Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What we call "age verification" is actually mass surveillance

pluralistic.net

Post reply on HN
Print view View original

201–210 of 520 posts

Re: What we call "age verification" is actually mass surveillance

#201

Post by chollida1 »

Aaargh20318 wrote: post #93
Wowfunhappy wrote: post #16

Earlier quoted context omitted.

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general. Heck—in most cases, we can't even tell…

The way identity wallets work: The government issues an eID to your wallet. The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID. The government signs individual attributes combined…

How does this work without a phone? I do 99% of my computer work, like now, not on a phone.

Do regular desktop and laptop computers have the same secure enclave feature?

Re: What we call "age verification" is actually mass surveillance

#202

Post by jonathanstrange »

actionfromafar wrote: post #53
jonathanstrange wrote: post #23

Earlier quoted context omitted.

How about taking some personal responsibility for your life? This shouldn't even be a consideration concerning adults.

I assume you are also for heroin vending machines at every school corner if you watch a 30 second ad slot. You don't have to use them, you know.

No, but I'm not against selling alcohol and fast sports cars to adults, for example. I'm not very fond of a nanny state that prohibits almost everything to adults "for their sake" and because the government knows so much better.

Re: What we call "age verification" is actually mass surveillance

#203

Post by OkayPhysicist »

gambiting wrote: post #59
Retr0id wrote: post #29

Earlier quoted context omitted.

Where are these mythical sweet-spot solutions? Concretely, half the websites I visit from the UK want me to either scan my face or upload ID documents to access their full featureset. Now that users have been conditioned to accept this, nobody seems very interested in figuring out how to collect less PII - only insulating themselves from liability by having the data processed by a third party.

Government builds a website where you can log in using any government issued ID or using one of the many many many available services that hold your details already(at least in the UK nearly everyone will have a DLVA account, HMRC account, HMPO account, NHS account.....all of these are government services which we can only assume hold our data securely already). On that website, you can click "give me a verification…

This means giving the government complete insight into your internet browsing. All they need to do is store a database table of handed out keys to ids.

This is unacceptable tyranny on its face.

Re: What we call "age verification" is actually mass surveillance

#204

Post by irusensei »

Aaargh20318 wrote: post #93
Wowfunhappy wrote: post #16

Earlier quoted context omitted.

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general. Heck—in most cases, we can't even tell…

The way identity wallets work: The government issues an eID to your wallet. The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID. The government signs individual attributes combined…

>The government issues an eID to your wallet

So people in dubious legal circumstances are locked out the internet?

Re: What we call "age verification" is actually mass surveillance

#205

Post by OkayPhysicist »

intended wrote: post #183
Retr0id wrote: post #85

Earlier quoted context omitted.

Every time I search something, I open a fresh private tab and google it. If I want to turn safe-search off, I'd have to go through this code verification flow for every single search. Aside from just being annoying, they'd have to implement strict rate limiting to prevent automated code sharing, so I'd soon end up waiting for a rate limit to expire before I can search anything. And "the government will know you've au…

Sadly we got to this place because there are other harms that are occurring and those are forcing this conversation.

The "other harms" are made up fearmongering by rightwing cowards and incompetent parents.

Re: What we call "age verification" is actually mass surveillance

#206

Post by Aaargh20318 »

Aurornis wrote: post #173
Aaargh20318 wrote: post #93

Earlier quoted context omitted.

The way identity wallets work: The government issues an eID to your wallet. The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID. The government signs individual attributes combined…

> The website only sees the ‘over_18’ attribute, which is backed by the government signature Not true. The device's public key is also sent, which functions as a stable device identifier. We've spent years trying to get away from stable tracking IDs and fingerprinting. Returning to a system where devices are sending a stable ID to a website to prove ownership is a step backward. There are proposed mitigations like is…

> Not true. The device's public key is also sent, which functions as a stable device identifier.

This is covered by allowing for single-use credentials. IIRC the EU personal IDs will use this. Basically, the wallet requests a batch of single-use eIDs that all use different device key-pairs. Each credential is only used for one request and then deleted. The wallet will automatically request new credentials in batches when they run out. The old key-pairs are deleted along with the credential so you don’t run out of space in the secure enclave.

> Another reason why these proposals aren't getting much uptake

I’m not sure what you mean by not much uptake, EU countries are required to issue and accept them for official business by the end of 2026

Re: What we call "age verification" is actually mass surveillance

#207

Post by dofm »

Retr0id wrote: post #121
dijksterhuis wrote: post #97

Earlier quoted context omitted.

> half the websites I visit from the UK want me to either scan my face or upload ID documents to access their full featureset. what kind of websites are you visiting to get age checked on half of the sites you visit? i've only been asked to verify for dating apps and "sexy stuff". and i definitely don't spend 50% of my total browsing time on those sites. maybe this says more about the kind of content/sites you're acc…

reddit.com, discord.app, google.com with safe-search off (This one works sometimes, they are A/B testing force-enabling safe-search for unauth'd sessions)

Oh, reddit, yes. Good point.

I don't use that; it's worse for your brain than any regulated substance. Kick your reddit habit while you can.

Google safe search: I've only seen this from my PAYG mobile phone, because I've never bothered to lift the adult content lock on that after more than a decade, and Google is the only place I've seen ask, actually. Even so it rarely happens.

Discord: the mere idea of being in an adult-content-related discord group is enough to make my skin crawl.

Worth noting that of these three, only one of them is a UK-only decision, as far as I am aware: Google Safe Search respects UK phone companies' default adult content block on PAYG. They are about the only company that does. Reddit and Discord have made this decision globally, have they not? Because there are US state laws too.

Re: What we call "age verification" is actually mass surveillance

#208

Post by irusensei »

Retr0id wrote: post #29
john_strinlai wrote: post #2

> "Age verification" means that everyone who does anything online will have to submit to fine-grained tracking and recording of all their online activities. its been said 1000 times here, but: age verification doesn't have to be a nightmare dystopia of 24/7 fine-grained tracking and recording unless you are somehow hoping to achieve 100% success rate (something we have not done with any other law ever). there are sev…

Where are these mythical sweet-spot solutions? Concretely, half the websites I visit from the UK want me to either scan my face or upload ID documents to access their full featureset. Now that users have been conditioned to accept this, nobody seems very interested in figuring out how to collect less PII - only insulating themselves from liability by having the data processed by a third party.

They don't exist because the organizations who lobbied governments were YOTI, Persona, K-ID and others who have a vested interest in collecting data and rent seek by latching through regulations like diseased ticks.

Re: What we call "age verification" is actually mass surveillance

#209

Post by drdexebtjl »

donmcronald wrote: post #60
john_strinlai wrote: post #27

Earlier quoted context omitted.

> Could you be more specific as to what you're imagining? sure, i'll put my favorite two. though you'll find much more detailed and thought-out versions of these (and others) in the dozens of other giant threads on the same topic. - buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is no…

> buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time Why should I pay continuously to prove I'm an adult? And those cards will be getting sold to kids faster than you can blink. I bet a lot of parents would buy them for their kids.

> I bet a lot of parents would buy them for their kids.

Good. I should be able to make judgement calls about what my children can or can’t access outside of school.

It’s better if they do it under my supervision than against my back, aided by a predator whose only moat is lending their ID, or their face.

Post reply on HN