Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EFF launches Age Verification Hub

eff.org

Post reply on HN
Print view View original

261–270 of 371 posts

Re: EFF launches Age Verification Hub

#261

Post by delusional »

raw_anon_1111 wrote: post #164
delusional wrote: post #156

Earlier quoted context omitted.

> How many kids say “I really want to smoke weed but it’s illegally so I won’t do it”? I think it's generally accepted that marijuana use increases after legalization. So yes.

Not according to the CDC with kids https://www.mpp.org/issues/legalization/adult-use-legalizati...

My guy, this is making the opposite argument from what you think:

"On the illegal market, no one is checking IDs before selling marijuana. When and where cannabis is illegal, high schoolers often sell cannabis to their peers. In contrast, licensed cannabis stores have overwhelming compliance with age-gating."

It has indeed not increased the cannabis use of kids, but that would also still be illegal. That study is an argument that age gating works.

Re: EFF launches Age Verification Hub

#262

Post by delusional »

pksebben wrote: post #175
delusional wrote: post #156

Earlier quoted context omitted.

> How many kids say “I really want to smoke weed but it’s illegally so I won’t do it”? I think it's generally accepted that marijuana use increases after legalization. So yes.

You would think so, but DARE increased adolescent usage of some drugs while having little to no effect on others. Turns out being illegal isn't as much of a disincentive as being uncool. If your parents are smoking it...

We have newer and more relevant data than DARE.

Re: EFF launches Age Verification Hub

#263

Post by Nevermark »

prophesi wrote: post #254
Nevermark wrote: post #243

Why don't we have zero-knowledge age verification? One actor verifies ages - and they only need to do so once. Sites give users a key tied to their user account to run by their verifier, who returns another key that attests to their verified age encoded for that specific site, to give back to the site. The site doesn't know anything about the user, but their user login info. The verifier doesn't know anything about w…

I think you're suggesting a centralized actor to verify the age of users which is problematic on multiple accounts. Practicality, privacy, enforcement, liability to coercion/corruption, and so on. This might be a wild take, but I think platforms could do a lot more to help with moderation to prevent child predators. Instead of just being okay with them finding outside avenues to converse with their victims through th…

There could be several verifiers. You pick the one you trust the most.

Or you pick three verifiers of your choice who you coordinate between to get verified, without knowing who each other are.

Re: EFF launches Age Verification Hub

#264

Post by Nevermark »

vbs_redlof wrote: post #247
Nevermark wrote: post #243

Why don't we have zero-knowledge age verification? One actor verifies ages - and they only need to do so once. Sites give users a key tied to their user account to run by their verifier, who returns another key that attests to their verified age encoded for that specific site, to give back to the site. The site doesn't know anything about the user, but their user login info. The verifier doesn't know anything about w…

Because it's not about age verification, it's about setting up infrastructure to enable incremental enchroachment on privacy. Fun fact: many ZK identity solutions run centralized provers and can be subpoenaed. Need to use something that generates proofs client-side.

> Because it's not about age verification, it's about setting up infrastructure to enable incremental enchroachment on privacy.

Yes. You are emphasizing a reason it would be a good idea.

Sideline the ulterior/hidden motive. Or at a minimum, force it into the open, where it has less of a chance. (Ulterior motives are kept quiet for a reason.)

> Fun fact: many ZK identity solutions run centralized provers and can be subpoenaed. Need to use something that generates proofs client-side.

Subpoenas are one of the many privacy problems solved by this.

If there is no log of your real identity tied to visiting a site, there is nothing to hack or subpoena.

A verifier can report you got keys validated. But they don't know what sites they were for.

Sites can ensure users are vetted for age. Without knowing who they are.

This is such a classic cryptography scenario, I don't know how it isn't being pushed to the center of this debate. Anything that reduces the practical tension between divisive goal posts is going to have practical benefit, and make worst case legislation much less likely.

Re: EFF launches Age Verification Hub

#265

Post by nyc_data_geek1 »

godelski wrote: post #257
edgineer wrote: post #252

Earlier quoted context omitted.

I'm sure those people exist, I just never happen to see anything they write online nor meet any of them in real life.

We're all in bubbles. But it's good to expand them when you recognize you're in one.

And the Internet also consists in large part of bots talking to bots. This is not to say that some people won't always promulgate the "Won't somebody please think of the children?" argument every time an expansion of the surveillance state apparatus is in question, but rather to say that we should not take for granted that every bad opinion we see online is one deeply held by any real people.

Re: EFF launches Age Verification Hub

#266

Post by [deleted] »

pksebben wrote: post #168
topkai22 wrote: post #153

Earlier quoted context omitted.

Age verification is absolutely about kids. It’s also being used (or hijacked into) a vehicle for people who want increased surveillance. There is a ton of evidence that there are harms to unrestricted online access for kids and teens (the book The Anxious Generation is cultural touchstone for this topic at this point). There is a real, well reasoned, and valid movement to do something about this problem. The solution…

As many others have mentioned in this thread and others, there are ways - effective and straightforward ways - that we could be protecting our kids from the harms that come with the www. The harms are real. The solution is a Surveillance Wolf wearing a dead Save The Kids Sheep(tm). Solutions that might work - RTA headers [0]. More robust parental controls. Not this reimagining of the rules of the internet in service…

[deleted]

Re: EFF launches Age Verification Hub

#267

Post by hunter2_ »

kahnclusions wrote: post #234
pksebben wrote: post #202

Earlier quoted context omitted.

the more I think about it, the more I feel like I need someone with deep knowledge to explain ZKPs to me. So like, we've got this algorithm that gets sent our way and we run it and that provides kind of a cryptographic hash or whatever. But if we're running the algorithm ourselves what's to stop us from lying? Where does the 'proof' come from? What's the check that it's running and why do we inherently trust the sour…

I’m not exactly sure about ZKPs but for age verification the “proof” can come from the government but in such a way that the web service doesn’t know anything more than whether an assertion is true, and the government doesn’t know anything more than you wanted to verify some assertion. This is a simplified method for age verification: I want to buy alcohol from my phone and need to prove I’m over 18. SickBooze.com as…

> the government [...] only know[s] that I needed to verify an assertion about my age

This is problematic if a majority of things needing age verification are looked down upon; for example, insurance companies would love to know what people don't do things needing age and therefore don't buy alcohol (at least not online).

Re: EFF launches Age Verification Hub

#268

Post by kmoser »

mikeyouse wrote: post #230
reorder9695 wrote: post #116

Earlier quoted context omitted.

In real life the situation is different. When I buy alcohol, someone looks at my drivers licence, does not make a copy of it, forgets it quickly, and cannot tie it to other information about me. As soon as it's online and it's copies, I can't tell what happens on anyone else's servers. I don't want any company knowing my actual name and location, then that can be tied to more data, which is what Google etc have been…

Not sure if you've bought alcohol lately, but at most large grocers near me, they're scanning licenses now instead of just verifying the birth date - and I'm pretty confident those scans aren't just checking the birthdate and then deleting all record of the interaction..

Pro tip: those scanners probably don't work with passports, so a human must still eyeball your passport to verify that you're old enough.

Re: EFF launches Age Verification Hub

#269

Post by magicalhippo »

crote wrote: post #147
magicalhippo wrote: post #136

Earlier quoted context omitted.

> None of them are part of the Age Verification discussion because kids are not the actual point of Age Verification. The EU age verification solution says implementations SHOULD implement[1] their ZKP protocol[2]. Not linking it to the user is stated as an explicit goal: Unlinkability: The goal of the solution is to prevent user profiling and tracking by avoiding linkable transactions. Initially, the solution will r…

If privacy is an explicit goal, why isn't it a MUST? Why even bother with the initial batch issuance phase? And what's stopping them from silently adopting a batch size of 1?

> Why even bother with the initial batch issuance phase?

This is a solution that requires non-trivial interaction between many paries.

It seems very reasonable to want to get the parties started on the implementation so they can iron out issues in the infrastructure they're building while they work on the details of the ZKP aspects.

Re: EFF launches Age Verification Hub

#270

Post by cocoto »

Epa095 wrote: post #259
rlpb wrote: post #11

I'd be OK with an "I am a child" header mandated by law to be respected by service providers (eg. "adult sites" must not permit a client setting the header to proceed). On the client side, mandate that consumer devices that might reasonably be expected to be used by children (every smartphone, tablet, smart TV, etc) have parental controls that set the header. Leave it to parents to set the controls. Perhaps even hold…

It would be possible to make a website which proxies other sites, but strips this header, right (maybe with some added ads)? If so I would expect such sites to appear, and the only way to secure a child device is to have a whitelist of webpages (to avoid the proxies), putting us back close to where we are today.

Such sites would be illegal if not sharing the header back from the source website and be banned as much as adult websites incorrectly setting this header. It’s not a real problem.
Post reply on HN