The Age Verification Trap: Verifying age undermines everyone's data protection • Hacker News Board

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#221

Post by [deleted] » Mon, Feb 23, 2026, 4:15 PM UTC

worldsayshi wrote: post #200

bondarchuk wrote: post #34

It's kind of weird to me how every article on this topic here has people rushing to comment within a couple minutes with some generic "yes I too support ID checks for internet use!". Has the vibe really shifted so much among tech-literate people?

There are better and there are really really bad ways to do ID checks. In a world that is increasingly overwhelmed by bots I don't see how we can avoid proof-of-humanity and proof-of-adulthood checks in a lot of contexts. So we should probably get ahead of this debate and push for good ways to do part-of-identity-checks. Because I don't see any good way to avoid them. We could potentially do ID checks that only show…

[deleted]

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#222

Post by armchairhacker » Mon, Feb 23, 2026, 4:15 PM UTC

delusional wrote: post #162

armchairhacker wrote: post #55

Age verification is very hard, because parents will give their children their unlocked account, and children will steal their parents' unlocked account. If that's criminalized (like alcohol), it will happen too often to prosecute (much more frequently than alcohol, which is rarely prosecuted anyways). I don't see a solution that isn't a fundamental culture shift. If there's a fundamental culture shift, there's an eas…

How does this solve the problem at all? You're just making more problems. Now you have to deal with a black market of "unlocked" phones. You're having to deal with kids sharing unlocked phone. Would police have to wal around trying to buy unlocked phones to catch people selling them to minors? What about selling phones on the internet, would they check ID now? SOME parents give their children access to their ID. That…

It would not be solved without a culture shift. But with a culture shift, giving a kid an unlocked device would be as rare as giving them drugs.

I'm sure it will occasionally happen. But kids are terrible at keeping secrets, so they will only have the unlocked device for temporary periods, and I believe infrequent use of the modern internet is much, much less damaging than the constant use we see problems from today. A rough analogy, comparing social media to alcohol: it's as if today kids are suffering from chronic alcoholism, and in the future, kids occasionally get ahold of a six pack.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#223

Post by hawk_ » Mon, Feb 23, 2026, 4:15 PM UTC

armchairhacker wrote: post #55

Age verification is very hard, because parents will give their children their unlocked account, and children will steal their parents' unlocked account. If that's criminalized (like alcohol), it will happen too often to prosecute (much more frequently than alcohol, which is rarely prosecuted anyways). I don't see a solution that isn't a fundamental culture shift. If there's a fundamental culture shift, there's an eas…

> If there's a fundamental culture shift,

You mean this culture shift is needed for the masses but I don't think that's the case. In my widest social circle I am not aware of anyone giving alcohol to young kids (yes by the time they are 16ish yes but even that's rare). Most guardians would willingly do similar with locked devices.

The real problem is that the governments/companies won't get to spy on you if locked devices are given to children only. They want to spy on us all. That's the missing cultural shift.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#224

Post by zarzavat » Mon, Feb 23, 2026, 4:16 PM UTC

condiment wrote: post #194

zarzavat wrote: post #138

Earlier quoted context omitted.

https://xkcd.com/538/ Your crypto nerd dream is vulnerable to the fact that someone under 18 can just ask someone over 18 to make an account for them. All age verification is broken in this way. There is a similar problem for people using apps like Ubereats to work illegally by buying an account from someone else. However much verification you put in, you don't know who is pressing the buttons on the screen unless yo…

You seem to have missed requirement #3 -> tracking and identifying reuse. An 18-year-old creating an account for a 12-year-old is a legal issue, not a service provider issue. How does a gas station keep a 21-year-old from buying beer for a bunch of high school students? Generally they don't, because that's the cops' job. But if they have knowledge that the 21-yo is buying booze for children, they deny custom to the 2…

> How does a gas station keep a 21-year-old from buying beer for a bunch of high school students?

They don't? Teenagers can easily get their hands on alcohol... you just need to know the right person at school who has a cool older brother. If their older brother is really cool they can get weed too!

The police absolutely do not have the time to investigate the crime of making a discord account for someone.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#225

Post by parineum » Mon, Feb 23, 2026, 4:16 PM UTC

iamnothere wrote: post #44

bondarchuk wrote: post #34

It's kind of weird to me how every article on this topic here has people rushing to comment within a couple minutes with some generic "yes I too support ID checks for internet use!". Has the vibe really shifted so much among tech-literate people?

Although there is some organic support, there is a lot of coordinated astroturfing. It’s apparent if you watch the discussions across platforms, there are obvious shared talking points that come in waves. Governments (and a few companies) really want this.

> there are obvious shared talking points that come in waves.

Groups of people who wake up at the same time of the day often have a tendency to be from a similar place, hold similar values and consume similar media.

Just because a bunch of people came to the same conclusion and have had their opinions coalesce around some common ideas, doesn't mean it's astroturfing. There's a noticeable difference between the opinions of HN USA and HN EU as the timezones shift.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#226

Post by anon_shill » Mon, Feb 23, 2026, 4:16 PM UTC

0x000xca0xfe wrote: post #185

anon_shill wrote: post #165

From the second paragraph: > And the only way to prove that you checked is to keep the data indefinitely. This is not true and made me immediately stop reading. If a social media app uses a third party vendor to do facial/ID age estimation, the vendor can (and in many cases does) only send an estimated age range back to the caller. Some of the more privacy invasive KYC vendors like Persona persist and optionally pass…

If you don't keep and cross-reference documents it is really easy to circumvent, e.g. by kids asking their older siblings to sign them up. I don't think a bulletproof age verification system can be implemented on the server side without serious privacy implications. It would be quite easy to build it on the client side (child mode) but the ones pushing for these systems (usually politicians) don't seem to care about…

Yep, it is easy to circumvent, and the silver lining of all of this is that regulators don't care. They care that these companies made an effort in guessing.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#227

Post by cromka » Mon, Feb 23, 2026, 4:16 PM UTC

bakugo wrote: post #220

cromka wrote: post #182

Someone explain me like I'm 5: there are some solutions already in effect that are based on cryptographically generated, anonymous, one-time use tokens that allow to confirm adults's age without being tied up yo your ID. Why on earth even technically skilled people completely ignore those? Is this pure NIMBY ignorance or am missing something?

Because those solutions always have obvious flaws. If the cryptographic token is anonymous, how do you know the user verifying is the same one who generated the token? How do you know the same cryptographic key isn't verifying several accounts belonging to other people?

They are one time use by definition. You can't know they are used by respectful owner, but the idea is you have to provide a new token every few weeks/months. Much like when using other services nowadays, I mean even Gmail will have you authorize every few months even if you didn't log out. Plus you fine/prosecute those who sell/misuse theirs. Just like you prosecute adults who buy kids alcohol or other substances.

Obvious flaws are OK. I absolutely hate the Nirvana fallacy that you people think is acceptable here, while hundreds of millions of kids suffer from serious developmental issues, as reported left and right by all kinds of organizations and governments themselves.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#228

Post by mulmen » Mon, Feb 23, 2026, 4:17 PM UTC

bondarchuk wrote: post #34

It's kind of weird to me how every article on this topic here has people rushing to comment within a couple minutes with some generic "yes I too support ID checks for internet use!". Has the vibe really shifted so much among tech-literate people?

Beware the vocal minority. Internet comment sections only tell you the sentiments of people who make comments.

HN comments sentiment seems to shift over the age of the thread and time of day.

My suspicion is that the initial comments are from people in the immediate social circle of the poster. They share IRC or Slack or Discord or some other community which is likely to be engaged and have already formed strong opinions. Then if the story gains traction and reaches the front page a more diverse and thoughtful group weighs in. Finally the story moves to EU or US and gets a whole new fresh take.

I’m not surprised that people who support something are the ones most tuned in to the discussion because for anyone opposed they also have their own unrelated thing they care about. So the supporters will be first since they’re the originators.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#229

Post by 2duct » Mon, Feb 23, 2026, 4:17 PM UTC

kristopolous wrote: post #121

armchairhacker wrote: post #55

Age verification is very hard, because parents will give their children their unlocked account, and children will steal their parents' unlocked account. If that's criminalized (like alcohol), it will happen too often to prosecute (much more frequently than alcohol, which is rarely prosecuted anyways). I don't see a solution that isn't a fundamental culture shift. If there's a fundamental culture shift, there's an eas…

I mean look, there's a point where the manufacturers back off and entrust the parents. Any parent can be reckless and give their children all kinds of things - poison, weapons, pornographic magazines ... at some point the device has enough protective features and it is the parents responsibility.

Digital media use is easier to conceal than weapons. My parents did not protect me from it growing up because they were not responsible, and I was harmed as a result. To this day they still do not realize I was harmed, because I did not tell them and we are not on speaking terms. Trying to be honest would have resulted in further rejection from them. This was on a personality level and I had no way to deal with this as a developing human.

I could not control how my parents were going to raise me, I was only able to play with the hand I was dealt. I hate the idea that parents are sacrosanct and do not share blame in these situations. At the same time, if this is just the family situation you're given and you're handed a device unaware of the implications, who is going to protect you from yourself and others online if your parents won't? Should anyone?

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#230

Post by semi-extrinsic » Mon, Feb 23, 2026, 4:17 PM UTC

worldsayshi wrote: post #200

bondarchuk wrote: post #34

It's kind of weird to me how every article on this topic here has people rushing to comment within a couple minutes with some generic "yes I too support ID checks for internet use!". Has the vibe really shifted so much among tech-literate people?

There are better and there are really really bad ways to do ID checks. In a world that is increasingly overwhelmed by bots I don't see how we can avoid proof-of-humanity and proof-of-adulthood checks in a lot of contexts. So we should probably get ahead of this debate and push for good ways to do part-of-identity-checks. Because I don't see any good way to avoid them. We could potentially do ID checks that only show…

> We could potentially do ID checks that only show exactly what the receiver needs to know and nothing else.

A stronger statement: we know how to build zero-knowledge proofs over government-issued identification, cf. https://zkpassport.id/

The services that use these proofs then need to implement that only one device can be logged in with a given identity at a time, plus some basic rate limiting on logins, and the problem is solved.