With many jurisdictions introducing age verification laws for various things on the internet, a lot of questions have come up about implementation and privacy. I haven’t seen anyone come up with a real working example of how to implement it technically/cryptographically that don’t have any major flaws.
Setting aside the ethics of age verification and whether or not it’s a good idea - is it technically possible to accurately verify someone’s age while respecting their privacy and if so how?
For an implementation to work, it should:
- Let the service know that the user is an adult by providing a verifiable proof of adulthood (eg. A proof that’s signed by a trusted authority/government)
- Not let the service know any other information about the user besides what they already learn through http or TCP/IP
- Not let a government or age verification authority know whenever a user is accessing 18+ content
- Make it difficult or impossible for a child to fake a proof of adulthood, eg. By downloading an already verified anonymous signing key shared by an adult, etc.
- Be simple enough to implement that non-technical people can do it without difficulty and without purchasing bespoke hardware
- Ideally not requiring any long term storage of personal information by a government or verification authority that could be compromised in a data breach
I think the first two points are fairly simple (lots of possible implementations with zero-knowledge proofs and anonymous signing keys, credentials with partial disclosure, authenticating with a trusted age verification system, etc. etc.)
The rest of the points are the difficult ones. Some children will circumvent any system (eg. By getting an adult to log in for them) but a working system should deter most children and require more than a quick download or a web search for instructions on how to circumvent.
The last point might already be a lost cause depending on your government, so unfortunately it’s probably not as important.
I have never seen a company do this in a manner that I would trust
Wrote a comment recently. Age verification? Unnecessary. OS-level parental controls? Possibly meriting.
https://programming.dev/comment/22589550
I am still against where all this age verification crap is coming from, and I’m against what specifically “age verification” entails; but here’s the thing: We keep saying, “It should be the parent’s responsibility to secure their kids”—and while that’s true, you can do all the talking and educating you want, but the fact is that the internet is now nigh-fully integrated with our lives, and unless you are surveilling your kid at every moment they are on the internet (don’t recommend), not every parent has the time, resources, or know-how to keep their children safe on the internet without help.
There are some states pushing for “OS-level age verification,” and I’m not convinced the proponents for this idea know what this combination of words means—but the idea isn’t all bad. An interface for apps to query the device for a simple “can access adult content” value would be helpful for parents to better manage what their kids can access without having to hover 24/7. There is zero need for any sort of identification at any point in the process. The fact that legislation is promoting cumbersome identification collection and not the already existing idea of parental controls is evidence enough that this is designed to surveil.
This may address the privacy concern, but the issue still remains of a centralized power deciding what is and what isn’t “safe for kids.”
I don’t think we’re gonna get around the child internet safety conversation, and for good reason; but the conversation should be around how we can do it without jeopardizing individuals’ safety and privacy, including children.
That’s what the router setting to block adult websites is for… you don’t have to monitor 24/7, have some idea that bad sites are blocked, and you can just be doing regular checkups on your child then.
There is and was never a need to involve IDs, other than more control over us as a whole and being able to extract more data.
I think maybe the barrier could be a little higher than just disconnecting from your home’s network.
If we were to accept the premise that there is currently an issue with child internet safety, then clearly this still an issue despite the existence of router controls. But now the question of if this premise is valid. What do you look at to determine whether “internet safety for children” is adequate? I don’t really know, and so I guess I have more reading to do.
I was gonna say something about PSAs, but no time.
I think if you as a parent have router controls and block adult content on their mobile plan if they have one (which I have seen as an option), then you are already doing a lot.
Most routers from ISPs come with “adult” content filtering enabled by default I think, at least the ones I’ve had have had this on.
VPNs already work and I can’t see them not working, so that’s always an option I guess, but they are also still an option with ID laws (ie connect to a region where they have no such laws).
Children’s safety online can’t involve limiting access and tracking everyone who ever goes online with their national ID attatched to every request (basically).
I think it’d be better if we explored the option that involves a parent blocking websites either on your network or on a device they give to you.
Most routers from ISPs come with “adult” content filtering enabled by default I think, at least the ones I’ve had have had this on.
Not that I’m doubting you, but is this a common thing? I’ve never even seen it as an option here in Canada, both on ISP supplied devices and on separate routers. Is it just because I’m using cheaper devices, or because on my region?
The German government ID card has an age verification function:
It only sends one bit to the requesting service: Yes, over 18 or No, not over 18.
And it doesn’t transmit back any data, so the state doesn’t know what services you access.
Since you are required to have an ID card and the state knows your age, this would be a pretty good option (in Germany).Yeah this. I don’t know why people are trying to make this into some incredibly complicated multi step process.
because it’s the first step in a multi step attack on our privacy.
I can’t speak for every government in the world, but as far as the major ones go, USA, Russia, China - I have less than zero percent trust in any of their companies to handle my data in a private and safe way.
It just isn’t happening. They will dissect it, sell the data points they can, surveil you with the other data points, train AI with it and all kinds of other shenanigans. And most people know this.
That’s why you can’t just go right in to doing that, gotta help me adults think they’re helping children and society at large first. Start with something small, just a small inconsequential right they lose (“Oh, I have to input my age to access this site”) and then raise the stakes a little (“Oh, now I have to input my picture ID, ok”)
Until it escalates into full inescapable 24/7 surveillance against you. And far from before that moment in time its already too late.
Once they implement this, its already too late.
How does this work to protect privacy though? Wouldn’t the site need to know who you are to be able to look you up with the government?
Or is it more like an SSO/Oauth callback style thing where you sign into the government and they send the “age bit” digitally signed and your browser gives it back the service? Either way the government would know when you’re accessing 18+ material and possibly what specific site you’re accessing? Or is there more to it?
The site doesn’t need to identify me, it only needs to know that a “Yes” bit was sent with a valid certificate from the government. And no data needs to be sent back to the government for that. The info is stored locally on a chip in the card.
If a child has access to my ID card, that’s on me.Ah misread that it was card, not a service. That mostly works and is the same kind of thing as the other crypto solutions.
Though a bad actor could still set up a service with a legit card that provides government signed anonymous “yes” responses on demand.
I worry that the response will be to require an account and a full ID from it. Social media sites saying “we need to verify your identity to ensure you’re an adult human and to combat bots. Scan your id card…”
Still one of the better technical solutions here though.
Can phones read this chip? What if you’re on a standard computer?
Yes, phones can read it.
For a standard computer, you’ll need a USB RFID chip reader.You can use your phone as the reader, I’ve had to do so many times to log into govt websites.
You know how there are stores that sell restricted substances and verify your age by checking a provided ID? Have those same stores sell a cheap, sealed card with a confirmation code on it. You can enter that code online to verify any service. The code expires after a set period of time after it’s first use to prevent sharing and misuse.
This system would be as secure as the restrictions on the restricted substance, such as alcohol, so it should be fine for “protecting the children”
Interesting idea. Could also give it out free with packs of beer like a golden ticket from Charlie And The Chocolate Factory.
And all across the whole world, 18 year old men will jump for joy when picking up birthday booze - “I can finally look at boobs on the internet!”
The problem with this question is assuming that violating privacy isn’t the entire point of age verification laws.
I’m pretty sure there is already a cryptographic protocol that can do this, but that’s not the point. We do NOT need age verification in software, it makes no sense. We need parents to take care of their own children because why would open-source software do the job of failed parenting? It’s a social issue, not something that can be solved with technology. Or we would have put shock-collars on every kids when they don’t behave.
Great idea, let’s get parents to raise their kids.
Now, how do we suddenly make them actually do that? Last I checked this idea has been around about as long as people have been around but it’s still not happening.
Parenting matters, but it’s not the only layer of protection. We don’t rely solely on parents to keep kids from walking into bars or buying cigarettes, we have laws and systems to back them up. Why should the internet be different?
Let’s not pretend that these laws actually do protect children…
There is always a way around something and if there’s any population to figure it out, it’s the ones with the most free time.
The difference between going to a bar and using the internet: Showing your ID at a bar doesn’t mean it’s stored on some server possibly ready to be stolen by hackers. It also doesn’t automatically link all of your user data to your id (like it does right now) and make it easier to track your movements everywhere you go.
These laws help no one except the elite. They restrict us, limit access to information and eventually cause our data to be comprimised.
Bad parents exist, but does that mean we lockdown the most expansive knowledge base for everyone? I don’t believe this will stop any children of bad parents from being exposed to horrible things online. Age gates don’t stop that (because they either get bypassed or another site exposes even worse stuff without the age gate).
How am I supposed to take care of my kids? My kid has got up at 3am and used his school device to do things I don’t want. The thing wasn’t supposed to be allow by the school but the bypass (web site not blocked) wasn’t one the school will find out and block. Bypasses like that spread fast in schools.
My point is that we can’t rely on parental oversight only because some plain won’t… and in your case, even actively trying may fail (it’s not your fault). And there’s always going to be loopholes in every system. Clever kids will get by most verifications, and if they don’t, that’s likely to mean the verification gets too invasive to be worth it. The best, though not perfect system is to have parental oversight + impartial verification + platform responsibility. This will reduce but not eradicate the problem.
Problem is an OS is not a useful part of this. My kids are perfectly able to install linux on a pi - and this is something I want to encourage in general (I don’t think they have, but they could), thus giving them root access - including access to things in the package repo that I may not approve of. It is a hard problem and I can’t always be there.
I can flash my id to a bartender who doesn’t need to take a copy or otherwise retain my PII to serve me. This isn’t how we do age attestation in most cases right now. We require a third party to issue and verify identity and said third parties have been show to be poor stewards of our identity.
Need parents to use already existing parental controls and for society to blame parents more for incompetence
I’m pretty sure there is already a cryptographic protocol that can do this
+1 only because I can’t upvote more.
I’ll add one on your behalf
As a parent, an extra layer of protection would be a positive. Balancing everything, and not leaving holes is hard enough, and I’ve yet to deal with the teenage phase.
As the same time, as a Netizen, the risk of abuse to datamine me is FAR too great.
The only way I would accept it is via zero knowledge proof type tokens. I can prove I am of age, but nothing more about me can be determined by any party.
The current laws seem aimed at using “protect the children” to remove anonymity from the web, and are a data miner’s wet dream.
I’m not sure if this is part of the “setting aside” stuff, but I’d ask why age needs to be verified and not simply stated.
I’m the admin on this device, I say I’m 50, why does the website need to check some ID to prove I’m 50? They trust what I reported, and if I lied to them that’s on me. It shouldn’t be the websites’ job to validate.
Exactly, it should be a parent’s job to limit a child’s access not a website.
Yes… liquor, guns, driving, and physical punishment should solely be parents choice. Wait… those caused issues and the government decided to mitigate some of the negative consequences?
when you go to a website, do you drive to the website store and ask the salesperson for a copy? All of your examples are solved because there is real, in-person interaction as part of the process.
I wasn’t replying to a comment about if this is solved or not, or the complexities of getting an outcome that most people are happy with. I replied to a comment that simplified the issue all the way to “it’s the parent’s choice”.
Your comment is opening up new issues, that I agree make enforcement while respecting privacy more difficult (but that I personally don’t think are insurmountable)
I agree, but also parents need better tools to be able to effectively limit their child’s access. App and device level parental controls are not sufficient as they currently work.
Also, more and more local router parental controls come with a monthly fee. Legislation should be attacking those subscriptions for software that runs on hardware you own, not privacy.
Despite our current parliament sucking ass, I still have some general trust in my country’s government (and culture). So with that in mind:
Our government bodies already have my basic data. Healthcare, census etc. and we use our online banking services to verify identity when accessing the data. It’s simple, and extremely widely used. I really don’t see why it would be so hard to make a relatively simple service that just gives sites that need to know a yes or no answer on if I’m over 18. They don’t need to know my birth date or any other information.
Not let a government or age verification authority know whenever a user is accessing 18+ content
This should be possible but of course the question is if one trusts the government to actually uphold this. Again, with my background, it’s a bit easier for me to speak.
Make it difficult or impossible for a child to fake a proof of adulthood, eg. By downloading an already verified anonymous signing key shared by an adult, etc.
You’ll never patch all the holes. In a perfect world, we wouldn’t be having this conversation. In a perfect world, parents would actually parent their kids and monitor their internet use. Access to adult content doesn’t even come close to being the biggest problem in many cases where some kids parents are fucking up their duties. Drugs, gangs, petty (and not so petty) crime comes to mind. Collective responsibility would be great but since we don’t live in a perfect world where everyone can just agree to a good idea like “take responsibility of your kids”, I’ll settle for trusting a democratic government to have some capacity to pick up those that fall.
I happen to agree with age verification laws. This is a tangent but I would also go a step further in saying that MAINSTREAM internet should not be possible to use without verifying that the user is a real individual person. This would be another yes/no question via a service. Outwardly they don’t have to reveal their identity but even JizzMcCumsocks needs to have a backend verification as a real person. Basically, if any government member uses some service with their own name and has a verification about that, that service must also have a way of verifying that any user is a real person. We have given Xitter way too much power and at the same time, allowed anonymity. Meta services too of course but I think Xitter is one of the worst due to easy and straight forward use. Humanity has shown that we are not equipped to handle the kind of (mis)information flow there is in these spaces. Spaces such as Lemmy can and should operate in full anonymity, as there are natural barriers to entry here, plus it’s less appealing when it’s not even really intended for the kind of use mainstream social media sites are. Here we have a collective and individual responsibility to account for the anonymity and the challenges it brings.
for a moment, let’s ignore all of the conspiratorial conjecture (not that it isn’t warranted).
by exposing an API for web services to identify the users age/birthday, how does that solve the issue of “protecting children online”.
what’s stopping a bad actor from identifying, tracking, and grooming children directly based on this same mechanism?
right now the majority of kids online are protected through anonymity, but once they are identified they can be targeted directly and the adults responsible for their well being are blissfully unaware because “the government is tracking their age”.
also. what comes next is worse than the date. online content ratings. because there’s no point in tracking age if you can’t apply a ratings system.
Imagine entire swaths of the internet banned because the content rating doesn’t meet the government requirements.
this is less about tracking users and more about censoring dissent.
I agree, although in this thread I’m mostly interested in the technical puzzle.
Parental Controls. Most devices have this setting. Parents need to be taught how to turn it on, and penalized when they don’t turn it on. This way there would be no centralized database that could be hacked thereby violating user privacy. Adults wouldn’t have to give up their government issued ID to websites.
Devices have them, but they are not very good. I’ma parent and there are thing i want to block that I can’t and others I want to allow but a on different rules than their system has.
This thread is going to be great for learning to spot https://en.wikipedia.org/wiki/Nirvana_fallacy
When software poses a requirement, software should be ditched in favor of protocols. This is why any software that relies on a closed spec protocol should be avoided.
You’ll never see an age verification requirement on IRC or XMPP. And any software using these protocols that try to implement age verification will simply be left at the curbside, replaced by an alternative.
Why prove it at all?? An assertion from the OS should be good enough. Just have the OS ask once, and send that info when it has to as a general age range. A few different age ranges for kids/teens, an 18-21 group, and 21+ is all the info they really need at most.
If age verification has to be a thing, let the user supply it at install/profile creation time, and just leave it at that.
For an implementation to work, it should: * Let the service know that the user is an adult by providing a verifiable proof of adulthood (eg. A proof that’s signed by a trusted authority/government) * Not let the service know any other information about the user besides what they already learn through http or TCP/IP *
Seems like that’s exactly what https://yivi.app/en/ can do.
How do they deal with the other requirements though? What’s stopping someone from setting up a service that uses their yivi account to sign “I’m over 18” for anyone who wants to be over 18?
What’s to stop people from providing that service to buy people alcohol?
The difference is one is physical and requires interaction with a human: “Hey uncle Bob, buy me beer?” Vs. The other one is technical and just requires them to do a Google search and click a button without interacting with anyone.
The first one has a higher barrier for entry and at least involves some form of adult supervision. The second one makes it not much different to the classic “what is your birthday?” thing.
Yoti too.
They hold and verify ID, then mostly just pass an OK to the website or service you wanna access. Similar to Paypal playing the middle man when shopping and clicking Pay with Paypal.
They do also have the ability to share other details, but according to their FAQ it’s always with your permission.
Likewise Paypal will share your name address and email, but that’s often necessary while shopping.
Logging in to sites with Google or Facebook has a similar effect, the login prompts often have check boxes that allow you to control the data you share.
The biggest problem of course is that Yoti or other similar services then know what sites you’ve been visiting, and if they don’t respect your privacy and/or keep logs of those sites that information can be hacked or misused by bad actors.
Thus they should only keep age verification use logs extremely temporarily, or anonymize their logs if storing to track general system use patterns, for maintenance and research.
There are a few options for age verification, but the one I like best is at the ISP/device level. You make the account at the ISP level have a flag for being a kid friendly service. You could also have the government establish simple tools for parents to install on their kids devices which would limit other apps and services, for example by blocking porn or violent age inappropriate content. You could even have it tie in with the age advice for film classification, though the current classification guidelines are pretty horrible. All of that could be handled by a very small government team and could be deliverable in 6 months.
These are active steps a parent can take to limit their child’s exposure to the internet and do not come with added cost to the parent. They would be just as available for someone who is poor as for someone who is rich. It would be possible to protect kids from many of the more dangerous aspects of the internet while also leaving unmanaged devices free and clear, preserving the good things about the open internet.
