Are we all going to be paranoid schizophrenics?
Paranoid, maybe. Schizophrenics? No. Firstly, "paranoid schizophrenia" is an outdated diagnosis. Paranoia is a common symptom of schizophrenia, but schizophrenics exhibiting paranoia are not considered to have separate mental illness from those who are not. Secondly, schizophrenia is not caused simply by psychological stress, and is associated with a large cluster of positive and negative symptoms, with paranoia being only one of them.
[dead]
Generally speaking, I share the HN consensus on age verification laws. But, there is a real problem with kid's unfettered internet access. Just think about all the adults who are hopelessly addicted to social media. The negative affects are amplified when it comes to developing minds.
My SO has been teaching for nearly 20 years now, and mental health in kids has fallen off a cliff in the last two decades. I could fill this page with online bullying stories. Some of which, are especially cruel. Half her students are on medication for anxiety. It's out of control, honestly.
That said, I don't know how to solve it. It's easy to put this on the parents, but that's not the answer. Otherwise, it would be solved already. Some don't care. Some don't have the time to care because they're trying to keep the lights on, and dinner on the table. And, some simply think it doesn't apply to them or their children. Parents on HN are hyper-aware of this sort of thing, but that's definitely the minority.
I know a family that would be most folks least likely candidate for something bad to happen online. Single income, relatively well off, the parent at home has an eye on the kids 24/7. And, if you met the kids, you would most likely qualify them as "good kids". Without going into detail, their life was turned upside down because one of the kids was "joking around" online.
Again, I don't know what the answer to the problem is. Clearly, age verification laws are a veiled attempt to both collect and control data. And, EFF's emphasis on advertising restrictions as a solution, seems off the mark. There's more to it than that. Idk, this shit makes me want to log off permanently, and pretend it's 1992.
> It's easy to put this on the parents, but that's not the answer. Otherwise, it would be solved already.
I would argue it must be part of the answer, if it isn't literally the answer. You even kind of hit the nail on the head later in that paragraph:
> Parents on HN are hyper-aware of this sort of thing, but that's definitely the minority.
I would start there. Spreading awareness and social pressure is a tractable problem.
Is the EFF captured? This is a resource against misguided laws but what's a law they'd actually approve of? This entire resource is boring defense of the status quo.
Asking for a year of birth is the best solution and always will be. Once kids are old enough to figure that out you're not going to stop them from much.
Besides Porn, what sites are doing this? It's odd to me that the EFF page does not mention "porn" or "adult content" at all.
Here in Europe they want to do the same for chat services like WhatsApp.
Discord. Twitter. YouTube and other google services.
YouTube.
Why is this so difficult?
Verified Credentials exist on the Web.
Drivers’ licenses exist.
Just show that you are over 18 in a zero knowledge way and be done with it. Why do they need to see your IDs?
Because I don't want to prove myself in everything I do online?
I don’t want to follow many different laws. So inconvenient. I don’t want to stop at a red light if I see there are no cars around. It’s stupid. But…
No but this is exactly why I don't want this to become law. However yes if it does become law I will avoid it.
It is a big slippery slope aimed at destroying anonimity on the internet. Even if first attempts are privacy-preserving, it could still break the use of double accounts for example, something which I also use widely.
That is an extremely poor title. Reading it I'd expect the average person to be like "yea, it's about time" and skip the article.
I first interpreted it to mean the EFF had created their own site to perform age verification. So yes, a very poorly written title indeed.
The end goal of this line of thinking is tracking every molecule in the universe. Exagerated I know, but we're moving in that direction.
We must destroy all freedom and forsake all right to free speech and privacy... for the children!
Infuriating that we get all the bad sides of digital ID without the good sides.
It's deanonymizing and intrusive and mandatory for sites to implement without protecting them from sockpuppets and foreign troll farms.
This gives me Leisure Suit Larry flashbacks
Ken sent me
LSL4 was my favorite.
The net got too big, the 90% got in because of facebook and google, and automated bots took over from there.
Either we create the fix, or the feds take it over. we need to sever the idea of a global internet. per-country and allied nations only. anonymous cert-chain verified ID stored on device. problem fixed.
Whose fault is it when a child burns their hand on the stove?
We need common sense stove control. Verify your age before using the burner please.
"SAN FRANCISCO-With ill-advised and dangerous age verification laws proliferating across the United States and around the world, creating surveillance and censorship regimes that will be used to harm both youth and adults, the Electronic Frontier Foundation has launched a new resource hub that will sort through the mess and help"
The surveillance and censorship system is built, administered and maintained by Silicon Valley companies who have adopted this as their "business model". "Monetising" surveillance of other peoples' noncommercial internet use
These Silicon Valley companies have been surveilling internet subscribers for over a decade, relentlessly connecting online identity to offline identity, hell bent on knowing who is accessing what webpage on what website, where they live, what they are interested in, and so on, building detailed advertising profiles (including the age of the ad target) tied to IP addresses, then selling the subscribers out to advertisers and collecting obscene profits (and killing media organisations that hire journalists in the process)
Now these companies are being forced to share some of the data they collect and store
Gosh, who would have forseen such an outcome
These laws are targeting the Silicon Valley companies, not internet subscribers
But the companies want to spin it as an attack on subscribers
The truth is the companies have been attacking subscriber privacy and attempting to gatekeep internet publication^1 for over a decade, in the name of advertising and obscene profits
1. Discourage subscribers from publishing websites and encourage them to create pages on the company's website instead. Centralise internet publication, collect data, perform surveillance and serve advertisements
It was bad already, so who cares if that gets worse? Is that the message?
Silicon valley uses that information to sell adds, and sometimes votes. Not great, but I can imagine much worse from a State.
I am disappointed to find no mentions of zero knowledge proofs or any other indications that we wont have to trust anyone with this task.
We have the technology to do age verification without revealing any more information to the site and without the verification authority finding out what sites we are browsing. However, most people are ignorant of it.
If we don't push for the use of privacy preserving technology we wont get it and we will get more tracking. You cannot defeat age verification on the internet, age verification is already a feature of our culture. The only way out is to ensure that privacy preserving technologies are mandated.
Everyone, including politicians are intimately aware of Zero Knowledge Proofs.
Google even open-sourced technology to enable it: https://blog.google/technology/safety-security/opening-up-ze...
The politicians don't want Zero Knowledge Proof because it prevents the mass-surveillance of internet users. This is all deliberate.
> we must fight back to protect the internet that we know and love.
This is not compelling. The internet I know and love has been dying for a long time for unrelated reasons. The new internet that is replacing that one is an internet that I very much do not love and would be totally ok to see lots of it get harder to access.
What parts and content should be "harder to access" in your view?
The parts where traffic generates money for the kind of people who would think putting an advertisement on a screen on someone's home refrigerator is an acceptable thing to do (morally, not legally or whatever).
Extrapolate that how you will.
As I have stated before, AI is freeing us to:
1. create our own porn at home and (soon)
2. have home orgasmatrons.
Parents have complete control of the Chat/Porn server and since the orgasmatron necessarily has all your desires stored in its LLM (Large Lust Model) it trivially knows your age and will lock you out.
And internet porn can be banned regardless of age. (that's only half sarcastically said).
Demand for home Large Lust Models and orgasmatrons will soar. You heard it here first. Opportunity for entrepreneurs. And these home-based products are the only way to keep porn away from kids (if parents don't care now, they never will) and to maintain privacy on the internet.
Every place where I've worked in I.T., the rule was "No porn downloading at work. Porn belongs in the home." (especially in the days of slow home modems)
And to be really enforceable, all offshore sites would have to agree to the scheme, including certain Russian ones who are glad to pollute our children's and adults' minds with porn, propaganda and conspiracy theories.
Lastly: There always was and will be media. Micro-SD cards now? If not phones, thrift store picture frames and RPi's. "Porn finds a way."
I think sadly, this is a lost battle in public opinion. And the gambling of digital assets on Roblox and other casino-like website is also starting to get public attention, and will turn public opinion further.
The CNIL gave up 3 years ago, and gave guidelines, you can read about it here [0]. At the time it read like "How well, we tried, we said it is incompatible with privacy and the GDPR multiple times, we insist one more time that giving tools to parents is the only privacy-safe solution despite obvious problems, but since your fucking law will pass, so the best we can do is to draw guidelines, and present solutions and how to implement them correctly".
I think the EFF should do the same. That's just how it is. Define solutions you'll agree with. Fight the fight on chat control and other stuff where the public opinion can be changed, this is too late, and honestly, if it's done well,it might be fine.
If the first implementation is correct, we will have to fight to maintain the statu quo, which in a conservative society, is the easiest, especially when no other solution have been tested. If it's not, we will have to fight to make it correct, then fight to maintain it, and both are harder. the EFF should reluctantly agree and draft the technical solution themselves.
[0] https://www.cnil.fr/en/online-age-verification-balancing-pri...
online age verification is disingenuous and a pretext to give governments the hard coded technical option to regulate speech and association.
there's a great game being played out by these users of force against the advocates of desire. everything about the bureaucracies pushing digital ID is unwanted. this isnt about age verification tech, its about illegitimate power for unwanted people who are actuated by forcing their will on others.
we should treat these actions with the open disgust they deserve.
How are you going to verify the age of someone coming in from another country?
Realistically all but the largest sites are going to contract out age verification to third parties. There will probably be verification companies that will have a wide range of verifications.
There already are, and have been for a while. And, yes, of course, they've been involved in lobbying for the requirements.
Like any wrong government initiative, mass surveillance is being justified by "think of the children" and "fighting the bad guys".
[dead]
[dead]
Good. Let this version of internet be locked down and censored.
If people care enough, they will build a new internet.
Guifi.net and the rest of meshnets. Also, Yggdrasil. Not for anonymity, but availability.
* for the US Internet. Internet access, even on cafe shop wifi, in India is trace backable to the ID of the user already.
How would internet access in a coffee shop be traced to the specific user?
In Switzerland you are forced to receive an SMS code to your phone on every portal in every public space everywhere to establish your identity on every network. No SMS = No public wifi anywhere in Switzerland.
The reason is that the law in Switzerland requires identification of the user of free internet services [1]. So it is not just common practice
[1] https://www.gva.ch/Site/Passagers/Shopping/Services/Business...
That's a funny choice, I thought Europe was done with SMS. I can see this 1-to-1 mapping with other cellphone derived messaging like Whatsapp, etc being an issue for privacy but it's certainly possible to have multiple phones.
How would an SMS code sent to a phone number be traced to the specific user? Anonymous VOIP numbers are plentiful.
You need to show identification to get a SIM card.
You can't receive the text message without cellular service.
I had to show my passport to get a SIM card.
I imagine they would block anonymous VOIP numbers.
I believe cyber cafes in India must verify identity via ID before allowing internet access and maintain logs, browsing history, etc. for at least one year.
I want this practice to remain in countries like India and Russia.
I understand this is a technology forum, frequented mostly by liberal adults, who built a lot of their internet nous on totally free internet of 90s and 00s. I am one of them.
Equally, I think insisting that there must be no controls to internet access whatsoever is not right either. There is now plenty of evidence that eg. social media are very harmful to teenagers - and frankly, before I noticed, going on FB got me depressed each time I did it at one point. And as a parent, you realise how little control you have over your children's tech access. Case in point - my kids seem to have access to very poorly locked down iPads at school. I complained, but they frankly don't understand.
We all accept kids can't buy alcohol and cigarettes, even if that encroaches on their freedom. But or course flashing an ID when you're over 18 is not very privacy-invading.
Likewise, I think it is much better to discuss better means of effecting these access controls. As some comments here mention, there are e.g. zero knowledge proofs.
I'm sure I'll be told it's all a sham to collect data and it's not about kids. And maybe. But I care about kids not having access to TikTok and Pornhub. So I'd rather make the laws better than moan about how terrible it is to limit access to porn and dopamine shots.
That’s not the moan friend.
You had me thinking "This is a reasonable argument even if I disagree" until the last line. That's completely disingenuous of the argument.