'You must be 13 years old or older to create an account on this forum.'
Yeah, sure. Whatever you say, Jack.
The Age Verification Trap: Verifying age undermines everyone's data protection
801–810 of 1001 posts
Re: The Age Verification Trap: Verifying age undermines everyone's data protection
#802It's kind of weird to me how every article on this topic here has people rushing to comment within a couple minutes with some generic "yes I too support ID checks for internet use!". Has the vibe really shifted so much among tech-literate people?
It's very odd. I see it everywhere I go. I think a lot of the younger generation supports it, actually. They didn't really grow up with a culture of internet anonymity and some degree of privacy.
The younger generation is growing up where the internet is a giant dumpster fire of enshitification that a tanker full of gasoline just got poured on in the form of AI chatbots. With agents becoming even easier the equivalent of script kiddies are going to make it so much worse.
Privacy with respect to the government was one of the final pillars, but when everything placed on the internet is absorbed by the alphabets of government agencies, and the current admin does searches of it as their leisure they understand nothing is anonymous anymore.
It's funny that this is what the younger generation is going to think Millennials and older are completely stupid for still supporting. The current structure only benefits corporations and bots.
Re: The Age Verification Trap: Verifying age undermines everyone's data protection
#803Age verification is very hard, because parents will give their children their unlocked account, and children will steal their parents' unlocked account. If that's criminalized (like alcohol), it will happen too often to prosecute (much more frequently than alcohol, which is rarely prosecuted anyways). I don't see a solution that isn't a fundamental culture shift. If there's a fundamental culture shift, there's an eas…
Yes we need a fundamental shift where sharing of parent accounts is akin to atleast some sort of infraction or maybe even a misdemeanor.
Just remove "parent" and "account" from the mix and all these. Tie the screen to the human and most of these challenges go away. This is what is trying to be achieved with these laws, so we may as well institute it that way.
Re: The Age Verification Trap: Verifying age undermines everyone's data protection
#804I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…
I have a few questions. In that system does the age verification result come with some sort of ID linked to my government issued ID card? Say, if I delete my account on a platform after verifying and then create a new one, will the platform get the same ID in the second verification, allowing it to connect the two and track me? Or is this ID global, potentially allowing to track me through all platforms I verified my…
You are describing a situation where a pairwise pseudonymous identifier is generated. I don't think any real system does this with government IDs, but it might be possible.
Re: The Age Verification Trap: Verifying age undermines everyone's data protection
#805Earlier quoted context omitted.
How does this solve the problem at all? You're just making more problems. Now you have to deal with a black market of "unlocked" phones. You're having to deal with kids sharing unlocked phone. Would police have to wal around trying to buy unlocked phones to catch people selling them to minors? What about selling phones on the internet, would they check ID now? SOME parents give their children access to their ID. That…
It would not be solved without a culture shift. But with a culture shift, giving a kid an unlocked device would be as rare as giving them drugs. I'm sure it will occasionally happen. But kids are terrible at keeping secrets, so they will only have the unlocked device for temporary periods, and I believe infrequent use of the modern internet is much, much less damaging than the constant use we see problems from today.…
> It would not be solved without a culture shift. But with a culture shift, giving a kid an unlocked device would be as rare as giving them drugs.
You understand that to many people that is a very obvious reason why we should never do this and they do not want that culture shift, right?
Re: The Age Verification Trap: Verifying age undermines everyone's data protection
#806The elephant in the room is 'unverified' users will overwhelmingly be underage kids, and that absence will be tracked across the internet. This whole thing inadvertently exposes who are the kids vs the adults programmatically.
Second, if all it takes to get into underage spaces is not being verified, predators *will* notice and exploit this hole.
Even the absence of information is information.
> The Roblox games site, which recently launched a new age-estimate system, is already suffering from users selling child-aged accounts to adult predators seeking entry to age-restricted areas, Wired reports.
I rest my case.
Re: The Age Verification Trap: Verifying age undermines everyone's data protection
#807Earlier quoted context omitted.
It's this I believe: https://www.w3.org/TR/vc-data-model-2.0/
A Verifiable Credential fundamentally doesn't solve the problem of "sharing", "smuggling". All it takes is one verified adult to "leak" their VC somewhere, and millions of underage people would be able to use it to "prove" they are over 18. This would only work with something like MS TPM 2 / Apple Secure Enclave (device attestation), which is anti-freedom by design. I was curious if they found a way around that (mayb…
You could use an oblivious pairwise pseudonym, and then you do not require hardware attestation. But that does essentially limit one ID to one account per service.
Re: The Age Verification Trap: Verifying age undermines everyone's data protection
#808Earlier quoted context omitted.
According to the EU Identity Wallet's documentation, the EU's planned system requires highly invasive age verification to obtain 30 single use, easily trackable tokens that expire after 3 months. It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". You have to blindly trust that the tokens will not be tracked, which is a total no-go for pr…
> EU's planned system requires highly invasive age verification EUDI wallets are connected to your government issued ID. There is no "highly invasive age verification". We are literally sending a request to our government's server to sign, with their private key, message "this john smith born on 1970-01-01 is aged over 18" + jwt iat. There are 3 claims in there. They are hashed with different salts. This all is signe…
> Government can track all salts for your tokens, site can collect all salts, they can compare notes.
That is not zero knowledge. Given that actual zero-knowledge systems are well understood, the only reason to deploy a system that allows that would be if you planned to abuse it.
Re: The Age Verification Trap: Verifying age undermines everyone's data protection
#809Age verification is very hard, because parents will give their children their unlocked account, and children will steal their parents' unlocked account. If that's criminalized (like alcohol), it will happen too often to prosecute (much more frequently than alcohol, which is rarely prosecuted anyways). I don't see a solution that isn't a fundamental culture shift. If there's a fundamental culture shift, there's an eas…
> I don't see a solution that isn't a fundamental culture shift.
What shift?
Re: The Age Verification Trap: Verifying age undermines everyone's data protection
#810Earlier quoted context omitted.
> EU's planned system requires highly invasive age verification EUDI wallets are connected to your government issued ID. There is no "highly invasive age verification". We are literally sending a request to our government's server to sign, with their private key, message "this john smith born on 1970-01-01 is aged over 18" + jwt iat. There are 3 claims in there. They are hashed with different salts. This all is signe…
> Government can track all salts for your tokens, site can collect all salts, they can compare notes. That is not zero knowledge. Given that actual zero-knowledge systems are well understood, the only reason to deploy a system that allows that would be if you planned to abuse it.
What is your definition of zero knowledge?