Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Age Verification Trap: Verifying age undermines everyone's data protection

spectrum.ieee.org

Post reply on HN
Print view View original

621–630 of 1001 posts

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#621

Post by myrion »

viktorcode wrote: post #541
antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

I have a few questions. In that system does the age verification result come with some sort of ID linked to my government issued ID card? Say, if I delete my account on a platform after verifying and then create a new one, will the platform get the same ID in the second verification, allowing it to connect the two and track me? Or is this ID global, potentially allowing to track me through all platforms I verified my…

In the Swiss system, it depends on what they verified. If they required your full ID, that has a document number like a passport and they could track that.

If they did the right thing and only asked for the over 18 bit, then they wouldn't have a trackable identifier.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#622

Post by fuzzfactor »

SecretDreams wrote: post #586
EmbarrassedHelp wrote: post #558

Earlier quoted context omitted.

Age verification tech companies are lobbying heavily for governments to legally require their services. The proposed "solutions" are about funneling money into the hands of other tech companies and shady groups, while violating user privacy. If anything, we should be banning the collection of any age related information to access social media and more mature content. We need companies to respect privacy, rather than…

If anything, we should be preventing young people from being exposed to the version of the internet that currently exists until the tech companies that made it this way offer a solution. I am all ears if you have an alternative that big tech can implement to ensure this is the case while they are given the task of cleaning up the mess they've made?

>If you are working on a product, or ever did work on a product, that made the internet worse rather than better, you have a shared responsibility to right that wrong.

This is how the "predatory debt" involved has built up, and grown exponentially until now, and the only thing Facebook considers as a solution would be to pay it down using other peoples' resources instead of their own.

No one else has matching leverage and the dollar figure would be many billions if not a full trillion or more, which is about what it's worth, and who else could afford that except Facebook?

So it has to come from the collective subtraction of everyone's complete privacy. Just to amount to something comparable.

Add that up and it shows you how valuable privacy really is and what it's worth in dollar figures.

Yes, do the math, privacy is worth more than Facebok no matter what, it always was and always will be.

You can't have both, so big tech should jettison Meta. Who else could afford it?

A more non-existential solution would be for Meta to fully fund a completely anonymous internet to replace the one that they soiled from the beginning, and let them keep the (anti-)social-media exclusive network separate.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#623

Post by qball »

CobrastanJorji wrote: post #519
JohnMakin wrote: post #261

We'll try everything, it seems, other than holding parents accountable for what their children consume. In the United States, you can get in trouble if you recklessly leave around or provide alcohol/guns/cigarettes for a minor to start using, yet somehow, the same social responsibility seems thrown out the window for parents and the web. Yes, children are clever - I was one once. If you want to actually protect child…

You're understating the US's policy on recklessness. We have "attractive nuisances," which means that if you put a trampoline in your backyard, and a kid passing through sees it, decides to do a sick jump off of it, and breaks their leg, that was partly your fault for having something so awesome that kids would probably like.

And that law is incredibly and hideously stupid, as it's a heckler's veto on having cool stuff.

The Internet is basically the final frontier where this harmful law doesn't reach, though the Karens are really trying to expand their power there.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#624

Post by tzs »

thewebguyd wrote: post #134
jonstaab wrote: post #110

Why is no one talking about using zero knowledge proofs for solving this? Instead of every platform verifying all its users itself (and storing PII on its own servers), a small number of providers could expose an API which provides proof of verification. I'm not sure if some kind of machine vision algorithm could be used in combination with zero-knowledge technology to prevent even that party from storing original do…

People are talking about it, at least here anyway. The reason you don’t see it in policy discussion from the officials pushing these laws is because removal of anonymity is the point. It’s nit about protecting kids, it never was. It’s about surveillance and a chilling effect on speech.

You do see it in policy discussions from officials in the EU. You probably don't see it in policy discussions in the US because the groups that should be telling US officials how to do age verification without giving up anonymity are not doing so.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#625

Post by ajam1507 »

Forgeties79 wrote: post #612
throwawayk7h wrote: post #579

Earlier quoted context omitted.

Parents can't easily prevent their kids from going to those kinds of stores once they're at the age where the parent doesn't need to keep an eye on them all the time and they can travel about on their own. The difference though is that parents are generally the ones to give their kids their phones and devices. These devices could send headers to websites saying "I'm a kid" -- but this system doesn't exist, and parent…

So what’s the alternative? Pretend we don’t live in a digitally connected society and set our kids up for failure when they get one years after their peers?

Keeping your kids off social media is setting them up for success.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#626

Post by hiciu »

EmbarrassedHelp wrote: post #498
antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

According to the EU Identity Wallet's documentation, the EU's planned system requires highly invasive age verification to obtain 30 single use, easily trackable tokens that expire after 3 months. It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". You have to blindly trust that the tokens will not be tracked, which is a total no-go for pr…

> EU's planned system requires highly invasive age verification

EUDI wallets are connected to your government issued ID. There is no "highly invasive age verification".

We are literally sending a request to our government's server to sign, with their private key, message "this john smith born on 1970-01-01 is aged over 18" + jwt iat. There are 3 claims in there. They are hashed with different salts. This all is signed by the government.

You get it with the salts. When you want to prove you are 18+ you include salt for the "is aged over 18" claim, and the signed document with all the salts and the other side can validate if the document is signed and if your claim matches the document.

No face scanning, no driver license uploading to god-knows-where, no anything.

> to obtain 30 single use, easily trackable tokens that expire after 3 months

This is the fallback mechanism. You are supposed to use bbs+ signatures that are zero knowledge, are computed on the device and so on. It is supposed to provide the "unlinkability". I don't feel competent enough to explain how those work.

> jailbreaking / "prevent tampering"

This is true. The eidas directive requires that secret material lives in a dedicated hardware / secure element. It's really not much different than what a banking app would require.

> You have to blindly trust that the tokens will not be tracked

This is not true, the law requires core apps to be opensource. Polish EUDI wallet has been even decompiled by a youtuber to compare it with sources and check if the rumors about spying are true. So you can check yourself if the app tracks you.

Also we can't have a meaningful discussion without expanding on definition of "tracking".

Can the site owner track you when you verify if you are 18+? Not really, each token is unique, there should be no correlation here.

Can the government track you? No, not alone.

Can the site owner and the government collude to track you? Yes they can! Government can track all salts for your tokens, site can collect all salts, they can compare notes. There are so called policy mitigations currently: audits and requirements for governments to remove salts from memory the moment stuff is issued.

Can they lie? Sure.

Can the site owner and the government collude to track you if you are using bbs+? No. Math says no.

Can they lie if you are using bbs+? Math says no.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#627

Post by EmbarrassedHelp »

chrishare wrote: post #598
EmbarrassedHelp wrote: post #498

Earlier quoted context omitted.

According to the EU Identity Wallet's documentation, the EU's planned system requires highly invasive age verification to obtain 30 single use, easily trackable tokens that expire after 3 months. It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". You have to blindly trust that the tokens will not be tracked, which is a total no-go for pr…

Link?

https://github.com/eu-digital-identity-wallet/av-doc-technic...

https://www.forbes.com/sites/federicoguerrini/2025/08/10/who...

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#628

Post by bix6 »

thegrim33 wrote: post #513
techblueberry wrote: post #432

Earlier quoted context omitted.

I know this is weird, but I'm in some ways not really sure who is on the side of freedom here. I get your position, but like. The whole idea of the promise of the internet has been destroyed by newsfeeds and mega-corps. There is almost literally documented examples of Facebook executives twirling their mustaches wondering how they can get kids more addicted. This isn't a few bands with swear words, and in fact, I thi…

Nobody is putting a gun to your head and forcing you to use Facebook or whatever other site. I quit using most social media over a decade ago. If you don't want to use it, or you don't want your children to use it, then don't use it.

O yeah? Where’s that guy who couldn’t get a job 6 months ago because he refuses to use LinkedIn.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#629

Post by jatari »

trueismywork wrote: post #336
estimator7292 wrote: post #319

Earlier quoted context omitted.

Companies are legally prohibited from marketing and selling certain products like tobacco and alcohol because they historically tried to . Parents are legally and socially expected to keep their kids away from tobacco and alcohol. You're breaking legal and social convention if you allow your kids to access dangerous drugs. Capitalist social media is exactly as dangerous as alcohol and tobacco. Somebody should be held…

So we should ban social media is what you're saying but not what OC is saying.

All "social media" that uses recommendation algorithms should be unavaliable to children.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#630

Post by rcbdev »

techblueberry wrote: post #432
JohnMakin wrote: post #261

We'll try everything, it seems, other than holding parents accountable for what their children consume. In the United States, you can get in trouble if you recklessly leave around or provide alcohol/guns/cigarettes for a minor to start using, yet somehow, the same social responsibility seems thrown out the window for parents and the web. Yes, children are clever - I was one once. If you want to actually protect child…

I know this is weird, but I'm in some ways not really sure who is on the side of freedom here. I get your position, but like. The whole idea of the promise of the internet has been destroyed by newsfeeds and mega-corps. There is almost literally documented examples of Facebook executives twirling their mustaches wondering how they can get kids more addicted. This isn't a few bands with swear words, and in fact, I thi…

For all the complaining some U.S.-Americans seem to do about the EU approach to these issues, things like the Digital Markets Act aim to fix exactly these types of issues.
Post reply on HN