Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What we call "age verification" is actually mass surveillance

pluralistic.net

Post reply on HN
Print view View original

361–370 of 520 posts

Re: What we call "age verification" is actually mass surveillance

#361

Post by forgetfreeman »

Our lives are being thoroughly surveilled by a combination of phone tech, financial records tracking, pervasive internet user tracking, smart appliances, data brokerages, and our cars. That this is what triggers an avalanche of pushback while the rest of it is ignored wholesale reeks to high hell of either an overt astroturf campaign or industrial grade hypocrisy.

I offer no opinion on the concept of age verification beyond noting it's detractors consistently refuse to advance alternatives that address any of problems it's proponents claim it's intended to address.

Re: What we call "age verification" is actually mass surveillance

#362

Post by palata »

microtonal wrote: post #311
Aaargh20318 wrote: post #93

Earlier quoted context omitted.

The way identity wallets work: The government issues an eID to your wallet. The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID. The government signs individual attributes combined…

The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID. IMO, there are two other issues that need to be solved. The major one is that there should be some way to do attestation of devi…

> The major one is that there should be some way to do attestation of devices that are not Google-certified Android or iOS.

IMO, just don't do the proof of possession. If I have the token that says I am an adult, I can use it to be considered an adult online. If someone requests millions of tokens and sells them, then punish that someone. It's not very hard to find them: they have to sell those tokens somewhere.

Also don't try to solve the VPN issue: I highly doubt most kids will use VPNs to access social media, and accessing porn isn't that hard if you are capable of running a VPN.

Again, I can consider age verification as some kind of "inconvenience for under age people". But the age verification that works 100% of the time is a problem, as you say it will lock people out with remote attestation and that is not acceptable.

Re: What we call "age verification" is actually mass surveillance

#363

Post by phyzix5761 »

palata wrote: post #358
phyzix5761 wrote: post #350

Earlier quoted context omitted.

The government still gets to know what you're doing online. How is that privacy?

Nope they don't. That's the whole point of privacy-preserving age verification. Technically it is possible. The complaint that people have is that they don't trust that any government will get it right. But it is technically possible with known cryptography.

Ah ok. I understand now. The website isn't making an additional request to the government to verify that the credentials you gave are real. The authenticity is built into the signature.

Re: What we call "age verification" is actually mass surveillance

#364

Post by bluegatty »

asdff wrote: post #327
bluegatty wrote: post #244

The slippery slope argument is hugely valid, but having kids not have access to alcohol, porn and guns is very normal. We don't even discuss it in the 'physical world' because it's absolutely normative. Even in 'Europe' kids aren't going into the liquor store stocking up obviously - there are always age and responsibility-related conventions. The 'online' nature of this piques our anti-authoritarian triggers and tend…

In europe drinking age is what 16? By the time you want to regularly drink you are already legally allowed to. Meanwhile in the US you get screwed by both the law and your university for drinking in a dorm at 20 years old.

[dead]

Re: What we call "age verification" is actually mass surveillance

#365

Post by niemandhier »

MyMemoryfails wrote: post #249
Aaargh20318 wrote: post #93

Earlier quoted context omitted.

The way identity wallets work: The government issues an eID to your wallet. The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID. The government signs individual attributes combined…

If you are referring to EUID (not fully sure as you said EU eID, i dont know if you are referring the estonia of eID like system) I have to mention that EUID is not private, since there's "provider" element which informs website if you are 18 or not. The flow is: 1) You scan QR code 2) Your EUDI wallet does verification, informs provider to tell you are 18+ 3) Provider informs website you are 18+ The EUID draft doesn…

The beauty of the EU is that you only need one county of upstanding people to get a permissible good implementation.

It will probably be a small country, one that is known to give no fucks about big tech.

Re: What we call "age verification" is actually mass surveillance

#366

Post by angiolillo »

Tangurena2 wrote: post #356
terribleperson wrote: post #287

Earlier quoted context omitted.

It doesn't even need 'age verification'. Ostensibly, the goal is to prevent children from accessing content their parents don't want them to see. That means all that's needed is a standard way for parents to make sure that websites know their children are children. They don't need identity, they don't need actual age, we don't even need a complicated cryptographic solution. California had the right idea - establish a…

> the goal is to prevent children from accessing content their parents don't want them to see This has been mandated in TVs sold in the US. No one sets the thing. https://en.wikipedia.org/wiki/V-chip

> No one sets the thing.

Based on the surveys from the wikipedia page it appears that 15-20% of parents used the v-chip feature on their TV. For an optional feature that has to be manually configured that seems like an incredible success. I would have guessed that fewer than 20% of users configure any optional setting on their TV.

Re: What we call "age verification" is actually mass surveillance

#368

Post by palata »

john_strinlai wrote: post #27
Wowfunhappy wrote: post #16

Earlier quoted context omitted.

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general. Heck—in most cases, we can't even tell…

> Could you be more specific as to what you're imagining? sure, i'll put my favorite two. though you'll find much more detailed and thought-out versions of these (and others) in the dozens of other giant threads on the same topic. - buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is no…

> buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is non-identifying.

It can be implemented in a privacy-preserving way online: your government gives you tokens that prove that you are above age and that they provably cannot track. That's the exact equivalent.

I believe that the other measures (remote attestation and such, the ones we hate) come when we try to make absolutely sure that you don't give/sell that UUID to someone else. But IMO we should just forget about doing that. Just like an adult can, today, buy cigarettes and porn and give them to a kid.

Re: What we call "age verification" is actually mass surveillance

#369

Post by cadamsdotcom »

No one in politics is going to listen unless solutions are provided.

Government research departments like DoD and CSIRO could commission work to solve this problem, that’s how we used to do this.

Relying on private boffins to complain creates too much noise in the room and the bureaucracy can’t tune into the signal.

It used to be done via gov sci. What changed?

Re: What we call "age verification" is actually mass surveillance

#370

Post by palata »

fl4regun wrote: post #118
john_strinlai wrote: post #67

Earlier quoted context omitted.

> And those cards will be getting sold to kids faster than you can blink. there's a reason i said 90% and not 100% effective. alcohol and tobacco get resold to kids, too.

What makes you think this will be close to 90%? Unless these cards are expensive I don't see that happening.

Let's try it. If it doesn't help the kids, we can remove it I guess.

Anything that doesn't accept this limitation becomes dystopian. The only viable age verification system is one that cannot be 100% effective, period.

Post reply on HN