Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What we call "age verification" is actually mass surveillance

pluralistic.net

Post reply on HN
Print view View original

311–320 of 520 posts

Re: What we call "age verification" is actually mass surveillance

#311

Post by microtonal »

Aaargh20318 wrote: post #93
Wowfunhappy wrote: post #16

Earlier quoted context omitted.

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general. Heck—in most cases, we can't even tell…

The way identity wallets work: The government issues an eID to your wallet. The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID. The government signs individual attributes combined…

The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID.

IMO, there are two other issues that need to be solved. The major one is that there should be some way to do attestation of devices that are not Google-certified Android or iOS. If this does not happen, the smartphone duopoly is permanently entrenched and not a fair/free market anymore. There is no way to use a smartphone without basically losing your privacy to Google/Apple and given the increasing importance of online services it's becoming increasingly impossible to live without a smartphone.

It was very disheartening that the EU reference implementation was rolled out with only Play Integrity and Apple's counterpart. IMO, this should have been solved before the reference implementation was rolled out to member countries, because many of them won't bother to go beyond that [1]. It is also completely counterproductive when it comes to EU tech sovereignty. There is a group of pioneers that are growing the sovereign ecosystems and then you cut them off.

The second, perhaps lesser, problem is that the security story is not super strong, because most Android phones do not even have a secure enclave (outside Pixel and Samsung flagships/A5x, there are very few). Instead they rely on TrustZone etc. which are regularly targeted by side-channel attacks, etc. Ironically, GrapheneOS is cut off from most of these systems (because Google Play Integrity), while it actually requires a secure enclave and is more secure than... well I guess every other smartphone.

[1] There is some hope, e.g. the developers of the Dutch identity wallet acknowledge the issue and are open to supporting alternative systems.

Re: What we call "age verification" is actually mass surveillance

#312

Post by Dylan16807 »

akmiller wrote: post #110
john_strinlai wrote: post #49

Earlier quoted context omitted.

i dont know what point you are trying to make. there are laws against underage drinking and buying alcohol. some kids still get access to alcohol. the law is mostly successful, with an acceptable amount of failure rate. same concept.

Gating is not just for porn, they are talking about using for social media and various other things. You can imagine that many things end up age gated if this becomes legislation, as a preventative measure. Then your 10% becomes problematic because you are either restricting or granting access based on invalid information. So in your world here we then need ways for people who were incorrectly gated to reach out and…

You're mixing up false positives and false negatives. Nobody is going to be incorrectly blocked under this system unless they lost their ID, and the fix there is getting a new ID.

Some kids skipping the block sometimes isn't catastrophic, especially because there won't be all this peer pressure to join adult social media when 90% or more are blocked.

Re: What we call "age verification" is actually mass surveillance

#313

Post by mindslight »

drnick1 wrote: post #310
mindslight wrote: post #198

Earlier quoted context omitted.

No, it only "requires" browser attestation if we taken it as a given that the onus is on tech companies for verifying who they are talking to - ie identity verification that most of these schemes boil down to regardless of how cute they're dressed up. To effectively keep adult content away from kids, it merely requires secure boot and closed app stores, which are already widespread. And they are only required on the…

> To effectively keep adult content away from kids, it merely requires secure boot and closed app stores This is unacceptable. If I own a computer, I expect to be able to build and run any program, either written by myself or others, without asking anyone for permission.

Maybe I needed to say "it merely requires the existence ...". Because I then do go on to say:

> And they are only required on the devices actually given to kids

My whole point is that this limits the blast radius, compared to any solution involving "age" (read: identity) verification which has a blast radius of every computing device!

Perhaps my other comment will show you where I'm coming from better: https://news.ycombinator.com/item?id=48645646

Re: What we call "age verification" is actually mass surveillance

#314

Post by teddyh »

john_strinlai wrote: post #2

> "Age verification" means that everyone who does anything online will have to submit to fine-grained tracking and recording of all their online activities. its been said 1000 times here, but: age verification doesn't have to be a nightmare dystopia of 24/7 fine-grained tracking and recording unless you are somehow hoping to achieve 100% success rate (something we have not done with any other law ever). there are sev…

This would be great and all, but all parties who are in a position to choose to implement this kind of system or to keep the status quo are already motivated to keep (and expand) the existing systems, for any number of reasons. Everybody (except the end users) loves to keep that juicy metadata and incidental logs of everything.

(Repost from 2021: https://news.ycombinator.com/item?id=26560821>)

Re: What we call "age verification" is actually mass surveillance

#315

Post by karussell »

Wowfunhappy wrote: post #16
john_strinlai wrote: post #2

> "Age verification" means that everyone who does anything online will have to submit to fine-grained tracking and recording of all their online activities. its been said 1000 times here, but: age verification doesn't have to be a nightmare dystopia of 24/7 fine-grained tracking and recording unless you are somehow hoping to achieve 100% success rate (something we have not done with any other law ever). there are sev…

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general. Heck—in most cases, we can't even tell…

I think the German Personalausweis has an electronic ID function that does this: age verification without giving out other information like name etc. But the application chooses which information is requested and could/will request more.

Unfortunately few know and use this information although the usage via NFC is not that complicated. Have used it successfully already a few times for banks, but including name information etc.

Re: What we call "age verification" is actually mass surveillance

#316

Post by Footprint0521 »

manapause wrote: post #264
Aaargh20318 wrote: post #93

Earlier quoted context omitted.

The way identity wallets work: The government issues an eID to your wallet. The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID. The government signs individual attributes combined…

What about at the device level? “You must be this tall to ride this ride” “ you must be 18 to own an iPhone 18+ “ I apologize for the drive-by question, and I appreciate your takes!

This would run into the same deal as VINs in the real world being tied to licenses, or serial numbers to guns. But the car equivalent of VMs/open hardware/custom firmware (imagine a $7 pi zero flashed with lineageOS “overage phone”) then becomes equivalent to a gun without a serial number, and suddenly open source/hardware people are felons and there is insane amount of control on hardware and software like it’s 1982.

This assumes that the government would be able to verify independently a phone serial number so that people’s IDs aren’t leaked. If not, then you’re back to the same thing as before since “drivers licenses” are stored by sites and shared around with advertisers

Re: What we call "age verification" is actually mass surveillance

#317

Post by terribleperson »

convolvatron wrote: post #293
terribleperson wrote: post #287

Earlier quoted context omitted.

It doesn't even need 'age verification'. Ostensibly, the goal is to prevent children from accessing content their parents don't want them to see. That means all that's needed is a standard way for parents to make sure that websites know their children are children. They don't need identity, they don't need actual age, we don't even need a complicated cryptographic solution. California had the right idea - establish a…

or don't put the burden on the website at all, but let the parent choose whitelists of child-appropriate sites based on whatever criteria they want.

This is already possible. There's not enough people doing it, so instead we get age verification schemes.

The benefit of an age attestation scheme is that it makes it easy for parents, while also diffusing future attempts to use children as an excuse for control.

Re: What we call "age verification" is actually mass surveillance

#318

Post by fluoridation »

CPLX wrote: post #281
fluoridation wrote: post #272

Earlier quoted context omitted.

I'm personally in favor of just banning children off the Internet, but I don't agree it's orthogonal to the discussion. What I replied to was the implication that someone should pay a recurring cost to prove they're an adult for the same reason that they pay to own a computer or to connect to the Internet. Don't disown the dumb thing you said.

I'm not disowning it at all. I think paying a recurring cost to prove you're an adult for purposes of accessing the internet is completely fine, trivial, and unimportant. You have to pay a cost to go out in public, since there are nudity laws. You have to pay a cost to use an airport or a train station. You have to pay a fee to prove that you own a car. And so on. It just doesn't matter. It's not important. It's cons…

>I think paying a recurring cost to prove you're an adult for purposes of accessing the internet is completely fine, trivial, and unimportant.

Okay, but the person you replied to doesn't, and instead of providing an actual answer to their question, you posed a false equivalence between proving your age and buying a computer.

>You have to pay a cost to go out in public, since there are nudity laws. You have to pay a cost to use an airport or a train station. You have to pay a fee to prove that you own a car. And so on.

You are purposefully muddying the waters by being lax with your use of language. The "cost" you "pay" by wearing appropriate attire in public is fundamentally different from the actual cost you actually pay when you engage in commerce; one is a trade of freedoms and the other is a trade of goods and/or services. If your argument is that the freedom you have to trade in exchange for the freedom to access the Internet, is that of not having to show an ID, that's one thing. If you also have to add a recurring monetary cost then that's another.

If you don't have an answer to the question of why someone should have to pay again to use the Internet beyond "*shrug* just 'cause, dude. Who cares?", then maybe you shouldn't have said anything.

Re: What we call "age verification" is actually mass surveillance

#320

Post by tarentel »

Wowfunhappy wrote: post #16
john_strinlai wrote: post #2

> "Age verification" means that everyone who does anything online will have to submit to fine-grained tracking and recording of all their online activities. its been said 1000 times here, but: age verification doesn't have to be a nightmare dystopia of 24/7 fine-grained tracking and recording unless you are somehow hoping to achieve 100% success rate (something we have not done with any other law ever). there are sev…

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general. Heck—in most cases, we can't even tell…

A lot of these age verifications things have to do with "protecting children". If that's the end goal we don't really need to verify anyone's age. Apple/Google, any smart phone maker, should be forced to add proper parental controls.

Parents should be able to control what apps can be used, what websites can be viewed, who the phone is able to contact.

That doesn't require knowing my age, or anyone else's.

Also, as an iOS developer, it's not my job to parent your child. The age ratings are clear on the app store, if you give your child unrestricted access to a phone that's on you, not me. If the OS doesn't have proper controls that's on Apple/Android, again, not my fault and not something I should be forced to police.

Thanks to Texas, I can see roughly how old your kid is. I'm not supposed to keep that information though. ;) I'm sure everyone who makes app will comply with that and not use that information for any other purposes and you can bet Texas has the means to audit every app on the app store to make sure that they're complying. lol

Post reply on HN