Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Age Verification Trap: Verifying age undermines everyone's data protection

spectrum.ieee.org

Post reply on HN
Print view View original

611–620 of 1001 posts

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#611

Post by myrion »

tgsovlerkhgsel wrote: post #533
uniq7 wrote: post #423

Earlier quoted context omitted.

In your system, can companies verify age offline, or do they need to send a token to the Government's authority to verify it (letting the Government identify and track users)? Switzerland is working on a system that does the former, but if Government really wants to identify users, they can still ask the company to provide the age verification tokens they collected, since the Government hosts a centralized database t…

Aren't the companies also expected to do revocation checking, essentially creating a record of who identified where, with a fig leaf of "pseudonymity" (that is one database join away from being worthless)?

The revocation checking is implemented in a way where the government doesn't know who you checked and you can even cache the information (if that's good enough for you) so they won't notice at all.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#612

Post by Forgeties79 »

throwawayk7h wrote: post #579
belorn wrote: post #290

Earlier quoted context omitted.

I am a bit confused by that comment. Are parents social responsible to prevent companies from selling alcohol/guns/cigarettes to minors? If a company set up shop in a school and sold those things to minors during school breaks, who has the social responsibility to stop that?

Parents can't easily prevent their kids from going to those kinds of stores once they're at the age where the parent doesn't need to keep an eye on them all the time and they can travel about on their own. The difference though is that parents are generally the ones to give their kids their phones and devices. These devices could send headers to websites saying "I'm a kid" -- but this system doesn't exist, and parent…

So what’s the alternative? Pretend we don’t live in a digitally connected society and set our kids up for failure when they get one years after their peers?

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#613

Post by ImPleadThe5th »

bondarchuk wrote: post #34

It's kind of weird to me how every article on this topic here has people rushing to comment within a couple minutes with some generic "yes I too support ID checks for internet use!". Has the vibe really shifted so much among tech-literate people?

I think it's complicated by the turning tide on the health effects of social media.

So people are kind of primed for "makes sense to keep kids from these attention driven platforms"

But I think the average person isn't understanding the implications of the facial/id scanning.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#614

Post by Wobbles42 »

user3939382 wrote: post #580
Wobbles42 wrote: post #461

The purpose of a system is what it does. Undermining data protection and privacy is clearly the point. The fact that it's happening everywhere at the same time makes it look to me like a bunch of leaders got together and decided that online anonymity is a problem. It's not like kids having access to adult content is a new problem after all. Every western government just decided that we should do something about it at…

No, this is proven false by reducing this theory to the individual level. Anyone who has tried to design/imagine -> actually build something, be it an artist, architect, song writer, programmer, or otherwise, knows there is inevitably a gap between design and realization. No one involved in that process would at any point consider the gap to be part of its “purpose”. People do hide their intentions but that doesn’t g…

Bugs get fixed when systems are iterated on. They also tend to be single results from single mistakes, not compound end results of the implementation.

Design features tend to persist.

The phrase/idiom "the purpose of a system is what it does" maps best to situations where a multiple decisions within a system make little sense when viewed through the lens of the stated purpose, but make perfect sense if the actual outcome is the desired one.

It is an invitation to analyze a system while suspending the assumption of good faith on the part of the implementors.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#615

Post by wedog6 »

chris37879 wrote: post #515
techblueberry wrote: post #432

Earlier quoted context omitted.

I know this is weird, but I'm in some ways not really sure who is on the side of freedom here. I get your position, but like. The whole idea of the promise of the internet has been destroyed by newsfeeds and mega-corps. There is almost literally documented examples of Facebook executives twirling their mustaches wondering how they can get kids more addicted. This isn't a few bands with swear words, and in fact, I thi…

Those execs were also using the tactics to addict adults, and while they may have targeted teens, the problem is, at its core: humans. So no amount of nannying by either the company nor the government will solve this issue. Who would be responsible if a child developed alcohol addiction? A nicotine problem? Any other addiction? Exactly. The same people that should be responsible for giving them unfettered access to a…

> Who would be responsible if a child developed alcohol addiction? A nicotine problem? Any other addiction?

The government literally actively prevents people selling all these things to children, rather than permit a free for all and then expect parents to take responsibility for steering their kids away from them.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#616

Post by tzs »

EmbarrassedHelp wrote: post #504
jonstaab wrote: post #110

Why is no one talking about using zero knowledge proofs for solving this? Instead of every platform verifying all its users itself (and storing PII on its own servers), a small number of providers could expose an API which provides proof of verification. I'm not sure if some kind of machine vision algorithm could be used in combination with zero-knowledge technology to prevent even that party from storing original do…

Zero knowledge proofs are only private and anonymous in theory, and require you to blindly trust a third party. In practice the implementation is not anonymous or private.

What third party do they require you to blindly trust?

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#617

Post by myrion »

donmcronald wrote: post #553
antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

> It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. How? If it’s analyzes my ID 100% client side I can fake any info I want. If my ID goes to a server, it’s compromised IMO. I think the zero proof systems being touted are like ephemeral messaging in Snapchat. That is, we’re being sold something that’s impossible and it only “works”…

There's no dynamic analysis done, necessarily. In the Swiss design, fex, SD-JWTs are used for selective disclosure. For those, any information that you can disclose is pre-hashed and included in the signed credential. So `over_18: true` is provided as one of those hashes and I just show this to the verifier.

The verifier gets no other information than the strictly necessary (issuer, expiry, that kind of thing) and the over 18 bit, but can trust that it's from a real credential.

That's not strictly a zero knowledge proof based system, though, but it is prvacy-preserving.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#618

Post by Avamander »

numbsafari wrote: post #281
JohnMakin wrote: post #261

We'll try everything, it seems, other than holding parents accountable for what their children consume. In the United States, you can get in trouble if you recklessly leave around or provide alcohol/guns/cigarettes for a minor to start using, yet somehow, the same social responsibility seems thrown out the window for parents and the web. Yes, children are clever - I was one once. If you want to actually protect child…

Except companies provide wholly inadequate safeguards and tools. They are buggy, inconsistent, easily circumvented, and even at time malicious. Consumers should be better able to hold providers accountable, before we start going after parents. The only real solution is to keep children off of the internet and any internet connected device until they are older. The problem there is that everything is done on-line now…

Yes, but how on earth is their malicious compliance at providing parental controls a good reason to go for the surveillance state that hurts absolutely everyone?

Social media operators love the surveillance state idea. That's why they aren't pushing against this.

I even cancelled YT Premium because their "made for kids" system interfered with being able to use my paid adult account. I urge other people to do the same when the solutions offered are insufficient.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#619

Post by MatteoFrigo »

vaylian wrote: post #491
alvatar wrote: post #287

zero knowledge cryptography solves this

Is there any production ready implementation out there?

ZKP is integrated in Google Wallet and has been running in production for a few months. We (Google) released the ZKP library as open source last year (this is the library used in production).

Announcement: https://blog.google/innovation-and-ai/technology/safety-secu...

Library: https://github.com/google/longfellow-zk

Paper: https://eprint.iacr.org/2024/2010

Afterwards, folks from ISRG produced an independent implementation https://github.com/abetterinternet/zk-cred-longfellow with our blessing and occasional help. I don't know if the authors would call it "production ready" yet, but it is at least code complete, fast enough, and interoperable with ours.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#620

Post by Aurornis »

jajuuka wrote: post #606
Aurornis wrote: post #590

Earlier quoted context omitted.

Thanks for posting this. The inherent problem with all zero knowledge identity solutions is that they also prevent any of the safeguards that governments want for ID checking. A true zero knowledge ID check with blind signatures wouldn't work because it would only take a single leaked ID for everyone to authenticate their accounts with the same leaked ID. So the providers start putting in restrictions and logging and…

I mean that's kind of a problem with ANY solution. There will be workarounds and ways to break it. There is no perfect solution outside someone standing over you while on the internet. We need to look at this more like age checks on porn sites and gaming platforms where you just put in a birthdate. Obviously someone can lie, but that point isn't to be a perfect wall but a hurdle to clear to make sure users are aware…

> I mean that's kind of a problem with ANY solution. There will be workarounds and ways to break it.

That's unnecessarily reductive.

Yes, every solution will have problems, but not all solutions have similar problems.

If a solution has problems such that it can be immediately reduced to security theater and bypassed by any teenager who cares, it's just extra hassle and privacy degradation for the rest of us.

These details matter. If a weak solution is regulated into law and the government discovers kids are easily bypassing it, they will immediately pivot into requiring more restrictions on it.

Post reply on HN