Live data from Hacker News

What we call "age verification" is actually mass surveillance

pluralistic.net

161–170 of 520 posts

Re: What we call "age verification" is actually mass surveillance

#161

Earlier quoted context omitted.

What's the point in making this distinction? This is HN, 99% of the users here are aware of what zero knowledge proof is and that it's possible to implement it that way. The general consensus and what the article is alluding to is that it will be probably implemented in a way that allows individual tracking and identification.

> What's the point in making this distinction? we're on a discussion board, so i started a discussion. that was the point.

I also only learned about Zero-Knowledge Proofs from links to articles, blogs, and discussions here so someone has to bring it up.

Re: What we call "age verification" is actually mass surveillance

#162

Earlier quoted context omitted.

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general. Heck—in most cases, we can't even tell…

The way identity wallets work: The government issues an eID to your wallet. The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID. The government signs individual attributes combined…

> which contains the device public key

And there it is.

Re: What we call "age verification" is actually mass surveillance

#163

Earlier quoted context omitted.

So now I have to have a mobile phone?

And one you don't fully own/control. Fully owned devices will be unsupported, obviously.

Sounds like what a government issued card should be used for, which seems fine

Re: What we call "age verification" is actually mass surveillance

#164

Earlier quoted context omitted.

What makes you think this will be close to 90%? Unless these cards are expensive I don't see that happening.

> What makes you think this will be close to 90%? Unless these cards are expensive I don't see that happening. its obviously just an illustrative guess. but if the penalty of possessing the card is similar to underage possession of alcohol/tobacco, and larger penalties if a store/person is found providing a card to someone underage, i see no reason why it wouldnt have a similar success rate as alcohol/tobacco.

Why possess the card when you can just buy the UUID on the dark web

Re: What we call "age verification" is actually mass surveillance

#165

Earlier quoted context omitted.

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general. Heck—in most cases, we can't even tell…

The way identity wallets work: The government issues an eID to your wallet. The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID. The government signs individual attributes combined…

> In practice this means no rooted/jailbroken phones.

Personally - this is less acceptable to me than just having the site collect my image/id.

I'd support just putting the id in a dedicated device (ex - gov issues smart key) or just accepting that sometimes people will share id info (just like... physical ids).

It doesn't even close all the doors to transferring ids - since I can still just hand someone a phone (just like... physical ids).

Re: What we call "age verification" is actually mass surveillance

#166

> "Age verification" means that everyone who does anything online will have to submit to fine-grained tracking and recording of all their online activities. its been said 1000 times here, but: age verification doesn't have to be a nightmare dystopia of 24/7 fine-grained tracking and recording unless you are somehow hoping to achieve 100% success rate (something we have not done with any other law ever). there are sev…

What's the point in making this distinction? This is HN, 99% of the users here are aware of what zero knowledge proof is and that it's possible to implement it that way. The general consensus and what the article is alluding to is that it will be probably implemented in a way that allows individual tracking and identification.

I don’t know? Maybe its the little give and take that helps build a solution that is mature and limits the kind of harms kid are facing, without sacrificing privacy?

It’s also the very cool, nuanced and technical tooling that people here tend to enjoy figuring out, and building.

It side steps the thought terminating tar pits of “privacy at all costs” or “save the children”.

Re: What we call "age verification" is actually mass surveillance

#167

Earlier quoted context omitted.

> Could you be more specific as to what you're imagining? sure, i'll put my favorite two. though you'll find much more detailed and thought-out versions of these (and others) in the dozens of other giant threads on the same topic. - buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is no…

And honestly, all these should ultimately just be done client side in the browser. After the browser has verified "User is x or user is over 21" there's no reason to then send that information to the website. Let websites issue a "window.isUserOver(16)" call once and then move forward based on the response to that query.

You can get their exact age by binary search.

Re: What we call "age verification" is actually mass surveillance

#168
post #127

Earlier quoted context omitted.

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general. Heck—in most cases, we can't even tell…

Using existing parental controls parents could set their kids age and that could be used for the age controls. Could the parents let the kids around the age gate? Sure but they could do that even if a government ID and camera was required. This actually might be more effective than a lot of these systems because other adults could not let the kids use their IDs

Existing parental controls don't work - new ones would have to be created.

Re: What we call "age verification" is actually mass surveillance

#169
I grew up during the 90s/2000s and I used the internet, first social media platforms, messengers, etc. – a lot. My parents had no idea of computers, how to use them, how to use the internet, what is out there etc. Yet I am convinced that the way my parents dealt with it is still the gold standard.

Their parenting equipped me well to deal with weird, dangerous or otherwise harmful things I encountered. They were the kind of parents who would let us play in the woods till 9 in the evening, no questions asked if there were scratched knees or dirty cloths. If there was something they thought might be problematic, they talked to us in a way that left the ultimate decision how to deal with a situation with us, displaying a high level of trust into our ability to make good decisions ourselves (and sometimes letting us make bad ones just to talk about it after the fact).

Turns out if you want your kid to be able to deal with unexpected situations you need them to deal with situations, period. And the opposite of that is what I even back then saw with many of my friends parents: trying to shield their kid from every encountering (and mastering!) even the tiniest of dangers themselves, alone. You think you tell your kid about the dangers of the world, so they know, but the actual lesson you teach is that only their parent knows what is and isn't dangerous and that they themselves can't be trusted to judge it. That is a bad lesson.

Don't get me wrong, we did stupid stuff, like jumping of bridges into rivers and so on. But we were very careful about how we did it, diving beforehand, etc. The real stupid stuff in my youth was all done by other kids that had never learned to judge risks themselves and who in one brazen attempt of rebellion bit off more than they could chew in one go. That landed them in the hospital. My brother and I were the only kids in our friends circle who made it to 18 without having broken a single bone in our bodies, despite being regular skateboarders, snowboarders, climbers, cliff jumpers and all other kinds of borderline insane past-times, some of which don't even have a name.

One aspect: Since my parents had no idea what was on the internet and how to protect against specific dangers lurking within it an educational method that didn't have to rely on them knowing and enumerating every danger in the world proved to be a really smart choice in hindsight. Since the landscapes of social media especially for kids and young teenagers is shifting constantly at a high pace, any parenting ideas would need to keep track of all this as well. I can't even imagine how that would work.

The alternative is to ban everything. But how do they build a healthy immune system if they are never even exposed to the mild dangers first?

Re: What we call "age verification" is actually mass surveillance

#170
post #57

Earlier quoted context omitted.

> mythical sweet-spot solutions? there are thousands of comments on these threads every time it comes up. there's tons of what i consider reasonable solutions proposed. there's examples below, too, which don't require face scans. > Concretely, half the websites I visit from the UK want me to either scan my face or upload ID documents yeah, i agree that really sucks.

I've yet to see one I consider reasonable.

[dead]
Post reply on HN