The Age Verification Trap: Verifying age undermines everyone's data protection • Hacker News Board

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#681

Post by SiempreViernes » Mon, Feb 23, 2026, 9:56 PM UTC

agentifysh wrote: post #531

antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

this is slightly better but not the hero we want or need. zeero knowledge proofs are improvement over uploading raw documents, trust is still an issue here. why should users have to authenticate with a government-backed identity wallet to access platforms to play games or access a website in the first place. we didnt have any of these guards in the 90s and early 2000s and everybody turned out just fine . in fact the…

> we didnt have any of these guards in the 90s and early 2000s and everybody turned out just fine

One of the most highly valued tech companies of today makes a software that sometimes talks its user's into killing themselves. Some guy put "uwu notices bulge" on a bullet casing and shot Charlie Kirk: things turned out fine indeed.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#682

Post by rkagerer » Mon, Feb 23, 2026, 9:58 PM UTC

mikestorrent wrote: post #677

JohnMakin wrote: post #261

We'll try everything, it seems, other than holding parents accountable for what their children consume. In the United States, you can get in trouble if you recklessly leave around or provide alcohol/guns/cigarettes for a minor to start using, yet somehow, the same social responsibility seems thrown out the window for parents and the web. Yes, children are clever - I was one once. If you want to actually protect child…

> give parents strong monitoring and restriction tools The problem is that it's bloody hard to actually do this. I'm in a war with my 7yo about youtube; the terms of engagement are, I can block it however I want from the network side, and if he can get around it, he can watch. Well, after many successful months of DNS block, he discovered proxies. After blocking enough of those to dissuade him, he discovered Firefox…

Sounds like a smart kid, is part of you secretly proud of him for his tenacity?

Is it impractical to keep an eye on what he's doing on his computer, i.e. physically checking in on him from time to time?

How about holding him responsible for his own behavior, to develop respect for the rules you impose? Is it just hopeless, and if so how come? Is it impossible for him to understand why you don't want him watching certain content or why he should care about being worthy of your trust?

I'm not judging here, I'm genuinely curious.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#683

Post by fuzzfactor » Mon, Feb 23, 2026, 9:59 PM UTC

Aurornis wrote: post #672

techblueberry wrote: post #432

Earlier quoted context omitted.

I know this is weird, but I'm in some ways not really sure who is on the side of freedom here. I get your position, but like. The whole idea of the promise of the internet has been destroyed by newsfeeds and mega-corps. There is almost literally documented examples of Facebook executives twirling their mustaches wondering how they can get kids more addicted. This isn't a few bands with swear words, and in fact, I thi…

> I just like, can't help but start with fuck these companies. All other arguments are downstream of that. Better the nanny state than Nanny Zuck. Wild times when we're seeing highest voted Hacker News commenters call for the nanny state. If you're thinking these regulations will be limited to singular companies or platforms you don't use, there is no reason to believe that's true. There was already outrage on Hacker…

OK, here's another one.

How about taking all these websites that require PII onto their own members-only domain?

This actually should have been in place and well fleshed-out before Google & Microsoft started pushing their "account" nonsense.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#684

Post by [deleted] » Mon, Feb 23, 2026, 10:00 PM UTC

JohnMakin wrote: post #261

We'll try everything, it seems, other than holding parents accountable for what their children consume. In the United States, you can get in trouble if you recklessly leave around or provide alcohol/guns/cigarettes for a minor to start using, yet somehow, the same social responsibility seems thrown out the window for parents and the web. Yes, children are clever - I was one once. If you want to actually protect child…

[deleted]

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#685

Post by SiempreViernes » Mon, Feb 23, 2026, 10:01 PM UTC

armchairhacker wrote: post #289

horsawlarway wrote: post #234

Earlier quoted context omitted.

I don't understand how this is any better. It's my job as a parent (and I have several kids...) to monitor the things they consume and talk with them about it. I don't want some blanket ban on content unless it's "age appropriate", because I don't approve that content being banned. (honestly - the idea of "age appropriate" is insulting in the first place) Fuck man, I can even legally give my kids alcohol - I don't se…

You should be able to choose what's age-appropriate for your kids. Giving them access to e.g. "PG-13" media when they're 9 isn't the problem. Giving mature kids unrestricted access isn't a problem. The problem is culture: - Many parents don't think about restricting their kids' online exposure at all. And I think a larger issue than NSFW is the amount of time kids are spending: 5 hours according to this survey from 2…

> Parents that want to restrict their kids struggle with ineffective parental controls: https://beasthacker.com/til/parental-controls-arent-for-pare.... Optional parental controls would fix this

Did you mean "mandatory" parental controls? All current systems are optional and as you describe they are frequently ineffective, so not clear why keeping things like they are would be different.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#686

Post by user3939382 » Mon, Feb 23, 2026, 10:02 PM UTC

Wobbles42 wrote: post #614

user3939382 wrote: post #580

Earlier quoted context omitted.

No, this is proven false by reducing this theory to the individual level. Anyone who has tried to design/imagine -> actually build something, be it an artist, architect, song writer, programmer, or otherwise, knows there is inevitably a gap between design and realization. No one involved in that process would at any point consider the gap to be part of its “purpose”. People do hide their intentions but that doesn’t g…

Bugs get fixed when systems are iterated on. They also tend to be single results from single mistakes, not compound end results of the implementation. Design features tend to persist. The phrase/idiom "the purpose of a system is what it does" maps best to situations where a multiple decisions within a system make little sense when viewed through the lens of the stated purpose, but make perfect sense if the actual out…

> Bugs get fixed when systems are iterated on.

It’s not that simple. Especially not in politics but even in the domain you’re referencing, have you ever seen Mozilla’s bug tracker? Once your project is so big and involves so many people you move beyond fixing everything you want.

There may be central planning at play, in this case I assume there is, but to claim it necessarily is relies on an oversimplification that doesn’t exist in human political machines that are a giant ship of theseus essentially. There’s no identity -> management capacity proven anywhere enough to make that kind of claim. Institutions inherit and have emergent behavior driven by the dynamics of their constituents/individuals. That includes the inability to create imagined outcomes reliably. The platonic intent and physical regimes cannot be integrated.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#687

Post by Galanwe » Mon, Feb 23, 2026, 10:03 PM UTC

Aurornis wrote: post #582

Galanwe wrote: post #449

Well there are technical solutions for this: blind signatures. I could generate my own key, have the government blind sign it upon verifying my identity, and then use my key to prove I'm an adult citizen, without anyone (even the signing government) know which key is mine. Any veryfying entity just need to know the government public key and check it signed my key.

The ID check laws are about matching an identity to a user account. If the identity check was blind it wouldn't actually be an identity check. It would be "this person has access to an adult identity". If there is truly no logging or centralization, there is no limit on how many times a single ID could be used. So all it takes is one of those adult blind signatures to be leaked online and all the kids use it to verif…

I don't quite get your point. The signer is blind to what it signs, but that does not mean there is no identity per se.

A signed key is still unique.

- You can still check that user 1 and user 2 don't use the same key.

- You can still issue a challenge to the user every 10 days to make sure he has indeed access to his key and not just borrowed it.

- You can still enforce TPM use of said keys, so that they cannot be extracted or distributed online, but require a physical ID card.

- You can still do whatever revocation system you want for the cases when a key is stolen or lost.

Really the "blind" nature of the signature changes nothing to what you would normally do with a PKI.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#688

Post by Aurornis » Mon, Feb 23, 2026, 10:08 PM UTC

hiciu wrote: post #639

Aurornis wrote: post #590

Earlier quoted context omitted.

Thanks for posting this. The inherent problem with all zero knowledge identity solutions is that they also prevent any of the safeguards that governments want for ID checking. A true zero knowledge ID check with blind signatures wouldn't work because it would only take a single leaked ID for everyone to authenticate their accounts with the same leaked ID. So the providers start putting in restrictions and logging and…

> A true zero knowledge ID check with blind signatures That is not true and "true zero knowledge ID check" + "age verification" with blind signatures is what's being implemented by the EU ID project. So someone's id leaks. It happens. In EUDI there are things called "cryptographic accumulators of non-revocation proofs". If your ID leaks it goes into the accumulator. Similar to the certificate revocation lists. During…

You're assuming the leak was accidental, the person knows about it, and they didn't intend for others to use it.

What happens when someone sets up a marketplace where people can sell those blind signatures using their ID for $2 each? And then kids just pay $2 to have someone else blindly use their ID to validate the account, because supposedly the system is structured so that nobody can tell which ID was used or tie it back to the account?

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#689

Post by Aurornis » Mon, Feb 23, 2026, 10:10 PM UTC

Galanwe wrote: post #687

Aurornis wrote: post #582

Earlier quoted context omitted.

The ID check laws are about matching an identity to a user account. If the identity check was blind it wouldn't actually be an identity check. It would be "this person has access to an adult identity". If there is truly no logging or centralization, there is no limit on how many times a single ID could be used. So all it takes is one of those adult blind signatures to be leaked online and all the kids use it to verif…

I don't quite get your point. The signer is blind to what it signs, but that does not mean there is no identity per se. A signed key is still unique. - You can still check that user 1 and user 2 don't use the same key. - You can still issue a challenge to the user every 10 days to make sure he has indeed access to his key and not just borrowed it. - You can still enforce TPM use of said keys, so that they cannot be e…

You're only describing a half-blind system.

If the site you send your information to gets a uniquely identifying piece of information, that's not blind to your identity.

> - You can still check that user 1 and user 2 don't use the same key.

The systems described elsewhere in the thread give people a set of signatures that can't be traced back to their source.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#690

Post by fsflover » Mon, Feb 23, 2026, 10:11 PM UTC

Gormo wrote: post #527

pokstad wrote: post #438

Earlier quoted context omitted.

Social media is like tobacco. We went after tobacco for targeting kids, we should do the same to social media. Highly engineered addictive content is not unlike what was done to cigarettes.

No, it isn't. Tobacco is a physical substance that alters users' biochemistry and creates a physical dependence. Social media is information conveyed via a computing device. You can criticize social media for what it is in its own right, without having to engage in these kinds of disingenuous equivocations.

Yes, it is: https://news.ycombinator.com/item?id=24579498