The article talks about the possibilities of malicious cloning of these tokens by third parties, but fails to identify the much more common use case, and one that makes this scheme useless for age verification.

It's one thing to be concerned about someone stealing my credential, but another to prevent the transfer of these credentials, especially if they are limited use credentials.

The entire point of age verification systems is to prevent minors from accessing certain resources. I think we all know that this is basically impossible; but what these various governments and social media companies want to do is to make it high friction to do so.

The highest friction version of this is that the credential ties to a real world identity somehow; maybe locked behind legal barriers, etc., but if a minor is caught using someone's credential, then the person whose credential they are using can be investigated, and, if necessary, charged with a crime roughly equivalent to providing alcohol to a minor. Without the possibility of real world enforcement, none of these identity solutions can possibly work.

Keep dreaming of a technological solution -- there is none that does not lead to the world that FIRE is warning about, except to accept that we can only make a solution "good enough" and leave it at that, without expanding into full on identity verification. The solution here is likely to just try to provide better abilities for parents to monitor and limit their children's use of the internet. Let individual parents decide on the level of harm that they are willing to accept, and accept that there will be ways to work around this even if parents are vigilant, but just try to reduce it on the margins.

There is a much easier solution that already exists - parental controls on children's devices. I honestly don't understand why is it not solving the problem?

Yes, parents are responsible to set this up. But parents are also responsible to lock their alcohol, drugs or guns, condoms, etc., and many other things.

Perhaps parental controls are not good enough? That's where the regulation could genuinely help - require child-certified devices to implement minimum set of parental controls, and make them easy to use.

I wouldn't trust governments, today or in the future, to keep such a system private and I don't see a foolproof way of building some kind of audit mechanism into it to make sure the data is always truely private.

I've also always been curious how a truely anonymous identity verification could possibly work. At best for age verification, I could be given some kind of token that would still have to verify my age and be verifiable with a central authority to ensure my token is valid. The central authority could always keeper records of my token, revoke it whenever they please, and every entity that can verify the age associated with, or embedded into, the token knows at least some of my PII.

>Modern versions of this technique allow one to associate metadata (like a proof of age exceeding a threshold) in such a way that the verifier can't even correlate repeated requests across users.

If it's unlinkable, what's preventing someone from setting up a site that hands out anonymous tokens for anyone to use?

As you say, it's doubtful governments want it to be private. So we should expect them to not use these kind of elegant solutions, and the public is generally not sophisticated enough to distinguish between the options already.

I don't think they are serious about privacy and even if they were I don't even want to distinguish between "children" and "adults" on the internet. Things seem to have worked fine up to this point, there doesn't appear to be a public demand for age verification, rather some murky corporations/NGOs/agencies pushing for this. I think it's pretty clear there is some other intention besides protecting children that is the goal here.

By some stroke of luck, the NZ government recently put into place a robust privacy-preserving framework for digital identity [1].

They just launched the GOVT.NZ [2] app, and it contains a wallet that can store digital credentials. It's built by a local company called MATTR [3], who specialise in trust technology and exotic cryptography like zero-knowledge proofs. The first credential available this year will be a mobile drivers license, and we'll then be able to prove things about ourselves like whether or not we're over 18 (according to an accredited institution), completely privately over the internet and without sharing any other information.

I'm cautiously optimistic about the direction our digital ecosystem is heading in NZ :')

[1] https://www.publicservice.govt.nz/about-the-commission/gover...

[2] https://www.digital.govt.nz/digital-government/key-areas-of-...

[3] https://mattr.global/

Zero Knowledge Proofs are worthless for this.

Either they validate so little information that a single homeless person can authenticate the entire country or they validate so much information as to not have a significant privacy guarantee.

There is no in-between for ZKP validating someone's age.

The problem is that you still have to trust something you don't control and can't verify that the technological solutions are correctly implemented and applied.

> There are at least some technological solutions here, such as anonymous credentials.

Identity verification is busy being rolled out across the entire developed world right now, and I have yet to see or hear about even one single mention of anonymous credentials in the discussion of any of the laws.

>There are at least some technological solutions here, such as anonymous credentials.

Technological solutions for what problem?

Yep, there are a variety of ways this can work well, but the overwhelming 'vibe' here at HN is a) that the tech is too complex and b) that governments actually want to end privacy anyway for their own nefarious reasons.

I find 'a' amusing as we'll often see in the same conversation that users appeal to parents to take responsibility and lock down their kids' access to things, as if that's trivial for non-tech folk and foolproof. It's also silly because the user interface to such a system doesn't need to show all that complexity.

And 'b' is often supported by some out of context quote that at first glance looks incriminating but doesn't actually mean much.

The saddest thing is that the article you link addresses most of the objections people have brought up in the thread, but few have read it.

No. The point of these initiatives IS TO GET ID, not to protect children.

Anonymous credentials don’t allow the state to retaliate in the dark of night against protected expression that they don’t like. Anonymous credentials do not allow for that, so they are irrelevant.

This seems to come up in every discussion, in practice it’s irrelevant both because it’s too complicated for normal people to understand, and because the point of all this nonsense really is identification so anything that defeats that will be a non starter.

Most likely there's some huge breach where all the IDs are stolen and resold, which would maybe fix this problem while creating a bunch of others.

> privacy advocates need to be much more specific

I'm starting to think we need to lean on conspiracy theories in order to get broader population on train with this - and I'm saying this in utmost regret. That's a borrowing game from a right wing/extremist playbook.

Start with this: requiring IDs online is a first step in micro-chipping the population.

...or how about this: marxists/atifa/nazis/zionists/islamist/whoever-group-people-think-is-in-power want to erode your privacy online so it can be used against you. Some nefarious group what to know your every move!

...or how about this: remember Epstein files!? Well the pedos now want to id your children online!

I simply saying truth/evidence/rational based approach to this will not get people attention. People just don't care.

Which is precisely why powers will try to make all these illegal

I have been slowly moving towards that for a decade or two now. I still do some internet stuff (mostly here) but it is greatly diminished. The rest is just at work.

Got to the same conclusion. Guess I will go back to in-person only, and lots lots of time away from devices (which I already have).

Its a tragedy of the commons situation. The benefits of being offline are dampened by the kid being out of the loop

I agree, I think kids should have limited access to the internet. I pretty much did and it worked out for me but I have seen so many reports about it causing harm in schools and personal life. (Specifically I think LLMs should not be used in education also, but different point) However, I think the main problem people have with this "think of the children" narrative is that it will force EVERYONE to give up their credentials to access the internet, not just kids. And the general consensus is that we as adults do not want to and should not have to prove our identity to access the internet.

That's their parents' decision to make, not yours.

I mean its only a hope and a skip away from having to validate ones age to turn on the router.

This isn’t about children, mate. It’s about controlling the population’s access to content.

The children are fine. Many countries no longer allow smartphones at school, which lowers the peer-pressure factor to be online.

Parents are doing their best to steer kids. But these pesky adults, goshdarnit, they access whatever content they want without approval from The State, potentially reading dissident materials, borrowing 1984 from libraries… politicians don’t like that.

Renting and work already require ID in the UK. Every landlord and employer is supposed to take a copy of original documents proving the right to rent/work in the UK. Technically you can do that without handing the docs to the government, but there's less potential liability to do so via the Home Office website.

Here in Australia we already have the first part of 1 then most of 3,4,5. We are almost there. And you thought our wildlife was the torment nexus.

Unfortunately I don’t think it has the public’s attention, it’s still very niche. Nowhere near enough to change anything yet.

Most folks already know the internet is not a safe place to express political thought. The powerlessness the public feels is obvious.

>I’m glad this is finally becoming the cause célèbre du jour.

It really isn't, though. Don't mistake the internet for reality. The majority of people in the US and Europe support laws like these, and most of the rest don't care.

Even on Hacker News the consensus is mostly in favor of anything from age restriction to making all social media illegal.

only for a short while longer. US, EU, China, and Russia are all on the same page about you-vill-ovn-nothing-und-you-vill-be-happy kind of future, and they will bully the rest of the world into compliance.

Only if it can be turned into gray market business: additional layers of proxies and VPNs, and whatever new is invented.

As simple "I care about privacy" need is not a reason to bother with setup for a regular person. So it could work only if it's as easy, as current internet. And for profit businesses provide it.

As for another protocol all together: there are some experiments already, but again, why use those?

Better, official link https://papersplea.se/ since it has been released on multiple platforms

Sadly your take doesn’t matter since the other voting bloc is parents and people concerned about their kids.

I wish this resulted in techies spending more time to look at the substance of the harms playing out, however I see denial of the situation altogether more than anything else.

> these systems expose you to coercion, extortion, blackmail, ID theft, etc. by criminals and immoral people

I'd prefer to have safety from that regardless of privacy.

I think privacy is a stopgap semi-solution to those problems that might lessen the pressure to actually solve them in a reasonable manner.

None of this is necessary. First, the only devices that actually need to be gated are cell phones.

The user agent should simply send the user’s age of the parental lock is set up and the websites required to respect this.

Parental controls and the OS should be robust enough to not let kids bypass it (e.g.: by installing a browser that skips the header, or blocking proxy websites)

Done.

Cellphones only because those are the devices kids can have on them all the time and can easily use in private unsupervised.

They want it to equal identity verification! When virtually every top tech executive who wants a favor is at the inauguration and you have companies doing 180 degrees on support for something they previously furiously opposed, someone is getting something they wanted. It seems naive to think otherwise. Furthermore, the current administration in the U.S. fired or ignored the competent people to which you’re referring, and those people oppose a centralized repository of various metadata because it creates a central point of failure, otherwise known as a target, that is generally a bad idea for both our nation and our citizens. Of course there are agencies in the federal government that possess this information already, but they possess it for their purposes only. This is good because it means that it’s both more difficult to abuse internally in addition to being more cumbersome to collect externally.

It's a political problem, not a technical problem.

Yeah this is a basic problem that's been solved since the advent of PGP. As many other posters have said, this isn't about age verification.

There's still a whole DB matching IDs to keys waiting to be leaked. The US government can't even keep it's own personnel records safe and you think this won't get stolen and used to target people?

This still criminalizes sharing "adult" information with people who are not on the government's approved list (the things states do to crush dissent are not safe for children.)

why would any site on the internet need to give a damn about is_citizen? That's just gross to me at the mere suggestion. If it's a government service site, then they already know that information. If you're trying to use something like social media, then it couldn't possibly matter less.

Renaissance of LAN parties and SneakerNets?

How is hitting the library an act of rebellious defiance? Getting a library card requires an ID and proof of address. The library then tracks which books you've signed out. Unless you're reading the books inside the library without signing them out.

Do you know any librarians? Public libraries have always been a bit punk rock.

The internet is not free. We've been running out of IP addresses for ages and most people don't have direct internet access these days so are completely dependent on man-in-the-middle servers. All it would take is a broad ban on VPN and end-to-end encryption. Governments have been wanting to ban strong encryption ever since the public got access to it in the 90s (see PGP/Zimmermann).

"just"?

It’s not just kids. Adults are having their brains fried on AI generated political videos online right now. The state of the internet is an absolute disaster.

Parents taking responsibility for their kids.

I grew up in a neighborhood full of drug dealers. Street sellers, not the classy Walter White kind.

Ironically being on a computer all day kept me out of trouble.

But with these laws in place I guess you might as well start doing stupid ish in real life.

Most people want to operate within the boundaries of their society.

A simple G/PG/PG-13/R header for websites would solve 97% of actual issues anyone could care to present. (violence, porn, etc)

Forcing people to identify themselves will not solve skinner boxes, gambling-for-children, focus-degrading slop, etc.

Bluey-themed slot machines are still harmful.

The government is largely incompetent about proactively sifting through vast amounts of information for relevant bits.

That’s minimal defense, but it’s worth remembering the difference between what it in theory knows and what its actually paying attention to.

There is a difference between the NSA knowing and being every petty burocrat being a trivial administrative subpoena away from everything.

We could try investing in positive infrastructure that improves peoples life's in stead of creating the panopticon torment nexus. Things like third spaces where people can spend time is save spaces where they form communities and public transit so that people can get to those places. Incentivize positive behaviors instead of closing off public spaces and pricing more and more people out of being able to do anything with the minuscule amount of free time they have besides going on the internet.

And yet as the article mentioned, the "problem" is a lie... an excuse to justify the surveillance state.

Thought experiment: How do you get a phone or electricity in the most impoverished, backwards parts of the USA?

You need to identify yourself to the phone and electricity utilities so they know where to send your monthly bill. My ISP knows my name because I pay them for connectivity. I am okay with this.

If I misbehave here, dang can just ban me. There's no reason HN needs to know my real name. The only reason to mandate blanket age and identity verification is to control online speech.

You aren't required to identify yourself to get a phone. You can get a prepaid phone with no ID.

You are required to identify yourself for an electricity account because it is essentially extending you credit. You use the electricity first, and then they bill you for it later. They also only identify the person who is receiving the bill. You could have a house with a dozen people in it but the electric company only knows the name of the person responsible for the bill.

You are free to identify yourself on the internet right now. People who are intelligent and/or believe in freedom and free speech are opposed to this authoritarian power grab.

>Tech companies should ignore it and just publicly name whoever attempts to prosecute them

The most powerful tech companies are in favor of this.

Freedom of speech is contextually misunderstood. It's about political speech and the commons. Social Media is overwhelmingly private space, subject to contract terms and conditions. It may be a de-facto commons to some people but I do not believe this axiomatically, or legally makes it so, for the purposes of law and constitution. Law and constitutional bounds on speech online hit the international nature of the media very quickly.

Extra-territorial issue are huge here. What is the limit of the boundary on a given nations constitution and law? How much does the economy of the user, the hosting company, the owning company, the receiving parties matter?

Social Media has advertising and publishers. It has people who can effect editorial control over what is seen and by who and to who it is "said" -And that imposes obligations on them, and on people lodging content. Differentially depending on their economy, the reach of law, registration of legally incorporated entities.

All of this is being implemented somewhat haphazardly internationally, enforced differently, subject to legal and financial and social pressures differently depending on the times and the context.

If you want to ask questions about America, about Americans, using American companies, speaking to Americans, believe me you don't neccessarily have a simpler task here. It may well be clearer to some of you, but to me, its just as fraught.

It's just not clear to me "free speech" is the bastion rule which applies here. The EFF may think so, I don't think they have actually demonstrated it all the way to the end.

Have you ever heard the joke, how do you know if someone does CrossFit? Don’t worry, they’ll tell you

In my experience Trump supporters aren’t exactly quiet about it.

> ...you should be forced to identify yourself for posting...

The Supreme Court has repeatedly held that the right to anonymous speech is inherent in the first amendment [1] [2]. See also The Federalist Papers or Common Sense, without which the US might not exist at all.

[1] https://www.law.cornell.edu/supremecourt/text/362/60

[2] https://www.law.cornell.edu/supct/html/93-986.ZO.html

I disagree because the people who have the most important things to say have the most to lose by saying it.

Also anonymity can actually improve social media polarization (see Chris Bail’s research)

> My privacy is already decimated. For 2 decades we’ve already known about the NSA slurping up everything[1] on top of the Snowden leaks.

If you were correct, there would be no need for them to push these new laws. The fact is, you will have less privacy after these identification requirements are fully enforced.

Mate, you have to revise your stance on Russia, more people are imprisoned annually in the UK for speaking than people in Russia in a decade. The UK banned RT while you can access any western propaganda outpost from within Russia.

You’re on Hacker News, this website is known for attracting open minded free thinkers that do not fall under the influence of government financed propaganda. Learn and reassess your thoughts.