The Age Verification Trap: Verifying age undermines everyone's data protection • Hacker News Board

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#891

Post by m4rtink » Tue, Feb 24, 2026, 10:13 AM UTC

freakynit wrote: post #837

godelski wrote: post #816

Earlier quoted context omitted.

> It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". Regulatory capture at its finest. Such a ruling gives Apple and Google a duopoly over the market. Maybe worse, it encourages the push of personal computers to be more mobile like (the fact that we treat phones as different from computers is already a silly concept). So when are we goin…

"Anyone playing around with things like Reticulum? LoRA? Mesh networks?" I'm curious about the 'day after' scenario: what's the move if the state decides to regulate these into "illegality" because they bypass official channels? We have to remember that the devices aren't the problem... the real hurdle is the bureaucratic gatekeeping of communication. The problem are people, not devices.

MeshCore is spreading quite rapidly - it uses solar powered repeaters and that helps a lot. :)

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#892

Post by KoolKat23 » Tue, Feb 24, 2026, 10:26 AM UTC

EmbarrassedHelp wrote: post #498

antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

According to the EU Identity Wallet's documentation, the EU's planned system requires highly invasive age verification to obtain 30 single use, easily trackable tokens that expire after 3 months. It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". You have to blindly trust that the tokens will not be tracked, which is a total no-go for pr…

I'm sorry to say it but the fact it bans jailbreaking/rooting your device really makes me believe "think of the children" isn't their real goal.

There's some clever kids out there but come on.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#893

Post by miki123211 » Tue, Feb 24, 2026, 10:28 AM UTC

antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

I think there's a tradeoff triangle here, not dissimilar to Zooko's triangle or the CAP theorem, where the three aspects are age verification, privacy, and the freedom to run custom software on devices of your choosing.

You can have no system at all, which gives you freedom and privacy, but not age verification. You can have ID uploads, which give you age verification and freedom, but not privacy. You can have a ZKP-based system, which gives you age verification and privacy, but not freedom. This is because you need a way to prevent one unscrupulous ID owner from issuing millions of valid assertions for any interested user.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#894

Post by nicbou » Tue, Feb 24, 2026, 10:31 AM UTC

antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

Immigrants do not have an ID for up to a few years when they move to Germany. Just this week the Berlin immigration office stopped issuing plastic residence cards for budget reasons, so people get a sticker in their passport.

Passport recognition is also spotty. The ID verification providers used by banks do not recognise Indian passports.

Will we exclude a few million people because it’s too expensive to verify that they are over 18?

Add this to “falsehoods programmers believe about ID verification”.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#895

Post by Borealid » Tue, Feb 24, 2026, 10:32 AM UTC

Grimeton wrote: post #878

They could just issue a x509 cert with an above 18 attribute and nothing else. You're not 18 yet? No Problem we just give you two certs with different valid from/to ranges that overlap and don't give away your birthday. Problem solved.

Steelmanning the opposing position: one adult shares their certificate with every child on the planet.

Because it has no attributes (not even a unique serial number that could be used to track it) the whole scheme is now defeated.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#896

Post by nicbou » Tue, Feb 24, 2026, 10:35 AM UTC

yard2010 wrote: post #876

antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

In Amsterdam 1850 the municipality kept track of people's names, address, age, gender and religion (bevolkingsregister). It meant nothing at this time, but 90 years later the Nazi used these lists to murder jewish people going house by house. Thanks for the partisans setting this archive ablaze, life were saved. I'm not saying it's right or wrong, you tell me, I just want to point at this random timeline.

I shudder when I think of how effective the Stasi would have been in the digital age. The only thing checking them was the labour demands of surveillance.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#897

Post by fragmede » Tue, Feb 24, 2026, 10:35 AM UTC

Borealid wrote: post #895

Grimeton wrote: post #878

They could just issue a x509 cert with an above 18 attribute and nothing else. You're not 18 yet? No Problem we just give you two certs with different valid from/to ranges that overlap and don't give away your birthday. Problem solved.

Steelmanning the opposing position: one adult shares their certificate with every child on the planet. Because it has no attributes (not even a unique serial number that could be used to track it) the whole scheme is now defeated.

Which, adult is merely someone who's just turned 18. What're the chances that any of them just post the thing up on 4chan? (I'm going to go with 100% chance of that happening.)

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#898

Post by nicbou » Tue, Feb 24, 2026, 10:43 AM UTC

notTooFarGone wrote: post #8

>Some observers present privacy-preserving age proofs involving a third party, such as the government, as a solution, but they inherit the same structural flaw: many users who are legally old enough to use a platform do not have government ID. So there is absolutely no way to change that and give out IDs from the age of 14? You can already get an ID for children in Germany https://www.germany.info/us-de/service/reise…

German immigrants can’t get an ID, sometimes for years

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#899

Post by egorfine » Tue, Feb 24, 2026, 10:45 AM UTC

girvo wrote: post #813

hiciu wrote: post #626

Earlier quoted context omitted.

> EU's planned system requires highly invasive age verification EUDI wallets are connected to your government issued ID. There is no "highly invasive age verification". We are literally sending a request to our government's server to sign, with their private key, message "this john smith born on 1970-01-01 is aged over 18" + jwt iat. There are 3 claims in there. They are hashed with different salts. This all is signe…

> It's really not much different than what a banking app would require. I can use my banking services through the web. Codifying the Google/Apple monopoly in law is gross.

> I can use my banking services through the web.

Not for much longer. Stealing your data on mobile device is way too lucrative for the banks to pass on. All while pretending it's done for security.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#900

Post by egorfine » Tue, Feb 24, 2026, 10:48 AM UTC

nicbou wrote: post #894

antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

Immigrants do not have an ID for up to a few years when they move to Germany. Just this week the Berlin immigration office stopped issuing plastic residence cards for budget reasons, so people get a sticker in their passport. Passport recognition is also spotty. The ID verification providers used by banks do not recognise Indian passports. Will we exclude a few million people because it’s too expensive to verify that…

> Will we exclude a few million people because it’s too expensive to verify that they are over 18?

Yes. We absolutely will. KYC services is something that no one wants and everyone hates, thus there is no motivation to make it better. And if any, "better" might mean more invasive, because that means more data to mine and sell.

So, sure, excluding millions of people from KYC because it's cheaper to reject them than it is to study their documents - is the right decision business wise.

I am speaking as a person in the very same position.