Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Age Verification Trap: Verifying age undermines everyone's data protection

spectrum.ieee.org

Post reply on HN
Print view View original

771–780 of 1001 posts

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#771

Post by stubish »

Starts off with a flawed assumption, playing into the hands of people who want surveillance.

"The only way to prove that someone is old enough to use a site is to collect personal data about who they are. And the only way to prove that you checked is to keep the data indefinitely."

If you start by legislating that you can't collect personal data or ID, then you are forced to do your age verification through other means. And legislate the government can't see what websites a user is visiting if you can to stop overreach. End result is a workable solution, zero knowledge proof or similar where government (the source of your ID documents) signs a token brokered by a proxy.

But when you start arguments from the position of 'no way to do this without violating privacy', the end result will be to violate privacy, because it seems an awful lot of people are demanding age verification and will sacrifice if they believe it is necessary.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#772

Post by andrepd »

> The only way to prove that someone is old enough to use a site is to collect personal data about who they are. And the only way to prove that you checked is to keep the data indefinitely.

Well isn't this premise false from the get go? Many countries (not the US sure, but others) have digitised ID. Services can request info from the ID provider; in this case social media websites would simply request a bool isOver16, literally one bit of information, to grant access. No other information needs to be leaked, and no need for idiotic setups like sending photos of your passport to god knows what website (or god knows what external vendor that website uses for ID verification).

Seems silly to worry about this when social media itself is predicated on collecting gigabytes of data about you daily.

Again, this is not about half assed solutions that force you to send photos of your passport to websites. That's a terrible idea for the reasons discussed in the article. But it's obviously false that this is the only way.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#773

Post by donmcronald »

kuon wrote: post #332

Even if you design the perfect system, kids will just ask parents for an unlocked account, many parents will accept, myself included. My kids have full access to the internet and I never used parental control, I talk to them. Of course, I don't want to give parenting advice, that would be presumptuous. But, my point is that a motivated kid will find a way, you have to "work" on that motivation. Many of the worst pres…

The solution is education. The most well adjusted kids I've seen are told flat out about the risks they'll face and, in general, helped to understand there are break points where things get too serious for them to try to deal with on their own.

I think that if you block all porn, social media, etc. all that does is create an opportunity for kids to be shifted to platforms controlled by bad actors. Adults fall victim to pig butchering schemes where they're given 100% fake investment apps that look completely real and they don't realize they're getting scammed until they try to get their money out of the system. There was a story in Canada about a guy and his daughter that thought they had $1 million in savings and it was a pig butchering scam with a fake app.

Are kids today equipped to deal with that? What happens when someone tells a kid to get app XYZ because it's un-moderated, but that app is controlled by a bad actor? Imagine a Snapchat like platform promising ephemeral messaging with simple username / password on-boarding so parents don't see account creation emails, but the app is run by organized crime.

I don't even know how you handle it if they manage to normalize the idea of children sending ID to random platforms. In addition to getting platform shifted and exploited, kids will be vulnerable to sending their real ID to bad actors.

The whole thing seems insane to me. Spend some money on education. That's the only long-term option.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#774

Post by femto »

techblueberry wrote: post #432
JohnMakin wrote: post #261

We'll try everything, it seems, other than holding parents accountable for what their children consume. In the United States, you can get in trouble if you recklessly leave around or provide alcohol/guns/cigarettes for a minor to start using, yet somehow, the same social responsibility seems thrown out the window for parents and the web. Yes, children are clever - I was one once. If you want to actually protect child…

I know this is weird, but I'm in some ways not really sure who is on the side of freedom here. I get your position, but like. The whole idea of the promise of the internet has been destroyed by newsfeeds and mega-corps. There is almost literally documented examples of Facebook executives twirling their mustaches wondering how they can get kids more addicted. This isn't a few bands with swear words, and in fact, I thi…

Don't conflate the Internet with Social Media. Social media is a service, just like FTP. The death of social media will not mean the death of the Internet. There's an argument that reducing social media use, by age verification or other means, will lead to a more free Internet due to reduced power of gatekeepers.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#775

Post by andrepd »

hiciu wrote: post #626
EmbarrassedHelp wrote: post #498

Earlier quoted context omitted.

According to the EU Identity Wallet's documentation, the EU's planned system requires highly invasive age verification to obtain 30 single use, easily trackable tokens that expire after 3 months. It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". You have to blindly trust that the tokens will not be tracked, which is a total no-go for pr…

> EU's planned system requires highly invasive age verification EUDI wallets are connected to your government issued ID. There is no "highly invasive age verification". We are literally sending a request to our government's server to sign, with their private key, message "this john smith born on 1970-01-01 is aged over 18" + jwt iat. There are 3 claims in there. They are hashed with different salts. This all is signe…

Great comment all around but

> jailbreaking / "prevent tampering"

> This is true. The eidas directive requires that secret material lives in a dedicated hardware / secure element. It's really not much different than what a banking app would require.

This is unacceptable. So much talk about independence from the US, you simply cannot make it a hard requirement to use the duopoly to be a citizen (as if it wasn't a quasi-hard requirement already)!

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#776

Post by harshreality »

cowboylowrez wrote: post #717
Terretta wrote: post #444

Earlier quoted context omitted.

> ... start with fuck these companies. Better the nanny state than Nanny Zuck. I'm not sure how those two positions connect. Execs bad, so laws requiring giving those execs everyone's IDs, instead of laws against twirled mustaches?

these are just bad arguments all around, including gov't with this upload id crap. Why aren't we making internet 18+? The only unrefutable answers I get are just downvotes which is ok I guess, sort of validates my point because there's no reason for kids to get unrestricted internet access and downvotes are easy.

How well would anything like that work in practice?

First of all, would we restrict all internet access, or just access to certain known sites and VPNs, letting everything else through because it's too insignificant even if it technically might merit being blocked for kids? I don't think a global internet block for minors is a good idea.

On wired internet, restricting access for devices that aren't clearly tied to individual users is problematic. Imposing age verification overhead on anyone who runs a network is unacceptable and unworkable. Locking non-mobile devices to individual users, in order to have mandatory software that blocks or sends age signals to the ISP, is also unacceptable and unworkable.

For mobile devices, maybe. There's a privacy problem if it's required for sim cards to be paid using credit cards, but if we do that, or if that's already effectively the case, I think it's fair that anyone who has an active credit card should be permitted on the "adult" internet. For multi-line accounts, we could make it a crime for the account holder to misrepresent age of the user of a line, i.e. to claim they're an adult when they're really a minor. Not very different from minors and cigarettes. It's not universally illegal for a parent to supply them, but it is in some places, and it should be.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#777

Post by jackvalentine »

JohnMakin wrote: post #261

We'll try everything, it seems, other than holding parents accountable for what their children consume. In the United States, you can get in trouble if you recklessly leave around or provide alcohol/guns/cigarettes for a minor to start using, yet somehow, the same social responsibility seems thrown out the window for parents and the web. Yes, children are clever - I was one once. If you want to actually protect child…

What is your proposed recourse for me as a parent if your kid shows my kid gore videos?

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#778

Post by [deleted] »

myrion wrote: post #617
donmcronald wrote: post #553

Earlier quoted context omitted.

> It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. How? If it’s analyzes my ID 100% client side I can fake any info I want. If my ID goes to a server, it’s compromised IMO. I think the zero proof systems being touted are like ephemeral messaging in Snapchat. That is, we’re being sold something that’s impossible and it only “works”…

There's no dynamic analysis done, necessarily. In the Swiss design, fex, SD-JWTs are used for selective disclosure. For those, any information that you can disclose is pre-hashed and included in the signed credential. So `over_18: true` is provided as one of those hashes and I just show this to the verifier. The verifier gets no other information than the strictly necessary (issuer, expiry, that kind of thing) and th…

[deleted]

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#779

Post by Seattle3503 »

bakugo wrote: post #206
bondarchuk wrote: post #34

It's kind of weird to me how every article on this topic here has people rushing to comment within a couple minutes with some generic "yes I too support ID checks for internet use!". Has the vibe really shifted so much among tech-literate people?

> Has the vibe really shifted so much among tech-literate people? HN has largely shifted away from tech literacy and towards business literacy in recent years. Needless to say that an internet where every user's real identity is easily verifiable at all times is very beneficial for most businesses, so it's natural to see that stance here.

You talk about tech literacy, but then conflate age verification with knowing someone's identity. You should see the work people are doing to perform age verification in a way that preserves privacy, for example the EU and Denmark.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#780

Post by conception »

aqme28 wrote: post #148

If we're going to do this at all, it should be on the device, not the website/app. Parents flag their child's device or browser as under 18, and websites/apps follow suit. Parents get the control they're looking for, while service providers don't have to verify or store IDs. I guess it's just more difficult to pressure big dogs like google/apple/mozilla for this than pornhub and discord.

Yeah vchip style with ratings, with a setting to hide unrated sites. A simple header. Done. Have all the browsers/os support it - easy peasy.
Post reply on HN