Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Age Verification Trap: Verifying age undermines everyone's data protection

spectrum.ieee.org

Post reply on HN
Print view View original

851–860 of 1001 posts

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#851

Post by phanimahesh »

myrion wrote: post #617
donmcronald wrote: post #553

Earlier quoted context omitted.

> It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. How? If it’s analyzes my ID 100% client side I can fake any info I want. If my ID goes to a server, it’s compromised IMO. I think the zero proof systems being touted are like ephemeral messaging in Snapchat. That is, we’re being sold something that’s impossible and it only “works”…

There's no dynamic analysis done, necessarily. In the Swiss design, fex, SD-JWTs are used for selective disclosure. For those, any information that you can disclose is pre-hashed and included in the signed credential. So `over_18: true` is provided as one of those hashes and I just show this to the verifier. The verifier gets no other information than the strictly necessary (issuer, expiry, that kind of thing) and th…

The issuer knows everything and can help track if the wish to. The issue here is lack of trust in any corporate or government entity.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#852

Post by wolvoleo »

antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

I just don't want to have to ID myself at every corner of the internet. Whether the site receives my details or not.

I've heard they even want to mandate periodic re-checks now which is insane. The internet should remain free.

Besides, if parents don't want to give access to social media they can just not give their kids a phone, or just use the many parental control features available on it. Every phone has this these days.

And even if the government wants to ban this stuff for all kids (which I would not agree with but ok I don't have kids so I don't really care and parents do seem to want this), they don't have to enforce it this way. They can just make the parents liable if the kids are found to have access.

To me this is just another attempt at internet censorship and control.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#853

Post by Tyumyu »

antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

[dead]

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#854

Post by verisimi »

forgetfreeman wrote: post #836
godelski wrote: post #816

Earlier quoted context omitted.

> It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". Regulatory capture at its finest. Such a ruling gives Apple and Google a duopoly over the market. Maybe worse, it encourages the push of personal computers to be more mobile like (the fact that we treat phones as different from computers is already a silly concept). So when are we goin…

A new internet to do what? What is the proposed goal of a new network?

I would assume it would be not be regulated by government, so without constraints on age, restrictions on what you can do - you know, like reality.

And I know that government attempts to regulate reality too, but if you drive at 35 where the limit is 30, or speak to someone dodgy to get some marijuana or whatever, and get away with these and other heinous crimes, you're good!

The distinction really is whether you bake regulation into the technology or not. And it seems that technology is actually the new legal system. Or perhaps that should be the 'pre-legal system' as it won't allow you to do those things it determines as 'wrong'. Which is absolutely fine if you think government really does know best, or hell on earth for everyone else.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#855

Post by charcircuit »

godelski wrote: post #816
EmbarrassedHelp wrote: post #498

Earlier quoted context omitted.

According to the EU Identity Wallet's documentation, the EU's planned system requires highly invasive age verification to obtain 30 single use, easily trackable tokens that expire after 3 months. It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". You have to blindly trust that the tokens will not be tracked, which is a total no-go for pr…

> It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". Regulatory capture at its finest. Such a ruling gives Apple and Google a duopoly over the market. Maybe worse, it encourages the push of personal computers to be more mobile like (the fact that we treat phones as different from computers is already a silly concept). So when are we goin…

>regulatory capture

It's not other operating systems fault that they failed to invest into security. They should try and catch up instead of blaming people for not trusting their security on "regulatory capture".

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#856

Post by antitoxic »

erremerre wrote: post #843
antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

You mean that system that requires either to use an original unmodified Android phone, or a iOS phone and it does not work in absolutely anything else?

No it is open-source and portable to any platform you want. We currently support iOS and Android through Play store and F-droid, but that is just because most of the market is there at the moment.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#857

Post by renegat0x0 »

armchairhacker wrote: post #55

Age verification is very hard, because parents will give their children their unlocked account, and children will steal their parents' unlocked account. If that's criminalized (like alcohol), it will happen too often to prosecute (much more frequently than alcohol, which is rarely prosecuted anyways). I don't see a solution that isn't a fundamental culture shift. If there's a fundamental culture shift, there's an eas…

Age verification has always been about normalization of it, and about mitigating snow flake blame.

- I always give my children unlocked devices, because I know what they are doing

- Internet is not a safe space, and there will always be means of circumventing protections. Age verifications do not protect anybody

- Parents do not want to 'rise children' they give phones to kids and expects youtube to show kids only good stuff. They expect this from platform

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#858

Post by budududuroiu »

antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

> As long as you trust the government that gave out the ID

I'm a citizen of a European Union member, I trust my government to issue me an ID and use said ID in my interactions with the state, I do not trust my state with anything more than that.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#859

Post by armchairhacker »

SiempreViernes wrote: post #685
armchairhacker wrote: post #289

Earlier quoted context omitted.

You should be able to choose what's age-appropriate for your kids. Giving them access to e.g. "PG-13" media when they're 9 isn't the problem. Giving mature kids unrestricted access isn't a problem. The problem is culture: - Many parents don't think about restricting their kids' online exposure at all. And I think a larger issue than NSFW is the amount of time kids are spending: 5 hours according to this survey from 2…

> Parents that want to restrict their kids struggle with ineffective parental controls: https://beasthacker.com/til/parental-controls-arent-for-pare .... Optional parental controls would fix this Did you mean "mandatory" parental controls? All current systems are optional and as you describe they are frequently ineffective, so not clear why keeping things like they are would be different.

The current systems are not ineffective because they’re optional, they could be more effective and stay optional.

I also don’t mean “mandatory” as in “the software manufacturer must implement parental controls” like the Colorado bill. There only needs to exist one decent operating system, one decent messaging service, etc. with good parental controls; parents can use those technologies and block the others. Although regulators could pressure specific popular platforms like YouTube, and maybe that would be fine, I think it would be better to incentivize and support add-ons or alternatives (e.g. kid-safe YouTube frontend).

Post reply on HN