Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Age Verification Trap: Verifying age undermines everyone's data protection

spectrum.ieee.org

Post reply on HN
Print view View original

871–880 of 1001 posts

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#871

Post by theodric »

I'm happy to see the IEEE talking about this, and to see the topic getting attention in the technical press. The problem is, I think (for the most part) that technical people already Get It. Who we need to convince are average, non-technical voters who don't know, don't understand, think it's a good thing, or would happily jump feet-first into a wood chipper if someone told them it would protect the children.

I also suspect that social media has damaging effects on kids, and they probably shouldn't have access to it, but not like this. I'd probably be quicker to support something like saying that individuals <18 aren't allowed to buy or possess a phone or tablet that has access to an app store or web browser, and only offers voice- and text-based communications channels. Ok, so now it all happens on a laptop? What's "a tablet?" Is a Chromebook a tablet? It's fucking impossible.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#872

Post by raxxorraxor »

Noaidi wrote: post #214
tolmasky wrote: post #155

I am so surprised by the comments on this thread. I was not expecting to see so many people on Hacker News in favor of this. As is typically the case with things like this, the reasoning stems from agreeing with the goal of age verification, with little regard to whether age verification could ever actually work. It reminds me in some sense to the situation with encryption where politicians want encryption that block…

Whatever happened to all the innovation the tech world was capable of? This is 100% a solvable problem. It only needs the will and good law. 1) Person signs up with discord with fake name and fake email. 2) Discord asks (state system) for an age validation. 3) In pop up window, state validates the persons age with ID matching with face recognition. 3) State system sends token to discord with yes or no with zero data…

Innovation doesn't need a big brother looking over your shoulder all the time. We have enough tracking tech on the web, no need to make it official as well. So yes, the "will" is missing, especially with the many misbehaviour states have shown towards privacy and surveillance.

A little legislative change and you can kiss your zero-proof goodbye if any infrastructure is established. This is about making intelligent decisions in your life. Your suggestion is far from innovative.

We will see real innovation in mechanisms to sideline age verification.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#873

Post by [deleted] »

hiciu wrote: post #626
EmbarrassedHelp wrote: post #498

Earlier quoted context omitted.

According to the EU Identity Wallet's documentation, the EU's planned system requires highly invasive age verification to obtain 30 single use, easily trackable tokens that expire after 3 months. It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". You have to blindly trust that the tokens will not be tracked, which is a total no-go for pr…

> EU's planned system requires highly invasive age verification EUDI wallets are connected to your government issued ID. There is no "highly invasive age verification". We are literally sending a request to our government's server to sign, with their private key, message "this john smith born on 1970-01-01 is aged over 18" + jwt iat. There are 3 claims in there. They are hashed with different salts. This all is signe…

[deleted]

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#874

Post by antitoxic »

budududuroiu wrote: post #858
antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

> As long as you trust the government that gave out the ID I'm a citizen of a European Union member, I trust my government to issue me an ID and use said ID in my interactions with the state, I do not trust my state with anything more than that.

That is exactly the trust I mean. You need to trust that country X gives out valid IDs. If you have sketchy company Y giving out IDs to everyone, you probably would not trust any attributes derived from that ID. If you trust that a country gives out valid IDs, you can trust the information derived from that ID. You do not really need to trust your government any more than that for this system to work.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#875

Post by raxxorraxor »

antitoxic wrote: post #865
raxxorraxor wrote: post #850

Earlier quoted context omitted.

For me it is disqualified for usage because I need to buy into a Google or Apple ecosystem. At least the reference implementation does. This is just the next level of enshitification. And no, I don't need a digital blockwart at all. And I have zero illusion privacy is compromised, it is trivial to identify devices these days, so it doesn't even work technically. Next sentence we hear some empty bickering about digita…

We support F-droid, so you could get a degoogled android version and use that to load the app on your phone. The app could also be ported to other platforms, but right now there is really no market for it.

That sill forces me into a Google ecosystem. F-Droid is better than the Play Store, but issues remain.

There is certainly a market for desktop OS as well. This creates a market for freedom.gov, shady as it is.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#876

Post by yard2010 »

antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

In Amsterdam 1850 the municipality kept track of people's names, address, age, gender and religion (bevolkingsregister). It meant nothing at this time, but 90 years later the Nazi used these lists to murder jewish people going house by house. Thanks for the partisans setting this archive ablaze, life were saved.

I'm not saying it's right or wrong, you tell me, I just want to point at this random timeline.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#877

Post by dominicrose »

vinyl7 wrote: post #324
JohnMakin wrote: post #261

We'll try everything, it seems, other than holding parents accountable for what their children consume. In the United States, you can get in trouble if you recklessly leave around or provide alcohol/guns/cigarettes for a minor to start using, yet somehow, the same social responsibility seems thrown out the window for parents and the web. Yes, children are clever - I was one once. If you want to actually protect child…

We live in a technofeudalist society now, we're all at the whims of the tech corps

age verification doesn't work in favor of a tech corp like facebook as they will see some users leave, some because they don't have the age required and some because they don't want to do the verification

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#879

Post by deaux »

antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

Good luck finding the single government in the world that actually wants that, rather than it being a pretext for control that is too sweet to pass up. If you manage to find them, post an article on HN about it as top places to move to.

The system you're describing is good for the masses, not for those with power.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#880

Post by antitoxic »

donmcronald wrote: post #553
antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

> It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. How? If it’s analyzes my ID 100% client side I can fake any info I want. If my ID goes to a server, it’s compromised IMO. I think the zero proof systems being touted are like ephemeral messaging in Snapchat. That is, we’re being sold something that’s impossible and it only “works”…

Yes it does actually. You load your ID into your phone with the MRZ and NFC. The cryptographic proof inside your ID is used to verify that it was issued by an official government. So your ID is not being sent to a central server.

The reusing another ID is an issue. In some countries they will have a in person check to verify only you can load your ID into your phone. But then you still have the problem of sending a verification QR code to someone else and have them verify it. This might be solved by rolling time-gated QR codes and by making it illegal to verify someone else's verifications. But this is a valid concern and a problem that still needs solving.

Post reply on HN