Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Age Verification Trap: Verifying age undermines everyone's data protection

spectrum.ieee.org

Post reply on HN
Print view View original

921–930 of 1001 posts

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#921

Post by julianozen »

EnderWT wrote: post #323
julianozen wrote: post #235

There is missing a solution. Give our personal devices have the ability to verify our age and identity securely and store on device like they do our fingerprint or face data. Services that need access only verify it cryptographically. So my iPhone can confirm I’m over 21 for my DoorDash app in the same way it stores my biometric data. The challenge here is the adoption of these encryption services and whether compani…

ISO/IEC 18013-5 (Personal identification — ISO-compliant driving licence — Part 5: Mobile driving licence (mDL) application) is a potential solution for this. https://www.iso.org/obp/ui/en/#iso:std:iso-iec:18013:-5:ed-1... It would allow someone with an mDL on their device to present only their age instead of other identifying information.

Yes. I think it’s this + policy.

And that your iPhone and other devices become more restrictive if this is not implemented.

I presume most devices in the world do not have a solution to this (desktop windows computer for instance).

I’m not sure if it’s a good idea for like every porn website in the world to require a secret enclave to work. But this sounds better to me than storing users photo ids in an s3 bucket

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#922

Post by thenoblesunfish »

I was hoping for more on "... The only way to prove that you checked is to keep the data indefinitely." What do the laws say on this? What data is this? I would have assumed that just like a bouncer can check my ID and hand it back to me, a digital system can verify my identity and not hold onto everything (e.g. the actual photo of my ID).

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#923

Post by ndriscoll »

uniq7 wrote: post #738
myrion wrote: post #608

Earlier quoted context omitted.

That assumes the companies store the individual tokens, as does the government. Neither of which are part of the design, but could be done if both sides desired it. The Swiss design actually doesn't store the issued tokens centrally. It only stores a trust root centrally and then a verifier only checks the signature comes from that trust root (slightly simplified).

If companies are required to verify age, then it's in their best interest to store all tokens, just in case they are ever accused of not verifying it. The Swiss E-ID system stores people identifiers and token status lists in their so-called "Base Registry". From https://swiyu-admin-ch.github.io/technology-stack/#credentia... > Decentralized Identifiers (DID) developed by the W3C represent an identifier standard that…

At least the US bills I've read make it illegal to store any information provided as part of age verification. Are the EU versions not the same?

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#925

Post by andrepd »

donmcronald wrote: post #553
antitoxic wrote: post #390

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age. I think there are many pros and cons to be said about…

> It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. How? If it’s analyzes my ID 100% client side I can fake any info I want. If my ID goes to a server, it’s compromised IMO. I think the zero proof systems being touted are like ephemeral messaging in Snapchat. That is, we’re being sold something that’s impossible and it only “works”…

> If my ID goes to a server, it’s compromised IMO

Might be breaking news, but the state already has your passport ID in a server.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#926

Post by andrepd »

nubg wrote: post #814
dogcomplex wrote: post #646

Earlier quoted context omitted.

Correct. A ZK Proof backed identity system is a significant bump up in both privacy and security to even what we have right now. Everyone does realize we're being constantly tracked by telemetry, right? A proper ZK economy would mitigate the vast majority of that tracking (by taking away any excuse for those in power to do so under the guise of "security") and create a market for truly-secure hardware devices, while…

Explain how the plastering of streets with cameras can be done in a privacy-preserving way?

Well it could. Laws that simply ban any public-facing camera from doing anything except write to encrypted storage, which can only be opened with a court warrant.

I know laws are boring and tech is exciting, but sometimes there's no technological solution to a societal problem. Good old laws, police, fines, prison, is all you need.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#927

Post by briHass »

freakynit wrote: post #837
godelski wrote: post #816

Earlier quoted context omitted.

> It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". Regulatory capture at its finest. Such a ruling gives Apple and Google a duopoly over the market. Maybe worse, it encourages the push of personal computers to be more mobile like (the fact that we treat phones as different from computers is already a silly concept). So when are we goin…

"Anyone playing around with things like Reticulum? LoRA? Mesh networks?" I'm curious about the 'day after' scenario: what's the move if the state decides to regulate these into "illegality" because they bypass official channels? We have to remember that the devices aren't the problem... the real hurdle is the bureaucratic gatekeeping of communication. The problem are people, not devices.

This is exactly the argument that is (correctly) levied against firearm restrictions.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#928

Post by lII1lIlI11ll »

jackvalentine wrote: post #777
JohnMakin wrote: post #261

We'll try everything, it seems, other than holding parents accountable for what their children consume. In the United States, you can get in trouble if you recklessly leave around or provide alcohol/guns/cigarettes for a minor to start using, yet somehow, the same social responsibility seems thrown out the window for parents and the web. Yes, children are clever - I was one once. If you want to actually protect child…

What is your proposed recourse for me as a parent if your kid shows my kid gore videos?

What is your recourse if his kid gives yours a bottle of whisky?

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#929

Post by agentultra »

downrightmike wrote: post #799
agentultra wrote: post #101

There are alternatives to ID verification if the goal is protecting children. You could, for example, make it illegal to target children with targeted advertising campaigns and addictive content. Then throw the executives who authorized such programs in jail. Punish the people causing the harm.

It isn't about the kids, they are just the smoke and mirrors.

I think this is true, it’s more about enabling a surveillance apparatus with plausible deniability built in.

The funny thing is, just like how politicians have been led to believe that AI data centres create jobs, politicians think this system can be managed responsibly so that only they can get access to its data [0].

[0] https://cybernews.com/security/global-data-leak-exposes-bill...

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#930

Post by Kazik24 »

Shouldn't the verification be other way around? That is, you need to prove that you are a child. Then the site can present you more strictly filtered content. Parent can sign child's device on first boot, token stored in TPM so that it's hard to remove.

It's basically the same type of enforcement on sites, as they need to verify and filter content for children, or just block them. Most of the internet users are adults, why not make internet for adults by default.

Post reply on HN