Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Age Verification Trap: Verifying age undermines everyone's data protection

spectrum.ieee.org

Post reply on HN
Print view View original

881–890 of 1001 posts

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#881

Post by deaux »

hiciu wrote: post #626
EmbarrassedHelp wrote: post #498

Earlier quoted context omitted.

According to the EU Identity Wallet's documentation, the EU's planned system requires highly invasive age verification to obtain 30 single use, easily trackable tokens that expire after 3 months. It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". You have to blindly trust that the tokens will not be tracked, which is a total no-go for pr…

> EU's planned system requires highly invasive age verification EUDI wallets are connected to your government issued ID. There is no "highly invasive age verification". We are literally sending a request to our government's server to sign, with their private key, message "this john smith born on 1970-01-01 is aged over 18" + jwt iat. There are 3 claims in there. They are hashed with different salts. This all is signe…

> This is true. The eidas directive requires that secret material lives in a dedicated hardware / secure element. It's really not much different than what a banking app would require.

Most banking apps run on GrapheneOS, will this? Nearly all EU banking websites run on Firefox on Linux, will this?

Why did you not quote the App Store/Google Play Services part, which is much worse?

> There are so called policy mitigations currently: audits and requirements for governments to remove salts from memory the moment stuff is issued.

I'm sure this will be as diligently carried out as GDPR enforcement. [0].

[0] https://noyb.eu/en/project/dpa/dpc-ireland

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#882

Post by HeartofCPU »

antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

> As long as you trust the government…

You should never trust the government

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#883

Post by raincole »

armchairhacker wrote: post #55

Age verification is very hard, because parents will give their children their unlocked account, and children will steal their parents' unlocked account. If that's criminalized (like alcohol), it will happen too often to prosecute (much more frequently than alcohol, which is rarely prosecuted anyways). I don't see a solution that isn't a fundamental culture shift. If there's a fundamental culture shift, there's an eas…

The only needed culture shift is everyone should realize that it's ultimately the parents/teachers' duty to educate the kids.

If parents think it's okay for their kids to use Facebook/X/whatever somehow responsibly, they should not be punished or prosecuted for that. Yes, I do believe it applies to alcohol too.

It's how it works in physical world. We let the parents to decide whether hiking/swimming/football/walking to the school are too dangerous for their kids. We let the parents to decide which books are suitable for their kids. But somehow when it comes to the internet it's the government's job. I can't help but think there is an astroturf movement manufacturing the consent rn.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#884

Post by [deleted] »

kooshball wrote: post #694
techblueberry wrote: post #432

Earlier quoted context omitted.

I know this is weird, but I'm in some ways not really sure who is on the side of freedom here. I get your position, but like. The whole idea of the promise of the internet has been destroyed by newsfeeds and mega-corps. There is almost literally documented examples of Facebook executives twirling their mustaches wondering how they can get kids more addicted. This isn't a few bands with swear words, and in fact, I thi…

> Better the nanny state than Nanny Zuck. This is a huge self own. I can't believe I'm reading this on a website called "hacker news".

[deleted]

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#885

Post by CJefferson »

JohnMakin wrote: post #261

We'll try everything, it seems, other than holding parents accountable for what their children consume. In the United States, you can get in trouble if you recklessly leave around or provide alcohol/guns/cigarettes for a minor to start using, yet somehow, the same social responsibility seems thrown out the window for parents and the web. Yes, children are clever - I was one once. If you want to actually protect child…

What? Are there billion dollar companies with huge staffs who are constantly trying to figure out how to sneak my child a gun all the time, at school, wherever they go?

I'd say this comparison is good -- we as a society have decided that people who provide alcohol, guns, and cigarettes are responsible if children are provided them. You don't get to say 'hey, you didn't watch your child, they wandered into my shop, I sold to them 2 liters of vodka and a shotgun'.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#886

Post by KoolKat23 »

direwolf20 wrote: post #745
KoolKat23 wrote: post #415

Earlier quoted context omitted.

Devices such as phones come with an option when you start the device asking simply is this for a child or an adult. Your router generally these days comes with a parental filter option on start up too. Heck we have chatgpt that can guide a parent through setting up a system if they want something more custom. If people want to push, they should just push to make these set up options more ubiquitous, obvious and stand…

Router parental filters are accountability sinks. They don't actually work, and they can't because we spent the last 20 years redesigning network protocols to prevent middle boxes from tampering with connections.

In what sense? DNS blockers work generally do they not? Adguard also censors google search results.

I don't see why your kid should be browsing reddit.

I mean even only allow whitelisted sites. As I say this can be standardized further.

These measures I truly believe do not need to be 100% foolproof so long as the hurdle is high enough that children give up it's fine. And these measures could potentially notify a parent of a suspected breach or attempt to game it, without intruding too much into the child's privacy.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#887

Post by myrion »

uniq7 wrote: post #738
myrion wrote: post #608

Earlier quoted context omitted.

That assumes the companies store the individual tokens, as does the government. Neither of which are part of the design, but could be done if both sides desired it. The Swiss design actually doesn't store the issued tokens centrally. It only stores a trust root centrally and then a verifier only checks the signature comes from that trust root (slightly simplified).

If companies are required to verify age, then it's in their best interest to store all tokens, just in case they are ever accused of not verifying it. The Swiss E-ID system stores people identifiers and token status lists in their so-called "Base Registry". From https://swiyu-admin-ch.github.io/technology-stack/#credentia... > Decentralized Identifiers (DID) developed by the W3C represent an identifier standard that…

That's not how that works - they can prove they check by showing logs, rather than VPs. There's even legal limits on what identifiers they can store and for how long. But even ignoring that, they'd be storing only very limited disclosures.

The base registry stores identifiers of issuers and verifiers, not credential holders.

Even the status register does not contain the tokens themselves:

> Within these status lists, each index (i.e., status entry) documents the validity of one VC. The corresponding index is captured in the VC’s metadata to allow for a decentralized status information retrieval that does not require verifiers or the VC holder to contact the issuer.

Of course, each issuer needs to maintain a list of the credentials they have issued in order to be able to ever revoke them. That's unavoidable.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#888

Post by myrion »

phanimahesh wrote: post #851
myrion wrote: post #617

Earlier quoted context omitted.

There's no dynamic analysis done, necessarily. In the Swiss design, fex, SD-JWTs are used for selective disclosure. For those, any information that you can disclose is pre-hashed and included in the signed credential. So `over_18: true` is provided as one of those hashes and I just show this to the verifier. The verifier gets no other information than the strictly necessary (issuer, expiry, that kind of thing) and th…

The issuer knows everything and can help track if the wish to. The issue here is lack of trust in any corporate or government entity.

Well, yes, if they use something completely different to what's published and designed.

But no, we're not talking about the case where there's no trust at all in the government, because then you don't get verifiable credentials at all. We're talking about building privacy-preserving credentials that actually have a use.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#889

Post by p0w3n3d »

aesopturtle wrote: post #848

Age checks sound simple, but they tend to turn into “please create a permanent ID for the internet.” I’d love a version that’s more like a one-time wristband than a loyalty card.

mandatory loyalty card (won't sell you bread if you don't present it) with additional database of your extra-shop activities

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#890

Post by notyourwork »

freakynit wrote: post #837
godelski wrote: post #816

Earlier quoted context omitted.

> It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". Regulatory capture at its finest. Such a ruling gives Apple and Google a duopoly over the market. Maybe worse, it encourages the push of personal computers to be more mobile like (the fact that we treat phones as different from computers is already a silly concept). So when are we goin…

"Anyone playing around with things like Reticulum? LoRA? Mesh networks?" I'm curious about the 'day after' scenario: what's the move if the state decides to regulate these into "illegality" because they bypass official channels? We have to remember that the devices aren't the problem... the real hurdle is the bureaucratic gatekeeping of communication. The problem are people, not devices.

Anyone remember when the discussions about classifying the internet as a utility and Akit’s stupid Reese cup coffee mug. It feels so long ago given how much has transpired since.
Post reply on HN