Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Age Verification Trap: Verifying age undermines everyone's data protection

spectrum.ieee.org

Post reply on HN
Print view View original

811–820 of 1001 posts

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#811

Post by godelski »

JamesLeonis wrote: post #806

The elephant in the room is 'unverified' users will overwhelmingly be underage kids, and that absence will be tracked across the internet. This whole thing inadvertently exposes who are the kids vs the adults programmatically. Second, if all it takes to get into underage spaces is not being verified, predators * will* notice and exploit this hole. Even the absence of information is information. > The Roblox games sit…

  > Second, if all it takes to get into underage spaces is not being verified, predators *will* notice and exploit this hole.
Well the default state is "assume underage". So the default state is be in same location as children. There's nothing for predators to exploit, they get access by default.

Which once people realize that, it all becomes really silly. The only way it would really work is by verifying that people are children, so only children can be in the gated location. But then you need to do mass surveillance on children and I think even the average person realizes this just makes that a great place for predators and the damage caused by a leak is far greater to children. Not to mention the impractical nature of it as children are less likely to able to verify themselves and honestly, you expect kids to jump through extra hoops?

Anyone that believes these systems will keep predators away from children haven't thought about even the most basic aspects of how these systems work. They cannot do what they promise

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#812

Post by with »

kids will just use their parents' credentials. it's not an edge case, it will actually just be a default behavior, I promise. platforms need to be safe by default, but that's the problem - safe by default doesn't play nice with engagement. platforms need engagement for profit. chicken and egg.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#813

Post by girvo »

hiciu wrote: post #626
EmbarrassedHelp wrote: post #498

Earlier quoted context omitted.

According to the EU Identity Wallet's documentation, the EU's planned system requires highly invasive age verification to obtain 30 single use, easily trackable tokens that expire after 3 months. It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". You have to blindly trust that the tokens will not be tracked, which is a total no-go for pr…

> EU's planned system requires highly invasive age verification EUDI wallets are connected to your government issued ID. There is no "highly invasive age verification". We are literally sending a request to our government's server to sign, with their private key, message "this john smith born on 1970-01-01 is aged over 18" + jwt iat. There are 3 claims in there. They are hashed with different salts. This all is signe…

> It's really not much different than what a banking app would require.

I can use my banking services through the web. Codifying the Google/Apple monopoly in law is gross.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#814

Post by nubg »

dogcomplex wrote: post #646
antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

Correct. A ZK Proof backed identity system is a significant bump up in both privacy and security to even what we have right now. Everyone does realize we're being constantly tracked by telemetry, right? A proper ZK economy would mitigate the vast majority of that tracking (by taking away any excuse for those in power to do so under the guise of "security") and create a market for truly-secure hardware devices, while…

Explain how the plastering of streets with cameras can be done in a privacy-preserving way?

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#815

Post by EmbarrassedHelp »

jajuuka wrote: post #606
Aurornis wrote: post #590

Earlier quoted context omitted.

Thanks for posting this. The inherent problem with all zero knowledge identity solutions is that they also prevent any of the safeguards that governments want for ID checking. A true zero knowledge ID check with blind signatures wouldn't work because it would only take a single leaked ID for everyone to authenticate their accounts with the same leaked ID. So the providers start putting in restrictions and logging and…

I mean that's kind of a problem with ANY solution. There will be workarounds and ways to break it. There is no perfect solution outside someone standing over you while on the internet. We need to look at this more like age checks on porn sites and gaming platforms where you just put in a birthdate. Obviously someone can lie, but that point isn't to be a perfect wall but a hurdle to clear to make sure users are aware…

> age checks on porn sites and gaming platforms where you just put in a birthdate

That's the only solution that truly protects user privacy and security. Video games and especially mature content should not require age verification. People's lives can be permanently destroyed over perfectly legal sexual fantasies, and thus anything that increases the risk of the information being tracked is unacceptable.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#816

Post by godelski »

EmbarrassedHelp wrote: post #498
antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

According to the EU Identity Wallet's documentation, the EU's planned system requires highly invasive age verification to obtain 30 single use, easily trackable tokens that expire after 3 months. It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". You have to blindly trust that the tokens will not be tracked, which is a total no-go for pr…

  > It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering".
Regulatory capture at its finest. Such a ruling gives Apple and Google a duopoly over the market.

Maybe worse, it encourages the push of personal computers to be more mobile like (the fact that we treat phones as different from computers is already a silly concept).

So when are we going to build a new internet? Anyone playing around with things like Reticulum? LoRA? Mesh networks?

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#817

Post by spaqin »

andrepd wrote: post #775
hiciu wrote: post #626

Earlier quoted context omitted.

> EU's planned system requires highly invasive age verification EUDI wallets are connected to your government issued ID. There is no "highly invasive age verification". We are literally sending a request to our government's server to sign, with their private key, message "this john smith born on 1970-01-01 is aged over 18" + jwt iat. There are 3 claims in there. They are hashed with different salts. This all is signe…

Great comment all around but > jailbreaking / "prevent tampering" > This is true. The eidas directive requires that secret material lives in a dedicated hardware / secure element. It's really not much different than what a banking app would require. This is unacceptable. So much talk about independence from the US, you simply cannot make it a hard requirement to use the duopoly to be a citizen (as if it wasn't a quas…

Funny how they just handwave it like it's a totally normal thing, like the insane situation with banking apps. Most people don't care as they run with whatever's available without modification, but we still should fight for the right to run the code we want on devices we own.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#818

Post by txrx0000 »

hiciu wrote: post #626
EmbarrassedHelp wrote: post #498

Earlier quoted context omitted.

According to the EU Identity Wallet's documentation, the EU's planned system requires highly invasive age verification to obtain 30 single use, easily trackable tokens that expire after 3 months. It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". You have to blindly trust that the tokens will not be tracked, which is a total no-go for pr…

> EU's planned system requires highly invasive age verification EUDI wallets are connected to your government issued ID. There is no "highly invasive age verification". We are literally sending a request to our government's server to sign, with their private key, message "this john smith born on 1970-01-01 is aged over 18" + jwt iat. There are 3 claims in there. They are hashed with different salts. This all is signe…

> We are literally sending a request to our government's server to sign

You've already lost. You're at the government's mercy. They can simply refuse to sign.

"Mr. John Smith, we noticed you've published some poorly-worded comments online. Why are you locked out of your account, you say? Oh, that's just an unfortunate technical issue with our signing system, happens all the time. Anyway, this is a friendly reminder for you to improve your online etiquette. Have a nice day."

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#819

Post by Seattle3503 »

jajuuka wrote: post #587

I feel like the ending undermines the whole piece. Throwing your hands up and going "we should do nothing" isn't really a solution. If a compromise exists I think it's adding age requests on device setup. There wouldn't be any verification but it could be used as a way to limit access to content globally. Content provides would just need a simple API to check if the age range fits and move right along. This puts more…

> Personally I do agree with the "do nothing" stance, but I don't think it's going to hold up among the wider public. The die is cast and far too many average people are supporting moves like this. So the first defense should be to steer that conversation in a better way instead of stonewalling.

I agree with this, and I find it frustrating how many people refuse to see this. It seems a lot of people would rather be "right" than compromise and keep the world closer to their stated values.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#820

Post by stevenjgarner »

Looking at actual data regarding Australia's landmark legislation setting a minimum age of 16 for social media access with enforcement starting on December 10, 2025 indicates weakened data protection. The Australian data suggests that while the legislation has successfully cleared the decks of millions of underage accounts (4.7 million account deactivations together with increased VPN usage and "ghost" accounts to bypass restrictions), it has simultaneously forced platforms to rely on third-party identity vendors, with the following failures so far:

1) Persona (Identity Vendor) Exposure (Feb 20, 2026): researchers discovered an exposed frontend belonging to Persona, an identity verification vendor used by platforms like Discord. This system was performing over 260 distinct checks, including facial recognition and "adverse media" screening, raising massive concerns about the scope creep of age verification.

2) Victorian Department of Education (Jan 2026): a breach impacting all 1,700 government schools exposed student names and encrypted passwords. This is a primary example of how child-related data remains a high-value target.

3) Prosura Data Breach (Jan 4, 2026): this financial services firm suffered a breach of 300,000 customer records.

4) University of Sydney (Dec 2025): a code library breach affected 27,000 people right as the new legislation was rolling out.

Post reply on HN