We are missing accessible cryptographic infrastructure for human identity verification.
For age verification specifically, the only information that services need proof of is that the users age is above a certain threshold. i.e. that the user is 14 years or older. But in order to make this determination, we see services asking for government ID (which many 14-year-olds do not have), or for invasive face scans. These methods provide far more data than necessary.
What the service needs to "prove" in this case is three things:
1. that the user meets the age predicate
2. that the identity used to meet the age predicate is validated by some authority
3. that the identity is not being reused across many accounts
All the technologies exist for this, we just haven't put them together usefully. Zero knowledge proofs, like Groth16 or STARKs allow for statements about data to be validated externally without revealing the data itself. These are difficult for engineers to use, let alone consumers. Big opportunity for someone to build an authority here.
4 minutes ago [-]
notTooFarGone 10 minutes ago [-]
>Some observers present privacy-preserving age proofs involving a third party, such as the government, as a solution, but they inherit the same structural flaw: many users who are legally old enough to use a platform do not have government ID.
This is a problem that has to be solved by the government and not by private tech companies.
This is a lazy cop out to say "we have tried nothing and we are all out of ideas"
logifail 7 minutes ago [-]
> This is a problem [..]
(This is a genuine question) please could you describe the underlying problem that age verification is attempting to solve?
notTooFarGone 2 minutes ago [-]
Not my point in the comment but my personal opinion:
To regulate access to addicting material.
This is done in the physical world - why should digital be lawless when it applies to the same human behaviors?
I've been addicted to a lot of digital media parts in harmful ways and I had the luck and support to grow out of most of it. A lot of people are not that lucky.
crazypyro 4 minutes ago [-]
I don't think that's what the original comment was discussing at all...
If governments want to require private companies to verify ages, those same governments need to provide accessible ways for their citizens to get verification documents, starting from the same age that is required.
iamnothere 2 minutes ago [-]
The problem is not that we aren’t doing age verification, it’s that a group of authoritarians are trying to force mandatory implementation of age verification (and concomitant removal of anonymity). That’s the problem.
Aerroon 3 minutes ago [-]
It costs money. Getting an ID here costs about 5% of minimum wage if you order it online + travel (you still have to travel there for the photos and pickup). It costs even more if you apply in person.
You could buy 19 gallons of milk for that money (80 liters).
meowface 6 minutes ago [-]
What problem? I don't think internet websites and apps actually need to know the face, age, or name of their users if their users don't want to provide that information. With exceptions for things like gambling websites.
infotainment 4 minutes ago [-]
Why should gambling be the exception? One could argue other app-based vices are just as bad, if not worse.
zenbowman 6 minutes ago [-]
Exactly right. Also, better to be overly restrictive here given the well documented harms of social media on young minds. If the law stipulates that you must be 15 to obtain social media access, and most people don't get their IDs until 18, then most people will stay off social media for another three years: no big deal.
edgyquant 11 minutes ago [-]
Everything is a trade off in the world. I think that people who are anti-id ignore this but for me personally it’s harder and harder to accept the trade offs of an internet without id. AI has only accelerated this, I don’t want to live in a world where the average person unknowingly interacts with bots more than other individuals and where black market actors can sway public opinion with armies of bots.
I think most people are aligned here, and that an internet without identification is inevitable whether we like it or not.
zenbowman 8 minutes ago [-]
100% correct. At this point the harms to children from social media use are very well documented.
Like everything else in society, there are tradeoffs here, I'm much more concerned with the damage done to children's developing brains than I am to violations of data privacy, so I'm okay with age verification, however draconian it may be.
logifail 4 minutes ago [-]
> At this point the harms to children from social media use are very well documented
Our middle child (aged 12) has an Android phone, but it has Family Link on it.
Nominally he gets 60 mins of phone time per day, but he rarely even comes close to that, according to Family Link he used it for a total of 17 minutes yesterday. One comes to the conclusion that with no social media apps, the phone just isn't that attractive.
He seems to spend most of his spare time reading or playing sports...
meowface 4 minutes ago [-]
We need to destroy privacy and anonymity online for the noble goal of the government banning teenagers from looking at Twitter and Instagram?
If it's a concern, parents can prevent or limit their children's use. If all this were being done to prevent consistent successful terrorist attacks in the US with tens of thousands of annual casualties, I'd say okay maybe there is an unavoidable trade-off that must be made here, but this is so absurd.
spwa4 7 minutes ago [-]
ID verification doesn't protect against that. Why not? Because there are a lot of people that will trade their ID for a small amount of money, or log someone/something in. IDs are for sale, like everyone who was ever a high school student knows for "some" reason.
Plus what you're asking would require international id verification for everyone, which would first mostly make those IDs a lot cheaper. But there's a second negative effect. The organizations issuing those IDs, governments, are the ones making the bot armies. Just try to discuss anything about Russia, or how bad some specific decision of the Chinese CCP is. Or, if you're so inclined: think about how having this in the US would mean Trump would be authorizing bot armies.
This exists within China, by the way, and I guarantee you: it did not result in honest online discussion about goods, services or politics. Anonymity is required.
RockRobotRock 19 minutes ago [-]
Here is an example of the problem with inference-based verification:
My main takeaway from this is that politicians seem to have given up on making "social media" less harmful by regulating it, and instead focus on gatekeeping access, with the added perk of supplying security services and ad tyrants with yet another data pump.
CrzyLngPwd 9 minutes ago [-]
It's just another way to surveil the population and won't cause any real problems for anyone who can work around it.
ck2 17 minutes ago [-]
if you are paying for internet access you have to be over 18, no?
and if you have internet access without paying, that means someone else is legally responsible for your access
"problem solved" ?
gpderetta 5 minutes ago [-]
Ideally the law would require websites (and apps) to provide some signed age requirement token to the client (plus possibly classification) instead of the reverse. Similarly OS and web clients should be required to provide locked down modes where the maxium age and/or classification could be selected. As a parent I would the be able to setup my child device however I wish without loss of privacy.
Is it bypassable by a sufficiently determined child? Yes, but so it is the current age verification nonsense.
malfist 15 minutes ago [-]
Famously children can only access internet from wifi paid for by their parents.
I'm not for these draconian age verification nonsense, but this isn't a valid argument.
bondarchuk 11 minutes ago [-]
It is a valid alternative avenue towards a legal implementation of "child safeguarding" IMO. Someone pays for the internet, that person is responsible for what minors do on their connection. If they have trouble doing that we can use normal societal mechanisms like idk social services, education, and government messaging.
This is the way it works with e.g. alcohol and cigarettes, most places. Famously kids can just get a beer from a random fridge and chug it, but someone 16/18/21+ will be responsible and everyone seems mostly fine with this.
moritonal 9 minutes ago [-]
This is the answer. If you provide internet access to someone, you're responsible for it. It's a generally established law from a Torrenting PoV, so isn't it equally applicable to downloading content unsuitable for children. Sure it'll destroy offering free wifi, but that always was tricky from a legal PoV around responsibilities.
daveoc64 6 minutes ago [-]
> if you are paying for internet access you have to be over 18, no?
No, that's not the case.
john_strinlai 4 minutes ago [-]
every contract by every ISP i have ever signed has required me to be over the age of 18 to enter the contract.
daveoc64 2 minutes ago [-]
In many countries, it's possible to get a prepaid SIM with data access - without any ID or age requirement whatsoever.
2OEH8eoCRo0 8 minutes ago [-]
Fuck data privacy, what privacy? Your ISP knows you, sites track you, cookies track you. It's a myth. But oh, we totally can't figure out age verification. Fuck off
john_strinlai 17 minutes ago [-]
[dead]
infotainment 5 minutes ago [-]
Device based attestation seems like the way to go largely; it doesn't solve the problem, but it's good enough that it would cover most cases.
Rendered at 15:18:23 GMT+0000 (Coordinated Universal Time) with Vercel.
For age verification specifically, the only information that services need proof of is that the users age is above a certain threshold. i.e. that the user is 14 years or older. But in order to make this determination, we see services asking for government ID (which many 14-year-olds do not have), or for invasive face scans. These methods provide far more data than necessary.
What the service needs to "prove" in this case is three things:
1. that the user meets the age predicate
2. that the identity used to meet the age predicate is validated by some authority
3. that the identity is not being reused across many accounts
All the technologies exist for this, we just haven't put them together usefully. Zero knowledge proofs, like Groth16 or STARKs allow for statements about data to be validated externally without revealing the data itself. These are difficult for engineers to use, let alone consumers. Big opportunity for someone to build an authority here.
So there is absolutely no way to change that and give out IDs from the age of 14? You can already get an ID for children in Germany https://www.germany.info/us-de/service/reisepass-und-persona...
This is a problem that has to be solved by the government and not by private tech companies.
This is a lazy cop out to say "we have tried nothing and we are all out of ideas"
(This is a genuine question) please could you describe the underlying problem that age verification is attempting to solve?
To regulate access to addicting material. This is done in the physical world - why should digital be lawless when it applies to the same human behaviors?
I've been addicted to a lot of digital media parts in harmful ways and I had the luck and support to grow out of most of it. A lot of people are not that lucky.
If governments want to require private companies to verify ages, those same governments need to provide accessible ways for their citizens to get verification documents, starting from the same age that is required.
You could buy 19 gallons of milk for that money (80 liters).
I think most people are aligned here, and that an internet without identification is inevitable whether we like it or not.
Like everything else in society, there are tradeoffs here, I'm much more concerned with the damage done to children's developing brains than I am to violations of data privacy, so I'm okay with age verification, however draconian it may be.
Our middle child (aged 12) has an Android phone, but it has Family Link on it.
Nominally he gets 60 mins of phone time per day, but he rarely even comes close to that, according to Family Link he used it for a total of 17 minutes yesterday. One comes to the conclusion that with no social media apps, the phone just isn't that attractive.
He seems to spend most of his spare time reading or playing sports...
If it's a concern, parents can prevent or limit their children's use. If all this were being done to prevent consistent successful terrorist attacks in the US with tens of thousands of annual casualties, I'd say okay maybe there is an unavoidable trade-off that must be made here, but this is so absurd.
Plus what you're asking would require international id verification for everyone, which would first mostly make those IDs a lot cheaper. But there's a second negative effect. The organizations issuing those IDs, governments, are the ones making the bot armies. Just try to discuss anything about Russia, or how bad some specific decision of the Chinese CCP is. Or, if you're so inclined: think about how having this in the US would mean Trump would be authorizing bot armies.
This exists within China, by the way, and I guarantee you: it did not result in honest online discussion about goods, services or politics. Anonymity is required.
https://streamable.com/3tgc14
and if you have internet access without paying, that means someone else is legally responsible for your access
"problem solved" ?
Is it bypassable by a sufficiently determined child? Yes, but so it is the current age verification nonsense.
I'm not for these draconian age verification nonsense, but this isn't a valid argument.
This is the way it works with e.g. alcohol and cigarettes, most places. Famously kids can just get a beer from a random fridge and chug it, but someone 16/18/21+ will be responsible and everyone seems mostly fine with this.
No, that's not the case.