Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Users claim Discord's age verification can be tricked with video game characters

thepinknews.com

Post reply on HN
Print view View original

61–70 of 193 posts

Re: Users claim Discord's age verification can be tricked with video game characters

#61

Post by parsimo2010 »

dom96 wrote: post #58
jhgg wrote: post #4

> government passes law that requires companies to age verify users > said government provides no way to actually verify a human's age > hilarity ensues

This really deserves a digital solution. Let me get a government account and generate tokens that websites can ingest to confirm I'm an adult (and other optional details about me). Having to use passports or poor solutions like face scanning isn't good enough. I guess the reason they don't do this is because they fear the cost, anything governments price up these days seems to be in the billion range. So the politici…

When you place all the requirements on a software product like what the government has to, then it’s going to be expensive. Anyone who thinks that the total cost of a privacy protecting, government accredited, widely available, reliable, audited, and domestically produced age verification system isn’t going to be in the hundreds of millions has never actually shipped something comparable.

It is literally illegal to slap a few lines of glue code and say “there’s your age verification, look how cheap it is.” The public would be happy about saving money right up until there’s a massive privacy breach and all the ways you cut corners are exposed.

I don’t know if leaving the standards unspecified is the right thing to do (it’s probably not), but don’t pretend like a government verified solution could ever be cheap when dealing with citizens’ identities.

Re: Users claim Discord's age verification can be tricked with video game characters

#62

Post by close04 »

dfghjk4 wrote: post #34
Culonavirus wrote: post #20

Earlier quoted context omitted.

My bank has an API endpoint that (basically) returns your name and age (in this use case). It can return more for signing electronic docs etc. and is basically your digital ID. https://en.wikipedia.org/wiki/BankID Need to buy "toys", vape products, alcohol... anything adult online? There's a 3rd party web app (you rightfully don't trust) as an age check in the shopping cart / user account of any of these adult shops,…

Identity shouldn’t be tied to a private institution that requires you to have a bank account to login. Two of the well-used solutions to identity in the U.S. are login.gov (government-managed) and id.me (private, but used by government). Basically to get setup, at some point you have to have physical presence to get an actual government-approved physical ID, which can still be a barrier to some, but it doesn’t requir…

Whether it’s a government controlled or private identity provider which can or has to provide data to the government, in the end it’s still the perfect way to control what people do online. It’s age restricted stuff at first, but can just as well be applied to any store or social media. Not so eager to express your dissent if it has your name stapled to it.

Re: Users claim Discord's age verification can be tricked with video game characters

#63

Post by stavros »

Hamuko wrote: post #55
jhgg wrote: post #4

> government passes law that requires companies to age verify users > said government provides no way to actually verify a human's age > hilarity ensues

EU is also gonna require companies to verify ages but there's a white label application that EU member states can use. https://ageverification.dev/ If I've understood it correctly, Pornhub can't see anything except that you've turned 18 (no names, no date of births, nothing) and your local government can't see that you've signed up for Pornhub using the app.

Yes, this is correct. As I understand it, the server asks the application some questions ("is the user above 18?" "are they a resident of country X?" or whatever), you confirm that you want to share the answer, and the application just gets "yes" or "no" to each question.

Re: Users claim Discord's age verification can be tricked with video game characters

#64

Post by gambiting »

cronin101 wrote: post #33
Culonavirus wrote: post #20

Earlier quoted context omitted.

My bank has an API endpoint that (basically) returns your name and age (in this use case). It can return more for signing electronic docs etc. and is basically your digital ID. https://en.wikipedia.org/wiki/BankID Need to buy "toys", vape products, alcohol... anything adult online? There's a 3rd party web app (you rightfully don't trust) as an age check in the shopping cart / user account of any of these adult shops,…

As a Brit that relocated to Norway a decade ago, trust me when I say you cannot fathom the lack of organization around identity that the UK (somewhat intentionally) has. (It’s constantly used for political Godwin’s-law fear-mongering) There is no centralized ID number, the closest is your social security number but this is basically only outbound for PAYE tax and haphazardly correlated to your pension payments in lat…

>>There is no centralized ID number, the closest is your social security number

Until you find out that due to a cock up years ago the National Insurance numbers are not guaranteed to be unique, and you realize that somehow the best proof of identity British people have is a humble driving licence because DVLA is at least somewhat competent.

Re: Users claim Discord's age verification can be tricked with video game characters

#65

Post by criley2 »

parsimo2010 wrote: post #61
dom96 wrote: post #58

Earlier quoted context omitted.

This really deserves a digital solution. Let me get a government account and generate tokens that websites can ingest to confirm I'm an adult (and other optional details about me). Having to use passports or poor solutions like face scanning isn't good enough. I guess the reason they don't do this is because they fear the cost, anything governments price up these days seems to be in the billion range. So the politici…

When you place all the requirements on a software product like what the government has to, then it’s going to be expensive. Anyone who thinks that the total cost of a privacy protecting, government accredited, widely available, reliable, audited, and domestically produced age verification system isn’t going to be in the hundreds of millions has never actually shipped something comparable. It is literally illegal to s…

I disagree. This is exactly what happened with the initial launch of Healthcare.gov after the Affordable Care Act. The government spent hundreds of millions contracting a large firm that completely botched the site, it couldn't even handle a few hundred users at launch.

Then a small team of highly skilled engineers from Google/Facebook etc were brought in to fix it. They stabilized and relaunched the system in weeks at a fraction of the original cost. It showed that the problem wasn't the complexity or the standards, it was how the project was managed and who was building it.

Re: Users claim Discord's age verification can be tricked with video game characters

#66

Post by 2OEH8eoCRo0 »

jhgg wrote: post #4

> government passes law that requires companies to age verify users > said government provides no way to actually verify a human's age > hilarity ensues

Why should the govt provide a way to verify? They should fine companies that violate. Companies will figure how to comply because they don't want to be fined.

Re: Users claim Discord's age verification can be tricked with video game characters

#67

Post by Retr0id »

hhh wrote: post #5

I think the way discords setup works is reasonable. It’s an on-device model that only submits the outcome of the scan to the platform. I hope they just improve that performance, rather than see this and back out of it entirely and require ID checks.

On-device models are excellent for privacy, but they are fundamentally broken from a security perspective. Preventing people from spoofing the results would involve locking them out of their own devices, via DRM.

Re: Users claim Discord's age verification can be tricked with video game characters

#68

Post by 2OEH8eoCRo0 »

Something that's occurred to me is that we are already deanonymized and tracked everywhere online but most people are fine with it because it's done secretly and transparently (you don't notice). Age verification w/ something like a license online brings the issue front and center. It's not hidden that you are not anonymous online and people freak out.

Re: Users claim Discord's age verification can be tricked with video game characters

#69

Post by hhh »

Retr0id wrote: post #67
hhh wrote: post #5

I think the way discords setup works is reasonable. It’s an on-device model that only submits the outcome of the scan to the platform. I hope they just improve that performance, rather than see this and back out of it entirely and require ID checks.

On-device models are excellent for privacy, but they are fundamentally broken from a security perspective. Preventing people from spoofing the results would involve locking them out of their own devices, via DRM.

I understand, and think that there’s an acceptance criteria for some level of fraud tbh.

Re: Users claim Discord's age verification can be tricked with video game characters

#70

Post by zdragnar »

criley2 wrote: post #65
parsimo2010 wrote: post #61

Earlier quoted context omitted.

When you place all the requirements on a software product like what the government has to, then it’s going to be expensive. Anyone who thinks that the total cost of a privacy protecting, government accredited, widely available, reliable, audited, and domestically produced age verification system isn’t going to be in the hundreds of millions has never actually shipped something comparable. It is literally illegal to s…

I disagree. This is exactly what happened with the initial launch of Healthcare.gov after the Affordable Care Act. The government spent hundreds of millions contracting a large firm that completely botched the site, it couldn't even handle a few hundred users at launch. Then a small team of highly skilled engineers from Google/Facebook etc were brought in to fix it. They stabilized and relaunched the system in weeks…

IIRC, it wasn't even that it contracted one firm, it contracted many, and the individual contracts were managed separately. None of the systems were actually required to work with each other in letter, only in spirit.

The major advantage of bringing in the engineers (only one ex-googler, most were oracle and redhat, again IIRC) was that they were all already bigwigs and knew how to take ownership of large systems, and were given the authority to do so.

Post reply on HN