The UK’s new age-gating rules are easy to bypass • Hacker News Board

Re: The UK’s new age-gating rules are easy to bypass

#51

Post by magicalhippo » Sat, Jul 26, 2025, 12:27 PM UTC

zigzag312 wrote: post #42

Wouldn't age verification without revealing identity be solved with a service that acts as an identity authority? 1) Site that needs to verify age generates a globally unique id, creates requested data array ["is_over_18"], valid_until property and hmac signature of this message. 2) Client forwards just the id and requested data array to identity authority. Identity authority returns the id, map of data {"is_over_18"…

EU is working on something like this[1] (got limited discussion here[2]).

I haven't looked into it very much, but at a glance it doesn't sound terrible. Here's the basic flow[3]:

- The User initiates an age verification process by enrolling with an Attestation Provider (AP), which collects the necessary evidence from authentic sources or trusted 3rd party private data sources.

- The AP generates a Proof of Age attestation and issues it to the Age Verification App Instance (AVI) of the User.

- The AVI presents the attestation to a Relying Party (RP) when attempting to access age-restricted services.

- The RP checks the validity of the attestation, referencing the trusted list to confirm the AP's authorisation.

So it uses an app on a mobile device as a proxy of sorts. They're also working on incorporating zero-knowledge proofs[4].

[1]: https://digital-strategy.ec.europa.eu/en/news/commission-mak...

[2]: https://news.ycombinator.com/item?id=44561797

[3]: https://ageverification.dev/Technical%20Specification/archit...

[4]: https://ageverification.dev/Technical%20Specification/archit...

Re: The UK’s new age-gating rules are easy to bypass

#52

Post by Xelbair » Sat, Jul 26, 2025, 12:27 PM UTC

AnthonyMouse wrote: post #46

zigzag312 wrote: post #42

Wouldn't age verification without revealing identity be solved with a service that acts as an identity authority? 1) Site that needs to verify age generates a globally unique id, creates requested data array ["is_over_18"], valid_until property and hmac signature of this message. 2) Client forwards just the id and requested data array to identity authority. Identity authority returns the id, map of data {"is_over_18"…

You're making this far more complicated than it needs to be. It requires no cryptography more than a random number generator. Create a service that generates a random token and then gives it to anyone who is over 18. Any service with any employee who is over 18 can get the token and then compare it to the one submitted by the client. Everyone uses the same token across every service and the token is only available to…

Now make sure that only someone over 18 can generate token, and that token cannot be given to 3rd party for reuse.

Re: The UK’s new age-gating rules are easy to bypass

#53

Post by AnthonyMouse » Sat, Jul 26, 2025, 12:28 PM UTC

michaelt wrote: post #12

Hasz wrote: post #8

Earlier quoted context omitted.

Many, eg Mullvad, allow for crypto payments

It's surprisingly hard to get cryptocurrency without a KYC check in the UK - bitcoin ATMs and suchlike are banned. Far simpler, if you're a teen that wants to get around the block, to just have an older looking friend do the video selfie.

What stops anyone from just mining it? Cryptocurrency mining may or may not be profitable at any given time, but it doesn't matter that you're spending $7 to mine $5 worth of cryptocurrency if you're willing to pay the $7 to get the VPN.

Re: The UK’s new age-gating rules are easy to bypass

#54

Post by AnthonyMouse » Sat, Jul 26, 2025, 12:34 PM UTC

dns_snek wrote: post #25

gennarro wrote: post #4

Except paying the vpn requires a credit card that does the same verification check so it’s not thwarting the rule at all.

Kids aren't going to pay for a VPN, even if they had the option to. They're going to Google "Free VPN" and download the first option which will probably add their device into a "UK residential proxy" botnet. Everyone is getting something out of it, the state of UK cybersecurity is weakened further, and no money is changing hands, good luck stopping that.

It's the same thing that happens every time the government tries to ban something that customers actually want. You get a black market, criminals make more money than ever and use it to fund other crimes and the banned thing continues to be available but now the suppliers don't have to follow other laws because then the customers can't object when they're both doing something illegal.

Governments never seem to learn.

Re: The UK’s new age-gating rules are easy to bypass

#55

Post by tempodox » Sat, Jul 26, 2025, 12:39 PM UTC

HPsquared wrote: post #39

I wonder when the UK will become another one of those countries to ban VPNs. So liberal!

It's no coincidence that the man who wrote “1984” was a Brit.

Re: The UK’s new age-gating rules are easy to bypass

#56

Post by AnthonyMouse » Sat, Jul 26, 2025, 12:40 PM UTC

Xelbair wrote: post #52

AnthonyMouse wrote: post #46

Earlier quoted context omitted.

You're making this far more complicated than it needs to be. It requires no cryptography more than a random number generator. Create a service that generates a random token and then gives it to anyone who is over 18. Any service with any employee who is over 18 can get the token and then compare it to the one submitted by the client. Everyone uses the same token across every service and the token is only available to…

Now make sure that only someone over 18 can generate token, and that token cannot be given to 3rd party for reuse.

The first problem is easy: Write the token on the back of your ID when the government issues it to someone over 18.

The second problem is universally intractable. If you have the cooperation of someone over 18, the service will let you in and has no way of knowing that the person using it is a different person.

Re: The UK’s new age-gating rules are easy to bypass

#57

Post by tempodox » Sat, Jul 26, 2025, 12:42 PM UTC

Brendinooo wrote: post #13

I dunno, I was imagining much simpler ways before I clicked through. Or maybe easier ways. Having to buy something and then configure it is a real barrier.

There is a sudden surge in face scanning of video game characters.

Re: The UK’s new age-gating rules are easy to bypass

#58

Post by steveharman » Sat, Jul 26, 2025, 12:45 PM UTC

Uptick in TOR usage?

Re: The UK’s new age-gating rules are easy to bypass

#59

Post by zigzag312 » Sat, Jul 26, 2025, 12:46 PM UTC

Xelbair wrote: post #44

zigzag312 wrote: post #42

Wouldn't age verification without revealing identity be solved with a service that acts as an identity authority? 1) Site that needs to verify age generates a globally unique id, creates requested data array ["is_over_18"], valid_until property and hmac signature of this message. 2) Client forwards just the id and requested data array to identity authority. Identity authority returns the id, map of data {"is_over_18"…

That limitation is enough to kill such proposal. Also authority could also do it. Nothing stops them from that.

Yes, if site shares data with identity authority then a malicious identity authority can also share full identity data with the site.

Re: The UK’s new age-gating rules are easy to bypass

#60

Post by rcxdude » Sat, Jul 26, 2025, 12:46 PM UTC

AnthonyMouse wrote: post #46

zigzag312 wrote: post #42

Wouldn't age verification without revealing identity be solved with a service that acts as an identity authority? 1) Site that needs to verify age generates a globally unique id, creates requested data array ["is_over_18"], valid_until property and hmac signature of this message. 2) Client forwards just the id and requested data array to identity authority. Identity authority returns the id, map of data {"is_over_18"…

You're making this far more complicated than it needs to be. It requires no cryptography more than a random number generator. Create a service that generates a random token and then gives it to anyone who is over 18. Any service with any employee who is over 18 can get the token and then compare it to the one submitted by the client. Everyone uses the same token across every service and the token is only available to…

There's still privacy issues here: e.g. the service is generally still aware of what services the user is using that require verification. ZKP can eliminate this hole.