Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Age Verification Trap: Verifying age undermines everyone's data protection

spectrum.ieee.org

Post reply on HN
Print view View original

971–980 of 1001 posts

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#971

Post by TZubiri »

alt227 wrote: post #278
TZubiri wrote: post #193

>"None of this is an argument against protecting children online. It is an argument against pretending there is no tradeoff" Tradeoff acknowledged, and this runs both sides, there's hundreds of risks that these policies are addressing. To mention a specific one, I was exposed to pornography online at age 9 which is obviously an issue, the incumbent system allowed this to happen and will continue to do so. So to what…

> I was exposed to pornography online at age 9....allowing kids first sexual experiences to be pornography I was initially exposed to pornography at 8 years old, by finding a disgarded magazine in a hedge. However this was pretty soft. I was exposed to serious pornography at 10 years by finding a hidden VHS tape in the back of a drawer at a friends house and getting curious. This was hardcore German stuff with explic…

I think there's a non-trivial legal and ethical difference between distributing material (whether as a sale or not, or for profit or not) and a child finding material that was distributed to an adult.

The equivalence with alcohol would be finding an alcohol bottle in your parent's cabinet. It's not the same as buying alcohol while you are 10, and it's in no way an excuse to allow the sale of alcohol to minors.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#972

Post by hellojesus »

intrasight wrote: post #803
dyauspitr wrote: post #284

Earlier quoted context omitted.

Yes we need a fundamental shift where sharing of parent accounts is akin to atleast some sort of infraction or maybe even a misdemeanor.

Just remove "parent" and "account" from the mix and all these. Tie the screen to the human and most of these challenges go away. This is what is trying to be achieved with these laws, so we may as well institute it that way.

Shouldn't it be done at the account level if you're going to do this? I am an admin. My kids have a non admin account. That seems pretty normal.

BTW this is a terrible idea. What if I can afford only one computer but have a household of four?

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#973

Post by hellojesus »

armchairhacker wrote: post #222
delusional wrote: post #162

Earlier quoted context omitted.

How does this solve the problem at all? You're just making more problems. Now you have to deal with a black market of "unlocked" phones. You're having to deal with kids sharing unlocked phone. Would police have to wal around trying to buy unlocked phones to catch people selling them to minors? What about selling phones on the internet, would they check ID now? SOME parents give their children access to their ID. That…

It would not be solved without a culture shift. But with a culture shift, giving a kid an unlocked device would be as rare as giving them drugs. I'm sure it will occasionally happen. But kids are terrible at keeping secrets, so they will only have the unlocked device for temporary periods, and I believe infrequent use of the modern internet is much, much less damaging than the constant use we see problems from today.…

What if my kids want to follow nand 2 tetris or build their own custom os from a Linux fork?

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#974

Post by hellojesus »

julianozen wrote: post #921
EnderWT wrote: post #323

Earlier quoted context omitted.

ISO/IEC 18013-5 (Personal identification — ISO-compliant driving licence — Part 5: Mobile driving licence (mDL) application) is a potential solution for this. https://www.iso.org/obp/ui/en/#iso:std:iso-iec:18013:-5:ed-1... It would allow someone with an mDL on their device to present only their age instead of other identifying information.

Yes. I think it’s this + policy. And that your iPhone and other devices become more restrictive if this is not implemented. I presume most devices in the world do not have a solution to this (desktop windows computer for instance). I’m not sure if it’s a good idea for like every porn website in the world to require a secret enclave to work. But this sounds better to me than storing users photo ids in an s3 bucket

So now I'm not allowed to choose what software runs on my personal computing device with a cellular module?

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#975

Post by keithnz »

trinsic2 wrote: post #593
keithnz wrote: post #502

Earlier quoted context omitted.

don't you have to age verify to get alcohol? We don't leave that up to the parents. Feels like you defeated your own argument with your examples.

The internet is not an object, its a communication medium. That is an apples to organges argument, it doesn't wash.

incorrect. Same principle at play, you want access to something, that thing is age restricted, the vendor of the thing wants you to provide proof of age.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#976

Post by Forgeties79 »

whaleidk wrote: post #477
jmye wrote: post #356

Earlier quoted context omitted.

Sorry, I know it's a hard line for parents to tread and it's really easy to criticize parenting decisions other people are making, but the "everyone else is doing it so I have to" always seems as lazy to me today, as it probably did to my parents when I said it to them as a teenager. Is it more important to prevent your son from being weaponized and turned into a little ball of hate and anger, and your daughter from…

We used to teach kids to be themselves and stand up for what they believe in and their own authenticity and uniqueness even in the face of bullying. That having less or other doesn’t mean your value is lesser or that you should be left out. Now we teach them… conform at all costs so you never have to risk being bullied or lonely?

> Now we teach them… conform at all costs so you never have to risk being bullied or lonely?

Literally every kid/teen-targeted movie has championed or contradicted this for decades. Yes even “back in the day.” Hell what is the end of Grease? Sandy changes who she is to conform with the greasers and everyone cheers including her man who allegedly liked her as she was before? I don’t even get what they’re saying at the end.

Conform, be an individual, the message is always shifting and always has. You’re a jock, you’re a nerd. Jocks beat up nerds and get the girls. Oh wait in this movie the nerds actually win and are rewarded for being themselves though.

There wasn’t some special time where you were taught the right lesson that everyone now is missing out on, and there were plenty of lessons passed on to you that we have thankfully eradicated I imagine. Growing up is complicated. Social dynamics are complicated. The way they are portrayed is also complicated. We’re all having to adapt and try our best here, no one has the exact answer

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#977

Post by LtWorf »

armchairhacker wrote: post #161
everdrive wrote: post #97

Earlier quoted context omitted.

Completely agree. The internet works differently than how people want it to, and filtering services are notoriously easy to bypass. Even if these age-verification laws passed with resounding scope and support, what would stop anyone from merely hosting porn in Romania or some country that didn't care about US age-verification laws. The leads to run down would be legion. I think you could seriously degrade the porn in…

> what would stop anyone from merely hosting porn in Romania or some country that didn't care about US age-verification laws A government could implement the equivalent of China's great firewall. Even if it doesn't stop everyone, it would stop most people. The main problem I suspect is that it would be widely unpopular in the US or Europe, because (especially younger) people have become addicted to porn and brainrot,…

Oh but brainrot would not be blocked, how would poor Meta keep making money otherwise?

What will be blocked are news outlets that don't agree with the government propaganda.

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#978

Post by Confiks »

hiciu wrote: post #626
EmbarrassedHelp wrote: post #498

Earlier quoted context omitted.

According to the EU Identity Wallet's documentation, the EU's planned system requires highly invasive age verification to obtain 30 single use, easily trackable tokens that expire after 3 months. It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". You have to blindly trust that the tokens will not be tracked, which is a total no-go for pr…

> EU's planned system requires highly invasive age verification EUDI wallets are connected to your government issued ID. There is no "highly invasive age verification". We are literally sending a request to our government's server to sign, with their private key, message "this john smith born on 1970-01-01 is aged over 18" + jwt iat. There are 3 claims in there. They are hashed with different salts. This all is signe…

> This is the fallback mechanism. You are supposed to use bbs+ signatures that are zero knowledge, are computed on the device and so on.

You're mistaken. SD-JWT with linkable ECDSA signature is the main mechanism. An unlinkable signature scheme is being discussed on the fringes of the EUDI-project (whether it be BBS+ or Longfellow) and very bare-bones support for Longfellow has been added to the reference wallet a month ago. However the Implementing Acts have no support for such a mechanism yet, and most member states will only implement ECDSA based mechanisms (SD-JWT and ISO 18013) for the foreseeable future.

It's therefore very likely the EUDI wallet and/or a age verification solutions will launch with issuer linkable ("easily trackable") signatures.

See also this thread: https://news.ycombinator.com/item?id=45363275

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#979

Post by inigyou »

lejalv wrote: post #964
hiciu wrote: post #626

Earlier quoted context omitted.

> EU's planned system requires highly invasive age verification EUDI wallets are connected to your government issued ID. There is no "highly invasive age verification". We are literally sending a request to our government's server to sign, with their private key, message "this john smith born on 1970-01-01 is aged over 18" + jwt iat. There are 3 claims in there. They are hashed with different salts. This all is signe…

> This is true. The eidas directive requires that secret material lives in a dedicated hardware / secure element. It's really not much different than what a banking app would require. Except the state is not a bank, of which there are many. The state is not optional, and trusting an American company with, of all things, the digital precondition for social existence, is suicidal.

[dead]

Re: The Age Verification Trap: Verifying age undermines everyone's data protection

#980

Post by Confiks »

hiciu wrote: post #639
Aurornis wrote: post #590

Earlier quoted context omitted.

Thanks for posting this. The inherent problem with all zero knowledge identity solutions is that they also prevent any of the safeguards that governments want for ID checking. A true zero knowledge ID check with blind signatures wouldn't work because it would only take a single leaked ID for everyone to authenticate their accounts with the same leaked ID. So the providers start putting in restrictions and logging and…

> A true zero knowledge ID check with blind signatures That is not true and "true zero knowledge ID check" + "age verification" with blind signatures is what's being implemented by the EU ID project. So someone's id leaks. It happens. In EUDI there are things called "cryptographic accumulators of non-revocation proofs". If your ID leaks it goes into the accumulator. Similar to the certificate revocation lists. During…

> That is not true and "true zero knowledge ID check" + "age verification" with blind signatures is what's being implemented by the EU ID project.

You are mistaken. In the EUDI wallet project, unlinkable signature schemes are currently being discussed among cryptographers and a month ago Longfellow very basic support for Longfellow has been merged into the reference wallet.

You're making it seem that unlinkable signatures are very established and the default, while they are not. They're not yet properly defined, experimental and mostly unimplemented by member states. Linkable ECDSA signature are currently the default in the EUDI wallet project.

Post reply on HN