Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Users claim Discord's age verification can be tricked with video game characters

thepinknews.com

Post reply on HN
Print view View original

91–100 of 193 posts

Re: Users claim Discord's age verification can be tricked with video game characters

#91

Post by Larrikin »

immibis wrote: post #86
dom96 wrote: post #58

Earlier quoted context omitted.

This really deserves a digital solution. Let me get a government account and generate tokens that websites can ingest to confirm I'm an adult (and other optional details about me). Having to use passports or poor solutions like face scanning isn't good enough. I guess the reason they don't do this is because they fear the cost, anything governments price up these days seems to be in the billion range. So the politici…

Problem: the millisecond this system is rolled out, personal data will be attached to it, not least because I'm just going to generate unlimited 18+ tokens and sell them for $10 apiece

You don't need to identify the user, just be able to show that two tokens are the same user and invalidate, log out both users, and make them generate a new token. You can sell your license to kids today, but it doesn't scale and is a terrible idea to give a kid an ID to a place you frequent.

Re: Users claim Discord's age verification can be tricked with video game characters

#92

Post by codedokode »

valenterry wrote: post #25
codedokode wrote: post #6

Age verification should be made on OS or firmware level when buying a device. And not by sending your passport scan to random companies with dubious data collection practices. A law must mandate that an "adult" version of OS (or device) may be sold only to adult users. It is not difficult for Microsoft/Apple to implement this yet they do not want to for some reason. This would allow more reliable age verification, wi…

Oh god no. We need to absolutely stop making OSs more restrictive than they already are. There are better solutions.

Uploading your passport to a random company is a worse solution, and it is being rolled out now.

Re: Users claim Discord's age verification can be tricked with video game characters

#93

Post by jrockway »

immibis wrote: post #90
ndsipa_pomu wrote: post #59

Earlier quoted context omitted.

That annoys me as the VPN isn't necessarily bypassing the age check, but instead is allowing the person to pretend that they don't live in a country with stupid laws. I mean, Ofcom might as well warn parents about cheap holiday websites that encourage people to bypass the age checks by flying to a sane country.

Yes? I expect that "take a weekend to France to bypass age verification" and "subscribe to NordVPN to bypass age verification" are both legal while "take a weekend to France to see the Eiffel tower" and "use NordVPN to increase your security" are both legal. Did you never wonder why VPN ads don't really list any actual use cases, yet they're wildly popular? If you know what you need it for, the ad doesn't have to tel…

VPN ads do list actual use cases. The most popular one I've heard is geolocation-based pricing on airline tickets.

(I still don't really know what people are actually using VPNs for.)

Re: Users claim Discord's age verification can be tricked with video game characters

#94

Post by codedokode »

snerbles wrote: post #41
valenterry wrote: post #25

Earlier quoted context omitted.

Oh god no. We need to absolutely stop making OSs more restrictive than they already are. There are better solutions.

The California legislature is already working on forcing operating systems to attest the age of the user at the account level. See the recent gut-and-amend of AB1043 [0], which was a privacy bill [1] just a few months ago: > This bill would require, among other things related to age verification on the internet, a covered manufacturer to provide an accessible interface at account setup that requires an account holder…

First, there are too many brackets, second, I think the age should be set by a store, not by the user because obviously all kids will state that they are over 18.

Re: Users claim Discord's age verification can be tricked with video game characters

#95

Post by codedokode »

PartiallyTyped wrote: post #11
codedokode wrote: post #6

Age verification should be made on OS or firmware level when buying a device. And not by sending your passport scan to random companies with dubious data collection practices. A law must mandate that an "adult" version of OS (or device) may be sold only to adult users. It is not difficult for Microsoft/Apple to implement this yet they do not want to for some reason. This would allow more reliable age verification, wi…

Denmark does it by sending you to a government-owned website, which then uses two factor authentication and responds back verifying one’s identity. I don’t understand why other countries can’t do the same.

This is a first step to shutting down anonymous accounts - here in Russia for example the account must be linked at least to a phone number or to a government ID and I see no reason why other governments don't want to do the same.

Re: Users claim Discord's age verification can be tricked with video game characters

#96

Post by subscribed »

Retr0id wrote: post #67
hhh wrote: post #5

I think the way discords setup works is reasonable. It’s an on-device model that only submits the outcome of the scan to the platform. I hope they just improve that performance, rather than see this and back out of it entirely and require ID checks.

On-device models are excellent for privacy, but they are fundamentally broken from a security perspective. Preventing people from spoofing the results would involve locking them out of their own devices, via DRM.

Hardware attestation would be enough to clamp down on almost anything, ensuring the hardware and the os guarantee the outcome is not manipulated.

Not the broken anti-competitive Google play store integrity (which is passing for any handset not patched for the last 8 years but with Google buttplug in it, effectively nullifying assurances from the attestation), but a proper hw attestation.

Re: Users claim Discord's age verification can be tricked with video game characters

#97

Post by Xelbair »

Hamuko wrote: post #55
jhgg wrote: post #4

> government passes law that requires companies to age verify users > said government provides no way to actually verify a human's age > hilarity ensues

EU is also gonna require companies to verify ages but there's a white label application that EU member states can use. https://ageverification.dev/ If I've understood it correctly, Pornhub can't see anything except that you've turned 18 (no names, no date of births, nothing) and your local government can't see that you've signed up for Pornhub using the app.

Yet it is still not a perfect solution. Arguably worse, for possible freedom of speech aspects, than current state.

https://www.eff.org/deeplinks/2025/04/age-verification-europ...

Re: Users claim Discord's age verification can be tricked with video game characters

#98

Post by macintux »

michaelt wrote: post #48
silisili wrote: post #24

Earlier quoted context omitted.

Maybe I'm old. Well, no, I am relatively old. Either way, when I see a person or business advertise a Discord link, I immediately think of either as immature. I miss the days of forums, and wish something like them could thrive again instead of rather private, but importantly ephemeral chats.

> I miss the days of forums, and wish something like them could thrive again instead of rather private, but importantly ephemeral chats. Open source projects have long had ephemeral chats, private to the people in the chat at that moment - it just used to be called IRC.

Except there were open, archival solutions for IRC for projects to take advantage of. Are there any for Discord?

Re: Users claim Discord's age verification can be tricked with video game characters

#99

Post by tzs »

wood_spirit wrote: post #75
anon7000 wrote: post #73

Earlier quoted context omitted.

Oh no, then the government will know how old I am!! (/s)

They will also know your habits and kinks etc.

It can be done in a way that prevents that.

Briefly, the government can give you a digital copy of your driver's license or passport or whatever that can be bound to a hardware security key you have. Most modern smartphones have a suitable security key built.

To verify your age for a site a zero-knowledge proof (ZKP) can be constructed for the site to prove that you have that document, it says your age is above the threshold needed for the site, and that you have the hardware key it is bound to, and you were able to unlock that hardware key. Nothing else is revealed to the site.

Note that once the government issues that digital ID bound to your security key they are out of the picture. They have no idea what you use that ID for or when you use it.

Google has released an open source library to help with this kind of system, discussed here [1].

[1] https://news.ycombinator.com/item?id=44457390

Re: Users claim Discord's age verification can be tricked with video game characters

#100

Post by Spivak »

parsimo2010 wrote: post #61
dom96 wrote: post #58

Earlier quoted context omitted.

This really deserves a digital solution. Let me get a government account and generate tokens that websites can ingest to confirm I'm an adult (and other optional details about me). Having to use passports or poor solutions like face scanning isn't good enough. I guess the reason they don't do this is because they fear the cost, anything governments price up these days seems to be in the billion range. So the politici…

When you place all the requirements on a software product like what the government has to, then it’s going to be expensive. Anyone who thinks that the total cost of a privacy protecting, government accredited, widely available, reliable, audited, and domestically produced age verification system isn’t going to be in the hundreds of millions has never actually shipped something comparable. It is literally illegal to s…

What are you talking about? The government gets to cheat and use the IRL ID verification they do already for licenses.

* You create your account as part of your license renewal and have a normal-ass login. As part of that your account is manually marked as being 18+ (or just your age) by the person behind the counter.

* The government publishes a few public certs which will be used to verify.

* Then you go to your account page and click the button to generate a certificate signed by one of the government's private keys. The cert is valid for say 7 days.

* You upload the cert to the website you want to access and the website validates it.

Done. You make it illegal to provide your tokens to minors like it's illegal to provide booze to minors. Good enough for government work. It's literally just an EV cert.

The problem gets a lot easier when you have a country wide IRL ID system already in place and can write laws.

Post reply on HN