Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Age Verification Trap: Verifying age undermines everyone's data protection

spectrum.ieee.org

Post reply on HN
Print view View original

821–830 of 1001 posts

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#821

Post by dcow »

horsawlarway wrote: post #234
armchairhacker wrote: post #55

Age verification is very hard, because parents will give their children their unlocked account, and children will steal their parents' unlocked account. If that's criminalized (like alcohol), it will happen too often to prosecute (much more frequently than alcohol, which is rarely prosecuted anyways). I don't see a solution that isn't a fundamental culture shift. If there's a fundamental culture shift, there's an eas…

I don't understand how this is any better. It's my job as a parent (and I have several kids...) to monitor the things they consume and talk with them about it. I don't want some blanket ban on content unless it's "age appropriate", because I don't approve that content being banned. (honestly - the idea of "age appropriate" is insulting in the first place) Fuck man, I can even legally give my kids alcohol - I don't se…

Your kids can’t buy alcohol though. If you want to unlock your phone and let your kids read smut then more power to you. Age gates do not and never will stop that. But I sure as hell don’t want companies selling porn to 5 yr olds.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#822

Post by dcow »

jatari wrote: post #634
horsawlarway wrote: post #234

Earlier quoted context omitted.

I don't understand how this is any better. It's my job as a parent (and I have several kids...) to monitor the things they consume and talk with them about it. I don't want some blanket ban on content unless it's "age appropriate", because I don't approve that content being banned. (honestly - the idea of "age appropriate" is insulting in the first place) Fuck man, I can even legally give my kids alcohol - I don't se…

The law is there to protect children in the case they have absent/neglectful parents. Unfortunately not every child has a parent as aware as you.

And to prevent companies from targeting children inappropriately.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#823

Post by stevenjgarner »

antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

If the age verification is going to mandate government issued ID, the government issuer can be the Trust Anchor issuing a Digitally Signed Credential for the zero knowledge proof - using any available open source zero-knowledge process:

1) zkcreds-rs (zk-creds) [1]

2) zkLogin (Sui Foundation) [2]

3) TLSNotary [3]

4) DECO (Chainlink/Cornell) [4]

5) Anon-Aadhaar [5]

[1] https://github.com/rozbb/zkcreds-rs

[2] https://github.com/mystenlabs/sui/tree/main/sdk/zklogin

[3] https://github.com/tlsnotary/tlsn

[4] https://chain.link/education/zero-knowledge-proof-zkp#preser...

[5] https://github.com/anon-aadhaar/anon-aadhaar

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#824

Post by trinsic2 »

adolph wrote: post #740
trinsic2 wrote: post #603

Earlier quoted context omitted.

That same argument doesn't hold water on the internet. Its a communication medium. Its like a flow of information. You don't enter or leave physically spaces. the information flows to you where ever you are. trying to apply the same kinds of laws to the internet is a recipe for disaster because you are effecting everyone at the same time.

Yes, afaik authentication is performed by applications at L7 and as such flows via Internet protocols like anything else. All kinds of laws are applied to services provided via Internet. For example, once upon a time people said collecting sales tax was an insurmountable problem and a disaster for ecommerce. Time passes and what do you know, people figured out ways to comply with laws.

Your example focused on time and place because taxes are done at a transactional level between the person purchasing goods online and receiving those goods in physically.

Age gating is not the same thing, there is no transfer of goods. It's someone's arbitrary idea of what should and shouldn't be allowed on the internet. And it's pretty clear at this point that it's about control over information. Plenty of articles on the subject if you care to look.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#825

Post by techpression »

girvo wrote: post #813
hiciu wrote: post #626

Earlier quoted context omitted.

> EU's planned system requires highly invasive age verification EUDI wallets are connected to your government issued ID. There is no "highly invasive age verification". We are literally sending a request to our government's server to sign, with their private key, message "this john smith born on 1970-01-01 is aged over 18" + jwt iat. There are 3 claims in there. They are hashed with different salts. This all is signe…

> It's really not much different than what a banking app would require. I can use my banking services through the web. Codifying the Google/Apple monopoly in law is gross.

In the context of world politics and the hunt for sovereign hosting etc it also seems incredibly weird to put all of EUs identity handling in the hands of two American companies.

For clarity, the US could over night make all European digital wallets nonfunctional by requiring app stores to remove them and have them uninstalled remotely (iirc there is such a feature but it’s very rarely used). Likely? No, still a very strange thing to put into law though.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#826

Post by blackqueeriroh »

Terretta wrote: post #447
antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

Not only EU -- Digital ID on iPhone does this today, and is accepted by many USA airports for travel, etc., with rollout for DLs.

Huh?

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#827

Post by blackqueeriroh »

gigel82 wrote: post #645
chrishare wrote: post #588

Earlier quoted context omitted.

It's this I believe: https://www.w3.org/TR/vc-data-model-2.0/

A Verifiable Credential fundamentally doesn't solve the problem of "sharing", "smuggling". All it takes is one verified adult to "leak" their VC somewhere, and millions of underage people would be able to use it to "prove" they are over 18. This would only work with something like MS TPM 2 / Apple Secure Enclave (device attestation), which is anti-freedom by design. I was curious if they found a way around that (mayb…

Lmao how is the Secure Enclqve anti-freedom?

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#828

Post by blackqueeriroh »

everdrive wrote: post #97
armchairhacker wrote: post #55

Age verification is very hard, because parents will give their children their unlocked account, and children will steal their parents' unlocked account. If that's criminalized (like alcohol), it will happen too often to prosecute (much more frequently than alcohol, which is rarely prosecuted anyways). I don't see a solution that isn't a fundamental culture shift. If there's a fundamental culture shift, there's an eas…

Completely agree. The internet works differently than how people want it to, and filtering services are notoriously easy to bypass. Even if these age-verification laws passed with resounding scope and support, what would stop anyone from merely hosting porn in Romania or some country that didn't care about US age-verification laws. The leads to run down would be legion. I think you could seriously degrade the porn in…

It’s very odd to hear you complain about age verification but then be fine with ruining the porn industry

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#829

Post by ori_b »

donmcronald wrote: post #750
runako wrote: post #563

Earlier quoted context omitted.

> If it’s analyzes my ID 100% client side I can fake any info I want. If my ID goes to a server, amplifying your point, there is effectively no way for the layperson to make this distinction. And because the app needs to send data over an encrypted channel, it would be difficult at best for a sophisticated person to determine whether their info is being sent over the wire.

> And because the app needs to send data over an encrypted channel, it would be difficult at best for a sophisticated person to determine whether their info is being sent over the wire. Devices are built from the ground up to prevent even sophisticated users from tapping them to verify we aren't being lied to. The average person thinks that "hackers" will mobilize if things get too bad and they're completely wrong. T…

Oh -- how do I ensure that the device is running only the software I installed, with exactly the patches I added, rather than a possibly malicious vendor -- for example, if the local government of the country I'm visiting has a court order for phone vendors to silently backdoor phones, it would be nice to know that only the software I personally signed is running.

As someone that patches their OS on the regular, this would be pretty interesting.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#830

Post by StopDisinfo910 »

EmbarrassedHelp wrote: post #498
antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

According to the EU Identity Wallet's documentation, the EU's planned system requires highly invasive age verification to obtain 30 single use, easily trackable tokens that expire after 3 months. It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". You have to blindly trust that the tokens will not be tracked, which is a total no-go for pr…

> It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering".

The EUDI spec is tech neutral.

What the EUDI mandates is a high level of assurance under the eIDAS 2.0 regulation and the use of a secure element or a trusted execution environment to store the key.

Post reply on HN