Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why isn't online age verification just like showing your ID in person?

eff.org

Post reply on HN
Print view View original

101–110 of 123 posts

Re: Why isn't online age verification just like showing your ID in person?

#101

Post by lcnPylGDnU4H9OF »

jraby3 wrote: post #49
zug_zug wrote: post #25

Cryptographically there are techniques that let you prove you're one of the several hundred million adults in the US that don't reveal anything about which adult you are. It's much less complicated than bitcoin. I'm bringing this up because it's the perfect litmus test to show whether you really care about age verification, or if you want personal trackability for all internet behavior. I'd be okay with this for cert…

Can you send a link or explain how this can be done? As a not super tech savvy parent I find it impossible to keep my son off screens. He always finds a workaround. So I'm a fan of age verification especially after reading The Anxious Generation, despite all the hate it gets from hacker news.

> the hate [age verification] gets

Age verification actually gets almost no hate. Society-wide surveillance gets a lot; age verification just happens to be the "think of the children" excuse to shoe-horn in the society-wide surveillance. As OP described, if the age verification is implemented as a "zero-knowledge proof" then we have age verification without society-wide surveillance and nobody is complaining.

https://en.wikipedia.org/wiki/Zero-knowledge_proof

Re: Why isn't online age verification just like showing your ID in person?

#102

Post by evgen »

swid wrote: post #61
jraby3 wrote: post #49

Earlier quoted context omitted.

Can you send a link or explain how this can be done? As a not super tech savvy parent I find it impossible to keep my son off screens. He always finds a workaround. So I'm a fan of age verification especially after reading The Anxious Generation, despite all the hate it gets from hacker news.

He’s talking about zero knowledge proofs - it’s a neat use of graph coloring where you send an encrypted proof that a graph can be colored with three colors and no neighbors with the same color. The verifier makes a challenge to prove two nodes don’t have the same color, and the prover provides a key to decrypted just those two nodes. This process is repeated a number of times (with new colored graphs) until the veri…

For simple yes/no questions ("Is over 18?", "Is US resident?") then you should look back to David Chaum's blind signatures and the work that came out of that back in the 90s. The math is super-simple to understand and there are a ton of even easier metaphors with envelopes and carbon paper that you can use to explain to your grandmother. Once you get someone to grok blind signatures it is easy to lead them to zero-knowledge proofs.

Re: Why isn't online age verification just like showing your ID in person?

#103

Post by Palmik »

If age verification has to be a thing (which isn't necessarily clear), then it should be up to the client to provide age indication to the server.

It could be through a header, or something like this: https://developer.chrome.com/blog/digital-credentials-api-or...

However, I have the feeling that none of these solutions will get wide enough buy in and adoption to be a viable solution to website owners.

Re: Why isn't online age verification just like showing your ID in person?

#104

Post by Izkata »

jraby3 wrote: post #49
zug_zug wrote: post #25

Cryptographically there are techniques that let you prove you're one of the several hundred million adults in the US that don't reveal anything about which adult you are. It's much less complicated than bitcoin. I'm bringing this up because it's the perfect litmus test to show whether you really care about age verification, or if you want personal trackability for all internet behavior. I'd be okay with this for cert…

Can you send a link or explain how this can be done? As a not super tech savvy parent I find it impossible to keep my son off screens. He always finds a workaround. So I'm a fan of age verification especially after reading The Anxious Generation, despite all the hate it gets from hacker news.

This is far from the best way to do it, but this is a much easier to understand example of how it could be done without having to read about math:

There's a type of token called a JWT that's really common nowadays, which is composed of 3 parts: Metadata describing encryption for the third part, the actual base64-encoded data, and the encrypted signature. The second part would include "is over 18" and "expiration date" to limit reuse/abuse, and is trivially decoded by anyone to confirm there's no personal information in there.

You'd get this token from your government site and copy/paste it into the site needing verification. The government site would provide a standard public key that can be used with the third part of the JWT to confirm it hasn't been tampered with (verification is built-in to JWT libraries). There would only be one public key that rarely changes, allowing the site to cache it, preventing the government site from correlating users based on timestamps - they never see the JWT from the other site (verification is done locally), and the other site would only need to pull the public key once for however many thousands of people use it.

...that said technical issues aside, I kinda feel like this would be the most acceptable version simply because it doesn't require the average user to trust the math - they could go to a JWT-decoding website and look at it themselves.

Re: Why isn't online age verification just like showing your ID in person?

#105

Post by takinola »

Izkata wrote: post #104
jraby3 wrote: post #49

Earlier quoted context omitted.

Can you send a link or explain how this can be done? As a not super tech savvy parent I find it impossible to keep my son off screens. He always finds a workaround. So I'm a fan of age verification especially after reading The Anxious Generation, despite all the hate it gets from hacker news.

This is far from the best way to do it, but this is a much easier to understand example of how it could be done without having to read about math: There's a type of token called a JWT that's really common nowadays, which is composed of 3 parts: Metadata describing encryption for the third part, the actual base64-encoded data, and the encrypted signature. The second part would include "is over 18" and "expiration date…

How would you prevent the token from being used by a different person than it was issued to? This is the online equivalent of getting your older cousin to buy you alcohol from the store using their own valid ID

Re: Why isn't online age verification just like showing your ID in person?

#106

Post by morgan814 »

cwmoore wrote: post #59
3rodents wrote: post #19

I don’t like this article. Irrelevant technical nuance is comingled with a philosophical opposition. The technical issues are all solvable. The free speech argument is foolish too: if limiting who can jerk off to pornography is an issue of free speech, surely so is limiting who can enter a bar and converse with the patrons. Opposition to ID checks because you believe the internet should be open and free is reasonable…

I am not that fond of stores scanning my ID data either. I’m over 21, there’s no question about it. Per policy, they’ll have my name and address in some log too, and with my photos and gait on camera and probably my license plates. What does all of that do for me? Are you safer because I am being recorded? I like the (disputed) comment elsewhere on this page, requiring parents to parent. They aren’t my kids.

If you have the money definitely get yourself a passport card. Stores can’t scan them and they only contain a pointer to personal info in some government database.

Re: Why isn't online age verification just like showing your ID in person?

#107

Post by 1718627440 »

takinola wrote: post #105
Izkata wrote: post #104

Earlier quoted context omitted.

This is far from the best way to do it, but this is a much easier to understand example of how it could be done without having to read about math: There's a type of token called a JWT that's really common nowadays, which is composed of 3 parts: Metadata describing encryption for the third part, the actual base64-encoded data, and the encrypted signature. The second part would include "is over 18" and "expiration date…

How would you prevent the token from being used by a different person than it was issued to? This is the online equivalent of getting your older cousin to buy you alcohol from the store using their own valid ID

How do you prevent your house key being used by a different person, that it was not issued to?

Re: Why isn't online age verification just like showing your ID in person?

#108

Post by 1718627440 »

SunshineTheCat wrote: post #29
dbbk wrote: post #24

Earlier quoted context omitted.

I'm not sure why we don't just make a law that parents must set parental controls on their kids' devices. We do this for most other things.

We should then make laws that parents must tell their kids to clean their room. Next we can make laws that parents must tell their children to eat their veggies. What about chore laws? Teeth brushing laws? Stop arguing with your sister laws! More laws!

> What about chore laws?

I know that was snarky, but that already exists in Germany, since the introduction of the civil law book two centuries ago. Children are legally required to do chores. Actually this is quite important, as otherwise it would be an adult requiring minors to do unpaid work, which is illegal.

Re: Why isn't online age verification just like showing your ID in person?

#109

Post by 1718627440 »

surgical_fire wrote: post #75
miguelbemartin wrote: post #13

In my opinion, access to internet should always be behind a device controlled by an adult. And it should be this adult's responsibility to set appropriate restrictions for minors.

This is something I am conflicted about as a parent. My daughter is still a baby, so the problem is still a few years away. But I don't know how to best handle it. In some ways, I see social media as more poisonous to the brain than alcohol or tobacco. So, forbidding - or heavily limiting - internet access sounds like a plan. On the other hand, part of me being a parent is teaching her how to navigate the world. And…

You don't teach your child to deal with alcohol by telling it to try it out.

Re: Why isn't online age verification just like showing your ID in person?

#110

Post by rolph »

miguelbemartin wrote: post #13

In my opinion, access to internet should always be behind a device controlled by an adult. And it should be this adult's responsibility to set appropriate restrictions for minors.

we trained our kids to avoid bad words we taught them to be ashamed of bad pictures, we put porn mags in a hidden location, we put sextoys in hidden location, we locked the pay channels on the cable box, but this internet thing came along and all of that is on there, we didnt lock the computer, or put it somewhere hidden, or the router, or the modem, we didnt lock the box for the service dropline, or for the starlink terminal, we decided to complain until pushing the entire service for everyone into the lock up, not only the kids.
Post reply on HN