Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Age Verification Laws: A Backdoor to Surveillance

eff.org

Post reply on HN
Print view View original

281–290 of 485 posts

Re: Age Verification Laws: A Backdoor to Surveillance

#281

Post by kallistisoft »

janci wrote: post #85

Our state-issued eID cards are supposed to have a function that allows anonymous age verification to a trusted party. It should work like this: a requesting party sends a request signed by state-issued certificate to the ID card, the card verifies the request authenticity and responds with a signed confirmation of legal age and that signature then can be verified by the requester. No personal information is shared. W…

There's an issue with the flow you described; the party requesting verification shouldn't directly interact with the verifying agent (the state) as this leaks to the state the identity of the requesting 3rd party.

The correct flow for preserving anonymity is: the requesting party issues a challenge token to the user -- the token header describes the type of request (>=18yo?) and the token body is completely random(). The user then takes this token and has the challenge verified (signed) on their side, the signed token is then returned to the requester.

This way the state never knows the identity of the challenge issuer.

() Note that this scheme requires good faith on the part of the challenge issuer that the token body is actually random, although it would seem that a simple DH-key mechanism would patch this vulnerability.

Re: Age Verification Laws: A Backdoor to Surveillance

#282

Post by cyberax »

Aeolun wrote: post #256
diddid wrote: post #144

Earlier quoted context omitted.

I don’t think it’s entirely a mentality issue. I think North America created an environment where you wouldn’t want your 8 year old to navigate New York City. I would let my kids wander Tokyo before I would let them wander Chicago. Japan would not tolerate people spitting at and harassing children where Chicago does indeed tolerate that. I’d say ask me how I know but you could probably guess.

Guessing leaves me two options, so was you, or your children that were spit on? Also, what could possibly lead to that happening? Someone upset they were noisy? Or just that they dared show up at all?

Drugs and mentally ill people.

Re: Age Verification Laws: A Backdoor to Surveillance

#283

Post by ty6853 »

tharkun__ wrote: post #275
Aeolun wrote: post #255

Earlier quoted context omitted.

> You will however be asked for ID before being allowed in a strip club, brothel or casino, or before being sold a DVD of some action movie. The action movie too? I’ve never seen that happen, and I’m certain I rented a whole bunch of age inappropriate DVD’s (or was it VCR’s?) back in the day. Maybe we were required to be ID’ed and the teenager behind the counter just gave zero fucks?

Again, depends on the country and time I suppose but "Video stores" back in the day used to be completely off limits to kids where I was. Just couldn't get in until 18. I never understood why as a kid. One time my parents got me in. They had made a deal with the owner that I'd be shielded by a parent from seeing anything in the store on my way to the small corner of "age appropriate" VHSs, so that I could pick out wh…

This sounds like the one I went to as a kid except the kid friendly stuff was up front. Beyond that was a huge room full of porn tapes, that iirc was locked so age filtering happened at the second door instead.

Re: Age Verification Laws: A Backdoor to Surveillance

#284

Post by consteval »

AnthonyMouse wrote: post #168
miki123211 wrote: post #128

Earlier quoted context omitted.

IMO the problem isn't ID-based age verification specifically, it's that such verification is usually impelemnted in a way where the service in question gets a lot more data than they need, with no real control over how that data is kept and processed. It would absolutely be possible to implement that stuff in a fully privacy-preserving way, with nothing but basic cryptography, and the government could absolutely enfo…

> It would absolutely be possible to implement that stuff in a fully privacy-preserving way, with nothing but basic cryptography, and the government could absolutely enforce that implementation. There are ways to do this which are less bad , but there is no way to do it "in a fully privacy-preserving way" without also making it fully ineffective, because if there is no way to prove who someone is then there is no way…

You can verify who someone is without knowing specifically who "who" refers to. We do it all the time. I give a one-time code to service X and it knows I am who I say I am, but the code I gave is virtually worthless information. All it knows is that I have credentials, and I am the authorized person to have those credentials because I have physical access to some device, unknown, which is known to belong to said person.

Re: Age Verification Laws: A Backdoor to Surveillance

#285

Post by ryototsu »

mjevans wrote: post #71

The Internet should be Unrated and thus Adults Only by default. Just like public spaces. (Would you allow an 8 year old to wander New York City unattended? Arguments can be made for more controlled spaces but...) Have a website and want the chance for kids to see it? Advertise in the headers that it's moderated and intended to be a given rating. Various indexers can pick that up. Complaints can be forward to relevant…

> Would you allow an 8 year old to wander New York City unattended

No, but that just means NYC is a crappy place. I regularly see 8yr olds wandering Tokyo alone.

Re: Age Verification Laws: A Backdoor to Surveillance

#286

Post by genewitch »

darioush wrote: post #196
cameldrv wrote: post #116

Earlier quoted context omitted.

Public spaces are most definitely not "Adults Only" by default. You're not allowed to have a big billboard with porn on it, you have to show ID to get into a bar, you have to show ID to buy a pack of cigarettes, and in many states the cigarettes have to be in an opaque cabinet. You can't walk around naked. You can't be drunk in public. Now admittedly many of these things are unevenly enforced, but society absolutely…

Just like to offer a counter-perspective that most billboards are basically soft porn.

Not in Central Louisiana. I can't remember the last tittilating billboard I saw.

Re: Age Verification Laws: A Backdoor to Surveillance

#287

Post by beeflet »

tzs wrote: post #184

For the issue of underage people purchasing products they should not be able to I wonder if this could be handled by requiring sellers to only accept payment by credit card, and to only complete the sale if the shipping address matches the credit card account address? A child could borrow an adult's card, but then the items would be shipped to that adult's address which could make it hard for the child to get them wi…

I feel like minors should be allowed to buy some stuff online as long as there is age verification for alcohol or whatever. They can go to a store and buy stuff in-person, so why not

Re: Age Verification Laws: A Backdoor to Surveillance

#288

Post by lll-o-lll »

cogman10 wrote: post #177
janci wrote: post #85

Our state-issued eID cards are supposed to have a function that allows anonymous age verification to a trusted party. It should work like this: a requesting party sends a request signed by state-issued certificate to the ID card, the card verifies the request authenticity and responds with a signed confirmation of legal age and that signature then can be verified by the requester. No personal information is shared. W…

Really comes down to "how sure do you want to be that the person is the right age"? Or the "how hard would it be for a preteen to buy beer?" test. With an eID card, if it's just saying "yes, this person is old enough" then any teen can swipe a device with an eID card and start using it.

So it’s tied to biometrics/other 2nd factor as with passkeys. Wouldn’t stop mini-me of course…

Re: Age Verification Laws: A Backdoor to Surveillance

#289

Post by genewitch »

devilbunny wrote: post #139
miki123211 wrote: post #128

Earlier quoted context omitted.

IMO the problem isn't ID-based age verification specifically, it's that such verification is usually impelemnted in a way where the service in question gets a lot more data than they need, with no real control over how that data is kept and processed. It would absolutely be possible to implement that stuff in a fully privacy-preserving way, with nothing but basic cryptography, and the government could absolutely enfo…

Yeah, the whole “we have to scan your driver’s license” which has my name, address, etc., encoded is way more than I want to share. I am mostly bald and even my beard is gray. There is no plausible situation where you think I might be under 21.

I've been gray for over a decade and get carded every time, because my state tries to enforce age restrictions.

Minors don't seem to have much of a problem, though?

Re: Age Verification Laws: A Backdoor to Surveillance

#290

Post by genewitch »

amrocha wrote: post #221
JumpCrisscross wrote: post #183

Earlier quoted context omitted.

> Why would we want to keep minors safe from "harmful chemicals" but not adults? My understanding is they’re harmful if misused.

That can be said about pretty much anything though. Don’t drink shampoo!

Why does it have fruit on the bottle then?
Post reply on HN