What we call "age verification" is actually mass surveillance • Hacker News Board

Re: What we call "age verification" is actually mass surveillance

#171

Post by john_strinlai » Tue, Jun 23, 2026, 4:18 PM UTC

inigyou wrote: post #164

john_strinlai wrote: post #131

Earlier quoted context omitted.

> What makes you think this will be close to 90%? Unless these cards are expensive I don't see that happening. its obviously just an illustrative guess. but if the penalty of possessing the card is similar to underage possession of alcohol/tobacco, and larger penalties if a store/person is found providing a card to someone underage, i see no reason why it wouldnt have a similar success rate as alcohol/tobacco.

Why possess the card when you can just buy the UUID on the dark web

sure? i feel like i need to reemphasize the "not going for 100% effectiveness" thing again.

hopefully some parent steps in if their kid is on the dark web trying to make purchases with their parent's credit card.

Re: What we call "age verification" is actually mass surveillance

#172

Post by rlt » Tue, Jun 23, 2026, 4:19 PM UTC

In general I'm opposed to this kind of regulation, but as a thought exercise, we do have the primitives needed to do age (or any other attribute) verification in a privacy-preserving and decentralized way.

You could imagine a hierarchy of organizations (governments, financial institutions, schools, etc) that a website trusts to verify some attribute (minimum age, citizenship, etc). Those organizations can attest that some identifier like an email address has been verified to belong to a real individual with that attribute, and that organization belongs to the hierarchy the website trusts, without revealing anything else about the user, the exact verifying organization, or the requesting website.

Re: What we call "age verification" is actually mass surveillance

#173

Post by Aurornis » Tue, Jun 23, 2026, 4:19 PM UTC

Aaargh20318 wrote: post #93

Wowfunhappy wrote: post #16

Earlier quoted context omitted.

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general. Heck—in most cases, we can't even tell…

The way identity wallets work: The government issues an eID to your wallet. The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID. The government signs individual attributes combined…

> The website only sees the ‘over_18’ attribute, which is backed by the government signature

Not true. The device's public key is also sent, which functions as a stable device identifier.

We've spent years trying to get away from stable tracking IDs and fingerprinting. Returning to a system where devices are sending a stable ID to a website to prove ownership is a step backward.

There are proposed mitigations like issuing multiple sets of credentials or rotating them, but we're not going to get an infinite number of keypairs for every website or session in the secure enclave in practice.

Another reason why these proposals aren't getting much uptake is that they aren't addressing what the lawmakers are pursuing: They don't want anonymous authorization tied to the device. They want IDs tied to accounts and a way to discourage people from sharing IDs. In the anonymous systems it only takes one person a few minutes to put an over-18 identity into a device and there's no way to determine if someone is abusing the system by stealing IDs or if someone's 18 year old brother is setting up all of their younger brothers' phones for $5 each.

The situation gets stickier when you acknowledge that it's not possible to limit all of these websites to only mobile phone devices with secure enclaves that are not jailbroken. Once you open a door to desktop devices and other OSes accessing these sites, you open the door to replaying and proxying attacks, where someone will produce those `over_18` attestations on-demand for you, possibly for a minimal price. This brings us back to the public stable identifier to discourage fraud, which means governments won't be happy to issue as many keypairs as we want, which means we're back to semi-stable fingerprints.

Re: What we call "age verification" is actually mass surveillance

#174

Post by Wowfunhappy » Tue, Jun 23, 2026, 4:19 PM UTC

oliwarner wrote: post #63

Wowfunhappy wrote: post #16

Earlier quoted context omitted.

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general. Heck—in most cases, we can't even tell…

That's because you're treating AV as a system that must be 100% correct immediately. This isn't banking or an election. As soon as you loosen off the requirements to "reasonable effort", you can start looking at account age, facial features, social attestation, and include retrospective tools to revisit someone's verification if they get in and start acting like a child. Heuristically messy but far from impossible to…

I understand it doesn't need to be 100% correct. But I think what you're describing is either (A) going to be very privacy invasive, (B) going to create problems for lots of adults, or (C) going to be precisely as effective as a checkbox saying "I agree I am over 18 years old".

Re: What we call "age verification" is actually mass surveillance

#175

Post by skinfaxi » Tue, Jun 23, 2026, 4:20 PM UTC

Aaargh20318 wrote: post #93

Wowfunhappy wrote: post #16

Earlier quoted context omitted.

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general. Heck—in most cases, we can't even tell…

The way identity wallets work: The government issues an eID to your wallet. The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID. The government signs individual attributes combined…

Couldn't the public key be used as an identifier for tracking?

Re: What we call "age verification" is actually mass surveillance

#176

Post by IshKebab » Tue, Jun 23, 2026, 4:22 PM UTC

simultsop wrote: post #8

This is a very strong argument simply put

Sorry but this isn't a strong argument at all. Nobody who thinks age verification laws are a good idea will be remotely persuaded by any of this.

Re: What we call "age verification" is actually mass surveillance

#177

Post by jazz9k » Tue, Jun 23, 2026, 4:22 PM UTC

john_strinlai wrote: post #2

> "Age verification" means that everyone who does anything online will have to submit to fine-grained tracking and recording of all their online activities. its been said 1000 times here, but: age verification doesn't have to be a nightmare dystopia of 24/7 fine-grained tracking and recording unless you are somehow hoping to achieve 100% success rate (something we have not done with any other law ever). there are sev…

It was never about the children. They are rolling this out, so online comments can be tracked to names and addresses.

It's to suppress free speech and arrest people that post anything against the government's narrative.

Many people have already been arrested in the UK for this. This is the next logical step.

Re: What we call "age verification" is actually mass surveillance

#178

Post by Wowfunhappy » Tue, Jun 23, 2026, 4:22 PM UTC

cogman10 wrote: post #65

john_strinlai wrote: post #27

Earlier quoted context omitted.

> Could you be more specific as to what you're imagining? sure, i'll put my favorite two. though you'll find much more detailed and thought-out versions of these (and others) in the dozens of other giant threads on the same topic. - buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is no…

And honestly, all these should ultimately just be done client side in the browser. After the browser has verified "User is x or user is over 21" there's no reason to then send that information to the website. Let websites issue a "window.isUserOver(16)" call once and then move forward based on the response to that query.

This would require browser attestation, wouldn't it? Otherwise kids are just going to download a custom build of Chromium where `window.isUserOver(16)` is always `True`.

Re: What we call "age verification" is actually mass surveillance

#179

Post by intended » Tue, Jun 23, 2026, 4:22 PM UTC

Retr0id wrote: post #98

john_strinlai wrote: post #76

Earlier quoted context omitted.

if you think even the client-side "yes im 18" on OS setup proposals are unreasonable, i dont know what to say.

Privacy-wise I think they're completely acceptable, but in terms of circumvention I don't think the politicians will be satisfied. It's barely a step up from the "I'm over 18" buttons on websites.

I believe kids will always find circumvention pathways.

There is a signaling function these laws serve: things are the products we consider acceptable in society. We have these rules for cigarettes, booze, and vapes.

That said, privacy being sacrificed for signals, is an unacceptable trade, especially when better solutions can be crafted.

Re: What we call "age verification" is actually mass surveillance

#180

Post by mzajc » Tue, Jun 23, 2026, 4:25 PM UTC

rlt wrote: post #172

In general I'm opposed to this kind of regulation, but as a thought exercise, we do have the primitives needed to do age (or any other attribute) verification in a privacy-preserving and decentralized way. You could imagine a hierarchy of organizations (governments, financial institutions, schools, etc) that a website trusts to verify some attribute (minimum age, citizenship, etc). Those organizations can attest that…

If the website sees (and possibly stores) the e-mail address, and the government or another party knows who it belongs to, the scheme is anything but privacy-preserving.