Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why isn't online age verification just like showing your ID in person?

eff.org

Post reply on HN
Print view View original

111–120 of 123 posts

Re: Why isn't online age verification just like showing your ID in person?

#111

Post by saghm »

johnnienaked wrote: post #91
saghm wrote: post #44

Earlier quoted context omitted.

No, I think what they want is not to have the rest of us have to jump through hoops (and sacrifice privacy) to achieve the same thing. Some of us don't have kids (or live in a household with any), so passing a law that potentially limits our internet access to solve a "problem" that already is dubious is ridiculous.

I couldn't agree more

Fair enough! I misunderstood your previous comment as implying that measures like this were needed due to the unlikelihood of parents enforcing this. (There's probably a joke somewhere in here about "parent" comments as well, but I'm not clever enough to figure it out at the moment).

Re: Why isn't online age verification just like showing your ID in person?

#112

Post by takinola »

1718627440 wrote: post #107
takinola wrote: post #105

Earlier quoted context omitted.

How would you prevent the token from being used by a different person than it was issued to? This is the online equivalent of getting your older cousin to buy you alcohol from the store using their own valid ID

How do you prevent your house key being used by a different person, that it was not issued to?

I don’t get the analogy. I keep my house keys out of the hands of people I don’t want in. In this case, the age verification is being circumvented by someone simply asking another person to perform it on their behalf.

I guess the practical answer is that it’s impossible because there’s always the option to have an adult perform the verification and then hand over the device to the minor

Re: Why isn't online age verification just like showing your ID in person?

#113

Post by bigbadfeline »

takinola wrote: post #105
Izkata wrote: post #104

Earlier quoted context omitted.

This is far from the best way to do it, but this is a much easier to understand example of how it could be done without having to read about math: There's a type of token called a JWT that's really common nowadays, which is composed of 3 parts: Metadata describing encryption for the third part, the actual base64-encoded data, and the encrypted signature. The second part would include "is over 18" and "expiration date…

How would you prevent the token from being used by a different person than it was issued to? This is the online equivalent of getting your older cousin to buy you alcohol from the store using their own valid ID

Why do you want the online process to be more secure than the one using physical IDs?

Re: Why isn't online age verification just like showing your ID in person?

#114

Post by EarthMephit »

swid wrote: post #50
zug_zug wrote: post #25

Cryptographically there are techniques that let you prove you're one of the several hundred million adults in the US that don't reveal anything about which adult you are. It's much less complicated than bitcoin. I'm bringing this up because it's the perfect litmus test to show whether you really care about age verification, or if you want personal trackability for all internet behavior. I'd be okay with this for cert…

Not really. There are ways to prove ownership of one of several hundred million tokens. If you give out this many tokens, the odds that some will be stolen or sold must be fairly close to 1.

Aren't these all solved problems that we've worked out decades ago with certificates?

Certificates prove that a website/server (and sometimes the client) are who they say they are.

We force the website to renew their certificate from an issuer every year so that stolen tokens/certificates are less of a problem.

The issuer can protect or hide the identity of the certificate owner, and doesn't get any information about which clients accessed a server.

Re: Why isn't online age verification just like showing your ID in person?

#115

Post by takinola »

bigbadfeline wrote: post #113
takinola wrote: post #105

Earlier quoted context omitted.

How would you prevent the token from being used by a different person than it was issued to? This is the online equivalent of getting your older cousin to buy you alcohol from the store using their own valid ID

Why do you want the online process to be more secure than the one using physical IDs?

Mostly because online process can scale a lot further and faster. An older cousin can only walk into a store to buy so much alcohol but a stolen token can be reused a million times in a second.

Re: Why isn't online age verification just like showing your ID in person?

#116

Post by swid »

EarthMephit wrote: post #114
swid wrote: post #50

Earlier quoted context omitted.

Not really. There are ways to prove ownership of one of several hundred million tokens. If you give out this many tokens, the odds that some will be stolen or sold must be fairly close to 1.

Aren't these all solved problems that we've worked out decades ago with certificates? Certificates prove that a website/server (and sometimes the client) are who they say they are. We force the website to renew their certificate from an issuer every year so that stolen tokens/certificates are less of a problem. The issuer can protect or hide the identity of the certificate owner, and doesn't get any information about…

The real problem is just managing identities for millions of people. Some of those people will voluntarily use their credentials for someone under 18. Some will sell their identities. There is no technical solution to that.

Re: Why isn't online age verification just like showing your ID in person?

#117

Post by techjamie »

1718627440 wrote: post #109
surgical_fire wrote: post #75

Earlier quoted context omitted.

This is something I am conflicted about as a parent. My daughter is still a baby, so the problem is still a few years away. But I don't know how to best handle it. In some ways, I see social media as more poisonous to the brain than alcohol or tobacco. So, forbidding - or heavily limiting - internet access sounds like a plan. On the other hand, part of me being a parent is teaching her how to navigate the world. And…

You don't teach your child to deal with alcohol by telling it to try it out.

My parents did exactly that, but not in a large quantity. Gave me a sip of a really crappy beer when I was young and basically told me it all tasted like that.

Did a pretty good job of not tempting me to try it very much.

Re: Why isn't online age verification just like showing your ID in person?

#118

Post by jraby3 »

pseudalopex wrote: post #83
jraby3 wrote: post #49

Earlier quoted context omitted.

Can you send a link or explain how this can be done? As a not super tech savvy parent I find it impossible to keep my son off screens. He always finds a workaround. So I'm a fan of age verification especially after reading The Anxious Generation, despite all the hate it gets from hacker news.

> hate You meant logical criticism?

I mean one sided criticism that doesn't account for the damage done to kids by having no online limits, and assuming everyone in the world is as tech savvy as they are.

Re: Why isn't online age verification just like showing your ID in person?

#119

Post by 1718627440 »

takinola wrote: post #112
1718627440 wrote: post #107

Earlier quoted context omitted.

How do you prevent your house key being used by a different person, that it was not issued to?

I don’t get the analogy. I keep my house keys out of the hands of people I don’t want in. In this case, the age verification is being circumvented by someone simply asking another person to perform it on their behalf. I guess the practical answer is that it’s impossible because there’s always the option to have an adult perform the verification and then hand over the device to the minor

Yes, the analogy is the burglar getting into the house by asking you to open your door for them. Adults are permitted to decide such a thing, because they know the risks and are expected to be able to reason about that. When an adult has decided, then there is no problem, as far as age verification is concerned. We have regulations when adults are in fact not able to decide such a thing "correctly".

We already have penalties for adults mistreating children by exposing them to dangerous things, but this is orthogonal to age verification.

Re: Why isn't online age verification just like showing your ID in person?

#120

Post by danaris »

mariusor wrote: post #96
danaris wrote: post #88

Earlier quoted context omitted.

So then you're just back to the even more basic problem of "is the person using this device the same person that the payload was signed on behalf of?"

Yep. But in my mind that's being mitigated by the real measure for identity proof, which is some type of electronic ids.

Which a) has a whole host of other concerns associated with it, and b) still does not solve that problem, because it's not at all hard for a child (especially a teenager!) to sneak their parent's ID, use it to authenticate for a service, then put it back.

After all, are most services going to require the ID to be present for every session? Or are they going to require a one-time authentication for the account?

Post reply on HN