Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Discord/Twitch/Snapchat age verification bypass

age-verifier.kibty.town

Post reply on HN
Print view View original

441–450 of 494 posts

Re: Discord/Twitch/Snapchat age verification bypass

#441

Post by voxic11 »

hparadiz wrote: post #420
ongy wrote: post #412

Earlier quoted context omitted.

You could do some scheme that hashes a site specific identifier with an identifier on the smart element of the id. If that ever repeats, the same I'd was used twice. At the same time, the site ID would act as salt to prevent simple matching between services.

People do, in fact, have multiple profiles. For very valid reasons.

the solution to this seems to be to issue multiple "IDs". So essentially the government mints you a batch of like 30 "IDs" and you can use each of those once per service to verify an account (30 verified accounts per service). That allows for the use case of needing to verify multiple accounts without allowing you to verify unlimited accounts (and therefor run into the large scale misuse issue I pointed out).

If you need to verify even more accounts the government can have some annoying process for you to request another batch of IDs.

Re: Discord/Twitch/Snapchat age verification bypass

#442

Post by myself248 »

As always, motivated minors will trivially bypass things.

Only annoyed adults, who don't see the point in pursuing a bypass, will supply their actual ID, which is what will eventually get breached in the inevitable yet-another-breach.

These schemes only place the honest at risk.

Re: Discord/Twitch/Snapchat age verification bypass

#443

Post by [deleted] »

hparadiz wrote: post #419
littlecorner wrote: post #402

Earlier quoted context omitted.

And have schools stop giving kids laptops or tablets. I wonder how much of the Chromebooks for school incitive was to develop a new market for Google

It's wild seeing these opinions on hackernews of all places. Do we want future generations to know nothing about computing? I would not be here if I didn't get my start in my early teen years.

[deleted]

Re: Discord/Twitch/Snapchat age verification bypass

#444

Post by jabroni_salad »

unethical_ban wrote: post #421
jabroni_salad wrote: post #417

Earlier quoted context omitted.

If you want to host your own stoat server, you will also need to recompile the apps to use your URL and distribute them to your friends, and they will not be compatible for any other server.

Yes, I learned in the Zulip promo discussion earlier this week that self-hosted push notification servers have to have certs compiled directly into the app. I can't tell if it's malice, indifference or incompetence to have that design; any answer is completely believable. Is there an architectural opportunity to build a "Self-hosted push notification" app and business, where the push broker builds an app to deploy to…

This topic comes up with firebase avoidance on degoogled phones. Have a look at unifiedpush.org and ntfy.sh

There's an implementation sample here: https://fluffy.chat/en/faq/#push_without_google_services

Re: Discord/Twitch/Snapchat age verification bypass

#445

Post by jen729w »

einr wrote: post #307
Valodim wrote: post #272

Earlier quoted context omitted.

None of those play in the same league as discord for hosting a community, and none of them look in a position to be there in the foreseeable future. It sucks but that's how it is.

This is how it always is, until suddenly one day it isn't. Linux didn't play in the same league as serious and commercial UNIX systems until one fateful day it killed them all dead forever.

> until suddenly one day it isn't

Thread OP here. This is exactly my point: today isn't that day. I need it to be.

Some future server that I can migrate my community to isn't useful.

Re: Discord/Twitch/Snapchat age verification bypass

#446

Post by miohtama »

shevy-java wrote: post #229

"k-id, the age verification provider discord uses doesn't store or send your face to the server. instead, it sends a bunch of metadata about your face and general process details." I think the primary issue is not the "send your face" (face info) to a server. The problem is that private entities are greedy for user data, in this case tying facial recognition to activities related to interacting with other people, mos…

The point is that 1) someone can claim there is a verification so we protect kids 2) but more importantly, there is a lot of money to be made selling verification solutions and usually these SaaS companies are owned by regulators and their buddies who make the rules about verifications.

Compliance industry has grown from zero to $90B after we cracked the nut everything needs compliance.

Here is a good book about the topic https://www.amazon.com/Compliance-Industrial-Complex-Operati...

Re: Discord/Twitch/Snapchat age verification bypass

#447

Post by nine_k »

luke727 wrote: post #392
pil0u wrote: post #289

Earlier quoted context omitted.

I agree that government legislation is part of the equation, but I don't agree that moving to other platforms is not a solution. If Discord were to witness a significant exodus of paying users because of this new verification process, they would probably start fighting the fight themselves. That said, I don't expect this to happen, switching is very hard for many reasons.

I meant that it's not a solution for users looking to avoid similar intrusions. When alternative platforms get big enough they'll be faced with the same legislative burdens. Of course there are decentralized options, but one of the primary attractions of these centralized services is that everyone's on there.

The point is that the alternative platforms should be small per-community chat servers run by their users. A one-click installation on a $5/mo web host like DO or Vultr or similar. Good luck policing them away.

Re: Discord/Twitch/Snapchat age verification bypass

#448

Post by hparadiz »

voxic11 wrote: post #441
hparadiz wrote: post #420

Earlier quoted context omitted.

People do, in fact, have multiple profiles. For very valid reasons.

the solution to this seems to be to issue multiple "IDs". So essentially the government mints you a batch of like 30 "IDs" and you can use each of those once per service to verify an account (30 verified accounts per service). That allows for the use case of needing to verify multiple accounts without allowing you to verify unlimited accounts (and therefor run into the large scale misuse issue I pointed out). If you…

This is a solved problem in the authentication space. Short lived tokens backed by short lived keys.

A token is generated that has a timestamp and is signed by a private key with payload.

The public key is available through a public api. You throw out any token older than 30 seconds.

Unlimited IDs.

That's basically what you want.

Re: Discord/Twitch/Snapchat age verification bypass

#449

Post by devman0 »

Cthulhu_ wrote: post #315
HeckFeck wrote: post #300

Earlier quoted context omitted.

They aren't comparable. Showing an ID to a staff member isn't stripping my anonymity. I know the retailer won't have that on file forever, tied to me on subsequent visits. Also they stop ID'ing you after a certain age ;) There isn't any way to achieve the same digitally.

Actually there is, various age verification systems exist where the party asking for it does not need to process their ID, like the Dutch iDIN ( https://www.idin.nl/en/ ) that works not unlike a digital payment - the bank knows your identity and age, just like they know your account balance, and can sign off on that kind of thing just like a payment. I hope this becomes more widespread / standardized; the precursor f…

The privacy issue has two facets, when I show ID to get in to a club or buy alcohol, the entire interaction is transient, the merchant isn't keeping that information and the issuer of the credential doesn't know that happened (i.e. the government).

Just allowing a service provider to receive a third party attestation that you "allowed" still allows the third party to track what you are doing even if the provider can't. That's still unacceptable from a privacy standpoint, I don't want the government, or agents thereof, knowing all the places I've had to show ID.

Re: Discord/Twitch/Snapchat age verification bypass

#450

Post by hparadiz »

munk-a wrote: post #439
hparadiz wrote: post #419

Earlier quoted context omitted.

It's wild seeing these opinions on hackernews of all places. Do we want future generations to know nothing about computing? I would not be here if I didn't get my start in my early teen years.

When I was an early teen I had access to the internet but my activities weren't entirely unsupervised (and I doubt yours were either). Since it was a new technology there was a lot of discussion around how best to talk to children and make sure they felt safe reporting threats or harms to parents. A smart phone is too disconnected of a device when compared to the desktops we all grew up on. No one is talking about fu…

Mine was not supervised cause immigrant parents that didn't know anything about computers really. So more or less entirely unsupervised.

By 16 I was regularly ignoring my parents to go to bed when I was up coding or gaming and doing dumb script kiddie stuff on IRC.

I had an adult introduce me to Astalavista (https://en.wikipedia.org/wiki/Astalavista.box.sk)

Thinking back to that I was very well aware of the fucked up part of the internet much more so than most adults around me. People did in fact meet up in person with strangers from the internet even back then.

I think it's more important to teach around age 10-14 about the dark side of the internet so that late teens can know how to stay safe. Rather than simply throwing them into the reality of it unprepared as "adults".

Also frankly I don't want to know the search history of a late teen. There's a degree of privacy everyone is entitled to.

Post reply on HN