There are at least some technological solutions here, such as anonymous credentials. [1] Modern versions of this technique allow one to associate metadata (like a proof of age exceeding a threshold) in such a way that the verifier can't even correlate repeated requests across users.
Governments that are serious about age verification and individual privacy (which, doubtful they truly are) should agree on a protocol and set up certificate issuers that are associated with a digital ID. Then age verification will not be an invasive procedure or risk data leaks or insider threats.
The article talks about the possibilities of malicious cloning of these tokens by third parties, but fails to identify the much more common use case, and one that makes this scheme useless for age verification.
It's one thing to be concerned about someone stealing my credential, but another to prevent the transfer of these credentials, especially if they are limited use credentials.
The entire point of age verification systems is to prevent minors from accessing certain resources. I think we all know that this is basically impossible; but what these various governments and social media companies want to do is to make it high friction to do so.
The highest friction version of this is that the credential ties to a real world identity somehow; maybe locked behind legal barriers, etc., but if a minor is caught using someone's credential, then the person whose credential they are using can be investigated, and, if necessary, charged with a crime roughly equivalent to providing alcohol to a minor. Without the possibility of real world enforcement, none of these identity solutions can possibly work.
Keep dreaming of a technological solution -- there is none that does not lead to the world that FIRE is warning about, except to accept that we can only make a solution "good enough" and leave it at that, without expanding into full on identity verification. The solution here is likely to just try to provide better abilities for parents to monitor and limit their children's use of the internet. Let individual parents decide on the level of harm that they are willing to accept, and accept that there will be ways to work around this even if parents are vigilant, but just try to reduce it on the margins.
Yes, this is the part of the issue that is so frequently ignored: Anonymous age verification schemes are easily defeated through proxying because there wouldn't be any consequences for selling your tokens. "Install this app on your phone and we'll pay you $1 per day" and it will mint your anonymous identity tokens and send them off to kids who want to buy them. If there's no way to track the tokens, there is no possibility of negative consequences.
So the schemes always start introducing features to reduce the anonymity of the tokens or make them more trackable in some way:
> The highest friction version of this is that the credential ties to a real world identity somehow; maybe locked behind legal barriers, etc., but if a minor is caught using someone's credential, then the person whose credential they are using can be investigated, and, if necessary, charged with a crime
Which requires that these identity tokens not be anonymous age-verification credentials. They become a traceable identity token tied to your government-issued ID.
But could you not set up a system where you need to go get (for free) a limited use token at a physical location, or have them mailed to your home, and they have a rough geographical lock? If a bunch of those tokens start appearing in random locations, it is a good indication that someone is reselling them to minors? I'm not saying this is idiot proof, but what could go wrong?
Not if you use a challenge-response protocol where the client returns a zero-knowledge proof of age, where the proof incorporates a random string sent by the website.
The traceable stuff is private information that the website never sees. If a minor is caught with it, then law enforcement has local access to the minor's hardware and can probably view the private data.
At that point, the private key can be put on a public revocation list. The zero-knowledge proof can include a proof that you're not on the revocation list. Once you've been revoked, you have to go through the hassle of setting this all up again, which might be enough incentive to keep it reasonably secure.
This doesn’t stop the scheme the parent proposes, where adults install some proxy on their device and challenges are responded to on the parent device. Then the private key never leaves the parent device and all the child device has is the proxy software, which could be set up to not log any identifier of the key that it used
I agree, but this is also clearly a increased barrier. Going back to OPs comment that perfection is impossible, the goal is to raise the bar, I would say that this is more than good enough.
If there's a simple piece of software that can be installed, it's not meaningfully increasing the barrier. Also, there are negative consequences to introducing "rules that you're expected to break" like this. It makes the law unserious.
Sure, but then you're partnering with someone you probably don't know to take payment for doing something illegal, and that partner knows your device and where to send the money.
And if it's a phone app, it's not going to be on app stores and you already know the person giving you the app is a criminal.
So you're installing an untrustworthy app to risk criminal charges, and the customers of this scheme are kids who mostly don't have a lot of money.
You’re missing the point. If the tokens are truly anonymous then none of this matters. There’s no way to discover or prove where the tokens came from. It could be someone in another country with stolen IDs, which are now a goldmine for minting tokens and selling on the internet.
So the schemes inherently add some traceability, which makes the tokens no longer actually anonymous.
This is the back door used to make the tokens double as ID tokens.
No, you can reliably attest public source builds of critical software for the ultimate in transparency. That even includes models running on GPUs. Combine that with blind tokens and you get trusted, anonymous identity verification.
What you also get is mobile devices that can't run unblessed code, make it impossible to remove legally-mandated spyware or backdoors, as well as websites that you can't use anonymously, even when you have very valid reasons to do so.
They are implying the use of trusted computing with proprietary software to ensure that only users on fully “trusted” (locked down) devices are allowed to access network resources.
Presumably, if you have a trusted application on a trusted device, the identifier was installed in a trusted way, the device is in trusted possession and the device won't be given to anyone else, trusted computing may be able, in certain cases, to make it more difficult for a remote minor to use the identifier.
> If a minor is caught with it, then law enforcement has local access to the minor's hardware and can probably view the private data.
And then what? You think the police are going to make a case out of getting a token blacklisted or start an investigation into the person who the token came from? Also confiscate their devices as part of the investigation? I guarantee that the token source will be someone in another state or another country or just a stolen ID being used to sell their tokens.
I can’t believe we’re getting to the point where we’re talking about sending the police to deal with cases where a minor is suspected of, what, accessing social media? To confiscate their device and do forensic analysis of the tokens on it?
Do you realize how insane this is getting? How does anyone think this is feasible, let alone a good idea?
I'm saying a system like this is preferable to attaching our real identities to everything we do online, as countries are attempting right now. We can verify age without losing privacy or anonymous speech.
It's still my preference to have no verification at all. On the internet, nobody should know you're a dog.
> I'm saying a system like this is preferable to attaching our real identities to everything we do online, as countries are attempting right now. We can verify age without losing privacy or anonymous speech.
The problem with your hypothetical was that you casually introduced the police as an enforcement mechanism for cases of a minor accessing an over-18 website. The implication is that the physical police are now involved in our access of websites, and you’re saying the tokens involved in us accessing websites will have some evidence that they can use in the investigation of that access.
This is why we keep saying that the anonymous token schemes don’t preserve privacy. It always turns into a slippery slope of adding escape hatches to the anonymity to enforce violations. The very implication that the police are going to be tasked with going out and confiscating devices to investigate suspected age token violations is an indicator of how far the window has shifted on Internet privacy.
> Not if you use a challenge-response protocol where the client returns a zero-knowledge proof of age, where the proof incorporates a random string sent by the website.
Obviously it does. These $1 per-day apps are 24/7 online and so challenges can simply be proxied just the same as tokens.
> ... law enforcement has local access to the minor's hardware ...
This is a large part of what people, in practice, want to prevent using this scheme.
> Once you've been revoked, you have to go through the hassle of setting this all up again, which might be enough incentive to keep it reasonably secure ...
States want to know who to punish when this happens. Which also details how this is defeated: you can't revoke the token, because that makes getting a conviction near-impossible and it exposes the states to counterclaims.
The people who install such forwarding apps don't have money for the court to charge, and they can't take away their identification apps (which these will be, obviously) because that's the cheapest way for states to communicate with them.
Unless you build this into the base layer of the internet (which European networks like minitel did, by the way, with France telecom graciously checking it for free. Free for the state, of course. YOU paid per packet)
> ... to keep it reasonably secure ...
Oh and "reasonably secure" won't cut it. Someone committed suicide after a message was posted, and they're "reasonably secure" who it came from? You see the problem, I hope.
Are you saying such proxying apps exist now? Can you link a source for me?
Regarding my scheme:
The only way law enforcement should have access is if they show up and get the phone in their possession, with a warrant. Which could happen any time some teenager posts something without realizing it identifies them.
If the teenager has your full credentials, that's when law enforcement sees who you are, and can take whatever action we deem appropriate. I would think just revocation if you might have been hacked, more severe if it's clear you shared on purpose. Revoking credentials doesn't interfere with the person using the app for other purposes, or with any prosecution, and criminal prosecution doesn't rely on the perp having money; quite the opposite in fact.
If you install a proxying app for the challenge-response, you're installing an untrustworthy app from a criminal to take payment for a criminal scheme, with risk of prosecution if that criminal gets caught.
Nothing in society is perfectly secure. There are all sorts of ways that we allow some crimes and tragedies to happen because we know that preventing them would be even worse. There are good reasons that courts have long protected privacy and anonymous speech, even though we could solve more crimes without those protections.
> The only way law enforcement should have access is if they show up and get the phone in their possession, with a warrant. Which could happen any time some teenager posts something without realizing it identifies them.
It’s beyond crazy that we’re actually talking about police showing up at someone’s house because they suspect a social media post came from an under-18.
This is one step away from your local government unmasking their Internet critics and sending police to their house by “suspecting” that they might actually be a minor.
> If the teenager has your full credentials, that's when law enforcement sees who you are, and can take whatever action we deem appropriate. I would think just revocation if you might have been hacked, more severe if it's clear you shared on purpose.
Why would you assume the person giving out the token is in the same jurisdiction? The tokens would almost certainly be coming from another country.
The police aren’t going to be tracking down teens, confiscating their phones, running forensic analyses, and then doing the work of getting tokens revoked through a possibly international process. They barely have enough time to show up and take a report when someone does minor physical proper damage.
All this does is open up the process for targeted abuse when governments or police need an excuse to go after someone posting on social media.
But ... you were arguing method X prevents this from "They become a traceable identity token". And what are you going to do with the anonymous tokens? You'll identify whose credentials they are ...
If you can identify physical hardware from a request or post, obviously it's not anonymous. In fact, if you can identify the owner of credentials from the credentials, they're not anonymous. Obviously in an actual anonymous system it is utterly impossible to do this, whoever you are.
So you've just proven your own argument wrong. Anonymous age verification online is impossible. You don't agree?
There is a way to prevent this (or at least slow it down), but that way requires device integrity protection.
With integrity protection, tokens can only be minted with a government app, driven by both biometrics and physical human hands touching the physical screen. There's no way to do it in the background. Without it, you can indeed have a single activist mint 10 billion tokens and give them out for free, defeating the entire scheme.
There's a CAP-style triangle here. You can have age assurance and anonymity but lose the ability to run your own software, have age assurance and device control but lose anonymity (via traditional ID checks, which don't require IP in theory), or have anonymity and device control but lose age assurance.
What you conveniently forgot to mention is this means the death of open general purpose computing. No more rooted devices, no more self built PCs. You go buy a government approved device and run the government approved OS preinstalled and the moment you deviate from the government approved happy path you are booted off the internet.
I'm a fan of separating the trusted compute levels for commercial and non-commercial uses/sides of the internet. I think we have to move in this direction.
As it stands today, doing business on ebay/craigslist/etc isn't that much different than doing it in a back alley in the bad part of town. Generally a bad idea but YMMV if you keep your wits about you. Of course it's your right to do business that way, but no one in their right mind thinks it's acceptable to do global commerce that way.
Commerce relies on legally enforceable contracts (both paper and EULAs), which ultimately rely on identity to be enforced. It's a bug, not a feature, that someone on the internet can steal my identity to purchase a product in my name and have it shipped wherever they want. It's a feature, not a bug, that my bank asks me for photo ID before I empty my account in person.
I'm not allowed to access banking computers, except occasionally and from within in a sandbox with proper credentials (ATM card for example). If, in the future my bank needs to do their compute inside my house on my phone, then it seems fair that there should be walls that keep me outside of their trusted compute.
That said, I am 100% behind keeping open purpose general computing free and available. Rooted devices, self built PCs etc all of it. I love it, saying this as a person who grew up building their own PCs and programming from a young age. I think that we all should be able to access the non-commercial side of the internet in any way we want, a true public square, warts, gutters and all. Hobbyists can do whatever they like as long as it doesn't touch commercial systems.
As I see it, the problem for most of us is that the social/fun side of the internet has largely been captured by commercial interests. Anything with a EULA should be considered a commercial site, since you're legally bound by a contract using it. As it stands today all the fun things on the internet would require enforced identity.
Maybe having a separate walled off "commercial internet with identity enforcement" will finally open the public's eyes as to the ramifications of the digital world we've built. And also allow us to individually take a stand and push back against the commercial interests through our daily choices of what sites we visit. Basically voting with your ID chip instead of your pocketbook. You can still do business in the gutter if you want to, but for the normies it will be easier for them to spot when they're in a back alley. And it gives parents options for keeping kids off of the anonymous side as as well.
I do think a Reddit with identity would be a much less toxic place. As long as the brave adventurers among us can still access the digital gutters like 4chan and other message boards.
> I do think a Reddit with identity would be a much less toxic place.
Do you remember the days of "Real name" requirements on YouTube and "Google+"? The experiment was tried, it didn't change things. (Also, see Facebook for an ongoing version of the same experiment).
The tokens could be tied to the device and Apple account by a provider like Apple, in fact you don’t need to issue tokens, only provide a web api that Apple and other browser providers support, which attests age.
This is certainly something that can be solved technically if we want.
It sounds like your scheme would only allow browsing the "adult web" on locked-down, unmodified devices running government-approved software. Frankly, that's worse than even requiring ID.
what you say which is the real thing, is the total institutionalisation of everything, the very wet dream of beurocrats everywhere, and of course done because "they have no choice", and are free to claim a pure lack of any motive or underlying agenda, and the vicious cycle of "just doing there job" enters our world, again.
I thought a solution to this would be to use a physical smartcard to store the certificate(perhaps on your government ID).
if the protocol is a challenge/response and the private key never leaves the card it would make proxying without the physical card more difficult.
A certificate could be anonymous and the website would only need to verify it against the born_before_2008_root_cert in 2026. You could issue has many certs as you want and all would have a validity of 1 year so that websites only have to install at the maximum 2 root certs.
I know but what I mean is it's a lot of hassle just to visit something. And many devices I have like my VR headset don't have an NFC reader to validate some govt ID.
If the smart cards required some human input to perform a signature maybe this could work. Otherwise there is nothing stopping someone from selling use of their card via some proxy software
We are talking about porn here.
And the internet will be always full of it - and that can only be prevented by controlling all of it, or have each state have a golden firewall.
All of these solutions seem very complicated, for little benefit. So a anonymous age verification scheme, fine with me. But making it more complicatdd, because dark entities could capture and resell tokens .. seems a step in the direction of madness.
Crusades against sexually explicit material are certainly popular in some places.
But these days I see a lot more talk about the developmental effects of parasocial media on kids. There’s a whole segment of buy-in there that didn’t exist before.
I don't see where I should sacrifice my freedoms to remain anonymous on the internet or MUCH more importantly, have control over my hardware and software just because parents can't do their job
> but if a minor is caught using someone's credential, then the person whose credential they are using can be investigated, and, if necessary, charged with a crime roughly equivalent to providing alcohol to a minor. Without the possibility of real world enforcement, none of these identity solutions can possibly work.
They don't work even then.
Suppose you completely eliminate privacy on the internet and require every domestic site to collect the name and social security number of everyone who visits. Then a child uses an adult's ID, regardless of whether it's with or without their knowledge. Is the child going to inform on themselves? No. Is the adult, when they don't even know about it? No. Is the adult, when they provided it on purpose? No.
That constitutes the entire set of people who would typically know that the person using the device isn't the person on the ID.
On top of that, we can punch an even bigger hole in it. Search engines, among other things, index other sites. Google is obviously the biggest but there are many others -- Bing, Marginalia, Brave, Swisscows, Yandex, Perplexity, Baidu, etc. They're run by adults and most of their users are adults, who reasonably expect to be able to turn off "safe search" if they want to. So some adult at each search engine would have to provide their ID to the crawler so it can index things inappropriate for children and show them to adult users. It would therefore be a fairly unremarkable and recurring thing to see the same ID make a zillion gigatons of requests.
But then you can't use "why is this person downloading 100 things from 100 computers at once" as an indication of anything nefarious happening, and anyone can still set up a service hosted on a foreign server that will serve adult content to anyone without an ID by serving it out of a cache. (And in the case where you're invading everyone's privacy, that service would also be very popular with adults.)
> Is the child going to inform on themselves? No. Is the adult, when they don't even know about it?
In the context of social media, if they want to actively participate they have to given that it's the entire point. It's true that even with a government ID scheme people could borrow someone's ID to get passive access with their consent. But a kid couldn't share an account with a parent without that parent knowing because you see their activity, and they also couldn't post.
Kids shred these schemes. The designers of them seem to forget that the social dynamics of the adult world are completely different - just one kid needs to figure out how to bypass the system, and the knowledge spreads like wildfire.
Example: schools banned phones, so kids switched to talking over Google docs:
If we give parents better tools to limit and monitor internet access, kids will just buy a used phone which is unregulated. If their parents even bother to use the tools in the first place (it is my impression most parents do not). There is also a lot of loopholes parents do not even think of (like a web browser on a game console).
This is where social media and other sites' endless datamining and profiling will come back to bite them. These sites already know the age range of users to a very high degree of certainty, and can continue to obtain such in an ongoing fashion. If an underage person is using these sites, it's likely going to be because the store clerk just nodded and winked, instead of because they were genuinely fooled by a borrowed or fraudulent ID. And in that case, the clerk is the one facing the penalties.
Put the burden of responsibility on the sites themselves and the number of people that will be able to successfully bypass such restrictions is going to be negligible and largely depend upon ongoing inorganic behavior or being an outlier in terms of behavior/interests.
the article also mentions; <But the government puts much of the onus on social media platforms to ensure users understand the verification process and on users to read up to make sure they aren’t being scammed.>
Unfortunately, the said-government doesn't seem to worry about the fact that their own systems have been breached over the years
> The entire point of age verification systems is to prevent minors from accessing certain resources.
Then why are they forbidding VPNs?
This is clearly NOT a use case that is solely referring to minors.
The whole cake is a lie and so is your assumption that age sniffing is "to protect children".
> Keep dreaming of a technological solution
We don't "dream" - we know what is possible and what is not.
Mass surveillance of everyone is simply not an option.
> Let individual parents decide on the level of harm that they are willing to accep
Nobody has an issue IF it were about individual parents, but it clearly is not. Governments try to criminalize and restrict everyone - and that is the true agenda.
> The entire point of age verification systems is to prevent minors from accessing certain resources. I think we all know that this is basically impossible; but what these various governments and social media companies want to do is to make it high friction to do so.
The problem is, this is wrong. What these governments want to do is get a grip on online behavior, through actions against individuals, who can't/won't defend themselves, rather than through actions against gigantic corporations that may choose litigation and take years to change their behavior, if they do at all.
Governments want to declare something illegal, say downloading a movie, putting racist comments online, ... then catch everyone who engages in that behavior online through mandatory identification, and actually have an effect.
To do this, breaking privacy is, of course, a core requirement. This can be introduced into these systems afterwards ("judge X wants to know who authenticated with token <token>, please provide the information"). Without this, government rules will remain totally ineffective online like they have been in the last 40 years.
I personally much prefer government rules remaining totally ineffective online.
I feel strongly that this conspiratorial mind-reading approach to this sort of issue is just counterproductive.
What all the governments (and non-governments, frankly, there are many supporters of these things) are asking for is excluding minors from certain websites and services.
The problem is that this translates to age verification, which translates to identify verification, which incidentally gives states and other actors a variety of other tools they can use for anti-civil-liberties purposes.
In the end their motives are just irrelevant unless there is a clear way to exclude minors from certain services without going down the chain towards identity verification. Such a way does not exist, so we have to fight it here, at the point where the basic ask emerges.
Why can’t you just sell single use codes at gas stations/liquor stores/etc and they just check your ID before sale? Of course shady places can still sell them without ID check, but we have this problem already for liquor and tobacco.
> The highest friction version of this is that the credential ties to a real world identity somehow; maybe locked behind legal barriers, etc., but if a minor is caught using someone's credential, then the person whose credential they are using can be investigated, and, if necessary, charged with a crime roughly equivalent to providing alcohol to a minor. Without the possibility of real world enforcement, none of these identity solutions can possibly work.
Buying alcohol for a minor implies knowledge and intent.
Getting the tokens out of a phone doesn't require the user to do any of that, the user just has to be frugal and keep the phone longer than it's supported by the manufacturer, until some local exploit is found again, and that token will be extracted and available online for everyone to use.
Parents buy those phones, phones could easily have a "user is a minor" setting (and a flag sent to all the sites that want one) with a password for parents to unlock stuff if needed. This would be set during the phones first set up, and it's done. But nope, the plan is for everyone to install a form if a digital ID on their phones, and once it's there, requiring full-name identification when registering is just one step away.
There is a much easier solution that already exists - parental controls on children's devices. I honestly don't understand why is it not solving the problem?
Yes, parents are responsible to set this up. But parents are also responsible to lock their alcohol, drugs or guns, condoms, etc., and many other things.
Perhaps parental controls are not good enough? That's where the regulation could genuinely help - require child-certified devices to implement minimum set of parental controls, and make them easy to use.
That's not the problem governments are solving. They're solving the problem of convincing the public it's a good idea to end the anonymity of internet use.
I know! What puzzles me is responses every such article gets even on HN - let's build some cool tech that 95% of the general population and 100% of politicians won't even understand not to mention agree to.
Yes, government want to end anonymity and that's clear to some. But governments enjoy on a pretty broad support for this and many people supporting this believe it's a real problem. Suggesting to leave it unsolved or solve it in a way they can't trust or understand is only going to alienate them, making the government job easier.
I think suggesting a simple, cheap and effective solution to this problem that has no impact on privacy is a way better way to counter that. I think local parental controls fits the bill.
People on average aren't very smart and will happily support programs objectively harmful to them and everyone else because the government and a nice lady from the breakfast TV says it's necessary to think of someone's else's children watching porn (this soundbite is gross. I don't understand how it's okay for the serious people to repeat it).
Of course it's accurate to say a lot of people aren't smart.
A lot of people also may or may not be smart but have limited knowledge of this area and limited time/effort to expend thinking about it.
I don't think you should rail against those things because they will always be true for every topic.
Instead, people who have understood the deeper implications of this, for instance the typical HN reader, need to connect with the average person, engage with rather than dismiss their child protection fears, while explaining the downsides.
Taking a high handed dismissive attitude will not help to shift public opinion.
But I'm expressing my opinion on HN, not for the general public?
I thought that stating this, I believe, fact as a contributing factor in the creeping authoritarian climate would be understood without having to attach a handful of caveats and papers?
Naah, "nice lady from the breakfast TV" is mostly[1] an allegory of the traditional media narrative, but you can't seriously deny the impact and importance of it?
If you deny for example Murdoch-owned media impact on the society, or the extent of the damage for example BBC did in the UK to the human rights or the discourse, I'd suggest reading more :)
[1] one TV programme I remember (I don't watch it): "Good Morning Britain is the UK's most talked about breakfast television show with a weekly audience reach of 4 million people." that's 10% of the age group 16-64 here, not too shabby-- and that's ONE tv.
> But governments enjoy on a pretty broad support for this
No they do not. They do an enormous amount of PR trying to convince people that they have it, though.
In the real world when there is a ton of support behind a position, you see representatives of it all over the place and they are pushing the agenda and the coverage. In the world of online age verification, you just see a bunch of lame duck politicians using procedure to sneak policy changes in and keep objections from being heard, and a few government contractor-surrogates writing op-eds (that they haven't read.)
When puritans go on the march, they're actually pretty loud. Most of the anti-social media people are hippy-dippy upper-middle class liberals who curse "screens," completely believed Cambridge Analytica's PR and think that Trump rules through mind control - who will be bothered by the end of anonymity; and the remainder are angry online right-wingers who think that they were censored by and as a result of social media. They're not marching together, they're not marching to have people identified when they're using the internet, neither of them are even prioritizing social media right now and they aren't putting pressure on anyone.
The fact that it's so unpopular is why there are lame ducks doing it. They're just assuring their fortunes on the way out, and the person on the way in will pretend like they had nothing to do with it even though it will be will be passed and implemented on their watch.
> No they do not. They do an enormous amount of PR trying to convince people that they have it, though.
Ok who is paying for that PR though? its not free.
its not like all the UK kids charities are for it.
> Most of the anti-social media people are hippy-dippy upper-middle class
My kids school is very much not in the posh area of london (although they are trying to make it posh) they hate what social media feeds their kids _indirectly_ As in clips and trends sent to their kids via chat or DMs.
It appears that what they want for their kids is basically a walled garden where the advert-content can't bombard their kids, along with the racist/violent stuff.
> That's not the problem governments are solving. They're solving the problem of convincing the public it's a good idea to end the anonymity of internet use.
I'm really sorry, but that's giving politicians far to much credit for being able to plan ahead.
Look at both the UK and the USA. The UK's just yeeted its PM because he had the personality of a block of cheese. The USA is currently inches away from shooting people if they mention the word green and water in DC. None of that screams "I am a master at planning ahead and manipulating public opinion in to doing x"
The politicians have no idea about how this all works, they see that "social media" is causing harm (its not the only source, we might get to that) The public, especially in the UK really do not like americanised media being forced in their faces and want "something to be done"
Again for the UK specifically the OSA specifically didn't layout a government mechanism for age verification. they left it to the end company to avoid the suggestion of tracking. Despite it being ripe for uberfraud and blackmail.
it would be much more private if ofcom had published an opensource gateway to anonymously authenticate against. (assuming the thing was built properly and verified)
But to the point you are hinting at
Google, meta, apple and $OS makers already track you. This is not an issue of privacy persay, its about who can track you and why. I'd much rather a list of times I access a site that required age verification being stored by the government, than every single fucking page I looked at tracked by google/meta.
> its about who can track you and why. I'd much rather a list of times I access a site that required age verification being stored by the government, than every single fucking page I looked at tracked by google/meta.
It is about what abuses can happen from that info. Google could sell your data. The government can imprison you. You don't think Trump wouldn't try to collect info on his opponents and weaponize the DOJ against them?
In 1953, Eisenhower signed a pact with the Zeta Reticulans (grey aliens) at Holloman Air Force Base. This pact set in motion a century-long program of preparing humanity for the alien disclosure. Communication must be controlled at a global scale, to avoid mass panic and the collapse of society when the disclosure is announced.
Yeah. Didn't you find your dad's dirty VHS tapes when you were young? I'm sure most of us did. And we turned out fine.
And no, porn isn't more extreme these days either. I remember seeing bukkake, golden showers etc on borrowed tapes and hacked pay TV. BDSM existed back then too. And I had some pics of a girls face surrounded by male members and their output. Never once did I think this would be a normal thing to do with my girlfriend once I got one.
And these things are still gonna happen. Teens are going to go through their dad's phone when he's sleeping, find his stack of Blu-ray's or vids on this computer. Even with all this age verification stuff. I don't understand why we suddenly think that's the end of civilization.
> Yeah. Didn't you find your dad's dirty VHS tapes when you were young? I'm sure most of us did. And we turned out fine.
Were they delivered to you in truckload volumes every day, including tapes recording executions, child molestation, foreign political propaganda, domestic political propaganda and misleading advertisements?
Every day, any day, unlimited quantities? Including giving your phone number to any strangers anywhere in the world so they can talk to you without limits, supervision or even parental knowledge?
No?
Then let's perhaps stop pretending that millenial internet free childhood is a thing that exists and let's talk about actual modern issues.
> I don't understand why we suddenly think that's the end of civilization.
Because they've been told to think it by the combined forces of Meta and the Heritage Project. They spelled it all out in Project 2025, a check list which has been followed nearly to the letter. They're also rampaging through libraries and trying to keep books of the shelves.
Conservatives don't like porn, because controlling sexuality is part of the cult playbook to control people. (Addendum: they don't like other people having it. They're hypocrites, of course.) They also want to, while instituting a backdoor ban on porn, define everything else they don't like as pornography. Project 2025 repeatedly uses the term "pornographic" as a synonym for for LGBT issues and other things.
The goal, after de-anonymizing the Internet, is specifically to control access to information and entrench their fascist Overton window shift.
They're really sore that many Millennials and Gen Z had the internet as an escape hatch from local, abusive churchy bubbles and want that locked down going forward.
And yes that usage of the law by linking LGBT content to porn is something I've seen in Europe like in Hungary too. But even in the Netherlands, one of my friends is always foaming at the mouth about schools mentioning lgbt in sex ed class. When it's the most important time to prevent people needlessly struggling with their orientation.
Luckily where I live this isn't a thing and it's still very pro lgbt. The city always makes a huge deal about pride month with posters and events everywhere.
I do worry about the control over the internet too. And I've seen it coming for a while. When I was younger there was this WAN movement where people connected their WiFi networks together with parabolic dishes and the government was always trying to prevent and discredit that saying it was used for illegal file sharing (which it was but so is/was the internet).
I'm not so worried for myself because I'm so technical, whatever restrictions they come up with I can work around them. But most people aren't that lucky.
I was thinking that some kind of permanent physical attachment with passive electronics could be given to children, like an ankle bracelet used for home curfew, monkey's headband, a dogs shock collar, or just a nice bracelet, call it MoB, which couldn't be removed until they are of age. Devices they are given could be associated with those devices and not usable without them, if they disappear from passive scanning then they have been tin-foiled, etc etc. I've not seen any discussion of this type of approach which gives children something to aim for - freedom, and tallies with human historical culture as well.
They very much aren't good enough yet. I'm a highly technical user and have had to move to using MDM tools to actually have something that works reliably.
Have decent defaults. “Is this phone for a child” and “scan this wr from parents phone”. 90% of problems solved.
That said while Apple does a good job at parental controls, Microsoft is altered. Trying to have controls on Minecraft across a windows laptop and a switch involved a multi hour odyssey, creating tons of accounts for parent and child.
Or, just incentivize or mandate stores to sell "child-certified" phones with parental controls pre-configured (along with a physical plug-and-play usb key for parents disable them when the child is old enough).
You've got to be really on the margin of society to not be able to set it up when every grandma and her dog use smartphones. There're about 1000 different ways to improve the lives of such people without making everyone use their government ID when scrolling Instagram.
I consider myself fairly tech literate and parental controls are incredibly hard to use correctly. I ended up just setting up an android phone with an MDM, because as someone with a sysadmin background it was far easier for me than anything I could find targeted at parents.
The local school district has been issuing iPads to kids for about a decade, and they still haven't figured out how to block exactly what they want blocked. The system they give parents for monitoring the iPads is a joke (Apparently my kid spent 75% of his iPad time the last week of school on sites categorized as "web").
I am a member of FIRE, I am extremely opposed to the mandatory ID laws, but the state of parental controls is phenomenally bad and saying you have to be "on the margin of society" to not be able to set it up is so far from my experience that I couldn't help but to respond to this comment.
I'm not sure what the solution is; a lot of people have suggested requiring sites to send categories (e.g. if every social media site was self-tagged, then blocking social media could be just a single check box in parental controls), but that probably isn't constitutional in the US (Compelled speech is usually banned under 1A grounds), and is subject to too much interpretation (seems unlikely that all 50 states would agree on a definition of "social media" much less "pornography").
Having devices send the age out to sites seems strictly better than ID checks to me, but is still a "one size fits all" approach to parental controls, I worry that if that became the norm the already mediocre controls that exist would atrophy, and it certainly would make it easier for malicious actors to setup a website to target minors.
Have you missed the recent moral panic about the declining birth rates of white children? Brought to you by the same people who hate pronouns [0], trans people, and/or covid vaccines. In such a world, condoms will be required for non-whites (or race mixing relationships) and forbidden to aryan/white couples.
Notes:
0 - For an example of using 2 pronouns in one sentence: "I am he".
There is a bootlegger and baptist thing going on here. One understandable point of view is that of parents that control their kids' phones, but other parents in the community do not. Then their kids are the only ones in the class without tiktok or Instagram or something.
For those parents life is easier if nobody is allowed on these things.
I don't understand why the act of buying internet access isn't considered a parental control. I doubt very many kids are doing it or can.
Ok, but parents buy internet access and then let their kids use it, because the kids need it for school. So? The parents job is to keep their kids out of trouble. Learning how to keep track of what their kids access shouldn't be difficult, and maybe should be part of the obligation parents have, kind of like their obligated to teach their kids to drive before giving them the keys to a car. Its analogious to saying "kids shouldn't walk home from school or be let out of the house at all because they might wander into a nude beach or join a drug smuggling satanic cult". Most of us don't hold that view because we trust that kids can be taught to be vaguely responsible.
What's more: tools to shield the kids have been around for longer than most of the parents have been alive at this point. The problem is pretty much solved in multiple ways, and wouldn't even be a problem if parents only followed their basic responsiblities. Also it isn't a problem in the first place, I haven't seen any clear, undisputed evidence that shows that kids are degenerating into fiends because of looking at adult stuff on the internet.
> The parents job is to keep their kids out of trouble. Learning how to keep track of what their kids access shouldn't be difficult
Unfortunately it is, but we could fix that with only minimally invasive legislation. Right now you either whitelist which breaks half the internet on a recurring basis (things are constantly changing) or you blacklist which is swiss cheese. Either way you're relying on third parties.
I think it would be much better to legally mandate a certain minimum level of self classification for website operators along with a simple and extensible scheme for communicating such. It might also be useful to mandate that devices ship from the OEM with parental control software supporting that standard but honestly I doubt that's necessary - if their were a standardized and above all reliable signal available I think browsers and operating systems would rapidly adopt support for it.
Exactly! We already have content tags on TV/Movies, just extend it to the web and make mandatory.
I imagine it could be not trivial to enforce (esp. for offshore web) - but definitely easier than enforcing the same sites to implement much more complicated identity verification (while preferably also not leaking this data).
But that might not even be necessary. A small on-device AI can probably do a decent job classifying pretty much everything we don't want children to see - with and option for parents to override it when needed.
> I imagine it could be not trivial to enforce (esp. for offshore web)
It's quite trivial, actually - the parental control software is designed so that if there are no content tags, then the site does not display. The mandate for websites to tag their content would only need to apply to websites over a certain size, to bootstrap the network effects.
The other option is for the major browsers to refuse to load pages that don't include the tag. I don't think it's a good thing that they can unilaterally dictate web standards but that's the reality so might as well take advantage of it for the better I guess.
I think that's the same option? I'm imagining "parental controls software" as something built into browsers (/ app stores) that can be enabled when you're setting up a new device. Or it can be disabled, meaning no tags would be required, leaving the open web unaffected.
Given that we're at the point where big tech is pushing its regulatory capture legislation aimed at demanding mandatory identification ("age verification" fundamentally boils down to identity verification), I don't think it would be unreasonable for a legislative mandate for every site over a certain size to have to publish tags, and every mobile device manufacturer over a certain marketshare to have to include a parental control solution in the device setup.
Although I'm also left wondering what the state of the art really does look like here, and whether a mandate for tags is even what is needed. The real problems would seem to be twofold - parental controls software isn't included with most devices, and most parents won't go out of their way to seek out a third party option. And second, very few websites aim to serve people under 18, 13, etc to begin with. Rather they like the fiction that their services are "18+" regardless of who is using them. (Mandating tags would serve that last one, but perhaps there is a more direct approach?)
Not quite. I'm suggesting that adoption could be forced if the major browsers refused to load sites that didn't include the tags regardless of whether or not parental controls were enabled. The end result would be that either your site included the tags or else it would not load without some sort of manual user intervention on every visit on windows, ios, etc.
> leaving the open web unaffected
But the entire point here is that there would be a legal mandate for all sites to carry such tags. The goal is to fix the problem that parental controls are spotty and unreliable at best.
> The real problems would seem to be twofold
It's as I previously explained. None of the current options are particularly good even if you are a parent that cares and is willing to invest time and effort.
> they like the fiction that their services are "18+" regardless of who is using them.
That's due to not wanting the liability of a mishmash of laws from different jurisdictions. Nearly all of them treat an 18 year old as an adult so problem solved.
That's entirely separate from these tags BTW. The idea isn't for the site to communicate some arbitrary age appropriateness signal that they as a third party to the family couldn't possibly know. Rather it's to communicate classes of content such as porn, gambling, violence, social media, user generated content, games, that sort of thing.
> But the entire point here is that there would be a legal mandate for all sites to carry such tags.
My point is that you don't even need to mandate it for all sites, and attempting to do is kind of specious based on the existence of foreign sites. Rather you can focus on mandating it for the large consumer-oriented sites, and this will create enough of a critical mass that a web browser with parental controls enabled will have decent functionality.
The difficulty with forcing some uniform mandate onto "all sites" is that the mandate has to be for tags that are faithfully stated, rather than a blanket 18+. And small personal website operators shouldn't be in the position of being forced to determine whether the random stuff on their personal website is specifically suitable for 13+, 18+, etc.
That's the goal of defining the semantics in terms of an open system rather than a closed system - it fails gracefully.
> None of the current options are particularly good even if you are a parent that cares and is willing to invest time and effort.
Pragmatically this is disappointing to hear, but matches everything I've been able to surmise.
> The idea isn't for the site to communicate some arbitrary age appropriateness signal that they as a third party to the family couldn't possibly know. Rather it's to communicate classes of content such as porn, gambling, violence, social media, user generated content, games, that sort of thing.
I think it should be both. There should be a class of tags that assert a site is legally fine for a 13 year old to view in the US, an 8 year old to view in the US, etc, possibly multiplied with jurisdiction. (note the direction there - it's not a statement that there is content unsuitable for a 13 year old, rather it's a warranty that the contents are suitable for a 13 year old). There should also be tags of the content/aim of the site like you've listed.
The settings in the parental control software can then make a good first pass based on age, then content categories, then parents could even allow/disallow specific sites. The point is to provide good defaults, but ultimately keep control of parents rather than giving it away to corporate attorneys as any age verification (ie identity verification) based solution inherently does.
The problem with this idea is that it assumes responsible parents, which are not a given. I agree with you completely - I don't want any kind of controls on the Internet - but we live in a world where we cannot actually rely on parents to fulfill what you would consider to be basic and reasonable expectations of parental duties.
They certainly have other problems however the internet is unique in that it drops the entire world directly in your living room. Even with irresponsible parents zoning laws keep most children away from things like casinos and strip clubs (at least until they can drive) and everyone benefits from community efforts to keep the neighborhood safe.
>The parents job is to keep their kids out of trouble.
I challenge that anyone believes this, and for my evidence, I would submit all the age based laws that protect children regardless of what parents do.
We have already, long ago, decided that it is the government's job to protect children, at least in cases where parents fail to do an adequate job. That's why I don't see this ending any other way. The march to total domination by the side of the government might be slow, but they already won the war around a century ago (exact timeline for laws protecting children in place of parents is a very long topic and does differ country to country, I recall hearing some places still even let kids buy alcohol if they say it is for their parents to consume).
Children can buy their own devices. School issued devices are not under parent control. Parental controls and school controls are laughable. There is no incentive for OS vendors/retailers to provide robust solutions to this problem. PII industry is essentially pushing regulatory capture.
I wouldn't trust governments, today or in the future, to keep such a system private and I don't see a foolproof way of building some kind of audit mechanism into it to make sure the data is always truely private.
I've also always been curious how a truely anonymous identity verification could possibly work. At best for age verification, I could be given some kind of token that would still have to verify my age and be verifiable with a central authority to ensure my token is valid. The central authority could always keeper records of my token, revoke it whenever they please, and every entity that can verify the age associated with, or embedded into, the token knows at least some of my PII.
> I've also always been curious how a truely anonymous identity verification could possibly work.
You go to a store. You show the clerk your id and give him a quarter. The clerk pulls a scratch-off ticket from the front of a ticket tape. The ticket contains a token identifier.
It's anonymous. The clerk or his POS system knows your name and age, but doesn't know your number. The vendor providing the tape doesn't know your number or your name. The system accepting the token knows your number, but doesn't know your name. The token is only valid for a day after use, so loss and transfer isn't much of an issue.
It's the exact same process by which you buy lottery tickets in a world where they don't need to verify your identity when you redeem them. The lottery has no idea who bought a particular ticket, only that a ticket was bought. The clerk knows you bought a ticket, but doesn't know which ticket.
Obviously, Eavesdropping Eve looking over your shoulder knows both your name and your ticket number, but that's not a practical attack.
> It's anonymous. The clerk or his POS system knows your name and age, but doesn't know your number. The vendor providing the tape doesn't know your number or your name.
Where does this 3rd party identity token provider come from?
For government-issued identity tokens, there are not separate parties. It's just the government, and they can choose to link whatever they want in their internal system if they decide it's in the interests of national security.
You're also forgetting that lottery tickets are tracked. This is how they can announce which store sold the winning ticket before anyone steps forward with it. It would be trivial to match a buyer to the ticket if they wanted to inspect the records. In the case of a government identity token service, there isn't even a separation of parties providing the records. They do it all and can have all the data.
> Where does this 3rd party identity token provider come from?
Some oracle whose job it is to print tokens and hand out rolls to the stores (and to the websystems). They would know which store got which roll, and which website authenticated it, but not who each ticket from that roll went to.
With a big enough roll, this is essentially anonymous.
Yes, lotteries know which store got the winning ticket, but they have no idea which of the patrons in the store got it. Not unless they ask Eve to get her telescopic lens and notepad out.
> It's the exact same process by which you buy lottery tickets in a world where they don't need to verify your identity when you redeem them.
I’ve sold lottery tickets, and you have to be legal age to both buy and redeem them, so I’m not sure that this analogy or hypothetical solution is comparable to lottery tickets, nor is it likely to be the panacea you think it is.
I don’t think that the nascent online age verification schemes are good for society in general, either, but that’s not really the point you were making in your comment, so I don’t assume that you believe they’re good or bad, but simply advocating for a more privacy-preserving implementation. Which is kind of the whole point of the argument against bad implementations, but those who mandate and implement the systems likely view uniquely identifying people as a boon, whereas you and I probably don’t, which is why I am not hopeful that your ticket system will be used, because it will be higher friction for more people than uploading scans of their IDs and/or their face.
The ticket system, if implemented, would be used by so few people that the folks who do could likely be re-identified by Bluetooth tracking beacons and facial recognition in the same stores which they bought the ID tickets you suggest, and so I think the number of people who would escape tracking by any such means to be so few as to be a rounding error.
Those folks who do pursue this privacy hobby/fetish are statistically likely to ultimately mess up on their opsec eventually on a long enough timeline, so it’s hard to even imagine a scenario in which it matters either way what individual privacy activists do or don’t do from the point of view of the panopticon designers or implementers. Those not identified to a desired confidence interval by the mass surveillance system will just be retargeted for more sophisticated surveillance measures.
Despite how we rage, we’re still just rats in a cage.
More and more, the privacy debate feels like a quixotic struggle against giants, when everyone already knows that those giants are actually windmills; the majority of society now lives on reclaimed lands which rely on those windmills’ continued existence, and so no one cares about privacy in the way that you or I might care, because they are incapable of perceiving windmills as giants, nor do they have the intellectual or philosophical or political beliefs which would allow them to even entertain such perceptions even for the purposes of discussion. The privacy debate is beyond their ken.
> It's anonymous. The clerk or his POS system knows your name and age, but doesn't know your number.
What prevents a commercial "AI" security camera analysis firm from doing a decent job of linking footage of a store's customers to a likely subset of tokens, based on the knowledge of which tokens are sent to which store and how many tokens have been pulled off of the roll so far? Remember that you can design the token roll packaging so the easiest thing for a clerk to do is to pull off the rolls in the order in which they were shipped. Or -hell- you can design the token dispenser so that it phones home to the oracle that sent the roll to the store with the range of tokens in the roll when the roll is loaded into the dispenser (for "security purposes").
> It's the exact same process by which you buy lottery tickets in a world where they don't need to verify your identity when you redeem them.
I've seen many people buy lotto tickets. I've never seen anyone asked for ID. Perhaps the merchant is supposed to check for ID, but they don't. Relatedly:
> The clerk pulls a scratch-off ticket from the front of a ticket tape. The ticket contains a token identifier.
What prevents rolls of those tickets from falling off of a truck and either being handed out for free or at a substantial markup, no questions asked? [0]
In the real world, the system you propose absolutely will not function to the standards required by the people agitating for these systems. You can't "protect the children" if "children" can easily get their hands on anonymous access-granting tokens.
[0] The fact that this doesn't happen with lotto tickets often enough to be newsworthy is not a compelling counterexample. Stores make a decent amount of money selling those, and wouldn't want to get cut off from that revenue source by regularly "losing" shipments of tickets. What you propose doesn't make stores any money, so either you have to spend a bunch of money to induce them to carry the tokens [1], or you have to have harsh penalties for "losing" shipments of tokens. If you risk harsh penalties for choosing to sell the tokens, why even bother? Stores put up with the risk of selling booze because it's quite profitable... selling 5c or 0c tokens absolutely is not.
[1] Where does that money come from? From you and me, of course!
I’ve worked in the industry, so just adding some extra info, as I agree with you that the ticket system is not really less tracked than other systems, just differently tracked:
Lottery tickets don’t “fall off of trucks” or get “lost in the mail” because they aren’t valid for redemption until they’re activated at the POS terminal of a licensed store, and the lottery company knows which store receives each ticket roll, because they are shipped to known locations with tracking numbers and delivery verification and/or delivered in person by lottery employees. Even the rolls of blank lottery ticket receipt paper have different serial numbers every few inches, and it’s forbidden by policy to swap receipt paper between stores. All of these things are audited both regularly and randomly by state lottery officials.
> Lottery tickets don’t “fall off of trucks” or get “lost in the mail” because...
Oh yeah, true. A few minutes after I posted the comment, it occurred to me that lotto tickets always get scanned at the register, which is the obvious way to track their distribution and make it annoying to use a whole bunch of winning ones that fell off of a truck. Thanks for the first-hand industry info.
If it's effective, all that tracking and auditing can't be cheap. The lotto gets to pay for it with ticket sales... I don't expect folks would tolerate paying for that [0] for this "I'm an adult" token-distribution system.
[0] ...whether that payment is paid by the token purchaser or by the taxpayers, generally...
The scan at the time of purchase is just for tracking what the store owes to the state for the lottery system. The last ticket in each roll of tickets is scanned by the dedicated lottery terminal prior to being placed for sale in an admin mode activation function. The terminals themselves I am familiar with are Linux-based and seem to be thin clients which do everything remotely in real-time, because nothing works if the terminal is offline, from activation to redemption of tickets to win/loss checking. The terminal has its own dedicated wired Ethernet connection to a stand-alone Cradlepoint or other competitor brand cellular modem/router, which along with the terminal is all outsourced to a third party management company. (SGI is the only one I’m familiar with; there are likely others.) All of this is public info which could be gleaned from observing the terminals and their installation/operation, but I probably can’t say much more about them, but they are pretty neat and seem to work fairly reliably.
Now that you mention the auditing etc, a lottery system would probably be an easy way to get people to literally buy into an online ID scheme, not because it would necessarily be privacy-preserving, which would depend on implementation details, but because a not insignificant number of folks seem to like the chance to win money. Considering many states already have lottery systems, the ID code tickets could probably be provided alongside lottery tickets for free or nearly free, and employees already have the training to check/scan IDs. If there was an incentive such as the possibility to get discounts, win prizes, or tie-in purchases of some kind, I think it could work.
Many stores that sell lottery tickets also sell gift cards, so that technology could also be used instead or in addition to ID tokens at the point of sale. There are a lot of sponsorship opportunities available for cross-promotion.
“Please drink a verification can” was probably more prescient than was at first apparent. Mike Judge saw this whole thing coming from a mile away.
You can also just follow people around and look in their windows. Nothing prevents that other than laws and rules and social norms.
> In the real world, the system you propose absolutely will not function to the standards required by the people agitating for these systems. You can't "protect the children" if "children" can easily get their hands on anonymous access-granting tokens.
What stops children from paying someone to buy beer and cigs for them? What's the difference between age-controlled liquor and an age-controlled token falling off the back of a truck?
You can introduce as many soft-verification systems as you want to tweak this. The roll of numbers doesn't become active unless installed in a dispenser that phones home when it is installed, for example. The empty bobbins containing the roll have to be returned to the oracle, and need to register installation in a dispenser. The dispenser can even count each dispensed ticket. The only requirement is that the sale and the process of paying for the sale isn't linked to the ticket. If you maintain that, the system is anonymous. If you break it, it's not.
> What stops children from paying someone to buy beer and cigs for them?
I preempted this line of questioning. I'll quote the section for you:
What you propose doesn't make stores any money, so either you have to spend a bunch of money to induce them to carry the tokens [1], or you have to have harsh penalties for "losing" shipments of tokens. If you risk harsh penalties for choosing to sell the tokens, why even bother? Stores put up with the risk of selling booze because it's *quite* profitable... selling 5c or 0c tokens absolutely is not.
[1] Where does that money come from? From you and me, of course!
No business is going to risk any part of their business by selling seriously-age-restricted goods that they get essentially no profit from. In order to get a business to deal in them, either they will give zero shits about who gets the tokens (because there's no penalty for not caring), or they will get paid a lot of taxpayer money in order to make up for the state-imposed loss when they inevitably give some to under-eighteens. [0]
> The only requirement is that the sale and the process of paying for the sale isn't linked to the ticket.
Unless you make it turbo-illegal to link those pieces of information (even weakly), then those two pieces of information will be linked lickety-split. As aspenmaver mentions, lotto tickets are activated at time of sale by phoning home to -I assume- the issuer of the ticket, providing a ready-made mechanism to correlate which tickets are sold to which person. When the people who are crying to protect the under-eighteen from the "evils" of computing notice that under-eighteens are -shock! outrage!- still exposed to that "evil" despite this token-distribution scheme, they will demand any such laws be weakened or eliminated.
[0] ...or fail to strictly follow all of the regs when giving one to a "Token Commission" officer doing an undercover buy, as absolutely happens with alcohol sales...
In a world where ubiquitous ID verification is required, you can just, like, mandate that stores with liquor licenses sell them. If they want to keep their licenses, that is.
A simple law against linking those two pieces of information would be sufficient. Sure, someone like the NSA wouldn't give two shits about what's legal, but they also wouldn't have the means to clandestinely get the necessary hardware installed in every one of the million stores that exist in the country.
You go to the store. You give the clerk many quarters, and get the maximum number of tickets. You go online and sell the lot, perhaps for $20. Since the system preserves privacy, doing this carries no risk for you.
Eventually this becomes common knowledge and "something must be done". Facebook (the corpo sponsoring these age verification laws to absolve their own liability) and their ilk decide that the token system no longer meaningfully proves age. They switch to demanding full government ID in cleartext, as there is still no comprehensive privacy law that would prevent such a thing.
Every single approach that puts the onus on the company to verify age falls apart this way, possibly including a de facto mandate for remote attestation (ie say good bye to libre operating systems and browsers that aren't MSIE, Safari, or Chrome). The only workable systems are ones in which the onus remains on parents giving their kids networked computing devices to enable parental controls and/or otherwise monitor their kids' usage, with those parental controls based on information flowing strictly from the website to the user agent (eg a content tag that asserts "this page is suitable for kids").
(and I say this as a parent who is staring down having to deal with this problem in a short year or two)
>Modern versions of this technique allow one to associate metadata (like a proof of age exceeding a threshold) in such a way that the verifier can't even correlate repeated requests across users.
If it's unlinkable, what's preventing someone from setting up a site that hands out anonymous tokens for anyone to use?
No, I'm meant me, using my 18+ ID to generate a bunch of tokens that can't be linked back to me, and then giving it to random < 18 year olds for the lulz.
There are multiple approaches. One, which the Europeans use, hardware-locks the token. Each age attestation is unlinkable, but the cryptographic credentials you need to make the attestation aren't portable. Of course, this model requires a big statist apparatus that does implementation certification, but it does achieve the narrow goal of unlinkable, privacy-preserving age attestation that doesn't instantly decay to mass copying.
Other approaches are possible. I'm particularly keen on ones that treat attestations as anonymous digital currency and use cryptographic penalties like slashing to discourage copying post-hoc instead of relying on EU-style implementation certification.
There's a huge literature on the subject I don't want to reproduce here. The point is that yes, we do have the technology to do attestation without sacrificing privacy, which makes all the calls for non-privacy-preserving attestation awfully curious.
> as anonymous digital currency and use cryptographic penalties like slashing
Or make it so that tokens cannot be tested except by spending/burning them, which would significantly reduce (but not eliminate) a black market because it would be hard for any buyers to trust any sellers.
The best outcome here is going to rest on getting people to agree that "good enough" is the best outcome. We want a system that gets the broad social results (e.g. less brain-rot in the kids) without being so impossibly strict and overbuilt that it leads to an even-worse problem (e.g. authoritarian hellhole tools.)
I'm not familiar with this, but what your describing sounds similar to the hardware DRM keys used for protecting 4K streams from being downloaded from Netflix.
If so, this stuff is already broken, and imagine it would be pretty simple to apply the same principles here.
I'm probably wrong on this though I'm out of my depth
Because those <18 year olds will immediately flip and identify you to the cops to try to lighten their punishment.
The anonymous crypto token scheme does not have any trace-back mechanism like this at all. If there's no way to track those tokens back to you, why not sell them for $1 each on the internet to make some extra money?
Yes, this breaks the whole scheme. Anyone promoting it as a solution is delusional. There's a triangle of "robust", "private", and "practical" and you can only pick two. This one omits robust. The various mitigations people might suggest in response will have to sacrifice one of the other dimensions.
I've noticed that tech people will respond to an encroachment on civil rights with a technological alternative. I think this is a mistake, because the excuse is presented in bad faith, and to present an alternative is to accept their framing. The correct response is something to the effect of "I know what you're trying to do, fuck off."
As you say, it's doubtful governments want it to be private. So we should expect them to not use these kind of elegant solutions, and the public is generally not sophisticated enough to distinguish between the options already.
There's two strong incentives - deanonymization for law enforcement is pretty useful so that's one. You want to make it easier to subpoena information about posters for various reasons, access to stores on different dates etc. Lots of reasons for that.
And you want to satisfy voters who are worried about children online or have heard scary things about anonymous criminals. You want to be seen to do something about those.
A distant third is that you want the system to be cheap and built up fast and relatively easy so voters don't complain about it.
All together this leads you to something like "any time a site needs to verify your age (based on this broad list of requirements) put in your government ID number / picture". The infrastructure already exists for that, banks need it, social media needs it, and the current president has agitated for it a few times now. If you're really aiming high you set up some digital ID attached to it that's easier for the users.
>There's two strong incentives - deanonymization for law enforcement is pretty useful so that's one.
When you say it like that it sounds less scary than "deanoymization so the government can track down people saying things it doesn't like." Let's not forget the UK has more people in jail for things they said on the internet than Russia and China put together.
Yeah the wording is a little broad, but the UK would call that law enforcement too.
Depends on your state and laws and you can look around at how that's going - maybe you'll have brought a first aid kit to the wrong event or helped print some zines and they want to check up on you now.
I don't think they are serious about privacy and even if they were I don't even want to distinguish between "children" and "adults" on the internet. Things seem to have worked fine up to this point, there doesn't appear to be a public demand for age verification, rather some murky corporations/NGOs/agencies pushing for this. I think it's pretty clear there is some other intention besides protecting children that is the goal here.
they want to isolate gay and trans children from other gay and trans people. don't you know, there's social contagion afoot, but if we protect y^Wour children from this inherently sexual (and thus adult) content, we can prevent it. this is enough to make me oppose age verification wholesale. I don't care if there's fancy ZKPs, it's still going to be used to isolate and harm hundreds of thousands of vulnerable trans kids, who are already experiencing astronomically elevated suicide rates over the past few years. they don't need more of this.
The problem is that you still have to trust something you don't control and can't verify that the technological solutions are correctly implemented and applied.
Either they validate so little information that a single homeless person can authenticate the entire country or they validate so much information as to not have a significant privacy guarantee.
There is no in-between for ZKP validating someone's age.
the truth is that the two extremes you listed can be titrated.
if you use nullifiers you can trade some privacy for some security. basically you convert your true identity into a private token which you can use to authenticate aspects of yourself, the price being that the token can be tracked with some effort across services. better than just using your identity at least. if a token/nullifier is abused it can be revoked and then you have to jump through a bunch of hoops to get another.
What combination of details can you validate on that is meaningfully privacy-preserving and couldn't result in wide-spread re-use of tokens?
Additionally - what would prevent some kids from getting a homeless man in the city to hand them his ID, get a facial scan, and everything else you can think of to generate a token and then pass that token around?
ZKP are a cryptography-nerd's joy but are are categorically unsuitable for the purpose of age verification. I stand by this without the slightest reservation.
In Italy every citizen has an electronic ID card that contains a private key and can sign challenges. It also has state-signed credentials/certificates that bind the public key to info about the citizen (date of birth etc).
You can do this: when you want to log into a service, the service provider gives you a fresh challenge C, bound to that service/session. You sign the challenge, and then generate a zkp of the fact that:
1. you have the signed challenge C with a certain public key P
2. you have a state-signed credential/certificate that binds P with a person with birth date BD
3. current date - BD > 18 years
4. optionally, you derived a per-service nullifier, e.g. from the card/credential secret, the service origin and a time bucket, so the service can rate-limit abuse without getting a global cross-site identifier
You send the proof to the service provider, that verifies it, and learns nothing about you (except for the fact that you're of age).
An adult can of course give away the card/PIN, but you need to have it physically to sign fresh challenges, so it cannot be passed around as easily as a bearer token. Moreover he loses access to his actual ID, which is required for other services.
the same thing that prevents them from doing reuse right now: platform detection mechanisms. the difference is that right now the identity of the subject is known whereas with ZKP (nullifier approach) only the dirty token is known and where that token was used.
So....what exactly would platform detection mechanisms be basing their decisions off of that wouldn't defeat the entire privacy-preserving premise of ZKP?
Wait - so you're advocating for use of a persistent identifier tied to a person? How is that any different than what advertising networks do right now beyond giving them additional guaranteed information of your age bracket?
To clarify - it's not cryptographically necessary to present the same token for each and every transaction and serves to categorically defeat the entire privacy guarantee of ZKP.
It also makes it trivial to associate your ZKP token with your real identity.
at the terminus, yes. there is no other way to avoid the homeless problem you listed. by terminus I am referring to where a central authority vouches for unforgability. this does not mean advertisers will have a token they can use (see remote attestation infrastructure).
> tied to a person
whether or not the terminus can tie a token to a real world identity will depend on how careless the user was and how much collusion there is between the terminus and the services. at the very least it will impose an investigation cost.
contrast this with the situation as it currently is (under ideal assumptions) where a central authority verifies your real identity and issues temporary rate limited tokens which are then saved by each service and can at any time be linked to you whenever the central authority can get the service to disclose the database entry. the nullifier will force the central authority to do an investigation about who the nullifier actually belongs to which may actually fail.
realistically I expect VPNs and Tor to just become more popular in response to such nonsense. I wouldn't be using government issued tokens for anything that isn't trivial to tie to your identity already: such as a personal bank access.
> at the terminus, yes. there is no other way to avoid the homeless problem you listed. by terminus I am referring to where a central authority vouches for unforgability. this does not mean advertisers will have a token they can use (see remote attestation infrastructure).
Where to even begin here....
To generate the token, it needs to be based on specific data. How do you prevent people from generating tokens based on fake data and submitting that to the "terminus" that you mention? We already have cases of people bypassing facial scan liveliness checks for banks using AI-generated footage.
What about validating tokens during the token enrollment process based on your government ID? Though that makes sure that poor or undereducated people who don't have such an ID are locked out of large swaths of Internet services.
Though there's also the matter of it being trivial to generate fake IDs using AI.
If you have no gatekeeping for the token enrollment process, anyone can submit an arbitrary number of new tokens.
And if you do have gatekeeping, you're right back to square one of needing to validate against more than just your age.
After all - the cryptography algorithms will be publicly known. If the only thing ZKP is validating against is age, it won't take long to figure out how to generate identifiers based on fabricated information.
> whether or not the terminus can tie a token to a real world identity will depend on how careless the user was and how much collusion there is between the terminus and the services. at the very least it will impose an investigation cost.
No it won't. A user submits a token to a server. The user also logs in with their e-mail address or phone number. Their email and/or phone number is hashed and it, along with the ZKP token and any additional information the website has on you, will be sent to data brokers.
This is the same as any other bit of information out there that data brokers collect on the internet. They just associate your new info with other info you are required to provide in order to use various services.
This will be automated and will cost next to nothing for data brokers to take advantage of.
> contrast this with the situation as it currently is (under ideal assumptions) where a central authority verifies your real identity and issues temporary rate limited tokens which are then saved by each service and can at any time be linked to you whenever the central authority can get the service to disclose the database entry. the nullifier will force the central authority to do an investigation about who the nullifier actually belongs to which may actually fail.
....what? What investigation by central authorities? You are talking of a system that would constantly mediate permissions for billions upon billions upon billions of devices across dozens of services and accounts per device.
You couldn't hire an army of people large enough to handle this and AI is infamously awful at detecting when a given image has been generated with AI.
> realistically I expect VPNs and Tor to just become more popular in response to such nonsense. I wouldn't be using government issued tokens for anything that isn't trivial to tie to your identity already: such as a personal bank access.
Their popularity would only rise in order to VPN into jurisdictions that don't enforce this. Assuming major websites don't just mandate age/identity verification for all new users regardless of jurisdiction just because it's easier and cheaper to apply one system to everyone.
Look - I know you mean well, but it is clear from this discussion you aren't familiar with cryptography, system security guarantees, Internet infrastructure scaling, or what would be needed to introduce new descriptive information about a person on the Internet and not have it become a new privacy risk.
This is an issue that has no tech-only solution. The specifics aren't just something to just figure out at a later date - the specifics are everything. And it's something that is enormously difficult to get right and extremely easy to get very, very wrong.
> Look - I know you mean well, but it is clear from this discussion you aren't familiar with cryptography, system security guarantees, Internet infrastructure scaling, or what would be needed to introduce new descriptive information about a person on the Internet and not have it become a new privacy risk.
it's actually clear that you are the one who isn't familiar with this, I referenced remote attestation which you appear to know little about as it addresses the problem of identifying information (the service has no way to link tokens across without help from the CA).
you also don't appear to know what a nullifier is, in a ZKP system you submit identifying information and a hash of a secret string. the CA adds the hash to a public database and in the future you prove you one of the members of the database with a nullifier - the anonymity-set is everyone in the database who entered it prior to your submission. this can also be done with a blind signature to the same effect.
> it's actually clear that you are the one who isn't familiar with this, I referenced remote attestation which you appear to know little about as it addresses the problem of identifying information (the service has no way to link tokens across without help from the CA).
You've promoted mutually exclusive concepts with regards to cryptography which is why I said you don't seem to understand it. And again - and again and again and again and again and again - what is the additional information you are authenticating based off of beyond age? Remote attestation provides absolutely zero privacy utility here whatsoever on its own! So you've remotely attested this ZKP key represents a person who is an adult. Creating another key based on that information alone is trivial to spoof - for it not to be trivial, it would require validating additional information!
What is your root of trust? What is the basis by which age is verified in a way that can't readily be spoofed?
> you also don't appear to know what a nullifier is, in a ZKP system you submit identifying information and a hash of a secret string. the CA adds the hash to a public database and in the future you prove you one of the members of the database with a nullifier - the anonymity-set is everyone in the database who entered it prior to your submission. this can also be done with a blind signature to the same effect.
That's nice and all for trivia on ZKP but how does that touch upon the problem being discussed?
The mechanics of ZKP are not relevant to the problem of ZKP being categorically worthless for the problem at hand. I don't say ZKP is worthless out of ignorance - more discussions about it won't change that.
The specifics of ZKP do not change the fact that you are validating either too little information to be useful for preventing fraud or too much to have privacy-preserving value.
> there is no further point to this discussion.
Evidently not.
We can't solve private age verification with blockchain tech. I'm happy you're so passionate about it, but it isn't a silver bullet.
Both Governments and industry players are, in actuality, interested in and moving in this direction, for some use cases. ex https://docs.withpersona.com/relay
Governments are serious about knowing who’s doing what online, and all this age verification is just an excuse. It will also raise the barrier to entry for newcomers in the market, so it’s convenient for platform owners as well.
Let's remember that this will greatly help ad attribution as well, enriching the platform owners. This reveals that their incentives are aligned against privacy.
> There are at least some technological solutions here, such as anonymous credentials.
Identity verification is busy being rolled out across the entire developed world right now, and I have yet to see or hear about even one single mention of anonymous credentials in the discussion of any of the laws.
I think the main takeaway is that the concept of such verifications is fundamentally incompatible with privacy. Today we have a simple "are you an adult" check but who is to say we wouldn't want further levels of segmentation (legal age to drive, age to allow health insurance etc)?
And this just one signal. Nobody likes the EU cookie/consent prompts but what they've shown us is that most websites are perfectly happy to fingerprint you the moment you step on their pages, and then share/broker your activity with hundreds and thousands of "legitimate interest" partners of theirs.
So the real-world equivalent of this situation is that you walk on the street and whenever you need to wait for a traffic light, board a bus or the tube, go into a shop, etc... you have a security person who needs to faceID(or fingerprint) you and make you wait until they find a match of your profile... and then they ask you to present your ID (which you have to carry at all times) but hey, it's private because you need to enter your PIN for them to read the chip.
No. The point of these initiatives IS TO GET ID, not to protect children.
Anonymous credentials don’t allow the state to retaliate in the dark of night against protected expression that they don’t like. Anonymous credentials do not allow for that, so they are irrelevant.
Yep, there are a variety of ways this can work well, but the overwhelming 'vibe' here at HN is a) that the tech is too complex and b) that governments actually want to end privacy anyway for their own nefarious reasons.
I find 'a' amusing as we'll often see in the same conversation that users appeal to parents to take responsibility and lock down their kids' access to things, as if that's trivial for non-tech folk and foolproof. It's also silly because the user interface to such a system doesn't need to show all that complexity.
And 'b' is often supported by some out of context quote that at first glance looks incriminating but doesn't actually mean much.
The saddest thing is that the article you link addresses most of the objections people have brought up in the thread, but few have read it.
This seems to come up in every discussion, in practice it’s irrelevant both because it’s too complicated for normal people to understand, and because the point of all this nonsense really is identification so anything that defeats that will be a non starter.
It doesn't have to be too complicated for normal people to understand.
Majority of people understand their SIN or SSN number or whatever, they understand they have a drivers license number. This could be built in such a way that it's basically just be another government issued "thing" that they have to know about and be able to produce when requested
Every government has been working on ways to identify and target individuals online since as long as the internet has existed. Governments are incentivized to continuously increase control. Why would you assume this is not yet another escalation towards their goal of being able to track and silence anyone who pushes back?
I didn't comment at all on what the governments goals are
Edit: I agree with you 100%, but the fact that governments want to track people online has no bearing on how technically possible it is to build a system where they can't
An anonymous internet auth system (probably) won't get built, but it is possible to build
> that it's basically just be another government issued "thing" that they have to know about and be able to produce when requested
During COVID, there were protests about "vaccine passports" and masks. My state legislature tried introducing bills that would outlaw such things. In 2024, in several states (including mine), legislators introduced bills that would outlaw mRNA (and every vaccine made from it) [0]. REAL ID took almost 2 decades to get every state to implement it until the feds threatened to close all (commercial) airports in states refusing to implement it.
Notes:
0 - every year one of my legislators introduces a bill to outlaw chemtrails. This year, he added the plot of Termination Shock to his bill.
I love the complete lack of reflection of the top comment in the website.
> All those policies are created with one single goal in mind - to catalogue and enumerate ALL human beings on the planet, not just kids.
1. Your government already has you catalogued, you have a birth certificate, you pay taxes don't you?
2. All these platforms are doing exactly that, do you think you are fouling anyone with that nickname? (come on lets face it you have at least one account with your real name).
> You’re not happy about it, but you hand over a photo of your passport and hope it doesn’t come back to haunt you.
I think for this argument to carry weight with voters, privacy advocates need to be much more specific about what "coming back to haunt you" looks like. They do a little bit of it later on[1], but I think most people do a rough cost benefit in their head and decide that the small benefit outweighs the small risk (to them).
[1] "And that creates a lot of risks for data breaches, overly broad data collection and retention, censorial legal demands for collected data, corporate and governmental malfeasance, pressure to self-censor, and perhaps blatant First Amendment violations. Every new layer and every new mandate brings more potential for risk. As we’ve unfortunately seen many times over the years, people including high-level government officials will maliciously seek to root out the identities of their critics, so the more layers of anonymity we can preserve in online speech, the better."
The biggest angle for me is censorship. You associate your online identity with your legal identity, there is no longer any recourse if you are banned from a platform. You could easily be arrested if your posts are determined to be 'offensive' in some manner considered to be in breach of the law, or simply have no ability to rejoin a platform under a new identity, or have identities across multiple platforms banned in parallel.
I've found that many people are actually in favor of these when they believe that it will only be enforced against people they disagree with. I'm hoping that people will be more likely to listen when they realize that their enemies may in future be able to get into power and change the definition of what is 'offensive', 'misinformation' or 'disinformation' to their own personal opinions.
I'm starting to think we need to lean on conspiracy theories in order to get broader population on train with this - and I'm saying this in utmost regret. That's a borrowing game from a right wing/extremist playbook.
Start with this: requiring IDs online is a first step in micro-chipping the population.
...or how about this: marxists/atifa/nazis/zionists/islamist/whoever-group-people-think-is-in-power want to erode your privacy online so it can be used against you. Some nefarious group what to know your every move!
...or how about this: remember Epstein files!? Well the pedos now want to id your children online!
I simply saying truth/evidence/rational based approach to this will not get people attention. People just don't care.
Just say that the government will control every single device that's controlled to the Internet and they can add government viruses that you can't remove and they can remotely control all of your devices and brick them if you try to send anything that the government doesn't like.
That's not even an exaggeration, once they enforce OS-level age verification via remote attestation they don't even have to pass a law to do this, they can send a secret order to Big Tech to do this.
I think both political extremes have their own angles: liberals might be concerned that conservative censors will censor kids from learning about LGBT people and minorities, conservatives will be concerned that liberals will force too much LGBT and minority content onto kids. Or whatever issue, they want to control what your kids read!
This will almost certainly be used to censor adults too, the only reason we aren’t doing that is because it hasn’t been possible to consistently identify people before. Considering who is pushing for this, they’re absolutely going to tie this into advertising, and if they know who you are so do all of the spooky upper echelons who could implement a true censorship regime.
“The only way they can do this is by controlling what you read, shouldn’t that be the parent’s choice?”
It's been decades since the very phrase "conspiracy theory" was introduced as a means to convert looking closer into something cringe. The normie position on most things is to accept something as no problem unless the mainstream designates it as such aliens), or it blows up enough that even unmotivated normies can't help but take notice (rich new york caribbean islanders). Privacy got close to that with Snowden, but it fizzled into apathy for most because imo there was no clear harm to present, it was perceived as abstract.
To me the connotation is that it's always an unreasonable theory, such as one that requires thousands of people to maintain nearly perfect secrecy for an indefinite period, with no mistakes and dedication even when they'd benefit from blabbing.
In contrast, imagine a 2-person conspiracy where both have lifelong reasons to keep it secret. Yeah, I could have a theory about that conspiracy existing, but it wouldn't be, y'know, a conspiracy theory in the usual sense.
> I'm starting to think we need to lean on conspiracy theories in order to get broader population on train with this - and I'm saying this in utmost regret. That's a borrowing game from a right wing/extremist playbook.
How about "if you want to buy a dildo on aliexpress, you have to do a full scan of your face and send it to israelis"?
I mean.. au10tix does age verification for aliexpress, it is an israeli firm, and you can't even buy a scalpel (the DIY crafts one) without having to scan your face there due to EU regulation.
> you’re criticizing a powerful politician, or talking about your experiences with abuse or addiction, or discussing embarrassing medical issues you’re facing
This is not the problem. Even if, like millions, you are not talking about these things online, these systems still place you in danger. Even if you are a perfect, clean, compliant citizen these privacy-destroying systems place you in danger.
Fundamentally these systems expose you to coercion, extortion, blackmail, ID theft, etc. by criminals and immoral people who want money or power over you. There are countless examples of bad actors inside and outside these systems obtaining access to innocent people's private data and misusing it to their detriment.
This is the strongest argument against these bad ideas. Arguments that paint innocent, privacy-seeking people as suspicious or immoral in any way, should not be used.
It is rational and moral to seek privacy for your own safety and the safety of those you care for. Don't let them argue otherwise.
Sadly your take doesn’t matter since the other voting bloc is parents and people concerned about their kids.
I wish this resulted in techies spending more time to look at the substance of the harms playing out, however I see denial of the situation altogether more than anything else.
> Sadly your take doesn’t matter since the other voting bloc is parents and people concerned about their kids.
I used to think the "think of the children" voting bloc was cowardly for hoping the government will do their job for them in setting strict ground rules so they don't have to be the uncool parent.
The closer I get to having children of my own, the more I understand why it seems like the only option. Fundamentally this is delaying indoctrination in digital consumerism, which is not parents versus themselves anymore. More like parents versus the entire economy.
Government might be the only champion for that kind of fight, but what a mess it will make of everything for them to get involved.
It is impossible to “solve” problems like this, only manage them intelligently. Human societies have certain failure modes that are constant across history, and it’s foolish to assume that you will ever fully eliminate them. This means that reducing potential methods of political repression (via privacy, for instance) is more critical than attempting to create an impossibly perfect, airtight system, at least if you care about individual liberties.
Assuming no revolutionary changes are coming to the USA, I am planning to opt out of the digital world when I retire. Physical media only. No subscriptions. Spend lots of time in the library. Find like-minded people and meet in person. Will only keep the bare minimum for survival, like banking.
In the US, if you do not have a passport and want to apply for a new one, you have to go to certain places where an authorized person will check your paperwork, see that you match the paperwork and send that directly to the passport office. Generally, county clerks and large post offices are the places that most people go. In some states, libraries are also authorized to do so. In 2026, Trump signed an executive order banning libraries from doing so. Libraries were doing the service for free. County clerks in my state charge around $50 for the service. The libraries doing this service were almost always in "blue" districts.
The SAVE ACT [0], which passed the House of Representatives last year (and is stalled in the Senate) only allows 4 types of identity documents to be allowed to register to vote in federal elections:
1. A US Passport,
2. A US Military ID with proof of US citizenship.
3. A US REAL ID with proof of US citizenship [1].
4. A US REAL ID without proof of US citizenship, plus a US birth certificate and the names must match [2].
1 - This is called Enhanced Driving License. It exists in only 5 states (Michigan, Minnesota, New York, Vermont, and Washington) and is an additional $35-40 above the cost of a regular driving license.
2 - In the US, it is common for a wife to take her husband's surname. This means that 74,000,000 US women will lose the right to vote in federal elections if they don't spend $150 (for a new passport) or hundreds-to-thousands of dollars changing their name legally.
You don't need to make libraries illegal to get rid of them, you just need to undermine their value and they'll be defunded and disappear. No passing laws necessary, just pubic ambivalence.
I have been slowly moving towards that for a decade or two now. I still do some internet stuff (mostly here) but it is greatly diminished. The rest is just at work.
This reminds me of a recent story I heard where a FEMA administrator had a militia organizer infiltrate his home as a "handyman" and the administrator was contacted by the FBI about who the handyman really was spying on his home and family in person.
Renting and work already require ID in the UK. Every landlord and employer is supposed to take a copy of original documents proving the right to rent/work in the UK. Technically you can do that without handing the docs to the government, but there's less potential liability to do so via the Home Office website.
You miss the point - they are stitching it all together in a way that deanonymize you to your ISP under the guise of save the kids and then convenience
Isn't this already the case in a lot of the Continent? I was just in CH and it seemed impossible to have anonymous Wi-Fi without a Swiss SMS or a airline boarding pass.
Do you want to help stop that, or do you just want to feel smarter than other people? If you happened to have seen my comments in other threads, you'd know I'm against all this. But telling people they are idiots isn't going to win them over. This is not just a criticism of your comment, it's widespread in these discussions.
Opposing this requires:
* Linking to specific harms, which the public can emotionally resonate with. For example, scanning billions of photos for suspicions of child abuse will result in false positives that cause innocent people's kids to be taken away.
* Not seeming like an overheated conspiracy theorist. Feeling angry about this is legitimate, but it's not necessary to communicate in the same emotional register that you are feeling, even if it feels inauthentic not to. The public are saturated with people being publicly angry, much of which is purely performance. Deep concern may work better.
* Have plausible reasons for why this is happening. Yes, a few individuals like Thiel want to create a digital Stasi, but this would still be happening without them. Mostly this is driven by companies that want to make money, and officials who have a bias towards centralised processes, and are tunnel-visioned with respect to some issue. And people who are genuinely concerned about kids and haven't been given another convincing solution.
* Get facts straight. (Eg, rent/job IDs aren't a future threat. They are here)
I think we can already conclude that the current approach is failing. I'm suggesting reasons why I think that is the case. Of course, my diagnosis may be wrong. But it's implausible that doing what we've done during 20 years of erosion of privacy is going to suddenly turn things around.
As for not alienating allies: if it's this easy to piss off people to agree with you, maybe it's also worth thinking about how to talk to those you want to win over.
The current approach includes people doing it your way, and people doing it GP's way, and people doing it many other ways. There's not a great way to draw conclusions from that, absent more data.
And if you're so eager to shake off allies who don't agree with all your ideas, maybe it's worth everyone thinking about how to talk to those we want to win over.
This is a very libertarian and ultimately low-trust forum where most people seem to think the government is out to get you, but I have to say: what's so great about having complete online anonymity anyway? I mean, seriously. Real life is not anonymous and consequence free either, why should online life be?
It's not as if there are no downsides. There are, and some of them are so severe that they are impacting the whole of society.
People can impersonate to be 500 or 5000 or 500000 people from another country and all echo some detrimental or even treasonous sentiment, critically influencing and steering voters, which changes politics and election outcomes and thereby the trajectories of whole countries. I cannot understate how serious that is.
If we can make sure that every real person can only have 1 social media account per platform, and if we can check that someone is an adult, and if (and only if) we can do that in a privacy preserving manner... then honestly, I don't see why I would be against that. I'm ok with being held accountable for what I do online. I want to pay that price to prevent the severe outside interference we've seen in elections and in our politics.
You and many others might not be, but it seems like you've lost the argument.
Just off the top of my head, what if I want to use reddit mostly to talk about mundane things like local events in my city or technology and don't really care if that ties back to me, but I also want to ask about embarrassing health problems or just weird shit and I would rather not have that tied back to me? I should have no options without everyone in the world being able to easily find out about it?
If some sites like Facebook want to be real-name only, that's fine. People can use Facebook for that if they choose. But don't ban alternatives for people who want alternatives.
Isn't the entire idea that all sites and use of the internet should be tied to your real identity. Of not publicly displayed then at least verifiable by the state
People will go nuts even with their real names. People will lie even with their real names. See: Facebook. Doesn't stop shit. So don't ruin it for the rest of us.
Even if you are not American, HN is very tied to American culture, so I assume you dislike either Trump or Biden (or both). Which one should be able to arrest people more easily for their online posts? https://www.bbc.com/news/articles/cg7pyjxjxrvo
Unfortunately I think most normies is thinking like this. And buy into the idea that we must all give up what we have so far considered freedom ideals because the bad guys will get us if we don't.
In my opinion this is just blind compliance and misunderstood trust in a system which is changing rapidly.
People that came before us have fought hard for these rights and if I'm not mistaken the us was founded on these rights.
I'm not saying that we should allow criminals to take over and I know crime is rampage but if we give up our liberties, what are we then fighting for.
I think the ideas the leaders are proposing have been shown not to work in history. Like east Germany and Similar...
> Real life is not anonymous and consequence free either, why should online life be?
In real life you are largely anonymous if you go to any place that is not in your social circle. If I go to any physical store under the sun and pay in cash I remain completely anonymous. The only exception is staff checking your ID for alcohol etc. if you look underage, but that datum is only stored in one persons brain for as long as they bother to remember. Many people would take issue if the clerk noted every persons name when getting carded.
> what's so great about having complete online anonymity anyway?
Because liberal governments can always become repressive governments. Unless you have absolute faith that your government will never do something you have a moral objection to, you can never be sure that anything you are, believe or do will not be censored or land you in jail in the future. Infrastructure that has a minor benefit under a "good" government, but would serve as a major tool of repression under a tyrannical regime should not be built out of principle.
As a thought experiment, ignoring issues with technical feasibility, would you approve if every person is only allowed to leave the house, under a stiff prison sentence for violation, if they wear a shock collar that can be activated remotely by a law enforcement official? That way, if police want to arrest you, they don't need to use violence and they don't have to chase you if you tried to run. It would make the police's job a lot easier, would it not?
> If we can make sure that every real person can only have 1 social media account per platform, and if we can check that someone is an adult, and if (and only if) we can do that in a privacy preserving manner... then honestly, I don't see why I would be against that. I'm ok with being held accountable for what I do online
To the extent that political discourse is shaped by astroturfing, realistically it'll just give a monopoly of influence to whoever controls/bribes the company or entity doing the verification. There certainly would be technical/cryptographic solutions where there isn't some central entity with a master key, but I doubt that it'll work like that anywhere, especially if it requires a citizen safeguarding his own keys.
> I want to pay that price to prevent the severe outside interference we've seen in elections and in our politics.
Outside interference in the form of legal bribes (lobbying) and sometimes less legal forms of corruption has orders of magnitude more sway over politics than whatever the public may effect in elections.
> You and many others might not be, but it seems like you've lost the argument.
It's ridiculous to imply that there was any serious public debate on this.
> Unless you have absolute faith that your government will never do something you have a moral objection to, you can never be sure that anything you are, believe or do will not be censored or land you in jail in the future.
Any solution that can convince the Germans, the most privacy obsessed sticklers on the whole planet, has my support by proxy. If they think it's safe enough, it most likely is. Almost no other country has seen the dark side of what you're saying here as much as Germany, first with the Nazis and then in East Germany.
> To the extent that political discourse is shaped by astroturfing
Both Brexit and the Trump election have been significantly impacted by this, and it's not even controversial to observe that.
> Outside interference in the form of legal bribes (lobbying) and sometimes less legal forms of corruption has orders of magnitude more sway over politics than whatever the public may effect in elections.
Perhaps, but that doesn't mean that we should not address the elephant in the room - the seriously degrading impact that social media has on our society.
> It's ridiculous to imply that there was any serious public debate on this.
There was no debate because almost no one in (for example) tech circles is even acknowledging the problem, let alone coming up with a solution. Give me a better solution and I would argue for that instead. The status quo is unacceptable.
> Perhaps, but that doesn't mean that we should not address the elephant in the room - the seriously degrading impact that social media has on our society.
I would argue that those crafting our policies are destabilizing society far more than social media, and that they, rather than social media, should be “regulated” (perhaps into a small cell).
I appreciate the wealth of technical solutions that don't violate privacy, but isn't this overlooking an important point: that children don't need to be connected to the Internet at all times from such an early age? Many internet and cell phone providers seem to take it for granted that children must be online, which is already a net loss for their privacy as they mature.
This whole FOMO thing isn't as real, nor as detrimental, for kids as people try and paint it. That's not to say there's not an impact, but kids survive just fine - everyone misses out on this and that, even adults who opt out. Nobody ever keeps up or is involved with everything everyone's doing. Learning that that's okay, and how to handle that, at a younger age pays dividends as an adult.
Besides, there are many ways to still keep your kids connected to their friends without feeding the beast.
I agree with this (I want to be a parent very soon). I think I'm trying to articulate that while its possible to make a quiet place for your kid at home, they still live in a very internet-driven world.
I actually am curious about your experience on this. Basically, I'm worried that I'll try to make restrictions in the future, and it'll just be a war of attrition that I lose, since internet platforms touch so many parts of social life, especially for the young. Maybe things will be different in a decade.
In my opinion, none, but many parents disagree. Also, its more about the secondary effects, where all of their friends at school are talking about internet things they are unfamiliar with.
This isn’t about children, mate. It’s about controlling the population’s access to content.
The children are fine. Many countries no longer allow smartphones at school, which lowers the peer-pressure factor to be online.
Parents are doing their best to steer kids. But these pesky adults, goshdarnit, they access whatever content they want without approval from The State, potentially reading dissident materials, borrowing 1984 from libraries… politicians don’t like that.
I agree, I think kids should have limited access to the internet. I pretty much did and it worked out for me but I have seen so many reports about it causing harm in schools and personal life. (Specifically I think LLMs should not be used in education also, but different point) However, I think the main problem people have with this "think of the children" narrative is that it will force EVERYONE to give up their credentials to access the internet, not just kids. And the general consensus is that we as adults do not want to and should not have to prove our identity to access the internet.
I am wholeheartedly against identity verification, especially when it comes to giving up privacy. And I hope these "think of the children" arguments can be pushed back at from multiple angles. If the danger is real, then by the time a child is online, 4 out of 5 in them in Australia can apparently access social media anyway. So even if everyone's privacy was somehow an acceptable price to pay, these requirements do nothing.
Lol yeah exactly, if kids want to go on social media they will 100% find a way around it.... putting in these identity requirements will literally do nothing except require us as adults to give over more information. I'm sure everything will pass through congress fine though because "someone think of the children!!!!".
Should it also be their decision that they can gamble? Smoke cigarettes? Get a job? Have sex?
We draw the line somewhere because these things that "are the parents' decision" have consequences on broader society. They have consequences that impact you and me. And we also have a say.
You can make the argument that it's just the parents' decision. But you have to say why.
> Should it also be their decision that they can gamble? Smoke cigarettes? Get a job? Have sex?
Not on the first 2 because they're illegal for minors. Yes on the last 2. A parent can e.g. forbid their minor from being employed if it's hindering their studies. They also have a say on their romantic partner and how they interact. If rules are not followed, they can e.g. be grounded.
> You can make the argument that it's just the parents' decision. But you have to say why.
Generally, the reasons are:
1) The parents know their child best (as opposed to a lawmaker, a voter, etc.); so, they can e.g. make the best decision whether their child is responsible enough to engage in a given activity, like social media and the internet as a whole. This is just a matter of fact from living together throughout the minor's life, as well as knowing themselves and what traits the child may have inherited.
2) Generally, nobody is going to care more about the child's welfare than the parents. They're the people you can most count on defending their child's best interest. Other people may just have other agendas. In the case of what we're going through with social media, the parents may determine that the internet access they provide is overall beneficial to their child, while attempts to forbid it may lie entirely in furthering a surveillance state of the adult population which their child will eventually be a part of. Children don't stay children. One must also think of their adult lives when advocating for them.
3) Families differ a lot in values. They each have their own perspective on the proper way to raise their child. There's no consensus on a lot of things both big and small. The views of an individual family are generally going to be more stable and consistent than whatever's going on in the general political arena and changing culture. They also depend a lot on the family's individual circumstances, which the child will also exist in and may need to navigate as their parents have done. The child may also inherit traits from their parents and may need their particular guidance based on that. Again, in the case of social media, the child will likely benefit from guidance on e.g. how to not use it compulsively, how to protect their privacy (including being watchful of how much of themselves they share, to not depend on their own obscurity, etc.), how to respond to other people, not take things personally, not need others' validation, why are parts of the internet the way they are, etc.
4) Once the minors are adults, the parents will ultimately have no say and no obligation. One needs the opportunity of the time they're minors to be able to gain that guidance. If the parents are disempowered to make such decisions, it's ultimately harmful to the child. They will have to parent themselves.
The fact that you asked this makes me think that either you're an adult that feels badly towards your parents (maybe justified or maybe not), or you're a minor that doesn't understand why parents have authority. In case of the latter, you might think that another authority would be better. You might have idealisms (e.g. on the ability of something as broad-brush as law to substitute parenting), and simply lack the experience/perspective to see why such idealisms fail.
Probably got downvoted for failing this guideline:
> When disagreeing, please reply to the argument instead of calling names. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3."
I agree. Browsing the internet is not remotely comparable to smoking.
I disagree. Using social media is totally comparable to smoking. It's addictive, it's detrimental to health, and it's especially detrimental to kids going through puberty. "Browsing the internet", these days, mostly consists of social media platforms.
I’m glad this is finally becoming the cause célèbre du jour. This feels like THE FIGHT or at least one of the TOP 3 THE FIGHTS and it hasn’t had even a fraction of the public’s attention until now.
It won't be an issue until mainstream media makes it one. Since the media is owned by right wing billionaires, that media will reflect the biases and interests of those billionaires - many of which own internet platforms that would benefit from knowing the exact identity of every single user.
>I’m glad this is finally becoming the cause célèbre du jour.
It really isn't, though. Don't mistake the internet for reality. The majority of people in the US and Europe support laws like these, and most of the rest don't care.
Even on Hacker News the consensus is mostly in favor of anything from age restriction to making all social media illegal.
>The majority of people in the US and Europe support laws like these
okay then, show us a poll where the majority answers "yes" to an unambiguous question like "are you in favor of having to provide your ID or scan your face to access the Internet?"
"The majority of people in the US and Europe" support laws against drugs, for example, but would likely object to having their cavities searched three times a day.
The main issue is that they are very careful not to frame it like that. In broader contexts, it's always framed as something like "do you favor limiting children's access to social media" without a word on what it would cost to actually institute such a ban.
You can end all wars and eliminate hunger if you point the Death Star at us and kill all life on earth. If someone objects to the collateral damage, remind him that when you said "world peace and no hunger at all costs," you meant all costs.
> if anything we are seeing what a good idea taking kids off social media is and how crazy we allowed this to all happen for so long
We're not seeing anything of the sort, and couldn't possibly for some time yet.
What we are seeing, as evinced by the article, is how ineffective these laws are at actually keeping kids off social media, and how effective the mass collection of identity data is at creating an environment for scammers, hackers, data brokers and the means for widespread political oppression.
You don't necessarily have to be in favor of any measures which reduce adult privacy to be in favor of that. Logically speaking, the liability for minors accessing age-gated products and services is the person who provides those products and services to the minor. In the case of the internet, that person is the parent, not the ISP or the website. It is the parent who contracts with the provider and then forwards the product to the unauthorized user, the child. A parent who purchases, say, access to porn and then provides that access to their child is no different than a parent who buys booze and provides access to it to their child.
Exactly. You frame these things in the general case and HN is against it because obviously it's evil.
You frame it as "we've come up with a composite score (social credit) that lets us more efficiently enforce [stuff HN likes but the population likes way less]" and it's mostly all cheering and the one guy with principals is downvoted and flagged.
I am always surprised that people get shocked when online privacy is put at risk, as if it was a fundamental human right.
REMOTE PRIVACY NEVER EXISTED BEFORE A FEW DECADES AGO!
And what happened in these decades are enough for the societies to wonder whether this new possibility in human connections (i.e. remote privacy) is globally a good thing. Just stomping your feet because the new toy may be declared illegal is not helping anyone. Governments are expressing serious doubts: this discussion needs serious interventions, not temper tantrums.
This is 100% wrong. Privacy has been the norm every time someone wandered a week by feet from home, or sent a letter. Famous authors published for a whole lifetime under pseudonyms.
We are living in a panopticon that never existed before.
This is much bigger than online privacy. It is about survailance and control of society. And possibly even a completely new society. Or a splitting of society into groups...
But to your point on anonymity. That has been protected in letter writing e.g. and also privacy has been considered a human right. Until now...
But maybe you have a point in saying that no temper tantrums are needed.
You see, when the governments are outraged that they can't monitor all facets of communication or are disallowed from using their shiny new ways to automatically observe and categorize billions of datapoints to automatically surveil-by-default millions of people, that is called having serious doubts and grave concerns, very important stuff. When the people are outraged that a freedom they've enjoyed for several decades now, many growing up with them, are taken away, that is called throwing a toddler temper tantrum, how abhorrent. Why can't you just be reasonable and compromise will all these legitimate concerns that they somehow didn't care about in the last 30 years? Stop protesting or being angry, you need to sit at the table and have a 'serious discussion' (in 100% of cases when this is brought up in this tone, that means "give endless concessions and compromises to make them go two steps forward, one step back - just give them everything they want, but incrementally this time!")
You see, when someone talks about "the governments" without realising that they do represent the people in a democracy, their ignorance show so much that it is difficult for them to attract any sympathy in those places where the laws are discussed.
It is ignorant to believe that democracy is a stable, self regulating equilibrium that maintains itself purely through elections.
The people in power in a democracy do not not persecute their dissidents because they are better people or because they got to power by being elected by the people, but because good democratic systems hold the people in power accountable to the general population. A surveillance state does the opposite. It holds the people accountable to the government.
Democracies stay democratic because the people hold power over the state and have means to get informed about the state. That requires for example journalism and protection for journalists and their sources. When the state can trivially find the sources of journalists and surveil the investigations of journalists before they can even publish anything that protection is no longer given.
When the state can know exactly all the people that participated in a protest that gives the state power over the people and takes power away from the people.
When the state can know exactly where in important organizations of all kinds there are dissidents so it can replace them before they can organize...
I'm sure all the people in the world suddenly did a 180 over the course of the last year, often with no new elections held, and all the governments are merely addressing their concerns by moving in complete lockstep with the exact same sets of policies proposed after ignoring 'the problems' for decades. After all, we live in a happy wonder world with perfect representation, direct democracy and absolutely no malicious actors, corruption, lobbying and coordination that is not controllable by ordinary people in any meaningful way - at least, as long as that thought-terminating assumption helps me argue for what I like. Stop protesting against Democracy (me).
The surveillance economy was brought in by people who were pontificating about freedom. Freedom for companies created it and bad faith arguments about freedom sustained it. The evil governments were Johny come lately here, basically. I have read absolutists libertarian rants about "the governments" trying to remove the freedom. In overwhelming majority of the cases, these people were actually supporting fascists and those strong rants were just tools to achieve that goal.
And now, general public is pissed about consequences of what large companies caused so much, that it is willing to put a lot of power into the hand of evil government, because they see it as less evil.
To me, again, this doesn't look like a real attempt by the people to counteract the corporations, although it's certainly sold and advertised that way. I think it's the world's biggest collaboration project between tech megacorporations and governments. Many companies stand to gain a lot from the removal of privacy, because it discourages competition and funnels users away from doing anything on their own and towards compliant services owned by these companies. More importantly, these companies will be the enforcement arm of many anti-privacy technologies. They're the ones who will be sifting through internet traffic, processing pictures of your IDs, organizing datapoints about everything you've ever done on their services. All mandated by governments as part of the world's largest conflict of interest. All the governments will do is just bundle these streams of data into narratives and timelines, a full automatic dossier on everyone without ever having to do actual old-school spying on them.
This issue here isn't surveillance as per a signed warrant. I don't think anybody's really arguing against that.
The problem is mass data collection without suspicion, probable cause, or warrants whatsoever. That's a brand new thing, other than the places in the world unfortunate enough to have roving gangs of police going door to door and searching homes without warrants. This facilitates it on a scale that's never really been seen before in human history.
> This issue here isn't surveillance as per a signed warrant. I don't think anybody's really arguing against that.
Everybody who talks about cryptography is arguing about that! With the digital technology we have, the options are very simple: either every man in the middle can read (even the villain), or nobody can (not even the justice departments). There's no middle ground.
> REMOTE PRIVACY NEVER EXISTED BEFORE A FEW DECADES AGO!
That is plain wrong.
You could absolutely send a letter anonymously without showing your ID. You could use a phone booth without showing your ID. Increasingly more countries demand ID verification for such things like getting a SIM card that used to be remote privacy.
But much more importantly you are making a false differentiation between 'remote' and local privacy. Before the internet that made some amount of sense. What you do in the locality of your home is private and what you do in public is not, such as buying a book in a store.
However two things have fundamentally changed since then:
1. This difference largely does not exist anymore. Things that used to be in your home and private and are now in some way or another in internet connected computers that act as surveillance devices. Your movie and book library used to sit on a bookshelf in the privacy of your home and only you would know when you watch a movie. Today it sits on Amazon's or Netflix servers and they know exactly what and when you watch and read. In fact turning the digital library you "bought" into something you own by converting them into a format you can store locally and use without restrictions and surveillance (local privacy) is illegal and punishable with jail time under the DMCA.
Notes written in a note book used to be local privacy, now they are written on a computer that automatically, without consent uploads them to "the cloud", a server controlled by a large corporation that acts as a panopticon for the state.
I could go on forever. Our lives are increasingly digital. That in itself would not necessitate being "remote", but in reality that is what follows, because people do not control their devices. Instead these devices are surveillance appliances controlled by corporations and increasingly the state.
2. Technology did not just enable the means for more anonymity, but also for a completely new, fundamentally different level of automated, all encompassing surveillance.
Before the internet you went into a store and bought a book with cash. You were not anonymous in the strict sense, the cashier could see you and might even recognize you, but you did not have to show your ID for everything you buy. The cashier did not create a log with your legal name and all the items you bought. Sure, the cashier might know you bought that book, but no one else did. There was no central surveillance log of every purchase accessible to corporations and the state.
Today credit cards are exactly that. Many countries have begun attacking cash as part of the war on privacy. We are heading towards a world where you effectively have to show your ID for absolutely everything you buy and every purchase will be logged.
CCTV is old, but the footage used to sit on tapes in the possession of individual stores and tracking someone's movements with this was a massive amount of work that would only make sense for specific investigations like murder cases.
Now CCTV is everywhere and systems like Palantir collect them all in a central system that logs everyone's movements all the time. The government can just search for "people who met with X in the last month" and get a log of all these people, their complete movement profiles, the people they met with etc.
Letters weren't exactly well protected, but no one would read your letters because it was infeasible. Now we have the infrastructure to automatically read all messages sent by anyone and the government can just get notified of anyone who voices in private communications that they do not like strawberries or the ruling political party.
Western democracies are building the wet dream of the Stasi, something that just a few years ago was supposedly an authoritarian dystopia and our great enemy. We were supposedly so much better than the bad guys of the Stasi. Now we are building a future where we are still different from the Stasi, because we are making it outdated.
While you could send a letter anonymously, it was also trivial for the government to read any letter it wanted.
The problem is we have switched from a world where it was easy to let the government read selected communications (single phones, letters), to one where it's hard not to give them access to everything or nothing.
Personally, if there was some 'magic wand' way I could let the government keep it's previous levels of control in the internet age (they could individually pick users and put work into monitoring their communications, with a clear low limit on the number they can previously watch), I personally would.
But that's hard to do -- it's not obvious it's possible at all, so we need to define a 'new normal', but let's not pretend we aren't taking a huge amount of existing power away from governments with large scale encryption.
> The idea that being anonymous online will save a society from a dictator/repression is wishful thinking.
Strawman.
> Only good faith engagement with an existing democractic system will ensure the success of democracy
This isn’t true. Voters are occasionally very willing to vote in demagogues, authoritarians, and fascists.
The founding fathers knew that democracy came with it the chance of mob rule.
The solution isn’t to guarantee that nobody has any anonymity online. It’s to make society more resilient by increasing media literacy. Countries which border Russia (notably Finland and Ukraine) are doing an amazing job at resisting the industrial volume of manufactured propaganda. Countries with gullible people just become victims to it.
No, it won’t. The internet is just getting smaller from my perspective because there’s no way I’m handing over my identification and allowing every connection made to a server to be tracked back to me.
It’s simply not on the cards, and I live a frugal enough life in a high paying industry that I can retire in a few years. If I was willing to bank on inheritance then I could retire now.
I feel for the people that are forced to engage though. But too many of them simply don’t care about privacy, which is why we’re here.
Do you think that this will lead to a new version of a alternative "internet" where people try to avoid the government control? And is that even possible? Or will we all just comply?
Only if it can be turned into gray market business: additional layers of proxies and VPNs, and whatever new is invented.
As simple "I care about privacy" need is not a reason to bother with setup for a regular person. So it could work only if it's as easy, as current internet. And for profit businesses provide it.
As for another protocol all together: there are some experiments already, but again, why use those?
only for a short while longer. US, EU, China, and Russia are all on the same page about you-vill-ovn-nothing-und-you-vill-be-happy kind of future, and they will bully the rest of the world into compliance.
It is such a sick idea. But i cant really figurer out if they want to force this on us or they just anticipate that type of poverty will become normal for the new "middle class" and they want to make everyone accept it with some "crisis argumentation".
We'll move permanently to the dark web, then. Ideally, we should maintain resilient wireless community networks that can withstand government abuse, as well.
Absolutely. If they end up making access to the deep and dark web impossible through commercial Internet infrastructure, the next logical step is cracking down on alternative Internet infrastructure. Overlay networks like I2P, Tor or Hyphanet can be a temporary safe haven, but ultimately a government can make it extremely hard for uncontrolled platforms to stay up. I guess we'll have to fight for it if push comes to shove, and it's looking very bleak.
There will be your internet-connected computer which will be assumed to be compromised, & which little, if anything of use will be kept on, & then there will be the airgapped system you do work on, which will probably be the last trusted version of a Linux distro you have multiple copies stashed away of. It will be a very old-fashioned experience, & moving/sharing data will become a dicey business.
The sad thing is that any actual bad actor will find a way to circumvent this, but it will just invade your privacy and lead to a worse Cambridge Analytica-style breach of privacy.
This seems more like a technical problem that we could actually solve well if we wanted to and had competent people advising the governments. You go to DMV and they generate a keypair and an entry in a DB. App looks up your age with your public key + signed private key authorization from you. Apps can ask for specific checks like is_over_21, is_citizen or whatever without any more data. Something like that, details are probably off ;) The whole infrastructure could be open source. Age verification doesn't need to equal identity verification by a 3rd party company that will leak your IDs.
None of this is necessary. First, the only devices that actually need to be gated are cell phones.
The user agent should simply send the user’s age of the parental lock is set up and the websites required to respect this.
Parental controls and the OS should be robust enough to not let kids bypass it (e.g.: by installing a browser that skips the header, or blocking proxy websites)
Done.
Cellphones only because those are the devices kids can have on them all the time and can easily use in private unsupervised.
They want it to equal identity verification! When virtually every top tech executive who wants a favor is at the inauguration and you have companies doing 180 degrees on support for something they previously furiously opposed, someone is getting something they wanted. It seems naive to think otherwise. Furthermore, the current administration in the U.S. fired or ignored the competent people to which you’re referring, and those people oppose a centralized repository of various metadata because it creates a central point of failure, otherwise known as a target, that is generally a bad idea for both our nation and our citizens. Of course there are agencies in the federal government that possess this information already, but they possess it for their purposes only. This is good because it means that it’s both more difficult to abuse internally in addition to being more cumbersome to collect externally.
There's still a whole DB matching IDs to keys waiting to be leaked. The US government can't even keep it's own personnel records safe and you think this won't get stolen and used to target people?
This still criminalizes sharing "adult" information with people who are not on the government's approved list (the things states do to crush dissent are not safe for children.)
why would any site on the internet need to give a damn about is_citizen? That's just gross to me at the mere suggestion. If it's a government service site, then they already know that information. If you're trying to use something like social media, then it couldn't possibly matter less.
How is hitting the library an act of rebellious defiance? Getting a library card requires an ID and proof of address. The library then tracks which books you've signed out. Unless you're reading the books inside the library without signing them out.
My library, at least, is fanatical about their patron's privacy.
I don't know what their retention time is on circulation records, but beyond aggregate statistics for culling materials that aren't circulating I bet it isn't too long. Now I want to go check.
My library also only keeps 24 hours of video surveillance because they didn't want to be able to fulfill requests from the cops for footage of patrons. I really liked that.
Edit: In the patron portal it permits me to disable "borrowing history" and says it permanently deletes my records. I do contract IT work for them so next time I'm engaged I'll ask about the details. They're moving to Koha later this year (free / open-source ILS) so I could go look at the code to see what it does (which is nice).
On the theme of their privacy fanaticism:
Over a decade ago the library got a grant to do outdoor public WiFi in the park behind their building. As part of that grant they needed to report the number of distinct users using the WiFi each day. Their UniFi controller tracks MAC addresses of associated stations. I used a query against the underlying MongoDB to get the usage reports to satisfy the grant.
To minimize the potential of tracking individual users the library director had me write a script to grovel thru MongoDB, do a SHA-1 hash of each public MAC address tracked concatenated with a randomly-generated salt for that day, then write back the first 48 bits of the hash over the original MAC. The library gets their daily statistics and long-term traffic trend data, they don't double-count associations for the same device in the same day, but they can't track individual people over a span of multiple days.
Now that devices randomly-generating MACs are mainstream it's much less necessary. I thought it was really cool she thought this. (The whole salting/hashing bit was my idea. She just wanted to be able to fulfill the grant reporting requirements amd be unable to track people.)
A library is supported by local property taxes, so requiring proof of residence serves a practical purpose. Of course they are going to track loaned books too. This is not the same thing, by any stretch. If they are somehow making that information available beyond the scope of the library system it is a breach of trust.
Certainly, but I think you need to have a library card to use the computers.
I do see folks who look homeless using the computers, so I assume there must be a special accommodation for them.
But, if you’re just a regular middle class joe looking for anonymity on the internet, I don’t think the library is the place for you—it’s tied to your library card which knows your address, and anyway what would you want to be private that you would be ok to broadcast in an open library setting? Nobody watching corn or browsing whatever successor to Silk Road.
Usually the login screen says something about fairly restrictive terms of use, even for the WiFi on a personal device, and I don’t know if you can install software on the library computers.
When I look around at library patrons using the computers, it’s usually lower income folks applying to jobs or similar, and people playing chess.
You can. You just have to ignore all the privileged people being annoyed that they have to see you. They love posting on Nextdoor about how much they hate homeless people.
Has always been anarchical, so in essence it's in opposition to any form of authority that's predominant at the time. It makes zero sense to call it left or right wing.
The anti-authoritarian, anti-government, anti-fascist, anti-capitalist music genre punk rock? Always right wing?
I mean, Nazis have always been attracted to punk because they like the loud noise but are too stupid to understand lyrics, but they tend to get their shit kicked in by punks more often than not. I don't think that's the same thing.
The Ramones were divided politically, if I remember rightly. One of them was on the moderate right.
In the UK, there was also the Rock against Communism movement which came out of the far right faction of punk and was a response to Rock against Racism.
That's one of the reasons why I opted for multiple citizenships. I was fortunate to have the option to rehash parts of my name, and I am using my birthplace country's passport as a throwaway for everything, and my other citizenships docs only the governments and legal system know about.
Plus, like others mentioned, I am preparing my future self to be in a total offline/unplugged world and be a semi-ghost digitally, and even now in 2026 I found a bunch opportunities already doing it in a semi-agorist way (e.g. second hand, cash on hand, offline remote physical work, hunting/fishing, farming/a little farm, etc).
This could be good to make the lack of privacy online more explicit to users, and actually cause people to be more cautious online, which all the snowden revelations failed to do. If we start using the internet the same way we use government websites, log in, do the thing, log out.
I feel we are still living in this bubble that treats the internet as some sort of utopian democratic institution. For certain people with strong mental gating it can be the case. But I'd say it's a massive projection from intelligent technologists on the rest of humanity. Most people really need some guardrails to avoid becoming hopelessly addicted to the worst material.
I hope this creates pressure for new technologies and media that answer some of the problems of communication which the internet couldn't. I guess people will find new bubbles of anonymity like Signal/Whatsapp groups to get information and discuss. Hopefully which reward some degree of contribution and proper thinking. Revive the genuine social sphere rather than tuning into the corporate filtered simulacrum of a town square. The truth I've seen is that the current internet is pure poison to most minds, and anonymity is just one less bit of friction to mindlessness.
Feels like identity control is not such a bad thing (prevents bots, identity thefts, cyberbullying, ect...). The questions is not "if it happens", its more a "who controls it?". If an NGO controls it, or a company that has "no political or national ownership", or something that is decentralized like BTC is, it's not a problem, but if it's a huge corp that only belongs to one single company which is backed and "piloted" by a government, that's when problems emerge.
How is it any different from being required to identify yourself to get a phone or electricity account? Identifying yourself on the internet is long overdue.
It is fine in some cases. But what is at stake here is not identifying yourself in a couple of common sense situations.
It is enabling control infrastructure for governments whom are becoming increasingly undemocratic in a society where the elite gets more and more influence and where the middle class is becoming ruined.
You need to identify yourself to the phone and electricity utilities so they know where to send your monthly bill. My ISP knows my name because I pay them for connectivity. I am okay with this.
If I misbehave here, dang can just ban me. There's no reason HN needs to know my real name. The only reason to mandate blanket age and identity verification is to control online speech.
You aren't required to identify yourself to get a phone. You can get a prepaid phone with no ID.
You are required to identify yourself for an electricity account because it is essentially extending you credit. You use the electricity first, and then they bill you for it later. They also only identify the person who is receiving the bill. You could have a house with a dozen people in it but the electric company only knows the name of the person responsible for the bill.
You are free to identify yourself on the internet right now. People who are intelligent and/or believe in freedom and free speech are opposed to this authoritarian power grab.
> You aren't required to identify yourself to get a phone. You can get a prepaid phone with no ID.
Requiring ID to buy a prepaid SIM card has become the norm across the developed world. There are still a few holdout countries, but they won’t hold out for long.
You say that as though it's a feature rather than a bug. Being able to have an anonymous SIM card is a useful privacy and security feature, to avoid things like "tell me the ID of everyone in the vicinity of this protest". (And that's one reason governments try to break that.)
My sympathies are increasingly with the Chinese model of development. So, yes, policies that confront the major challenge of our era – ensuring social harmony among the chaos of modern media and communications – are good features.
> ensuring social harmony among the chaos of modern media and communications
Harmony is another word for suppression of dissent, and that's the effect it'll have.
There's a long history of tools being promoted for one purpose and used for another. Tools supposedly intended to restrict "porn" get used to restrict LGBT healthcare and resources. Tools supposedly intended to promote "harmony" on social media get used to track down activists and protestors.
The obvious response to such overreach is to refuse to allow such tools to exist. It's not that the tools invite abuse; it's that all use of such tools is abuse.
I think it was Ethan Zuckerman who once said that Congress is ill-equipped and incompetent to solve this kind of problem and that we need to design systems that guarantee outcomes and cites Signal as an example. We need to have that mindset now: a clarion call to software engineers.
The goal should be to not repeat Star Wars - new technology that gives power and advantages is always adopted by companies first, then governments, and then it’s used to subjugate people. In Star Wars you have the trade federation abusing little planets. Little planet leaders go to government for help
and vote a more “strong” approach to government that will “fight for the little guy”. An authoritarian leader steps in and uses the new technology to subjugate galaxies. In Foundation that leader can also clone himself, leading to 1000 years of fascism. Today prize camels and horses are being cloned in the middle east. Fiction is a guidebook sometimes.
I'm pretty sure this is a "pick your poison" problem. We as a society are damned no matter what we do or do not do. For my part, we need to do something, because things are not fine the way they are, including the half ass Australian solution. We can't keep putting the onus on private enterprise to address social issues.
I may sound crazy for saying so, but I think the answer is more government run infrastructure for enabling identity-based operations, like payments and authentication, with rules about standards, open source, contractor selection, and audit that make operation transparent. It can work if technical operations are legislated instead of "left for the engineers to figure out." Then at least the evolution of systems can become real political issues that map to election cycles.
My stance is probably a polarizing one, but this is precisely why we need to be able to debate the minutae of these systems through our political discourse instead of just "will we; won't we" legislation. This should be debated in democratic process.
We could try investing in positive infrastructure that improves peoples life's in stead of creating the panopticon torment nexus. Things like third spaces where people can spend time is save spaces where they form communities and public transit so that people can get to those places. Incentivize positive behaviors instead of closing off public spaces and pricing more and more people out of being able to do anything with the minuscule amount of free time they have besides going on the internet.
Allowing the relevant authorities to control, shut down and arrest serious crimes doesn't turn a country into a surveillance state.
Poor surveillance controls do though - let's perhaps fix those instead of allowing garbage like Flock to spread and then hand wring? EU started with GDPR, let's see others follow and build on it?
I think the lie is to look at the problems we have that the internet has enabled and say "things are ok as they are don't try to do anything to solve it."
Things are, in fact, okay as they are, attempts to impose identity requirements would make things less okay, and people trying to claim they aren't okay need to be defeated.
Oh, a great many things are broken and need fixing. "The internet doesn't have enough surveillance and deanonymization" is just not one of those things.
If the problem is "social media bad for kids" then any parent that allows their children to access social media is as guilty of abuse or neglect as a parent that lets them play in traffic. Throw the parents in prison and put the kids in foster care. Problem solved.
People make problems where there are none. Parents all around me are giving smartphones to their eight year olds without supervision.
I have kids and no amount of bullshit is going to convince me this is necessary for social interaction of any kind. If anything the "phone kids" are the weird ones.
People are creating this problem. You can easily, very easily, say "no" to a kid. I pay to keep you bloody alive and I will defend your sanity with everything I got because these kids are our future. Being disliked or "hated" by them is the least of my worries. Are we adults or what?
Sometimes I think there is a severe lack of "adulting" lately. No amount of legislation will fix that.
Well, as I said, we figured out ways to make parents big-r Responsible by applying harsh penalties when they abuse or neglect their children. We spend countless billions on government agenices whose sole purpose is to intervene when parents fail their children. We should use this pre-existing system to deal with the problem of parents allowing their children to use social media.
That is a bold statement to make, and I wonder how many more people would be willing to make the same statement whenever these conversations come up on HN.
This was in part caused by the general public’s comfort with federated identity for OAuth. If everyone already has one anyway (the thinking may go), why not mandate it?
Unrelated, but you remind me of how absolutely useless ad technology is. The literal second I cross the border into Spain on holiday all I see is completely Spanish ads for stuff I never heard of and aren't even appropriate for my gender. This is for a ten year old YT account that basically knows everything there is to know about me. Even when I continue and look for English videos they keep shoving Spanish bullshit into my face.
Even at home I still get ads for music festivals, shoes and toothpaste, none of which are withing a thousand yards of my personal preference. The times I saw an ad for mechanical keyboards, interesting APIs, IDEs etc I can count on literally one hand and that's being online for decades.
iPhones' builtin autocomplete, Netflix and Spotify's recommendations all have robbed me of the illusion that smart people are actually working on this problem. If they are, it ain't working. The money printer works but not because of clever tech. YT's ad tech basically boils down to a geolocation of IP and I sometimes even question that.
"X will decimate your privacy" [please accept the following tracking cookies, including for 3rd party ad analytics from a company whose CEO has called its users "dumb fucks" for trusting him with their data]
Don't get me wrong, just because it's a hypocritical headline doesn't mean it's incorrect. Just still rankles to see it, is all.
If they wanted to verify your age or that you are a real person with ID/selfie it could always be done on device locally to respect privacy which of course they don't because its not about that I even googled just now and see is solutions for this like PrivateID
I can’t think of a better solution to the issue of children being so aggressively harmed by the internet. That doesn’t remove any of the problems associated with this.
It’s not just kids. Adults are having their brains fried on AI generated political videos online right now. The state of the internet is an absolute disaster.
I think he questioned the wisdom of isolating yourself from "people" in general.
On a related note I would like to add that social activity of any online kind is completely useless and can be get rid of immediately and without any adverse side effects whatsoever.
I'm pretty convinced the next generations will view being online as cheap and stupid. Offline is where the real value is.
The thing is, those dealers can end up in jail for selling drugs.
More to the point, if a kid walked into a convenience store and the clerk sold them a pack of cigarettes, the clerk wouldn't get off the hook by claiming, "well, the parents are responsible for their kids." I'm also not sure how one would justify holding parents legally liable for crimes they played no role in committing.
I'm not saying that I agree with these laws. They appear to be taking things too far. But that has more to do with there being no clear way to define sites that are only of interest to adults (no gatekeeping needed) and sites that should be restricted to adults.
Once upon a time they idea that Americans would surrender all of their God Given rights for an illusion of security was considered absurd, but that's where we're at.
I'm glad computers came in and saved you from your otherwise-inevitable life of cartel involvement, but I don't see what this has to do with the en-masse mental poisoning of children? I'm not even talking about politics yet. Cyber-bullying is insane.
Either way, I genuinely don't believe "let's just hope parents... start doing better?" is a solution.
We need to calibrate the incentives. Parents can be held accountable for neglect and abuse. Giving your kids phones and letting them use it without supervision is abuse. Enforce it. Denormalize this bullshit.
I have knives in my kitchen. Do I give it to them and let them run around the neighborhood? I could but there are consequences and I would be held accountable for it.
Social media = knives or as some other commenter pointed out, similar to letting your kids play in traffic.
>What happens when parents don’t lock the liquor cabinet? When they smoke in front of their kids? When they leave porn laying on the table?
The state can't control those things, it can control putting an age restriction on certain websites. Unless you are advocating for the complete abolition of all age restrictions throughout society.
My parents always kept a few bottles of wine in a cabinet in the living room. If 8 year old me wanted wine, I could have drunk a whole bottle while they were away and there was no way they could have stopped me. Yet I didn't drink my parents' wine, nor did I grow up alcoholic.
You could and when you would end up in the hospital your parents would have gotten a visit by people with sticks.
You can let your kid play in traffic. You can let your kid run around with knives. Sure, but when shit hits the fan you'll be luck to pay a hefty fine and lose all social credibility you had. In the worst case you're looking at jail time. Those sort of incentives will tend to smooth these issues out.
Kudos for resisting alcohol as an eight year old. How does that apply to all the kiddos whose lives are impacted by social media? Kind of a "them problem"?
Yes, it is. Kids get screwed up in all kinds of ways that we do nothing about. We could eliminate a lot of harm by prohibiting religious indoctrination, for instance, but that's unlikely to happen.
How is it more like leaving a liquor cabinet open than not buckling them up with seatbelts?
I'm glad we're discussing parental liability. It seems no one else is advocating for "social media access is criminal neglect," so I appreciate the novelty.
I would love to have this be the argument. Parents would typically agree that giving your kids heroin, for instance, should result in prison time. Yet I doubt they would argue the same for social media! Perhaps there should be discussions about what neglect looks like with regards to internet access and whether or not we need societal boundaries around this, enforced via punishing parents, rather than punishing everyone.
Giving children access to social media should have the same parental neglect charges as giving them heroin.
The current strategy of yelling "parent's should parent" does nothing to influence any sort of result. It's simply ineffective and makes people who say it look like slogan slingers rather than cooperating in any meaningful change.
We are in the 80s smoking phase. It's still all OK and it's normalized. We're seeing the first blips of trouble on the horizon.
In, say, about a decade this tech bullshit will be regarded as the relentless toxic insanity that it was and we'll be better for it. Social tech CEOs will be lucky to evade prison if I had my way.
Whenever I speak to someone who's planning to vote Reform (UK hard-right party) their views are primarily shaped by seeing AI slop videos on TikTok/Instagram, showing immigrants doing crimes etc etc
Reform will probably win the next election because of this, unless we find a way to make platforms manage the situation.
The simplest cure, even though it is US law but would also benefit the UK, would be to repeal Section 230 safe-harbors when the platform uses an algorithm to curate content. If they are covered by the "safe harbor" then they are not responsible for the content. Otherwise, they'd be liable for libel/defamation/conspiracy stuff.
My what now? What privacy do I have on the corporate internet? I'm already being observed. My data integrated in vast "AI" models that try to predict me. We have seen tons of examples of the current tech giants farming out content moderation, hiring empoverished workers in the 3rd world to view all my videos and listen to all my conversations.
Privacy or accountability, pick one. Everyone holds your identity or pointers to it. They - pinky promise - won’t weaponize it until it becomes advantageous or ordered by the government.
In the end someone has to be held accountable. Society does not work without accountability and never has. We were living in temporary illusory world made by nerds. Now the rest joins in.
The discussion is not about whether it's a good or bad idea, but whether we will yield the power to these people to ratchet in further oppressive laws onto formerly free countries.
Tech companies should ignore it and just publicly name whoever attempts to prosecute them and see how the population responds. I think people today are orders of magnitude more informed about their privacy and the consequences of digital ID laws. A few countries are on the edge of revolt at the moment anyway, and this would be a good way to get young people into the streets.
20 years ago, people would have had no defense against it or understanding of what was being imposed on them. Today, normal people use Signal and encrypted messengers, faraday bags, and leave their phones at home. Where we were nerdy security guys back then, non-technologist women and girls use spy tradecraft level electronic opsec for their own safety and security from middle school. People are much more sophisticated about their privacy now. They're ready to take this on.
The laws coming into force are on people who are not in favour of them, and I'm so optimistic that I will not interrupt the enemies of privacy and human dignity while they are making a mistake.
The internet is not free. We've been running out of IP addresses for ages and most people don't have direct internet access these days so are completely dependent on man-in-the-middle servers. All it would take is a broad ban on VPN and end-to-end encryption. Governments have been wanting to ban strong encryption ever since the public got access to it in the 90s (see PGP/Zimmermann).
I am glad that more and more people wake up to the highly criminal age sniffing movement. That age sniffing movement, sometimes called age verification to insinuate a more harmless movemet, wants to destroy the anonymous internet as we knew it; see their fight against VPNs. This is not accidental - this is very integral to this evil movement.
The only logical consequence and response to that is to completely abolish those lobbyists that work against freedom.
So everyone is on the same page on this issue. The First Amendment is the right to anonymous free speech. I doubt they teach it in the govt schools but the Federalist papers, which argued for the US Constitution, was published anonymously.
I'm not sure "social media" is the best example. You've never had complete freedom of speech on there.
It's been true for decades in the USA that if they want to arrest you, they will. The age verification doesn't make this situation better, but at this point it's almost just a formality.
Freedom of speech is contextually misunderstood. It's about political speech and the commons. Social Media is overwhelmingly private space, subject to contract terms and conditions. It may be a de-facto commons to some people but I do not believe this axiomatically, or legally makes it so, for the purposes of law and constitution. Law and constitutional bounds on speech online hit the international nature of the media very quickly.
Extra-territorial issue are huge here. What is the limit of the boundary on a given nations constitution and law? How much does the economy of the user, the hosting company, the owning company, the receiving parties matter?
Social Media has advertising and publishers. It has people who can effect editorial control over what is seen and by who and to who it is "said" -And that imposes obligations on them, and on people lodging content. Differentially depending on their economy, the reach of law, registration of legally incorporated entities.
All of this is being implemented somewhat haphazardly internationally, enforced differently, subject to legal and financial and social pressures differently depending on the times and the context.
If you want to ask questions about America, about Americans, using American companies, speaking to Americans, believe me you don't neccessarily have a simpler task here. It may well be clearer to some of you, but to me, its just as fraught.
It's just not clear to me "free speech" is the bastion rule which applies here. The EFF may think so, I don't think they have actually demonstrated it all the way to the end.
The internet is dieing just like mobile phones before that. Correction: mobiles were stillborn due to no open standards or O/S. Cant even buy a modern TV without privacy concerns -- lel.
Oh, not all of them. There were too many for that to be all of them. But this "secret ballot" nonsense won't protect them for much longer. Consequences.
All I can say is I will never vote for any politician who votes for any form of this. Even if the bill fails to pass, they will never, ever get my vote.
I hold an unpopular opinion here, but well regulated digital IDs might not be a benefit to us all.
Almost all big tech giants are frankly paper tigers (can I survive without facebook, sure, without next day delivery, harder, without banking or secure ways to talk to my utility providers, waaay harder.
Having a way to get rid of bots that sour our
Online discussions, lovely. To reduce billion in bank fraud, sounds great.
I feel as privacy advocates we need to be clear on the difference between secrecy (that’s gone unless you stay offline.) and privacy (your neighbour knows you are having sex in the afternoons but does not say anything.
Singing: nobody wants this everybody hates you! Governments burning their capital hard to try to prove what tough guys they are against the Declaration of Independence of Cyberspace.
My privacy is already decimated. For 2 decades we’ve already known about the NSA slurping up everything[1] on top of the Snowden leaks.
Then you have the mega corps like Facebook who can figure out every detail about you even from merely _not_ using their system because of the hole you leave in your social network that does use them.
The only privacy left is from anonymous troll farms claiming to be an American while talking about how the Texas oblast is valuable for its warm water ports.
I am fine for privacy on consumption of content, but you should be forced to identify yourself for posting so the common man at least has a chance to evaluate your statements instead of being misled, all while, as stated above, our governments and corporations don’t have that limitation.
> ...you should be forced to identify yourself for posting...
The Supreme Court has repeatedly held that the right to anonymous speech is inherent in the first amendment [1] [2]. See also The Federalist Papers or Common Sense, without which the US might not exist at all.
That’s pre the ability for foreign actors to engage in our public square en masse. I think technology has changed the situation.
Free speech absolutism that ends up in creating an environment where real speech is drowned out by lies is not valuable to me. It’s like the paradox of tolerance.
The first amendment doesn't have a clause that exempts Americans from anonymous speech if it's possible a foreigner could inadvertently take advantage of the freedom too.
You may as well advocate for no one to be allowed to drive cars because of the possibility of someone getting into a car accident.
Or (in case you're a fan of the second amendment) - advocate for guns not being allowed to be sold to law-abiding citizens because of the possibility of the gun later working its way into the hands of someone who would use it for a mass shooting.
Freedoms exist with the understanding that both positive and negative consequences can result from them. The argument is that the good vastly out-weighs the bad and are worth preserving.
> The first amendment doesn't have a clause that exempts Americans from anonymous speech if it's possible a foreigner could inadvertently take advantage of the freedom too.
Cool, ignore my point about technology changing the situation. I assume you’ll ignore Jefferson talking about how the constitution should be changed every 19-20 years because the world changed.
> You may as well advocate for no one to be allowed to drive cars because of the possibility of someone getting into a car accident.
That’s the literal reality with mandated car insurance. If you don’t have car insurance you can be banned from driving. What was your point here?
> Or (in case you're a fan of the second amendment) - advocate for guns not being allowed to be sold to law-abiding citizens because of the possibility of the gun later working its way into the hands of someone who would use it for a mass shooting.
I’m not an advocate for the 2nd amendment since the majority of people I’ve met advocating for it as a defense against tyranny are full throated proponents for the tyrannical leaders because they don’t like the cultural norms of anyone outside their tribe. I can’t think of a single 2nd amendment advocate who is ready to stand up to the government against rights violations and would be happy to hear from you of an example.
> Freedoms exist with the understanding that both positive and negative consequences can result from them. The argument is that the good vastly out-weighs the bad and are worth preserving.
Yea, the freedom to swing your fist ends at my nose. Freedom of speech to explicitly lie like Steve Bannon organized and many others using the “flood the zone” strategy seems to the be at the end of my nose. If you are actively lying to manipulate me or others knowledge of reality, that is not feee speech, that’s Machiavellian manipulation.
> Cool, ignore my point about technology changing the situation. I assume you’ll ignore Jefferson talking about how the constitution should be changed every 19-20 years because the world changed.
The Constitution doesn't have a "except when technology gets advanced enough" clause either. I checked.
You wanting the Constitution to change is something else entirely - and that's not what you're advocating for.
> That’s the literal reality with mandated car insurance. If you don’t have car insurance you can be banned from driving. What was your point here?
I fail to see what car insurance analogizes to here.
>Yea, the freedom to swing your fist ends at my nose. Freedom of speech to explicitly lie like Steve Bannon organized and many others using the “flood the zone” strategy seems to the be at the end of my nose. If you are actively lying to manipulate me or others knowledge of reality, that is not feee speech, that’s Machiavellian manipulation.
Speech is not violence. Comparing it to violence diminishes the suffefing and harm faced by people who have been a victim of violence.
You have the freedom to pay attention to whatever you want to - as do media outlets and political consultants.
Why should the entire country suffer because the media frequented by political-news-saturated people is so easily disatractable? They have the option to just...not...cover irrelevant nonsense.
It's not the option they choose to take though. See: The reflecting pool news cycle.
And I _can_ climb to the top of Mount Everest theoretically but it’s highly unlikely given the real world constraints.
I’d prefer a pragmatic solution and there is no pragmatic solution that gives us privacy back given the government and megacorps ability to pierce the vast majority of forms of privacy. The only thing anonymous speech is getting us currently is being manipulated by bad actors who are lying about their position.
I fundamentally do not want a world where I get the bad ends of both sides of semi anonymous speech where the government and megacorps know everything about me, but I just have to trust the account I am speaking to isn’t a bot or a worker in some foreign psyop shop, or even domestic psyop shop, lying to me.
I do not value free speech if it functionally disabled via the amount of lies permeating it. Free speech is useless if it’s nothing but a sea of “flood the zone” lies with the intent to make the truth unknowable, like how Russia or actors like Steve Bannon have manipulated the public square to be.
So much bad speech / misinformation is not anonymous, look at the kind of stuff the US President, Admin, and Gov't are proud posting, or the left/right-wing influencers. Forcing "papers please" on everyone is not going to meaningfully change the situation (imo). It will give the autocrats an inch and then they will take more. Eventually they will be able to police online speech.
---
From: On Tyranny by Timothy Snyder, Chapter 1 title & intro
Do not obey in advance.
Most of the power of authoritarianism is freely given. In times like these, individuals think ahead about what a more repressive government will want, and then offer themselves without being asked. A citizen who adapts in this way is teaching power what it can do.
I am not obeying in advance. My privacy was obliterated with the government before I could even vote, with the data science of mega corps, and with the double digit number of times companies leaked my data based on have I been pwned numbers.
I am not under the impression I have any sort of privacy on the internet anymore, other than from other regular civilians.
What I have to deal with is bots, foreign actors, and domestic actors all flooding the zone with lies that I cannot discern from the truth but that companies and the government can.
Making posting a non anonymous activity equalizes the playing field between me and governments/corporations.
If you are arguing that we should keep this thin skin of anonymity that doesn’t stop the bad actors, then I assume you just want them to keep power or that you don’t actually believe that they have managed to track our behavior.
Can you link said research? I have never seen anything but division pushed by anonymity.
Also again, the corporations and governments(for certain levels of government like the members of the Five Eyes) can pierce this veil of anonymity, the people who have a lot to lose already are risking it by speaking.
Edit: this also isn’t a newly diagnosed phenomena, I remember seeing this satirical description of the behavior as a kid back when Web 2.0 and social media was starting to change the internet[1]
> My privacy is already decimated. For 2 decades we’ve already known about the NSA slurping up everything[1] on top of the Snowden leaks.
If you were correct, there would be no need for them to push these new laws. The fact is, you will have less privacy after these identification requirements are fully enforced.
Anything to close Pandora's box. "They" liked the eras they could control the communications, and therefore the narrative. Boomers on their last legs, question is, will the future undo the unjustness that was forced upon them? Restore the rungs of the ladders that were removed, so they could have a chance too? Or are they going to stay in the fear narrative, and make this tragedy worse?
The internet will just stop being the "cool place". Young people will need to find some other avenue or medium to congregate away from their nannies' watchful eyes. That has been the one constant across the multiple technological revolutions we've had in the last few decades, younger generations looking for a place to call their own. Meta, etc. obviously know this, hence the "metaverse" and AI slop. But what they refuse to believe is that it can't be manufactured and forced top-down, it needs to be bottom-up.
What scary me a lot, is the amount of people here or in real life that are not concerned about that, and that are like "it is to protect the children, so whatever it is, it worth it. And what else we can do?". And often it goes on with things like "anyway, social media are bad, they ruin people even adult, so good thing". Literally they all look like repeating a carefully crafted propaganda without that much more deep thinking.
Basically, to mean it is brain rot. The problem is that it might concern a big part of the population and that is why we have such laws.
To me, it is exactly what was described in G. Orwell "Animal farm" book. Pigs are now in control and big part of the crowd are "sheeps".
Afterward, we always have hard time to understand how people could have let Nazi, Stasi, or Stalin come in power and do such awful things. But it never came in one day, and with the "i don't care, they probably now better" attitude of the current western country populations, you understand easily how all of that could have happened in a first place.
In the recent, and most recent history, let's not forget what happened to Putin's Russia. Russia was opening and on a very good course for individual freedom and rights, then a ex-KGB officer took control of the power and little by little, year after year, suppressed freedom, privacy, and opposition to reach the point of today where the country is a total nightmare for human rights and liberty.
Mate, you have to revise your stance on Russia, more people are imprisoned annually in the UK for speaking than people in Russia in a decade. The UK banned RT while you can access any western propaganda outpost from within Russia.
You’re on Hacker News, this website is known for attracting open minded free thinkers that do not fall under the influence of government financed propaganda. Learn and reassess your thoughts.
>you can access any western propaganda outpost from within Russia
You cannot without VPN. Anyway, this stupid polarizing "my cow is dead, but neighbor's two cows dead so I am happy" approach is just sad and enables more govt tyranny globally.
I mean, your ISP knows your IP, the government can know your IP, Google knows your IP, Meta knows your IP, all the websites you log on know who you are and what you're IP is, and forward your data to 3rd parties, many of these connect the dots between the various websites you visit.
If there is one benefit to true ID verification on the internet, is that people won't feel as if they're browsing things anonymously while they're not.
There are at least some technological solutions here, such as anonymous credentials. [1] Modern versions of this technique allow one to associate metadata (like a proof of age exceeding a threshold) in such a way that the verifier can't even correlate repeated requests across users.
Governments that are serious about age verification and individual privacy (which, doubtful they truly are) should agree on a protocol and set up certificate issuers that are associated with a digital ID. Then age verification will not be an invasive procedure or risk data leaks or insider threats.
[1]: https://blog.cryptographyengineering.com/2026/03/02/anonymou...
The article talks about the possibilities of malicious cloning of these tokens by third parties, but fails to identify the much more common use case, and one that makes this scheme useless for age verification.
It's one thing to be concerned about someone stealing my credential, but another to prevent the transfer of these credentials, especially if they are limited use credentials.
The entire point of age verification systems is to prevent minors from accessing certain resources. I think we all know that this is basically impossible; but what these various governments and social media companies want to do is to make it high friction to do so.
The highest friction version of this is that the credential ties to a real world identity somehow; maybe locked behind legal barriers, etc., but if a minor is caught using someone's credential, then the person whose credential they are using can be investigated, and, if necessary, charged with a crime roughly equivalent to providing alcohol to a minor. Without the possibility of real world enforcement, none of these identity solutions can possibly work.
Keep dreaming of a technological solution -- there is none that does not lead to the world that FIRE is warning about, except to accept that we can only make a solution "good enough" and leave it at that, without expanding into full on identity verification. The solution here is likely to just try to provide better abilities for parents to monitor and limit their children's use of the internet. Let individual parents decide on the level of harm that they are willing to accept, and accept that there will be ways to work around this even if parents are vigilant, but just try to reduce it on the margins.
Yes, this is the part of the issue that is so frequently ignored: Anonymous age verification schemes are easily defeated through proxying because there wouldn't be any consequences for selling your tokens. "Install this app on your phone and we'll pay you $1 per day" and it will mint your anonymous identity tokens and send them off to kids who want to buy them. If there's no way to track the tokens, there is no possibility of negative consequences.
So the schemes always start introducing features to reduce the anonymity of the tokens or make them more trackable in some way:
> The highest friction version of this is that the credential ties to a real world identity somehow; maybe locked behind legal barriers, etc., but if a minor is caught using someone's credential, then the person whose credential they are using can be investigated, and, if necessary, charged with a crime
Which requires that these identity tokens not be anonymous age-verification credentials. They become a traceable identity token tied to your government-issued ID.
But could you not set up a system where you need to go get (for free) a limited use token at a physical location, or have them mailed to your home, and they have a rough geographical lock? If a bunch of those tokens start appearing in random locations, it is a good indication that someone is reselling them to minors? I'm not saying this is idiot proof, but what could go wrong?
> They become a traceable identity token
Not if you use a challenge-response protocol where the client returns a zero-knowledge proof of age, where the proof incorporates a random string sent by the website.
The traceable stuff is private information that the website never sees. If a minor is caught with it, then law enforcement has local access to the minor's hardware and can probably view the private data.
At that point, the private key can be put on a public revocation list. The zero-knowledge proof can include a proof that you're not on the revocation list. Once you've been revoked, you have to go through the hassle of setting this all up again, which might be enough incentive to keep it reasonably secure.
This doesn’t stop the scheme the parent proposes, where adults install some proxy on their device and challenges are responded to on the parent device. Then the private key never leaves the parent device and all the child device has is the proxy software, which could be set up to not log any identifier of the key that it used
I agree, but this is also clearly a increased barrier. Going back to OPs comment that perfection is impossible, the goal is to raise the bar, I would say that this is more than good enough.
> but this is also clearly a increased barrier.
If there's a simple piece of software that can be installed, it's not meaningfully increasing the barrier. Also, there are negative consequences to introducing "rules that you're expected to break" like this. It makes the law unserious.
Sure, but then you're partnering with someone you probably don't know to take payment for doing something illegal, and that partner knows your device and where to send the money.
And if it's a phone app, it's not going to be on app stores and you already know the person giving you the app is a criminal.
So you're installing an untrustworthy app to risk criminal charges, and the customers of this scheme are kids who mostly don't have a lot of money.
You’re missing the point. If the tokens are truly anonymous then none of this matters. There’s no way to discover or prove where the tokens came from. It could be someone in another country with stolen IDs, which are now a goldmine for minting tokens and selling on the internet.
So the schemes inherently add some traceability, which makes the tokens no longer actually anonymous.
This is the back door used to make the tokens double as ID tokens.
Trusted computing fixes this up to the analog hole. Which is as much as you can expect.
Neuralink fixes the analog hole! Beam the ads directly to your cortex!
Trusted computing fixes this.
Trusted computing is the biggest threat to privacy and liberty of them all!
No, you can reliably attest public source builds of critical software for the ultimate in transparency. That even includes models running on GPUs. Combine that with blind tokens and you get trusted, anonymous identity verification.
What you also get is mobile devices that can't run unblessed code, make it impossible to remove legally-mandated spyware or backdoors, as well as websites that you can't use anonymously, even when you have very valid reasons to do so.
The same way a lobotomy fixes a headache.
How so?
They are implying the use of trusted computing with proprietary software to ensure that only users on fully “trusted” (locked down) devices are allowed to access network resources.
Presumably, if you have a trusted application on a trusted device, the identifier was installed in a trusted way, the device is in trusted possession and the device won't be given to anyone else, trusted computing may be able, in certain cases, to make it more difficult for a remote minor to use the identifier.
> in certain cases, to make it more difficult for a remote minor to use the identifier
Just offer the user some money if he installs some "trusted" app for age verification token sharing.
> If a minor is caught with it, then law enforcement has local access to the minor's hardware and can probably view the private data.
And then what? You think the police are going to make a case out of getting a token blacklisted or start an investigation into the person who the token came from? Also confiscate their devices as part of the investigation? I guarantee that the token source will be someone in another state or another country or just a stolen ID being used to sell their tokens.
I can’t believe we’re getting to the point where we’re talking about sending the police to deal with cases where a minor is suspected of, what, accessing social media? To confiscate their device and do forensic analysis of the tokens on it?
Do you realize how insane this is getting? How does anyone think this is feasible, let alone a good idea?
I'm saying a system like this is preferable to attaching our real identities to everything we do online, as countries are attempting right now. We can verify age without losing privacy or anonymous speech.
It's still my preference to have no verification at all. On the internet, nobody should know you're a dog.
> I'm saying a system like this is preferable to attaching our real identities to everything we do online, as countries are attempting right now. We can verify age without losing privacy or anonymous speech.
The problem with your hypothetical was that you casually introduced the police as an enforcement mechanism for cases of a minor accessing an over-18 website. The implication is that the physical police are now involved in our access of websites, and you’re saying the tokens involved in us accessing websites will have some evidence that they can use in the investigation of that access.
This is why we keep saying that the anonymous token schemes don’t preserve privacy. It always turns into a slippery slope of adding escape hatches to the anonymity to enforce violations. The very implication that the police are going to be tasked with going out and confiscating devices to investigate suspected age token violations is an indicator of how far the window has shifted on Internet privacy.
> Not if you use a challenge-response protocol where the client returns a zero-knowledge proof of age, where the proof incorporates a random string sent by the website.
Obviously it does. These $1 per-day apps are 24/7 online and so challenges can simply be proxied just the same as tokens.
> ... law enforcement has local access to the minor's hardware ...
This is a large part of what people, in practice, want to prevent using this scheme.
> Once you've been revoked, you have to go through the hassle of setting this all up again, which might be enough incentive to keep it reasonably secure ...
States want to know who to punish when this happens. Which also details how this is defeated: you can't revoke the token, because that makes getting a conviction near-impossible and it exposes the states to counterclaims.
The people who install such forwarding apps don't have money for the court to charge, and they can't take away their identification apps (which these will be, obviously) because that's the cheapest way for states to communicate with them.
Unless you build this into the base layer of the internet (which European networks like minitel did, by the way, with France telecom graciously checking it for free. Free for the state, of course. YOU paid per packet)
> ... to keep it reasonably secure ...
Oh and "reasonably secure" won't cut it. Someone committed suicide after a message was posted, and they're "reasonably secure" who it came from? You see the problem, I hope.
Are you saying such proxying apps exist now? Can you link a source for me?
Regarding my scheme:
The only way law enforcement should have access is if they show up and get the phone in their possession, with a warrant. Which could happen any time some teenager posts something without realizing it identifies them.
If the teenager has your full credentials, that's when law enforcement sees who you are, and can take whatever action we deem appropriate. I would think just revocation if you might have been hacked, more severe if it's clear you shared on purpose. Revoking credentials doesn't interfere with the person using the app for other purposes, or with any prosecution, and criminal prosecution doesn't rely on the perp having money; quite the opposite in fact.
If you install a proxying app for the challenge-response, you're installing an untrustworthy app from a criminal to take payment for a criminal scheme, with risk of prosecution if that criminal gets caught.
Nothing in society is perfectly secure. There are all sorts of ways that we allow some crimes and tragedies to happen because we know that preventing them would be even worse. There are good reasons that courts have long protected privacy and anonymous speech, even though we could solve more crimes without those protections.
> The only way law enforcement should have access is if they show up and get the phone in their possession, with a warrant. Which could happen any time some teenager posts something without realizing it identifies them.
It’s beyond crazy that we’re actually talking about police showing up at someone’s house because they suspect a social media post came from an under-18.
This is one step away from your local government unmasking their Internet critics and sending police to their house by “suspecting” that they might actually be a minor.
> If the teenager has your full credentials, that's when law enforcement sees who you are, and can take whatever action we deem appropriate. I would think just revocation if you might have been hacked, more severe if it's clear you shared on purpose.
Why would you assume the person giving out the token is in the same jurisdiction? The tokens would almost certainly be coming from another country.
The police aren’t going to be tracking down teens, confiscating their phones, running forensic analyses, and then doing the work of getting tokens revoked through a possibly international process. They barely have enough time to show up and take a report when someone does minor physical proper damage.
All this does is open up the process for targeted abuse when governments or police need an excuse to go after someone posting on social media.
But ... you were arguing method X prevents this from "They become a traceable identity token". And what are you going to do with the anonymous tokens? You'll identify whose credentials they are ...
If you can identify physical hardware from a request or post, obviously it's not anonymous. In fact, if you can identify the owner of credentials from the credentials, they're not anonymous. Obviously in an actual anonymous system it is utterly impossible to do this, whoever you are.
So you've just proven your own argument wrong. Anonymous age verification online is impossible. You don't agree?
There is a way to prevent this (or at least slow it down), but that way requires device integrity protection.
With integrity protection, tokens can only be minted with a government app, driven by both biometrics and physical human hands touching the physical screen. There's no way to do it in the background. Without it, you can indeed have a single activist mint 10 billion tokens and give them out for free, defeating the entire scheme.
There's a CAP-style triangle here. You can have age assurance and anonymity but lose the ability to run your own software, have age assurance and device control but lose anonymity (via traditional ID checks, which don't require IP in theory), or have anonymity and device control but lose age assurance.
What you conveniently forgot to mention is this means the death of open general purpose computing. No more rooted devices, no more self built PCs. You go buy a government approved device and run the government approved OS preinstalled and the moment you deviate from the government approved happy path you are booted off the internet.
I'm a fan of separating the trusted compute levels for commercial and non-commercial uses/sides of the internet. I think we have to move in this direction.
As it stands today, doing business on ebay/craigslist/etc isn't that much different than doing it in a back alley in the bad part of town. Generally a bad idea but YMMV if you keep your wits about you. Of course it's your right to do business that way, but no one in their right mind thinks it's acceptable to do global commerce that way.
Commerce relies on legally enforceable contracts (both paper and EULAs), which ultimately rely on identity to be enforced. It's a bug, not a feature, that someone on the internet can steal my identity to purchase a product in my name and have it shipped wherever they want. It's a feature, not a bug, that my bank asks me for photo ID before I empty my account in person.
I'm not allowed to access banking computers, except occasionally and from within in a sandbox with proper credentials (ATM card for example). If, in the future my bank needs to do their compute inside my house on my phone, then it seems fair that there should be walls that keep me outside of their trusted compute.
That said, I am 100% behind keeping open purpose general computing free and available. Rooted devices, self built PCs etc all of it. I love it, saying this as a person who grew up building their own PCs and programming from a young age. I think that we all should be able to access the non-commercial side of the internet in any way we want, a true public square, warts, gutters and all. Hobbyists can do whatever they like as long as it doesn't touch commercial systems.
As I see it, the problem for most of us is that the social/fun side of the internet has largely been captured by commercial interests. Anything with a EULA should be considered a commercial site, since you're legally bound by a contract using it. As it stands today all the fun things on the internet would require enforced identity.
Maybe having a separate walled off "commercial internet with identity enforcement" will finally open the public's eyes as to the ramifications of the digital world we've built. And also allow us to individually take a stand and push back against the commercial interests through our daily choices of what sites we visit. Basically voting with your ID chip instead of your pocketbook. You can still do business in the gutter if you want to, but for the normies it will be easier for them to spot when they're in a back alley. And it gives parents options for keeping kids off of the anonymous side as as well.
I do think a Reddit with identity would be a much less toxic place. As long as the brave adventurers among us can still access the digital gutters like 4chan and other message boards.
> I do think a Reddit with identity would be a much less toxic place.
Do you remember the days of "Real name" requirements on YouTube and "Google+"? The experiment was tried, it didn't change things. (Also, see Facebook for an ongoing version of the same experiment).
The tokens could be tied to the device and Apple account by a provider like Apple, in fact you don’t need to issue tokens, only provide a web api that Apple and other browser providers support, which attests age.
This is certainly something that can be solved technically if we want.
It sounds like your scheme would only allow browsing the "adult web" on locked-down, unmodified devices running government-approved software. Frankly, that's worse than even requiring ID.
I’m just pointing out that it is in fact technically possible to lock things down. Whether we should or not is a separate discussion.
what you say which is the real thing, is the total institutionalisation of everything, the very wet dream of beurocrats everywhere, and of course done because "they have no choice", and are free to claim a pure lack of any motive or underlying agenda, and the vicious cycle of "just doing there job" enters our world, again.
I thought a solution to this would be to use a physical smartcard to store the certificate(perhaps on your government ID). if the protocol is a challenge/response and the private key never leaves the card it would make proxying without the physical card more difficult.
Yeah great idea, having to get out your government ID every time you want to use a website.
A certificate could be anonymous and the website would only need to verify it against the born_before_2008_root_cert in 2026. You could issue has many certs as you want and all would have a validity of 1 year so that websites only have to install at the maximum 2 root certs.
I know but what I mean is it's a lot of hassle just to visit something. And many devices I have like my VR headset don't have an NFC reader to validate some govt ID.
The “2008” part hit me hard
If the smart cards required some human input to perform a signature maybe this could work. Otherwise there is nothing stopping someone from selling use of their card via some proxy software
Is this type of problem even solvable?
I mean Netflix haven't managed to solve password sharing so,
We are talking about porn here. And the internet will be always full of it - and that can only be prevented by controlling all of it, or have each state have a golden firewall.
All of these solutions seem very complicated, for little benefit. So a anonymous age verification scheme, fine with me. But making it more complicatdd, because dark entities could capture and resell tokens .. seems a step in the direction of madness.
Crusades against sexually explicit material are certainly popular in some places.
But these days I see a lot more talk about the developmental effects of parasocial media on kids. There’s a whole segment of buy-in there that didn’t exist before.
I don't see where I should sacrifice my freedoms to remain anonymous on the internet or MUCH more importantly, have control over my hardware and software just because parents can't do their job
Trusted computing solves this problem handily.
> but if a minor is caught using someone's credential, then the person whose credential they are using can be investigated, and, if necessary, charged with a crime roughly equivalent to providing alcohol to a minor. Without the possibility of real world enforcement, none of these identity solutions can possibly work.
They don't work even then.
Suppose you completely eliminate privacy on the internet and require every domestic site to collect the name and social security number of everyone who visits. Then a child uses an adult's ID, regardless of whether it's with or without their knowledge. Is the child going to inform on themselves? No. Is the adult, when they don't even know about it? No. Is the adult, when they provided it on purpose? No.
That constitutes the entire set of people who would typically know that the person using the device isn't the person on the ID.
On top of that, we can punch an even bigger hole in it. Search engines, among other things, index other sites. Google is obviously the biggest but there are many others -- Bing, Marginalia, Brave, Swisscows, Yandex, Perplexity, Baidu, etc. They're run by adults and most of their users are adults, who reasonably expect to be able to turn off "safe search" if they want to. So some adult at each search engine would have to provide their ID to the crawler so it can index things inappropriate for children and show them to adult users. It would therefore be a fairly unremarkable and recurring thing to see the same ID make a zillion gigatons of requests.
But then you can't use "why is this person downloading 100 things from 100 computers at once" as an indication of anything nefarious happening, and anyone can still set up a service hosted on a foreign server that will serve adult content to anyone without an ID by serving it out of a cache. (And in the case where you're invading everyone's privacy, that service would also be very popular with adults.)
> Is the child going to inform on themselves? No. Is the adult, when they don't even know about it?
In the context of social media, if they want to actively participate they have to given that it's the entire point. It's true that even with a government ID scheme people could borrow someone's ID to get passive access with their consent. But a kid couldn't share an account with a parent without that parent knowing because you see their activity, and they also couldn't post.
Kids shred these schemes. The designers of them seem to forget that the social dynamics of the adult world are completely different - just one kid needs to figure out how to bypass the system, and the knowledge spreads like wildfire.
Example: schools banned phones, so kids switched to talking over Google docs:
https://www.theatlantic.com/technology/archive/2019/03/hotte...
If we give parents better tools to limit and monitor internet access, kids will just buy a used phone which is unregulated. If their parents even bother to use the tools in the first place (it is my impression most parents do not). There is also a lot of loopholes parents do not even think of (like a web browser on a game console).
having kids fiddle around with alternative means and schemes of communication might well turn out to be an intellectual and academic net positive.
This is where social media and other sites' endless datamining and profiling will come back to bite them. These sites already know the age range of users to a very high degree of certainty, and can continue to obtain such in an ongoing fashion. If an underage person is using these sites, it's likely going to be because the store clerk just nodded and winked, instead of because they were genuinely fooled by a borrowed or fraudulent ID. And in that case, the clerk is the one facing the penalties.
Put the burden of responsibility on the sites themselves and the number of people that will be able to successfully bypass such restrictions is going to be negligible and largely depend upon ongoing inorganic behavior or being an outlier in terms of behavior/interests.
the article also mentions; <But the government puts much of the onus on social media platforms to ensure users understand the verification process and on users to read up to make sure they aren’t being scammed.>
Unfortunately, the said-government doesn't seem to worry about the fact that their own systems have been breached over the years
> The entire point of age verification systems is to prevent minors from accessing certain resources.
Then why are they forbidding VPNs?
This is clearly NOT a use case that is solely referring to minors.
The whole cake is a lie and so is your assumption that age sniffing is "to protect children".
> Keep dreaming of a technological solution
We don't "dream" - we know what is possible and what is not.
Mass surveillance of everyone is simply not an option.
> Let individual parents decide on the level of harm that they are willing to accep
Nobody has an issue IF it were about individual parents, but it clearly is not. Governments try to criminalize and restrict everyone - and that is the true agenda.
> The entire point of age verification systems is to prevent minors from accessing certain resources. I think we all know that this is basically impossible; but what these various governments and social media companies want to do is to make it high friction to do so.
The problem is, this is wrong. What these governments want to do is get a grip on online behavior, through actions against individuals, who can't/won't defend themselves, rather than through actions against gigantic corporations that may choose litigation and take years to change their behavior, if they do at all.
Governments want to declare something illegal, say downloading a movie, putting racist comments online, ... then catch everyone who engages in that behavior online through mandatory identification, and actually have an effect.
To do this, breaking privacy is, of course, a core requirement. This can be introduced into these systems afterwards ("judge X wants to know who authenticated with token <token>, please provide the information"). Without this, government rules will remain totally ineffective online like they have been in the last 40 years.
I personally much prefer government rules remaining totally ineffective online.
> What these governments want to do
I feel strongly that this conspiratorial mind-reading approach to this sort of issue is just counterproductive.
What all the governments (and non-governments, frankly, there are many supporters of these things) are asking for is excluding minors from certain websites and services.
The problem is that this translates to age verification, which translates to identify verification, which incidentally gives states and other actors a variety of other tools they can use for anti-civil-liberties purposes.
In the end their motives are just irrelevant unless there is a clear way to exclude minors from certain services without going down the chain towards identity verification. Such a way does not exist, so we have to fight it here, at the point where the basic ask emerges.
Why can’t you just sell single use codes at gas stations/liquor stores/etc and they just check your ID before sale? Of course shady places can still sell them without ID check, but we have this problem already for liquor and tobacco.
> The highest friction version of this is that the credential ties to a real world identity somehow; maybe locked behind legal barriers, etc., but if a minor is caught using someone's credential, then the person whose credential they are using can be investigated, and, if necessary, charged with a crime roughly equivalent to providing alcohol to a minor. Without the possibility of real world enforcement, none of these identity solutions can possibly work.
Buying alcohol for a minor implies knowledge and intent.
Getting the tokens out of a phone doesn't require the user to do any of that, the user just has to be frugal and keep the phone longer than it's supported by the manufacturer, until some local exploit is found again, and that token will be extracted and available online for everyone to use.
Parents buy those phones, phones could easily have a "user is a minor" setting (and a flag sent to all the sites that want one) with a password for parents to unlock stuff if needed. This would be set during the phones first set up, and it's done. But nope, the plan is for everyone to install a form if a digital ID on their phones, and once it's there, requiring full-name identification when registering is just one step away.
>charged with a crime roughly equivalent to providing alcohol to a minor
In most countries it's perfectly legal to provide alcohol to your kids.
There is a much easier solution that already exists - parental controls on children's devices. I honestly don't understand why is it not solving the problem?
Yes, parents are responsible to set this up. But parents are also responsible to lock their alcohol, drugs or guns, condoms, etc., and many other things.
Perhaps parental controls are not good enough? That's where the regulation could genuinely help - require child-certified devices to implement minimum set of parental controls, and make them easy to use.
That's not the problem governments are solving. They're solving the problem of convincing the public it's a good idea to end the anonymity of internet use.
I know! What puzzles me is responses every such article gets even on HN - let's build some cool tech that 95% of the general population and 100% of politicians won't even understand not to mention agree to.
Yes, government want to end anonymity and that's clear to some. But governments enjoy on a pretty broad support for this and many people supporting this believe it's a real problem. Suggesting to leave it unsolved or solve it in a way they can't trust or understand is only going to alienate them, making the government job easier.
I think suggesting a simple, cheap and effective solution to this problem that has no impact on privacy is a way better way to counter that. I think local parental controls fits the bill.
People on average aren't very smart and will happily support programs objectively harmful to them and everyone else because the government and a nice lady from the breakfast TV says it's necessary to think of someone's else's children watching porn (this soundbite is gross. I don't understand how it's okay for the serious people to repeat it).
Of course it's accurate to say a lot of people aren't smart.
A lot of people also may or may not be smart but have limited knowledge of this area and limited time/effort to expend thinking about it.
I don't think you should rail against those things because they will always be true for every topic.
Instead, people who have understood the deeper implications of this, for instance the typical HN reader, need to connect with the average person, engage with rather than dismiss their child protection fears, while explaining the downsides.
Taking a high handed dismissive attitude will not help to shift public opinion.
But I'm expressing my opinion on HN, not for the general public?
I thought that stating this, I believe, fact as a contributing factor in the creeping authoritarian climate would be understood without having to attach a handful of caveats and papers?
(you're contradicting yourself)
Once again blaming the tv which barely anyone watches rather than the algorithmic feed in their pocket 24 hours a day.
It’s not 1980 any more.
Naah, "nice lady from the breakfast TV" is mostly[1] an allegory of the traditional media narrative, but you can't seriously deny the impact and importance of it?
If you deny for example Murdoch-owned media impact on the society, or the extent of the damage for example BBC did in the UK to the human rights or the discourse, I'd suggest reading more :)
[1] one TV programme I remember (I don't watch it): "Good Morning Britain is the UK's most talked about breakfast television show with a weekly audience reach of 4 million people." that's 10% of the age group 16-64 here, not too shabby-- and that's ONE tv.
> But governments enjoy on a pretty broad support for this
No they do not. They do an enormous amount of PR trying to convince people that they have it, though.
In the real world when there is a ton of support behind a position, you see representatives of it all over the place and they are pushing the agenda and the coverage. In the world of online age verification, you just see a bunch of lame duck politicians using procedure to sneak policy changes in and keep objections from being heard, and a few government contractor-surrogates writing op-eds (that they haven't read.)
When puritans go on the march, they're actually pretty loud. Most of the anti-social media people are hippy-dippy upper-middle class liberals who curse "screens," completely believed Cambridge Analytica's PR and think that Trump rules through mind control - who will be bothered by the end of anonymity; and the remainder are angry online right-wingers who think that they were censored by and as a result of social media. They're not marching together, they're not marching to have people identified when they're using the internet, neither of them are even prioritizing social media right now and they aren't putting pressure on anyone.
The fact that it's so unpopular is why there are lame ducks doing it. They're just assuring their fortunes on the way out, and the person on the way in will pretend like they had nothing to do with it even though it will be will be passed and implemented on their watch.
> No they do not. They do an enormous amount of PR trying to convince people that they have it, though.
Ok who is paying for that PR though? its not free.
its not like all the UK kids charities are for it.
> Most of the anti-social media people are hippy-dippy upper-middle class
My kids school is very much not in the posh area of london (although they are trying to make it posh) they hate what social media feeds their kids _indirectly_ As in clips and trends sent to their kids via chat or DMs.
It appears that what they want for their kids is basically a walled garden where the advert-content can't bombard their kids, along with the racist/violent stuff.
The bills are being raised and passing in more countries than just America though.
> That's not the problem governments are solving. They're solving the problem of convincing the public it's a good idea to end the anonymity of internet use.
I'm really sorry, but that's giving politicians far to much credit for being able to plan ahead.
Look at both the UK and the USA. The UK's just yeeted its PM because he had the personality of a block of cheese. The USA is currently inches away from shooting people if they mention the word green and water in DC. None of that screams "I am a master at planning ahead and manipulating public opinion in to doing x"
The politicians have no idea about how this all works, they see that "social media" is causing harm (its not the only source, we might get to that) The public, especially in the UK really do not like americanised media being forced in their faces and want "something to be done"
Again for the UK specifically the OSA specifically didn't layout a government mechanism for age verification. they left it to the end company to avoid the suggestion of tracking. Despite it being ripe for uberfraud and blackmail.
it would be much more private if ofcom had published an opensource gateway to anonymously authenticate against. (assuming the thing was built properly and verified)
But to the point you are hinting at
Google, meta, apple and $OS makers already track you. This is not an issue of privacy persay, its about who can track you and why. I'd much rather a list of times I access a site that required age verification being stored by the government, than every single fucking page I looked at tracked by google/meta.
The latter is already here.
Formally politicians may be in charge, but at this point most political power derives from within the administrative state.
> its about who can track you and why. I'd much rather a list of times I access a site that required age verification being stored by the government, than every single fucking page I looked at tracked by google/meta.
It is about what abuses can happen from that info. Google could sell your data. The government can imprison you. You don't think Trump wouldn't try to collect info on his opponents and weaponize the DOJ against them?
That's why they are still appealing to sentiment rather than established research (which actively refutes the arguments they are making).
which begs the question, In preparation for what?
Alien disclosure.
In 1953, Eisenhower signed a pact with the Zeta Reticulans (grey aliens) at Holloman Air Force Base. This pact set in motion a century-long program of preparing humanity for the alien disclosure. Communication must be controlled at a global scale, to avoid mass panic and the collapse of society when the disclosure is announced.
Precisely. The people in power would love nothing more than to stop “disinformation” (facts that cause social unrest).
Yeah. Didn't you find your dad's dirty VHS tapes when you were young? I'm sure most of us did. And we turned out fine.
And no, porn isn't more extreme these days either. I remember seeing bukkake, golden showers etc on borrowed tapes and hacked pay TV. BDSM existed back then too. And I had some pics of a girls face surrounded by male members and their output. Never once did I think this would be a normal thing to do with my girlfriend once I got one.
And these things are still gonna happen. Teens are going to go through their dad's phone when he's sleeping, find his stack of Blu-ray's or vids on this computer. Even with all this age verification stuff. I don't understand why we suddenly think that's the end of civilization.
> Yeah. Didn't you find your dad's dirty VHS tapes when you were young? I'm sure most of us did. And we turned out fine.
Were they delivered to you in truckload volumes every day, including tapes recording executions, child molestation, foreign political propaganda, domestic political propaganda and misleading advertisements?
Every day, any day, unlimited quantities? Including giving your phone number to any strangers anywhere in the world so they can talk to you without limits, supervision or even parental knowledge?
No?
Then let's perhaps stop pretending that millenial internet free childhood is a thing that exists and let's talk about actual modern issues.
> I don't understand why we suddenly think that's the end of civilization.
Because they've been told to think it by the combined forces of Meta and the Heritage Project. They spelled it all out in Project 2025, a check list which has been followed nearly to the letter. They're also rampaging through libraries and trying to keep books of the shelves.
Conservatives don't like porn, because controlling sexuality is part of the cult playbook to control people. (Addendum: they don't like other people having it. They're hypocrites, of course.) They also want to, while instituting a backdoor ban on porn, define everything else they don't like as pornography. Project 2025 repeatedly uses the term "pornographic" as a synonym for for LGBT issues and other things.
The goal, after de-anonymizing the Internet, is specifically to control access to information and entrench their fascist Overton window shift.
They're really sore that many Millennials and Gen Z had the internet as an escape hatch from local, abusive churchy bubbles and want that locked down going forward.
Haha a backdoor ban, I see what you did there ;)
And yes that usage of the law by linking LGBT content to porn is something I've seen in Europe like in Hungary too. But even in the Netherlands, one of my friends is always foaming at the mouth about schools mentioning lgbt in sex ed class. When it's the most important time to prevent people needlessly struggling with their orientation.
Luckily where I live this isn't a thing and it's still very pro lgbt. The city always makes a huge deal about pride month with posters and events everywhere.
I do worry about the control over the internet too. And I've seen it coming for a while. When I was younger there was this WAN movement where people connected their WiFi networks together with parabolic dishes and the government was always trying to prevent and discredit that saying it was used for illegal file sharing (which it was but so is/was the internet).
I'm not so worried for myself because I'm so technical, whatever restrictions they come up with I can work around them. But most people aren't that lucky.
I was thinking that some kind of permanent physical attachment with passive electronics could be given to children, like an ankle bracelet used for home curfew, monkey's headband, a dogs shock collar, or just a nice bracelet, call it MoB, which couldn't be removed until they are of age. Devices they are given could be associated with those devices and not usable without them, if they disappear from passive scanning then they have been tin-foiled, etc etc. I've not seen any discussion of this type of approach which gives children something to aim for - freedom, and tallies with human historical culture as well.
My God, what a horrific and evil idea
They very much aren't good enough yet. I'm a highly technical user and have had to move to using MDM tools to actually have something that works reliably.
I think their point is to protect kids who have parents so tech illiterate they do not know how to manage parental controls.
Having seen some parents I kind of believe it but not to the point of wanting to implement ID tracking on everything.
Have decent defaults. “Is this phone for a child” and “scan this wr from parents phone”. 90% of problems solved.
That said while Apple does a good job at parental controls, Microsoft is altered. Trying to have controls on Minecraft across a windows laptop and a switch involved a multi hour odyssey, creating tons of accounts for parent and child.
Or, just incentivize or mandate stores to sell "child-certified" phones with parental controls pre-configured (along with a physical plug-and-play usb key for parents disable them when the child is old enough).
People aggressively attacked the proposal of California to add parental controls into OSes, so I'm not sure if that would fly.
You've got to be really on the margin of society to not be able to set it up when every grandma and her dog use smartphones. There're about 1000 different ways to improve the lives of such people without making everyone use their government ID when scrolling Instagram.
I consider myself fairly tech literate and parental controls are incredibly hard to use correctly. I ended up just setting up an android phone with an MDM, because as someone with a sysadmin background it was far easier for me than anything I could find targeted at parents.
The local school district has been issuing iPads to kids for about a decade, and they still haven't figured out how to block exactly what they want blocked. The system they give parents for monitoring the iPads is a joke (Apparently my kid spent 75% of his iPad time the last week of school on sites categorized as "web").
I am a member of FIRE, I am extremely opposed to the mandatory ID laws, but the state of parental controls is phenomenally bad and saying you have to be "on the margin of society" to not be able to set it up is so far from my experience that I couldn't help but to respond to this comment.
I'm not sure what the solution is; a lot of people have suggested requiring sites to send categories (e.g. if every social media site was self-tagged, then blocking social media could be just a single check box in parental controls), but that probably isn't constitutional in the US (Compelled speech is usually banned under 1A grounds), and is subject to too much interpretation (seems unlikely that all 50 states would agree on a definition of "social media" much less "pornography").
Having devices send the age out to sites seems strictly better than ID checks to me, but is still a "one size fits all" approach to parental controls, I worry that if that became the norm the already mediocre controls that exist would atrophy, and it certainly would make it easier for malicious actors to setup a website to target minors.
Why would you want to lock condoms?
Have you missed the recent moral panic about the declining birth rates of white children? Brought to you by the same people who hate pronouns [0], trans people, and/or covid vaccines. In such a world, condoms will be required for non-whites (or race mixing relationships) and forbidden to aryan/white couples.
Notes:
0 - For an example of using 2 pronouns in one sentence: "I am he".
https://www.biblegateway.com/passage/?search=John%2018%3A6-8...
I am he
As you are he
As you are me
And we are all together
There is a bootlegger and baptist thing going on here. One understandable point of view is that of parents that control their kids' phones, but other parents in the community do not. Then their kids are the only ones in the class without tiktok or Instagram or something.
For those parents life is easier if nobody is allowed on these things.
> For those parents life is easier if nobody is allowed on these things.
Get over it, and stop caring how other people parent their kids. Or, better yet, learn from them.
I don't understand why the act of buying internet access isn't considered a parental control. I doubt very many kids are doing it or can.
Ok, but parents buy internet access and then let their kids use it, because the kids need it for school. So? The parents job is to keep their kids out of trouble. Learning how to keep track of what their kids access shouldn't be difficult, and maybe should be part of the obligation parents have, kind of like their obligated to teach their kids to drive before giving them the keys to a car. Its analogious to saying "kids shouldn't walk home from school or be let out of the house at all because they might wander into a nude beach or join a drug smuggling satanic cult". Most of us don't hold that view because we trust that kids can be taught to be vaguely responsible.
What's more: tools to shield the kids have been around for longer than most of the parents have been alive at this point. The problem is pretty much solved in multiple ways, and wouldn't even be a problem if parents only followed their basic responsiblities. Also it isn't a problem in the first place, I haven't seen any clear, undisputed evidence that shows that kids are degenerating into fiends because of looking at adult stuff on the internet.
> The parents job is to keep their kids out of trouble. Learning how to keep track of what their kids access shouldn't be difficult
Unfortunately it is, but we could fix that with only minimally invasive legislation. Right now you either whitelist which breaks half the internet on a recurring basis (things are constantly changing) or you blacklist which is swiss cheese. Either way you're relying on third parties.
I think it would be much better to legally mandate a certain minimum level of self classification for website operators along with a simple and extensible scheme for communicating such. It might also be useful to mandate that devices ship from the OEM with parental control software supporting that standard but honestly I doubt that's necessary - if their were a standardized and above all reliable signal available I think browsers and operating systems would rapidly adopt support for it.
Exactly! We already have content tags on TV/Movies, just extend it to the web and make mandatory.
I imagine it could be not trivial to enforce (esp. for offshore web) - but definitely easier than enforcing the same sites to implement much more complicated identity verification (while preferably also not leaking this data).
But that might not even be necessary. A small on-device AI can probably do a decent job classifying pretty much everything we don't want children to see - with and option for parents to override it when needed.
> I imagine it could be not trivial to enforce (esp. for offshore web)
It's quite trivial, actually - the parental control software is designed so that if there are no content tags, then the site does not display. The mandate for websites to tag their content would only need to apply to websites over a certain size, to bootstrap the network effects.
The other option is for the major browsers to refuse to load pages that don't include the tag. I don't think it's a good thing that they can unilaterally dictate web standards but that's the reality so might as well take advantage of it for the better I guess.
I think that's the same option? I'm imagining "parental controls software" as something built into browsers (/ app stores) that can be enabled when you're setting up a new device. Or it can be disabled, meaning no tags would be required, leaving the open web unaffected.
Given that we're at the point where big tech is pushing its regulatory capture legislation aimed at demanding mandatory identification ("age verification" fundamentally boils down to identity verification), I don't think it would be unreasonable for a legislative mandate for every site over a certain size to have to publish tags, and every mobile device manufacturer over a certain marketshare to have to include a parental control solution in the device setup.
Although I'm also left wondering what the state of the art really does look like here, and whether a mandate for tags is even what is needed. The real problems would seem to be twofold - parental controls software isn't included with most devices, and most parents won't go out of their way to seek out a third party option. And second, very few websites aim to serve people under 18, 13, etc to begin with. Rather they like the fiction that their services are "18+" regardless of who is using them. (Mandating tags would serve that last one, but perhaps there is a more direct approach?)
> I think that's the same option?
Not quite. I'm suggesting that adoption could be forced if the major browsers refused to load sites that didn't include the tags regardless of whether or not parental controls were enabled. The end result would be that either your site included the tags or else it would not load without some sort of manual user intervention on every visit on windows, ios, etc.
> leaving the open web unaffected
But the entire point here is that there would be a legal mandate for all sites to carry such tags. The goal is to fix the problem that parental controls are spotty and unreliable at best.
> The real problems would seem to be twofold
It's as I previously explained. None of the current options are particularly good even if you are a parent that cares and is willing to invest time and effort.
> they like the fiction that their services are "18+" regardless of who is using them.
That's due to not wanting the liability of a mishmash of laws from different jurisdictions. Nearly all of them treat an 18 year old as an adult so problem solved.
That's entirely separate from these tags BTW. The idea isn't for the site to communicate some arbitrary age appropriateness signal that they as a third party to the family couldn't possibly know. Rather it's to communicate classes of content such as porn, gambling, violence, social media, user generated content, games, that sort of thing.
> But the entire point here is that there would be a legal mandate for all sites to carry such tags.
My point is that you don't even need to mandate it for all sites, and attempting to do is kind of specious based on the existence of foreign sites. Rather you can focus on mandating it for the large consumer-oriented sites, and this will create enough of a critical mass that a web browser with parental controls enabled will have decent functionality.
The difficulty with forcing some uniform mandate onto "all sites" is that the mandate has to be for tags that are faithfully stated, rather than a blanket 18+. And small personal website operators shouldn't be in the position of being forced to determine whether the random stuff on their personal website is specifically suitable for 13+, 18+, etc.
That's the goal of defining the semantics in terms of an open system rather than a closed system - it fails gracefully.
> None of the current options are particularly good even if you are a parent that cares and is willing to invest time and effort.
Pragmatically this is disappointing to hear, but matches everything I've been able to surmise.
> The idea isn't for the site to communicate some arbitrary age appropriateness signal that they as a third party to the family couldn't possibly know. Rather it's to communicate classes of content such as porn, gambling, violence, social media, user generated content, games, that sort of thing.
I think it should be both. There should be a class of tags that assert a site is legally fine for a 13 year old to view in the US, an 8 year old to view in the US, etc, possibly multiplied with jurisdiction. (note the direction there - it's not a statement that there is content unsuitable for a 13 year old, rather it's a warranty that the contents are suitable for a 13 year old). There should also be tags of the content/aim of the site like you've listed.
The settings in the parental control software can then make a good first pass based on age, then content categories, then parents could even allow/disallow specific sites. The point is to provide good defaults, but ultimately keep control of parents rather than giving it away to corporate attorneys as any age verification (ie identity verification) based solution inherently does.
The problem with this idea is that it assumes responsible parents, which are not a given. I agree with you completely - I don't want any kind of controls on the Internet - but we live in a world where we cannot actually rely on parents to fulfill what you would consider to be basic and reasonable expectations of parental duties.
For kids with parents like that, the internet is probably the least of their problems.
They certainly have other problems however the internet is unique in that it drops the entire world directly in your living room. Even with irresponsible parents zoning laws keep most children away from things like casinos and strip clubs (at least until they can drive) and everyone benefits from community efforts to keep the neighborhood safe.
Exactly. Might be the only place they have a semblance of home.
>The parents job is to keep their kids out of trouble.
I challenge that anyone believes this, and for my evidence, I would submit all the age based laws that protect children regardless of what parents do.
We have already, long ago, decided that it is the government's job to protect children, at least in cases where parents fail to do an adequate job. That's why I don't see this ending any other way. The march to total domination by the side of the government might be slow, but they already won the war around a century ago (exact timeline for laws protecting children in place of parents is a very long topic and does differ country to country, I recall hearing some places still even let kids buy alcohol if they say it is for their parents to consume).
...parents are also responsible to lock their alcohol, drugs or guns...
No they're not - all those things are illegal for children nearly everywhere.
Children can buy their own devices. School issued devices are not under parent control. Parental controls and school controls are laughable. There is no incentive for OS vendors/retailers to provide robust solutions to this problem. PII industry is essentially pushing regulatory capture.
I wouldn't trust governments, today or in the future, to keep such a system private and I don't see a foolproof way of building some kind of audit mechanism into it to make sure the data is always truely private.
I've also always been curious how a truely anonymous identity verification could possibly work. At best for age verification, I could be given some kind of token that would still have to verify my age and be verifiable with a central authority to ensure my token is valid. The central authority could always keeper records of my token, revoke it whenever they please, and every entity that can verify the age associated with, or embedded into, the token knows at least some of my PII.
> I've also always been curious how a truely anonymous identity verification could possibly work.
You go to a store. You show the clerk your id and give him a quarter. The clerk pulls a scratch-off ticket from the front of a ticket tape. The ticket contains a token identifier.
It's anonymous. The clerk or his POS system knows your name and age, but doesn't know your number. The vendor providing the tape doesn't know your number or your name. The system accepting the token knows your number, but doesn't know your name. The token is only valid for a day after use, so loss and transfer isn't much of an issue.
It's the exact same process by which you buy lottery tickets in a world where they don't need to verify your identity when you redeem them. The lottery has no idea who bought a particular ticket, only that a ticket was bought. The clerk knows you bought a ticket, but doesn't know which ticket.
Obviously, Eavesdropping Eve looking over your shoulder knows both your name and your ticket number, but that's not a practical attack.
> It's anonymous. The clerk or his POS system knows your name and age, but doesn't know your number. The vendor providing the tape doesn't know your number or your name.
Where does this 3rd party identity token provider come from?
For government-issued identity tokens, there are not separate parties. It's just the government, and they can choose to link whatever they want in their internal system if they decide it's in the interests of national security.
You're also forgetting that lottery tickets are tracked. This is how they can announce which store sold the winning ticket before anyone steps forward with it. It would be trivial to match a buyer to the ticket if they wanted to inspect the records. In the case of a government identity token service, there isn't even a separation of parties providing the records. They do it all and can have all the data.
> Where does this 3rd party identity token provider come from?
Some oracle whose job it is to print tokens and hand out rolls to the stores (and to the websystems). They would know which store got which roll, and which website authenticated it, but not who each ticket from that roll went to.
With a big enough roll, this is essentially anonymous.
Yes, lotteries know which store got the winning ticket, but they have no idea which of the patrons in the store got it. Not unless they ask Eve to get her telescopic lens and notepad out.
I'm talking about identity token services.
You're saying the real solution is that we bring in a private, 3rd-party company to start checking our IDs to access websites now?
It’s millions of third party companies checking ids. Anywhere that sells alcohol or tobacco could do it.
I was asked if this problem can be solved in an anonymous manner. I gave a solution that is pretty anonymous and fairly cheap.
I am not actually advocating for it. I'm just saying how it's possible to solve it given those constraints.
> It's the exact same process by which you buy lottery tickets in a world where they don't need to verify your identity when you redeem them.
I’ve sold lottery tickets, and you have to be legal age to both buy and redeem them, so I’m not sure that this analogy or hypothetical solution is comparable to lottery tickets, nor is it likely to be the panacea you think it is.
I don’t think that the nascent online age verification schemes are good for society in general, either, but that’s not really the point you were making in your comment, so I don’t assume that you believe they’re good or bad, but simply advocating for a more privacy-preserving implementation. Which is kind of the whole point of the argument against bad implementations, but those who mandate and implement the systems likely view uniquely identifying people as a boon, whereas you and I probably don’t, which is why I am not hopeful that your ticket system will be used, because it will be higher friction for more people than uploading scans of their IDs and/or their face.
The ticket system, if implemented, would be used by so few people that the folks who do could likely be re-identified by Bluetooth tracking beacons and facial recognition in the same stores which they bought the ID tickets you suggest, and so I think the number of people who would escape tracking by any such means to be so few as to be a rounding error.
Those folks who do pursue this privacy hobby/fetish are statistically likely to ultimately mess up on their opsec eventually on a long enough timeline, so it’s hard to even imagine a scenario in which it matters either way what individual privacy activists do or don’t do from the point of view of the panopticon designers or implementers. Those not identified to a desired confidence interval by the mass surveillance system will just be retargeted for more sophisticated surveillance measures.
Despite how we rage, we’re still just rats in a cage.
More and more, the privacy debate feels like a quixotic struggle against giants, when everyone already knows that those giants are actually windmills; the majority of society now lives on reclaimed lands which rely on those windmills’ continued existence, and so no one cares about privacy in the way that you or I might care, because they are incapable of perceiving windmills as giants, nor do they have the intellectual or philosophical or political beliefs which would allow them to even entertain such perceptions even for the purposes of discussion. The privacy debate is beyond their ken.
> It's anonymous. The clerk or his POS system knows your name and age, but doesn't know your number.
What prevents a commercial "AI" security camera analysis firm from doing a decent job of linking footage of a store's customers to a likely subset of tokens, based on the knowledge of which tokens are sent to which store and how many tokens have been pulled off of the roll so far? Remember that you can design the token roll packaging so the easiest thing for a clerk to do is to pull off the rolls in the order in which they were shipped. Or -hell- you can design the token dispenser so that it phones home to the oracle that sent the roll to the store with the range of tokens in the roll when the roll is loaded into the dispenser (for "security purposes").
> It's the exact same process by which you buy lottery tickets in a world where they don't need to verify your identity when you redeem them.
I've seen many people buy lotto tickets. I've never seen anyone asked for ID. Perhaps the merchant is supposed to check for ID, but they don't. Relatedly:
> The clerk pulls a scratch-off ticket from the front of a ticket tape. The ticket contains a token identifier.
What prevents rolls of those tickets from falling off of a truck and either being handed out for free or at a substantial markup, no questions asked? [0]
In the real world, the system you propose absolutely will not function to the standards required by the people agitating for these systems. You can't "protect the children" if "children" can easily get their hands on anonymous access-granting tokens.
[0] The fact that this doesn't happen with lotto tickets often enough to be newsworthy is not a compelling counterexample. Stores make a decent amount of money selling those, and wouldn't want to get cut off from that revenue source by regularly "losing" shipments of tickets. What you propose doesn't make stores any money, so either you have to spend a bunch of money to induce them to carry the tokens [1], or you have to have harsh penalties for "losing" shipments of tokens. If you risk harsh penalties for choosing to sell the tokens, why even bother? Stores put up with the risk of selling booze because it's quite profitable... selling 5c or 0c tokens absolutely is not.
[1] Where does that money come from? From you and me, of course!
I’ve worked in the industry, so just adding some extra info, as I agree with you that the ticket system is not really less tracked than other systems, just differently tracked:
Lottery tickets don’t “fall off of trucks” or get “lost in the mail” because they aren’t valid for redemption until they’re activated at the POS terminal of a licensed store, and the lottery company knows which store receives each ticket roll, because they are shipped to known locations with tracking numbers and delivery verification and/or delivered in person by lottery employees. Even the rolls of blank lottery ticket receipt paper have different serial numbers every few inches, and it’s forbidden by policy to swap receipt paper between stores. All of these things are audited both regularly and randomly by state lottery officials.
> Lottery tickets don’t “fall off of trucks” or get “lost in the mail” because...
Oh yeah, true. A few minutes after I posted the comment, it occurred to me that lotto tickets always get scanned at the register, which is the obvious way to track their distribution and make it annoying to use a whole bunch of winning ones that fell off of a truck. Thanks for the first-hand industry info.
If it's effective, all that tracking and auditing can't be cheap. The lotto gets to pay for it with ticket sales... I don't expect folks would tolerate paying for that [0] for this "I'm an adult" token-distribution system.
[0] ...whether that payment is paid by the token purchaser or by the taxpayers, generally...
The scan at the time of purchase is just for tracking what the store owes to the state for the lottery system. The last ticket in each roll of tickets is scanned by the dedicated lottery terminal prior to being placed for sale in an admin mode activation function. The terminals themselves I am familiar with are Linux-based and seem to be thin clients which do everything remotely in real-time, because nothing works if the terminal is offline, from activation to redemption of tickets to win/loss checking. The terminal has its own dedicated wired Ethernet connection to a stand-alone Cradlepoint or other competitor brand cellular modem/router, which along with the terminal is all outsourced to a third party management company. (SGI is the only one I’m familiar with; there are likely others.) All of this is public info which could be gleaned from observing the terminals and their installation/operation, but I probably can’t say much more about them, but they are pretty neat and seem to work fairly reliably.
Now that you mention the auditing etc, a lottery system would probably be an easy way to get people to literally buy into an online ID scheme, not because it would necessarily be privacy-preserving, which would depend on implementation details, but because a not insignificant number of folks seem to like the chance to win money. Considering many states already have lottery systems, the ID code tickets could probably be provided alongside lottery tickets for free or nearly free, and employees already have the training to check/scan IDs. If there was an incentive such as the possibility to get discounts, win prizes, or tie-in purchases of some kind, I think it could work.
Many stores that sell lottery tickets also sell gift cards, so that technology could also be used instead or in addition to ID tokens at the point of sale. There are a lot of sponsorship opportunities available for cross-promotion.
“Please drink a verification can” was probably more prescient than was at first apparent. Mike Judge saw this whole thing coming from a mile away.
You can also just follow people around and look in their windows. Nothing prevents that other than laws and rules and social norms.
> In the real world, the system you propose absolutely will not function to the standards required by the people agitating for these systems. You can't "protect the children" if "children" can easily get their hands on anonymous access-granting tokens.
What stops children from paying someone to buy beer and cigs for them? What's the difference between age-controlled liquor and an age-controlled token falling off the back of a truck?
You can introduce as many soft-verification systems as you want to tweak this. The roll of numbers doesn't become active unless installed in a dispenser that phones home when it is installed, for example. The empty bobbins containing the roll have to be returned to the oracle, and need to register installation in a dispenser. The dispenser can even count each dispensed ticket. The only requirement is that the sale and the process of paying for the sale isn't linked to the ticket. If you maintain that, the system is anonymous. If you break it, it's not.
> What stops children from paying someone to buy beer and cigs for them?
I preempted this line of questioning. I'll quote the section for you:
No business is going to risk any part of their business by selling seriously-age-restricted goods that they get essentially no profit from. In order to get a business to deal in them, either they will give zero shits about who gets the tokens (because there's no penalty for not caring), or they will get paid a lot of taxpayer money in order to make up for the state-imposed loss when they inevitably give some to under-eighteens. [0]> The only requirement is that the sale and the process of paying for the sale isn't linked to the ticket.
Unless you make it turbo-illegal to link those pieces of information (even weakly), then those two pieces of information will be linked lickety-split. As aspenmaver mentions, lotto tickets are activated at time of sale by phoning home to -I assume- the issuer of the ticket, providing a ready-made mechanism to correlate which tickets are sold to which person. When the people who are crying to protect the under-eighteen from the "evils" of computing notice that under-eighteens are -shock! outrage!- still exposed to that "evil" despite this token-distribution scheme, they will demand any such laws be weakened or eliminated.
[0] ...or fail to strictly follow all of the regs when giving one to a "Token Commission" officer doing an undercover buy, as absolutely happens with alcohol sales...
In a world where ubiquitous ID verification is required, you can just, like, mandate that stores with liquor licenses sell them. If they want to keep their licenses, that is.
A simple law against linking those two pieces of information would be sufficient. Sure, someone like the NSA wouldn't give two shits about what's legal, but they also wouldn't have the means to clandestinely get the necessary hardware installed in every one of the million stores that exist in the country.
You go to the store. You give the clerk many quarters, and get the maximum number of tickets. You go online and sell the lot, perhaps for $20. Since the system preserves privacy, doing this carries no risk for you.
Eventually this becomes common knowledge and "something must be done". Facebook (the corpo sponsoring these age verification laws to absolve their own liability) and their ilk decide that the token system no longer meaningfully proves age. They switch to demanding full government ID in cleartext, as there is still no comprehensive privacy law that would prevent such a thing.
Every single approach that puts the onus on the company to verify age falls apart this way, possibly including a de facto mandate for remote attestation (ie say good bye to libre operating systems and browsers that aren't MSIE, Safari, or Chrome). The only workable systems are ones in which the onus remains on parents giving their kids networked computing devices to enable parental controls and/or otherwise monitor their kids' usage, with those parental controls based on information flowing strictly from the website to the user agent (eg a content tag that asserts "this page is suitable for kids").
(and I say this as a parent who is staring down having to deal with this problem in a short year or two)
>Modern versions of this technique allow one to associate metadata (like a proof of age exceeding a threshold) in such a way that the verifier can't even correlate repeated requests across users.
If it's unlinkable, what's preventing someone from setting up a site that hands out anonymous tokens for anyone to use?
Using cryptographic signatures from approved signers, like a government
No, I'm meant me, using my 18+ ID to generate a bunch of tokens that can't be linked back to me, and then giving it to random < 18 year olds for the lulz.
There are multiple approaches. One, which the Europeans use, hardware-locks the token. Each age attestation is unlinkable, but the cryptographic credentials you need to make the attestation aren't portable. Of course, this model requires a big statist apparatus that does implementation certification, but it does achieve the narrow goal of unlinkable, privacy-preserving age attestation that doesn't instantly decay to mass copying.
Other approaches are possible. I'm particularly keen on ones that treat attestations as anonymous digital currency and use cryptographic penalties like slashing to discourage copying post-hoc instead of relying on EU-style implementation certification.
There's a huge literature on the subject I don't want to reproduce here. The point is that yes, we do have the technology to do attestation without sacrificing privacy, which makes all the calls for non-privacy-preserving attestation awfully curious.
> One, which the Europeans use, hardware-locks the token.
I'm surprised anyone considers this viable.
It would limit access to those sites to a limited set of acceptable devices and operating systems.
I couldn't use my laptop, desktop, or a jailbroken phone.
Exactly. And the funny thing is that the EU Age Verification App seems to be vulnerable to relay attacks anyway.
> as anonymous digital currency and use cryptographic penalties like slashing
Or make it so that tokens cannot be tested except by spending/burning them, which would significantly reduce (but not eliminate) a black market because it would be hard for any buyers to trust any sellers.
The best outcome here is going to rest on getting people to agree that "good enough" is the best outcome. We want a system that gets the broad social results (e.g. less brain-rot in the kids) without being so impossibly strict and overbuilt that it leads to an even-worse problem (e.g. authoritarian hellhole tools.)
Yes "good enough" is right. At least until the issue become important enough to seek a full proof method.
I'm not familiar with this, but what your describing sounds similar to the hardware DRM keys used for protecting 4K streams from being downloaded from Netflix.
If so, this stuff is already broken, and imagine it would be pretty simple to apply the same principles here.
I'm probably wrong on this though I'm out of my depth
The verification service would tie the token to the IP address/geolocation. It would also throttle the number of identifications, or expire old ones.
Yes, that can eventually be worked around, but not really that different than doing the verification today on someone else's device.
> The verification service would tie the token to the IP address
So I'm constantly grabbing new tokens from the government every time I go from work WiFi to my cellular internet to the train WiFi and then home?
Sounds like a fantastic point for capturing more tracking data.
> /geolocation.
Which means I have to send my geolocation data to apps to confirm I can use my token?
Don't want that either.
> It would also throttle the number of identifications,
And if I move around too much in one day or change networks too often, I'm unable to log into anything until tomorrow?
> Which means I have to send my geolocation data to apps to confirm I can use my token?
No, you don't need to send it there.
> So I'm constantly grabbing new tokens from the government every time ...
Every time you set up an account, would generally be the idea. So relatively infrequently.
>The verification service would tie the token to the IP address/geolocation
"Use this exact tor/vpn server"
>It would also throttle the number of identifications
So I can only wank off 5 times a day, or grant access to porn sites for 5 kids?
What's to stop you, using your 18+ ID from buying crates of alcohol and giving it to random < 18 year olds for the lulz?
Because those <18 year olds will immediately flip and identify you to the cops to try to lighten their punishment.
The anonymous crypto token scheme does not have any trace-back mechanism like this at all. If there's no way to track those tokens back to you, why not sell them for $1 each on the internet to make some extra money?
For one, I have to do it in meatspace so it's easily traced back to me, whereas anonymous tokens can't be traced back to me by design.
The minute this scheme went into place, there would be sites based in one of the "stans" selling tokens for a couple bucks to whomever wanted to buy.
Yes, this breaks the whole scheme. Anyone promoting it as a solution is delusional. There's a triangle of "robust", "private", and "practical" and you can only pick two. This one omits robust. The various mitigations people might suggest in response will have to sacrifice one of the other dimensions.
I've noticed that tech people will respond to an encroachment on civil rights with a technological alternative. I think this is a mistake, because the excuse is presented in bad faith, and to present an alternative is to accept their framing. The correct response is something to the effect of "I know what you're trying to do, fuck off."
As you say, it's doubtful governments want it to be private. So we should expect them to not use these kind of elegant solutions, and the public is generally not sophisticated enough to distinguish between the options already.
In what direction do the incentives point?
There's two strong incentives - deanonymization for law enforcement is pretty useful so that's one. You want to make it easier to subpoena information about posters for various reasons, access to stores on different dates etc. Lots of reasons for that.
And you want to satisfy voters who are worried about children online or have heard scary things about anonymous criminals. You want to be seen to do something about those.
A distant third is that you want the system to be cheap and built up fast and relatively easy so voters don't complain about it.
All together this leads you to something like "any time a site needs to verify your age (based on this broad list of requirements) put in your government ID number / picture". The infrastructure already exists for that, banks need it, social media needs it, and the current president has agitated for it a few times now. If you're really aiming high you set up some digital ID attached to it that's easier for the users.
>There's two strong incentives - deanonymization for law enforcement is pretty useful so that's one.
When you say it like that it sounds less scary than "deanoymization so the government can track down people saying things it doesn't like." Let's not forget the UK has more people in jail for things they said on the internet than Russia and China put together.
Yeah the wording is a little broad, but the UK would call that law enforcement too.
Depends on your state and laws and you can look around at how that's going - maybe you'll have brought a first aid kit to the wrong event or helped print some zines and they want to check up on you now.
God, that sentence didn’t pass the sniff test, so I checked:
https://pa.media/blogs/fact-check/fact-check-international-d...
Don’t think that the claim stands up to scrutiny, since its comparing unlike things.
Reading your link, "comparing unlike things" looks like spin to me. "It's different when we do it."
But comrade in the UK you can also criticize the government, as long as it's the russian government.
>In what direction
Checkpoint Charlie directly ahead, not that far down the road.
If you venture into No Man's Land you could be shot on sight.
For who?
I don't think they are serious about privacy and even if they were I don't even want to distinguish between "children" and "adults" on the internet. Things seem to have worked fine up to this point, there doesn't appear to be a public demand for age verification, rather some murky corporations/NGOs/agencies pushing for this. I think it's pretty clear there is some other intention besides protecting children that is the goal here.
they want to isolate gay and trans children from other gay and trans people. don't you know, there's social contagion afoot, but if we protect y^Wour children from this inherently sexual (and thus adult) content, we can prevent it. this is enough to make me oppose age verification wholesale. I don't care if there's fancy ZKPs, it's still going to be used to isolate and harm hundreds of thousands of vulnerable trans kids, who are already experiencing astronomically elevated suicide rates over the past few years. they don't need more of this.
We should only need to distinguish devices with parental controls turned on from other devices, and rely on parents to set up the devices accordingly.
EU is (trying at least) go in that direction with Zero Knowledge Proof:
https://ageverification.dev/Technical%20Specification/archit...
The problem is that you still have to trust something you don't control and can't verify that the technological solutions are correctly implemented and applied.
Zero Knowledge Proofs are worthless for this.
Either they validate so little information that a single homeless person can authenticate the entire country or they validate so much information as to not have a significant privacy guarantee.
There is no in-between for ZKP validating someone's age.
worthless is too strong.
the truth is that the two extremes you listed can be titrated.
if you use nullifiers you can trade some privacy for some security. basically you convert your true identity into a private token which you can use to authenticate aspects of yourself, the price being that the token can be tracked with some effort across services. better than just using your identity at least. if a token/nullifier is abused it can be revoked and then you have to jump through a bunch of hoops to get another.
there are some other trade offs that can be made.
Okay - so you verify age and what else?
What combination of details can you validate on that is meaningfully privacy-preserving and couldn't result in wide-spread re-use of tokens?
Additionally - what would prevent some kids from getting a homeless man in the city to hand them his ID, get a facial scan, and everything else you can think of to generate a token and then pass that token around?
ZKP are a cryptography-nerd's joy but are are categorically unsuitable for the purpose of age verification. I stand by this without the slightest reservation.
In Italy every citizen has an electronic ID card that contains a private key and can sign challenges. It also has state-signed credentials/certificates that bind the public key to info about the citizen (date of birth etc).
You can do this: when you want to log into a service, the service provider gives you a fresh challenge C, bound to that service/session. You sign the challenge, and then generate a zkp of the fact that:
1. you have the signed challenge C with a certain public key P 2. you have a state-signed credential/certificate that binds P with a person with birth date BD 3. current date - BD > 18 years 4. optionally, you derived a per-service nullifier, e.g. from the card/credential secret, the service origin and a time bucket, so the service can rate-limit abuse without getting a global cross-site identifier
You send the proof to the service provider, that verifies it, and learns nothing about you (except for the fact that you're of age).
An adult can of course give away the card/PIN, but you need to have it physically to sign fresh challenges, so it cannot be passed around as easily as a bearer token. Moreover he loses access to his actual ID, which is required for other services.
the same thing that prevents them from doing reuse right now: platform detection mechanisms. the difference is that right now the identity of the subject is known whereas with ZKP (nullifier approach) only the dirty token is known and where that token was used.
So....what exactly would platform detection mechanisms be basing their decisions off of that wouldn't defeat the entire privacy-preserving premise of ZKP?
multiple use of the same token on multiple accounts...?
tying multiple accounts and services together isn't ideal but its inarguably better than tying your real world identity to every single service.
Wait - so you're advocating for use of a persistent identifier tied to a person? How is that any different than what advertising networks do right now beyond giving them additional guaranteed information of your age bracket?
To clarify - it's not cryptographically necessary to present the same token for each and every transaction and serves to categorically defeat the entire privacy guarantee of ZKP.
It also makes it trivial to associate your ZKP token with your real identity.
contrast this with the situation as it currently is (under ideal assumptions) where a central authority verifies your real identity and issues temporary rate limited tokens which are then saved by each service and can at any time be linked to you whenever the central authority can get the service to disclose the database entry. the nullifier will force the central authority to do an investigation about who the nullifier actually belongs to which may actually fail.
realistically I expect VPNs and Tor to just become more popular in response to such nonsense. I wouldn't be using government issued tokens for anything that isn't trivial to tie to your identity already: such as a personal bank access.
> at the terminus, yes. there is no other way to avoid the homeless problem you listed. by terminus I am referring to where a central authority vouches for unforgability. this does not mean advertisers will have a token they can use (see remote attestation infrastructure).
Where to even begin here....
To generate the token, it needs to be based on specific data. How do you prevent people from generating tokens based on fake data and submitting that to the "terminus" that you mention? We already have cases of people bypassing facial scan liveliness checks for banks using AI-generated footage.
What about validating tokens during the token enrollment process based on your government ID? Though that makes sure that poor or undereducated people who don't have such an ID are locked out of large swaths of Internet services.
Though there's also the matter of it being trivial to generate fake IDs using AI.
If you have no gatekeeping for the token enrollment process, anyone can submit an arbitrary number of new tokens.
And if you do have gatekeeping, you're right back to square one of needing to validate against more than just your age.
After all - the cryptography algorithms will be publicly known. If the only thing ZKP is validating against is age, it won't take long to figure out how to generate identifiers based on fabricated information.
> whether or not the terminus can tie a token to a real world identity will depend on how careless the user was and how much collusion there is between the terminus and the services. at the very least it will impose an investigation cost.
No it won't. A user submits a token to a server. The user also logs in with their e-mail address or phone number. Their email and/or phone number is hashed and it, along with the ZKP token and any additional information the website has on you, will be sent to data brokers.
This is the same as any other bit of information out there that data brokers collect on the internet. They just associate your new info with other info you are required to provide in order to use various services.
This will be automated and will cost next to nothing for data brokers to take advantage of.
> contrast this with the situation as it currently is (under ideal assumptions) where a central authority verifies your real identity and issues temporary rate limited tokens which are then saved by each service and can at any time be linked to you whenever the central authority can get the service to disclose the database entry. the nullifier will force the central authority to do an investigation about who the nullifier actually belongs to which may actually fail.
....what? What investigation by central authorities? You are talking of a system that would constantly mediate permissions for billions upon billions upon billions of devices across dozens of services and accounts per device.
You couldn't hire an army of people large enough to handle this and AI is infamously awful at detecting when a given image has been generated with AI.
> realistically I expect VPNs and Tor to just become more popular in response to such nonsense. I wouldn't be using government issued tokens for anything that isn't trivial to tie to your identity already: such as a personal bank access.
Their popularity would only rise in order to VPN into jurisdictions that don't enforce this. Assuming major websites don't just mandate age/identity verification for all new users regardless of jurisdiction just because it's easier and cheaper to apply one system to everyone.
Look - I know you mean well, but it is clear from this discussion you aren't familiar with cryptography, system security guarantees, Internet infrastructure scaling, or what would be needed to introduce new descriptive information about a person on the Internet and not have it become a new privacy risk.
This is an issue that has no tech-only solution. The specifics aren't just something to just figure out at a later date - the specifics are everything. And it's something that is enormously difficult to get right and extremely easy to get very, very wrong.
you also don't appear to know what a nullifier is, in a ZKP system you submit identifying information and a hash of a secret string. the CA adds the hash to a public database and in the future you prove you one of the members of the database with a nullifier - the anonymity-set is everyone in the database who entered it prior to your submission. this can also be done with a blind signature to the same effect.
there is no further point to this discussion.
> it's actually clear that you are the one who isn't familiar with this, I referenced remote attestation which you appear to know little about as it addresses the problem of identifying information (the service has no way to link tokens across without help from the CA).
You've promoted mutually exclusive concepts with regards to cryptography which is why I said you don't seem to understand it. And again - and again and again and again and again and again - what is the additional information you are authenticating based off of beyond age? Remote attestation provides absolutely zero privacy utility here whatsoever on its own! So you've remotely attested this ZKP key represents a person who is an adult. Creating another key based on that information alone is trivial to spoof - for it not to be trivial, it would require validating additional information!
What is your root of trust? What is the basis by which age is verified in a way that can't readily be spoofed?
> you also don't appear to know what a nullifier is, in a ZKP system you submit identifying information and a hash of a secret string. the CA adds the hash to a public database and in the future you prove you one of the members of the database with a nullifier - the anonymity-set is everyone in the database who entered it prior to your submission. this can also be done with a blind signature to the same effect.
That's nice and all for trivia on ZKP but how does that touch upon the problem being discussed?
The mechanics of ZKP are not relevant to the problem of ZKP being categorically worthless for the problem at hand. I don't say ZKP is worthless out of ignorance - more discussions about it won't change that.
The specifics of ZKP do not change the fact that you are validating either too little information to be useful for preventing fraud or too much to have privacy-preserving value.
> there is no further point to this discussion.
Evidently not.
We can't solve private age verification with blockchain tech. I'm happy you're so passionate about it, but it isn't a silver bullet.
Both Governments and industry players are, in actuality, interested in and moving in this direction, for some use cases. ex https://docs.withpersona.com/relay
None of this is really about age verification, the goal is for it to be invasive so a real ID can be connected to every piece of speech online.
Governments are serious about knowing who’s doing what online, and all this age verification is just an excuse. It will also raise the barrier to entry for newcomers in the market, so it’s convenient for platform owners as well.
Let's remember that this will greatly help ad attribution as well, enriching the platform owners. This reveals that their incentives are aligned against privacy.
> There are at least some technological solutions here, such as anonymous credentials.
Identity verification is busy being rolled out across the entire developed world right now, and I have yet to see or hear about even one single mention of anonymous credentials in the discussion of any of the laws.
>There are at least some technological solutions here, such as anonymous credentials.
Technological solutions for what problem?
> There are at least some technological solutions
I think the main takeaway is that the concept of such verifications is fundamentally incompatible with privacy. Today we have a simple "are you an adult" check but who is to say we wouldn't want further levels of segmentation (legal age to drive, age to allow health insurance etc)?
And this just one signal. Nobody likes the EU cookie/consent prompts but what they've shown us is that most websites are perfectly happy to fingerprint you the moment you step on their pages, and then share/broker your activity with hundreds and thousands of "legitimate interest" partners of theirs.
So the real-world equivalent of this situation is that you walk on the street and whenever you need to wait for a traffic light, board a bus or the tube, go into a shop, etc... you have a security person who needs to faceID(or fingerprint) you and make you wait until they find a match of your profile... and then they ask you to present your ID (which you have to carry at all times) but hey, it's private because you need to enter your PIN for them to read the chip.
No. The point of these initiatives IS TO GET ID, not to protect children.
Anonymous credentials don’t allow the state to retaliate in the dark of night against protected expression that they don’t like. Anonymous credentials do not allow for that, so they are irrelevant.
Yep, there are a variety of ways this can work well, but the overwhelming 'vibe' here at HN is a) that the tech is too complex and b) that governments actually want to end privacy anyway for their own nefarious reasons.
I find 'a' amusing as we'll often see in the same conversation that users appeal to parents to take responsibility and lock down their kids' access to things, as if that's trivial for non-tech folk and foolproof. It's also silly because the user interface to such a system doesn't need to show all that complexity.
And 'b' is often supported by some out of context quote that at first glance looks incriminating but doesn't actually mean much.
The saddest thing is that the article you link addresses most of the objections people have brought up in the thread, but few have read it.
This seems to come up in every discussion, in practice it’s irrelevant both because it’s too complicated for normal people to understand, and because the point of all this nonsense really is identification so anything that defeats that will be a non starter.
It doesn't have to be too complicated for normal people to understand.
Majority of people understand their SIN or SSN number or whatever, they understand they have a drivers license number. This could be built in such a way that it's basically just be another government issued "thing" that they have to know about and be able to produce when requested
Every government has been working on ways to identify and target individuals online since as long as the internet has existed. Governments are incentivized to continuously increase control. Why would you assume this is not yet another escalation towards their goal of being able to track and silence anyone who pushes back?
I didn't comment at all on what the governments goals are
Edit: I agree with you 100%, but the fact that governments want to track people online has no bearing on how technically possible it is to build a system where they can't
An anonymous internet auth system (probably) won't get built, but it is possible to build
How is it possible to have something that both proves something about your identity but also does not allow ANYONE to deanonymize you?
That's probably too high a bar anyways? It's not like we have that today either.
> that it's basically just be another government issued "thing" that they have to know about and be able to produce when requested
During COVID, there were protests about "vaccine passports" and masks. My state legislature tried introducing bills that would outlaw such things. In 2024, in several states (including mine), legislators introduced bills that would outlaw mRNA (and every vaccine made from it) [0]. REAL ID took almost 2 decades to get every state to implement it until the feds threatened to close all (commercial) airports in states refusing to implement it.
Notes:
0 - every year one of my legislators introduces a bill to outlaw chemtrails. This year, he added the plot of Termination Shock to his bill.
Bill to make "pureblood" a thing:
https://web.archive.org/web/20250118232059/https://apps.legi...
Bill to outlaw chemtrails & Termination Shock:
https://apps.legislature.ky.gov/record/26rs/hb60.html
I love the complete lack of reflection of the top comment in the website.
> All those policies are created with one single goal in mind - to catalogue and enumerate ALL human beings on the planet, not just kids.
1. Your government already has you catalogued, you have a birth certificate, you pay taxes don't you?
2. All these platforms are doing exactly that, do you think you are fouling anyone with that nickname? (come on lets face it you have at least one account with your real name).
> You’re not happy about it, but you hand over a photo of your passport and hope it doesn’t come back to haunt you.
I think for this argument to carry weight with voters, privacy advocates need to be much more specific about what "coming back to haunt you" looks like. They do a little bit of it later on[1], but I think most people do a rough cost benefit in their head and decide that the small benefit outweighs the small risk (to them).
[1] "And that creates a lot of risks for data breaches, overly broad data collection and retention, censorial legal demands for collected data, corporate and governmental malfeasance, pressure to self-censor, and perhaps blatant First Amendment violations. Every new layer and every new mandate brings more potential for risk. As we’ve unfortunately seen many times over the years, people including high-level government officials will maliciously seek to root out the identities of their critics, so the more layers of anonymity we can preserve in online speech, the better."
According to the article:
> Australia does order that personal information collected for age verification “must be destroyed once all purposes have been met.”
Most likely there's some huge breach where all the IDs are stolen and resold, which would maybe fix this problem while creating a bunch of others.
The biggest angle for me is censorship. You associate your online identity with your legal identity, there is no longer any recourse if you are banned from a platform. You could easily be arrested if your posts are determined to be 'offensive' in some manner considered to be in breach of the law, or simply have no ability to rejoin a platform under a new identity, or have identities across multiple platforms banned in parallel.
I've found that many people are actually in favor of these when they believe that it will only be enforced against people they disagree with. I'm hoping that people will be more likely to listen when they realize that their enemies may in future be able to get into power and change the definition of what is 'offensive', 'misinformation' or 'disinformation' to their own personal opinions.
> privacy advocates need to be much more specific
I'm starting to think we need to lean on conspiracy theories in order to get broader population on train with this - and I'm saying this in utmost regret. That's a borrowing game from a right wing/extremist playbook.
Start with this: requiring IDs online is a first step in micro-chipping the population.
...or how about this: marxists/atifa/nazis/zionists/islamist/whoever-group-people-think-is-in-power want to erode your privacy online so it can be used against you. Some nefarious group what to know your every move!
...or how about this: remember Epstein files!? Well the pedos now want to id your children online!
I simply saying truth/evidence/rational based approach to this will not get people attention. People just don't care.
Just say that the government will control every single device that's controlled to the Internet and they can add government viruses that you can't remove and they can remotely control all of your devices and brick them if you try to send anything that the government doesn't like.
That's not even an exaggeration, once they enforce OS-level age verification via remote attestation they don't even have to pass a law to do this, they can send a secret order to Big Tech to do this.
I absolutely love meta-irony in this discussion.
Perhaps “censorship” & manufacturing consent?
I think both political extremes have their own angles: liberals might be concerned that conservative censors will censor kids from learning about LGBT people and minorities, conservatives will be concerned that liberals will force too much LGBT and minority content onto kids. Or whatever issue, they want to control what your kids read!
This will almost certainly be used to censor adults too, the only reason we aren’t doing that is because it hasn’t been possible to consistently identify people before. Considering who is pushing for this, they’re absolutely going to tie this into advertising, and if they know who you are so do all of the spooky upper echelons who could implement a true censorship regime.
“The only way they can do this is by controlling what you read, shouldn’t that be the parent’s choice?”
> Or whatever issue, they want to control what your kids read!
Considering demographic trends, soon such arguments will sound very hollow.
It's been decades since the very phrase "conspiracy theory" was introduced as a means to convert looking closer into something cringe. The normie position on most things is to accept something as no problem unless the mainstream designates it as such aliens), or it blows up enough that even unmotivated normies can't help but take notice (rich new york caribbean islanders). Privacy got close to that with Snowden, but it fizzled into apathy for most because imo there was no clear harm to present, it was perceived as abstract.
To me the connotation is that it's always an unreasonable theory, such as one that requires thousands of people to maintain nearly perfect secrecy for an indefinite period, with no mistakes and dedication even when they'd benefit from blabbing.
In contrast, imagine a 2-person conspiracy where both have lifelong reasons to keep it secret. Yeah, I could have a theory about that conspiracy existing, but it wouldn't be, y'know, a conspiracy theory in the usual sense.
> even when they'd benefit from blabbing.
Ok but what conspiracy theories are even filtered out by this? Whistleblowers almost always do it at great personal cost.
> I'm starting to think we need to lean on conspiracy theories in order to get broader population on train with this - and I'm saying this in utmost regret. That's a borrowing game from a right wing/extremist playbook.
How about "if you want to buy a dildo on aliexpress, you have to do a full scan of your face and send it to israelis"?
I mean.. au10tix does age verification for aliexpress, it is an israeli firm, and you can't even buy a scalpel (the DIY crafts one) without having to scan your face there due to EU regulation.
It always gets back to the evil Jews with some people and ideologies. Sheesh.
What you expect people to just ignore where a lot of this anti-privacy industry is based?
That’s a funny way to spell the United States.
OY VEY
> you’re criticizing a powerful politician, or talking about your experiences with abuse or addiction, or discussing embarrassing medical issues you’re facing
This is not the problem. Even if, like millions, you are not talking about these things online, these systems still place you in danger. Even if you are a perfect, clean, compliant citizen these privacy-destroying systems place you in danger.
Fundamentally these systems expose you to coercion, extortion, blackmail, ID theft, etc. by criminals and immoral people who want money or power over you. There are countless examples of bad actors inside and outside these systems obtaining access to innocent people's private data and misusing it to their detriment.
This is the strongest argument against these bad ideas. Arguments that paint innocent, privacy-seeking people as suspicious or immoral in any way, should not be used.
It is rational and moral to seek privacy for your own safety and the safety of those you care for. Don't let them argue otherwise.
I think it is going to be the time to get off the internet in general, as much as possible
Sadly your take doesn’t matter since the other voting bloc is parents and people concerned about their kids.
I wish this resulted in techies spending more time to look at the substance of the harms playing out, however I see denial of the situation altogether more than anything else.
> Sadly your take doesn’t matter since the other voting bloc is parents and people concerned about their kids.
I used to think the "think of the children" voting bloc was cowardly for hoping the government will do their job for them in setting strict ground rules so they don't have to be the uncool parent.
The closer I get to having children of my own, the more I understand why it seems like the only option. Fundamentally this is delaying indoctrination in digital consumerism, which is not parents versus themselves anymore. More like parents versus the entire economy.
Government might be the only champion for that kind of fight, but what a mess it will make of everything for them to get involved.
> these systems expose you to coercion, extortion, blackmail, ID theft, etc. by criminals and immoral people
I'd prefer to have safety from that regardless of privacy.
I think privacy is a stopgap semi-solution to those problems that might lessen the pressure to actually solve them in a reasonable manner.
It is impossible to “solve” problems like this, only manage them intelligently. Human societies have certain failure modes that are constant across history, and it’s foolish to assume that you will ever fully eliminate them. This means that reducing potential methods of political repression (via privacy, for instance) is more critical than attempting to create an impossibly perfect, airtight system, at least if you care about individual liberties.
Assuming no revolutionary changes are coming to the USA, I am planning to opt out of the digital world when I retire. Physical media only. No subscriptions. Spend lots of time in the library. Find like-minded people and meet in person. Will only keep the bare minimum for survival, like banking.
Which is precisely why powers will try to make all these illegal
I don't think they are going to make libraries illegal mate.
But what about entering one anonymously?
You could download few terabytes from torrent site which will contain almost all books published prior to current date and use it offline btw.
No, you won’t be able to do that, because going online, or even logging into your PC will require ID verification.
But why wait? Do it right now and just store somewhere
In the US, if you do not have a passport and want to apply for a new one, you have to go to certain places where an authorized person will check your paperwork, see that you match the paperwork and send that directly to the passport office. Generally, county clerks and large post offices are the places that most people go. In some states, libraries are also authorized to do so. In 2026, Trump signed an executive order banning libraries from doing so. Libraries were doing the service for free. County clerks in my state charge around $50 for the service. The libraries doing this service were almost always in "blue" districts.
The SAVE ACT [0], which passed the House of Representatives last year (and is stalled in the Senate) only allows 4 types of identity documents to be allowed to register to vote in federal elections:
1. A US Passport, 2. A US Military ID with proof of US citizenship. 3. A US REAL ID with proof of US citizenship [1]. 4. A US REAL ID without proof of US citizenship, plus a US birth certificate and the names must match [2].
Notes:
0 - https://www.congress.gov/bill/119th-congress/house-bill/22/t...
1 - This is called Enhanced Driving License. It exists in only 5 states (Michigan, Minnesota, New York, Vermont, and Washington) and is an additional $35-40 above the cost of a regular driving license.
https://www.tsa.gov/realid/realid-faqs
2 - In the US, it is common for a wife to take her husband's surname. This means that 74,000,000 US women will lose the right to vote in federal elections if they don't spend $150 (for a new passport) or hundreds-to-thousands of dollars changing their name legally.
Libraries track what books you read (nowadays via some database and in the past via paper)
They track what you lend, not what you read. Many people just read on location.
Unless you read it directly at the library (at least in my country), without borrowing it.
Ah, like how we don't have pay phones any more because they were made illegal.
I saw a working payphone at Pinecrest Lake a month ago. Presuming you didn’t literally mean illegal, what did you mean?
You don't need to make libraries illegal to get rid of them, you just need to undermine their value and they'll be defunded and disappear. No passing laws necessary, just pubic ambivalence.
I second this. Get off the net and away from the established society and into the parallel ones
I have been slowly moving towards that for a decade or two now. I still do some internet stuff (mostly here) but it is greatly diminished. The rest is just at work.
agree with most of what you wrote but "Find like-minded people and meet in person." this is where things can escalate
This reminds me of a recent story I heard where a FEMA administrator had a militia organizer infiltrate his home as a "handyman" and the administrator was contacted by the FBI about who the handyman really was spying on his home and family in person.
Got to the same conclusion. Guess I will go back to in-person only, and lots lots of time away from devices (which I already have).
The path ahead in the next few years (at least for the UK)
1. Age gating + VPN ban under the guise of protecting children from social media
2. Few years pass, Identity Passport gets ushered in under guise of convenience of not having to repeat those pesky age verification checks.
3. Utilities start to require ID Passport. Including signing up with an ISP.
4. Renting starts to require ID Passport.
5. Work requires ID Passport.
6. Well done, you built the torment nexus!
Renting and work already require ID in the UK. Every landlord and employer is supposed to take a copy of original documents proving the right to rent/work in the UK. Technically you can do that without handing the docs to the government, but there's less potential liability to do so via the Home Office website.
That did not stop the Government from pushing digital id in order to prevent illegal working, did it ?
You miss the point - they are stitching it all together in a way that deanonymize you to your ISP under the guise of save the kids and then convenience
Isn't this already the case in a lot of the Continent? I was just in CH and it seemed impossible to have anonymous Wi-Fi without a Swiss SMS or a airline boarding pass.
Do you want to help stop that, or do you just want to feel smarter than other people? If you happened to have seen my comments in other threads, you'd know I'm against all this. But telling people they are idiots isn't going to win them over. This is not just a criticism of your comment, it's widespread in these discussions.
Opposing this requires:
* Linking to specific harms, which the public can emotionally resonate with. For example, scanning billions of photos for suspicions of child abuse will result in false positives that cause innocent people's kids to be taken away.
* Not seeming like an overheated conspiracy theorist. Feeling angry about this is legitimate, but it's not necessary to communicate in the same emotional register that you are feeling, even if it feels inauthentic not to. The public are saturated with people being publicly angry, much of which is purely performance. Deep concern may work better.
* Have plausible reasons for why this is happening. Yes, a few individuals like Thiel want to create a digital Stasi, but this would still be happening without them. Mostly this is driven by companies that want to make money, and officials who have a bias towards centralised processes, and are tunnel-visioned with respect to some issue. And people who are genuinely concerned about kids and haven't been given another convincing solution.
* Get facts straight. (Eg, rent/job IDs aren't a future threat. They are here)
And this is why we are where we are
I'm not a big fan of the "my way is the right way to oppose things, your way of opposing it is wrong" routine.
You can each make a difference in your own way and report back in a year who changed the world more. No need to alienate allies.
I think we can already conclude that the current approach is failing. I'm suggesting reasons why I think that is the case. Of course, my diagnosis may be wrong. But it's implausible that doing what we've done during 20 years of erosion of privacy is going to suddenly turn things around.
As for not alienating allies: if it's this easy to piss off people to agree with you, maybe it's also worth thinking about how to talk to those you want to win over.
The current approach includes people doing it your way, and people doing it GP's way, and people doing it many other ways. There's not a great way to draw conclusions from that, absent more data.
And if you're so eager to shake off allies who don't agree with all your ideas, maybe it's worth everyone thinking about how to talk to those we want to win over.
This is a very libertarian and ultimately low-trust forum where most people seem to think the government is out to get you, but I have to say: what's so great about having complete online anonymity anyway? I mean, seriously. Real life is not anonymous and consequence free either, why should online life be?
It's not as if there are no downsides. There are, and some of them are so severe that they are impacting the whole of society.
People can impersonate to be 500 or 5000 or 500000 people from another country and all echo some detrimental or even treasonous sentiment, critically influencing and steering voters, which changes politics and election outcomes and thereby the trajectories of whole countries. I cannot understate how serious that is.
If we can make sure that every real person can only have 1 social media account per platform, and if we can check that someone is an adult, and if (and only if) we can do that in a privacy preserving manner... then honestly, I don't see why I would be against that. I'm ok with being held accountable for what I do online. I want to pay that price to prevent the severe outside interference we've seen in elections and in our politics.
You and many others might not be, but it seems like you've lost the argument.
Just off the top of my head, what if I want to use reddit mostly to talk about mundane things like local events in my city or technology and don't really care if that ties back to me, but I also want to ask about embarrassing health problems or just weird shit and I would rather not have that tied back to me? I should have no options without everyone in the world being able to easily find out about it?
If some sites like Facebook want to be real-name only, that's fine. People can use Facebook for that if they choose. But don't ban alternatives for people who want alternatives.
Isn't the entire idea that all sites and use of the internet should be tied to your real identity. Of not publicly displayed then at least verifiable by the state
Which alternative measures do you propose to counter the society destabilising effects I've described in the original comment?
Because I believe there are none.
People will go nuts even with their real names. People will lie even with their real names. See: Facebook. Doesn't stop shit. So don't ruin it for the rest of us.
Even if you are not American, HN is very tied to American culture, so I assume you dislike either Trump or Biden (or both). Which one should be able to arrest people more easily for their online posts? https://www.bbc.com/news/articles/cg7pyjxjxrvo
Are you a big fan of Peter Thiel? If not, why give him more power and money? https://www.openrightsgroup.org/press-releases/roblox-reddit...
Cementing Trump and friends' power may be considered some form of stabilization, but it's not one that I'm a fan of.
I'm not convinced that the status quo needs changing. Can you make a case with statistics?
Unfortunately I think most normies is thinking like this. And buy into the idea that we must all give up what we have so far considered freedom ideals because the bad guys will get us if we don't.
In my opinion this is just blind compliance and misunderstood trust in a system which is changing rapidly.
People that came before us have fought hard for these rights and if I'm not mistaken the us was founded on these rights.
I'm not saying that we should allow criminals to take over and I know crime is rampage but if we give up our liberties, what are we then fighting for.
I think the ideas the leaders are proposing have been shown not to work in history. Like east Germany and Similar...
> Real life is not anonymous and consequence free either, why should online life be?
In real life you are largely anonymous if you go to any place that is not in your social circle. If I go to any physical store under the sun and pay in cash I remain completely anonymous. The only exception is staff checking your ID for alcohol etc. if you look underage, but that datum is only stored in one persons brain for as long as they bother to remember. Many people would take issue if the clerk noted every persons name when getting carded.
> what's so great about having complete online anonymity anyway?
Because liberal governments can always become repressive governments. Unless you have absolute faith that your government will never do something you have a moral objection to, you can never be sure that anything you are, believe or do will not be censored or land you in jail in the future. Infrastructure that has a minor benefit under a "good" government, but would serve as a major tool of repression under a tyrannical regime should not be built out of principle.
As a thought experiment, ignoring issues with technical feasibility, would you approve if every person is only allowed to leave the house, under a stiff prison sentence for violation, if they wear a shock collar that can be activated remotely by a law enforcement official? That way, if police want to arrest you, they don't need to use violence and they don't have to chase you if you tried to run. It would make the police's job a lot easier, would it not?
> If we can make sure that every real person can only have 1 social media account per platform, and if we can check that someone is an adult, and if (and only if) we can do that in a privacy preserving manner... then honestly, I don't see why I would be against that. I'm ok with being held accountable for what I do online
To the extent that political discourse is shaped by astroturfing, realistically it'll just give a monopoly of influence to whoever controls/bribes the company or entity doing the verification. There certainly would be technical/cryptographic solutions where there isn't some central entity with a master key, but I doubt that it'll work like that anywhere, especially if it requires a citizen safeguarding his own keys.
> I want to pay that price to prevent the severe outside interference we've seen in elections and in our politics.
Outside interference in the form of legal bribes (lobbying) and sometimes less legal forms of corruption has orders of magnitude more sway over politics than whatever the public may effect in elections.
> You and many others might not be, but it seems like you've lost the argument.
It's ridiculous to imply that there was any serious public debate on this.
> Unless you have absolute faith that your government will never do something you have a moral objection to, you can never be sure that anything you are, believe or do will not be censored or land you in jail in the future.
Any solution that can convince the Germans, the most privacy obsessed sticklers on the whole planet, has my support by proxy. If they think it's safe enough, it most likely is. Almost no other country has seen the dark side of what you're saying here as much as Germany, first with the Nazis and then in East Germany.
> To the extent that political discourse is shaped by astroturfing
Both Brexit and the Trump election have been significantly impacted by this, and it's not even controversial to observe that.
> Outside interference in the form of legal bribes (lobbying) and sometimes less legal forms of corruption has orders of magnitude more sway over politics than whatever the public may effect in elections.
Perhaps, but that doesn't mean that we should not address the elephant in the room - the seriously degrading impact that social media has on our society.
> It's ridiculous to imply that there was any serious public debate on this.
There was no debate because almost no one in (for example) tech circles is even acknowledging the problem, let alone coming up with a solution. Give me a better solution and I would argue for that instead. The status quo is unacceptable.
https://digital-strategy.ec.europa.eu/en/policies/eu-age-ver...
> Perhaps, but that doesn't mean that we should not address the elephant in the room - the seriously degrading impact that social media has on our society.
I would argue that those crafting our policies are destabilizing society far more than social media, and that they, rather than social media, should be “regulated” (perhaps into a small cell).
Here in Australia we already have the first part of 1 then most of 3,4,5. We are almost there. And you thought our wildlife was the torment nexus.
I appreciate the wealth of technical solutions that don't violate privacy, but isn't this overlooking an important point: that children don't need to be connected to the Internet at all times from such an early age? Many internet and cell phone providers seem to take it for granted that children must be online, which is already a net loss for their privacy as they mature.
Its a tragedy of the commons situation. The benefits of being offline are dampened by the kid being out of the loop
This whole FOMO thing isn't as real, nor as detrimental, for kids as people try and paint it. That's not to say there's not an impact, but kids survive just fine - everyone misses out on this and that, even adults who opt out. Nobody ever keeps up or is involved with everything everyone's doing. Learning that that's okay, and how to handle that, at a younger age pays dividends as an adult.
Besides, there are many ways to still keep your kids connected to their friends without feeding the beast.
And I say this as a parent.
I agree with this (I want to be a parent very soon). I think I'm trying to articulate that while its possible to make a quiet place for your kid at home, they still live in a very internet-driven world.
I actually am curious about your experience on this. Basically, I'm worried that I'll try to make restrictions in the future, and it'll just be a war of attrition that I lose, since internet platforms touch so many parts of social life, especially for the young. Maybe things will be different in a decade.
What internet loop does a kid to be in before the age of 14?
In my opinion, none, but many parents disagree. Also, its more about the secondary effects, where all of their friends at school are talking about internet things they are unfamiliar with.
Where are these "many parents"? You're arguing something without any experience.
This isn’t about children, mate. It’s about controlling the population’s access to content.
The children are fine. Many countries no longer allow smartphones at school, which lowers the peer-pressure factor to be online.
Parents are doing their best to steer kids. But these pesky adults, goshdarnit, they access whatever content they want without approval from The State, potentially reading dissident materials, borrowing 1984 from libraries… politicians don’t like that.
I agree, I think kids should have limited access to the internet. I pretty much did and it worked out for me but I have seen so many reports about it causing harm in schools and personal life. (Specifically I think LLMs should not be used in education also, but different point) However, I think the main problem people have with this "think of the children" narrative is that it will force EVERYONE to give up their credentials to access the internet, not just kids. And the general consensus is that we as adults do not want to and should not have to prove our identity to access the internet.
I am wholeheartedly against identity verification, especially when it comes to giving up privacy. And I hope these "think of the children" arguments can be pushed back at from multiple angles. If the danger is real, then by the time a child is online, 4 out of 5 in them in Australia can apparently access social media anyway. So even if everyone's privacy was somehow an acceptable price to pay, these requirements do nothing.
Unfortunately, they are looking to expand the eCommmisioners powers to try and close that door a bit tighter now.
https://www.abc.net.au/news/2026-06-25/australia-will-streng...
Lol yeah exactly, if kids want to go on social media they will 100% find a way around it.... putting in these identity requirements will literally do nothing except require us as adults to give over more information. I'm sure everything will pass through congress fine though because "someone think of the children!!!!".
That's their parents' decision to make, not yours.
Should it also be their decision that they can gamble? Smoke cigarettes? Get a job? Have sex?
We draw the line somewhere because these things that "are the parents' decision" have consequences on broader society. They have consequences that impact you and me. And we also have a say.
You can make the argument that it's just the parents' decision. But you have to say why.
> Should it also be their decision that they can gamble? Smoke cigarettes? Get a job? Have sex?
Not on the first 2 because they're illegal for minors. Yes on the last 2. A parent can e.g. forbid their minor from being employed if it's hindering their studies. They also have a say on their romantic partner and how they interact. If rules are not followed, they can e.g. be grounded.
...yes on the last? Might be in a minority on that one.
Maybe depends on country/culture and what we threat as minor. I.e. I have completed first year of university at 16
> You can make the argument that it's just the parents' decision. But you have to say why.
Generally, the reasons are:
1) The parents know their child best (as opposed to a lawmaker, a voter, etc.); so, they can e.g. make the best decision whether their child is responsible enough to engage in a given activity, like social media and the internet as a whole. This is just a matter of fact from living together throughout the minor's life, as well as knowing themselves and what traits the child may have inherited.
2) Generally, nobody is going to care more about the child's welfare than the parents. They're the people you can most count on defending their child's best interest. Other people may just have other agendas. In the case of what we're going through with social media, the parents may determine that the internet access they provide is overall beneficial to their child, while attempts to forbid it may lie entirely in furthering a surveillance state of the adult population which their child will eventually be a part of. Children don't stay children. One must also think of their adult lives when advocating for them.
3) Families differ a lot in values. They each have their own perspective on the proper way to raise their child. There's no consensus on a lot of things both big and small. The views of an individual family are generally going to be more stable and consistent than whatever's going on in the general political arena and changing culture. They also depend a lot on the family's individual circumstances, which the child will also exist in and may need to navigate as their parents have done. The child may also inherit traits from their parents and may need their particular guidance based on that. Again, in the case of social media, the child will likely benefit from guidance on e.g. how to not use it compulsively, how to protect their privacy (including being watchful of how much of themselves they share, to not depend on their own obscurity, etc.), how to respond to other people, not take things personally, not need others' validation, why are parts of the internet the way they are, etc.
4) Once the minors are adults, the parents will ultimately have no say and no obligation. One needs the opportunity of the time they're minors to be able to gain that guidance. If the parents are disempowered to make such decisions, it's ultimately harmful to the child. They will have to parent themselves.
The fact that you asked this makes me think that either you're an adult that feels badly towards your parents (maybe justified or maybe not), or you're a minor that doesn't understand why parents have authority. In case of the latter, you might think that another authority would be better. You might have idealisms (e.g. on the ability of something as broad-brush as law to substitute parenting), and simply lack the experience/perspective to see why such idealisms fail.
The idea that browsing the internet is remotely comparable to smoking is utterly retarded.
Probably got downvoted for failing this guideline:
> When disagreeing, please reply to the argument instead of calling names. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3."
I agree. Browsing the internet is not remotely comparable to smoking.
I disagree. Using social media is totally comparable to smoking. It's addictive, it's detrimental to health, and it's especially detrimental to kids going through puberty. "Browsing the internet", these days, mostly consists of social media platforms.
What is "parents' decision" is up to debate. This is how the society always worked.
I mean its only a hope and a skip away from having to validate ones age to turn on the router.
I’m glad this is finally becoming the cause célèbre du jour. This feels like THE FIGHT or at least one of the TOP 3 THE FIGHTS and it hasn’t had even a fraction of the public’s attention until now.
Unfortunately I don’t think it has the public’s attention, it’s still very niche. Nowhere near enough to change anything yet.
At least it's a start.
Most folks already know the internet is not a safe place to express political thought. The powerlessness the public feels is obvious.
I like your spirit :)
It won't be an issue until mainstream media makes it one. Since the media is owned by right wing billionaires, that media will reflect the biases and interests of those billionaires - many of which own internet platforms that would benefit from knowing the exact identity of every single user.
>I’m glad this is finally becoming the cause célèbre du jour.
It really isn't, though. Don't mistake the internet for reality. The majority of people in the US and Europe support laws like these, and most of the rest don't care.
Even on Hacker News the consensus is mostly in favor of anything from age restriction to making all social media illegal.
>The majority of people in the US and Europe support laws like these
okay then, show us a poll where the majority answers "yes" to an unambiguous question like "are you in favor of having to provide your ID or scan your face to access the Internet?"
"The majority of people in the US and Europe" support laws against drugs, for example, but would likely object to having their cavities searched three times a day.
> Even on Hacker News the consensus is mostly in favor of anything from age restriction to making all social media illegal.
That doesn't sound right. Put up a poll. I'd put money on 90%+ choosing some flavor privacy/anonymity on the internet.
The main issue is that they are very careful not to frame it like that. In broader contexts, it's always framed as something like "do you favor limiting children's access to social media" without a word on what it would cost to actually institute such a ban.
It's about as meaningful a framing as asking if you favor world peace and ending world hunger.
You can end all wars and eliminate hunger if you point the Death Star at us and kill all life on earth. If someone objects to the collateral damage, remind him that when you said "world peace and no hunger at all costs," you meant all costs.
Relevant British comedy clip (Yes, [Prime] Minister) on such polls:
https://m.youtube.com/watch?v=ahgjEjJkZks
Yeah, and we’re starting to inoculate people against that kind of rhetoric. It’s a process.
Not really, if anything we are seeing what a good idea taking kids off social media is and how crazy we allowed this to all happen for so long.
> if anything we are seeing what a good idea taking kids off social media is and how crazy we allowed this to all happen for so long
We're not seeing anything of the sort, and couldn't possibly for some time yet.
What we are seeing, as evinced by the article, is how ineffective these laws are at actually keeping kids off social media, and how effective the mass collection of identity data is at creating an environment for scammers, hackers, data brokers and the means for widespread political oppression.
You don't necessarily have to be in favor of any measures which reduce adult privacy to be in favor of that. Logically speaking, the liability for minors accessing age-gated products and services is the person who provides those products and services to the minor. In the case of the internet, that person is the parent, not the ISP or the website. It is the parent who contracts with the provider and then forwards the product to the unauthorized user, the child. A parent who purchases, say, access to porn and then provides that access to their child is no different than a parent who buys booze and provides access to it to their child.
Exactly. You frame these things in the general case and HN is against it because obviously it's evil.
You frame it as "we've come up with a composite score (social credit) that lets us more efficiently enforce [stuff HN likes but the population likes way less]" and it's mostly all cheering and the one guy with principals is downvoted and flagged.
> I'd put money on 90%+ choosing some flavor privacy/anonymity on the internet.
I can only say what I've observed from numerous threads - people's advocacy for privacy on the internet here does not extend so social media.
But OK this could be fun let's put my keyboard where my mouth is: https://news.ycombinator.com/item?id=48680434
Talk to people in person and you’ll get a different view (at least among those under 50), especially if you ask about the negatives.
Social media is full of astroturfing.
Don't mistake cynicism for knowledge.
I am always surprised that people get shocked when online privacy is put at risk, as if it was a fundamental human right.
REMOTE PRIVACY NEVER EXISTED BEFORE A FEW DECADES AGO!
And what happened in these decades are enough for the societies to wonder whether this new possibility in human connections (i.e. remote privacy) is globally a good thing. Just stomping your feet because the new toy may be declared illegal is not helping anyone. Governments are expressing serious doubts: this discussion needs serious interventions, not temper tantrums.
This is 100% wrong. Privacy has been the norm every time someone wandered a week by feet from home, or sent a letter. Famous authors published for a whole lifetime under pseudonyms.
We are living in a panopticon that never existed before.
> every time someone wandered a week by feet from home
Remote privacy means that you don't have to move from home.
> or sent a letter
Which anybody could just intercept and read.
> Famous authors published for a whole lifetime under pseudonyms.
But someone had to know who they were and where they lived, and they could be convinced to share such information.
This is much bigger than online privacy. It is about survailance and control of society. And possibly even a completely new society. Or a splitting of society into groups...
But to your point on anonymity. That has been protected in letter writing e.g. and also privacy has been considered a human right. Until now...
But maybe you have a point in saying that no temper tantrums are needed.
You see, when the governments are outraged that they can't monitor all facets of communication or are disallowed from using their shiny new ways to automatically observe and categorize billions of datapoints to automatically surveil-by-default millions of people, that is called having serious doubts and grave concerns, very important stuff. When the people are outraged that a freedom they've enjoyed for several decades now, many growing up with them, are taken away, that is called throwing a toddler temper tantrum, how abhorrent. Why can't you just be reasonable and compromise will all these legitimate concerns that they somehow didn't care about in the last 30 years? Stop protesting or being angry, you need to sit at the table and have a 'serious discussion' (in 100% of cases when this is brought up in this tone, that means "give endless concessions and compromises to make them go two steps forward, one step back - just give them everything they want, but incrementally this time!")
You see, when someone talks about "the governments" without realising that they do represent the people in a democracy, their ignorance show so much that it is difficult for them to attract any sympathy in those places where the laws are discussed.
It is ignorant to believe that democracy is a stable, self regulating equilibrium that maintains itself purely through elections.
The people in power in a democracy do not not persecute their dissidents because they are better people or because they got to power by being elected by the people, but because good democratic systems hold the people in power accountable to the general population. A surveillance state does the opposite. It holds the people accountable to the government.
Democracies stay democratic because the people hold power over the state and have means to get informed about the state. That requires for example journalism and protection for journalists and their sources. When the state can trivially find the sources of journalists and surveil the investigations of journalists before they can even publish anything that protection is no longer given.
When the state can know exactly all the people that participated in a protest that gives the state power over the people and takes power away from the people.
When the state can know exactly where in important organizations of all kinds there are dissidents so it can replace them before they can organize...
I'm sure all the people in the world suddenly did a 180 over the course of the last year, often with no new elections held, and all the governments are merely addressing their concerns by moving in complete lockstep with the exact same sets of policies proposed after ignoring 'the problems' for decades. After all, we live in a happy wonder world with perfect representation, direct democracy and absolutely no malicious actors, corruption, lobbying and coordination that is not controllable by ordinary people in any meaningful way - at least, as long as that thought-terminating assumption helps me argue for what I like. Stop protesting against Democracy (me).
The surveillance economy was brought in by people who were pontificating about freedom. Freedom for companies created it and bad faith arguments about freedom sustained it. The evil governments were Johny come lately here, basically. I have read absolutists libertarian rants about "the governments" trying to remove the freedom. In overwhelming majority of the cases, these people were actually supporting fascists and those strong rants were just tools to achieve that goal.
And now, general public is pissed about consequences of what large companies caused so much, that it is willing to put a lot of power into the hand of evil government, because they see it as less evil.
To me, again, this doesn't look like a real attempt by the people to counteract the corporations, although it's certainly sold and advertised that way. I think it's the world's biggest collaboration project between tech megacorporations and governments. Many companies stand to gain a lot from the removal of privacy, because it discourages competition and funnels users away from doing anything on their own and towards compliant services owned by these companies. More importantly, these companies will be the enforcement arm of many anti-privacy technologies. They're the ones who will be sifting through internet traffic, processing pictures of your IDs, organizing datapoints about everything you've ever done on their services. All mandated by governments as part of the world's largest conflict of interest. All the governments will do is just bundle these streams of data into narratives and timelines, a full automatic dossier on everyone without ever having to do actual old-school spying on them.
How do you define remote privacy? Beyond a few decades ago I could use a phone booth and pay in coins.
And any phone could be tapped with a signature by a judge.
An individual phone… while targeting a specific crime and a specific suspect. The person could use a different phone and remain anonymous.
The difference is that one is very granular and done in reaction to a crime. The other is a wide scale collection of data which is necessary recorded.
Which is a MAJORLY different system than general surveillance of the whole populace.
This issue here isn't surveillance as per a signed warrant. I don't think anybody's really arguing against that.
The problem is mass data collection without suspicion, probable cause, or warrants whatsoever. That's a brand new thing, other than the places in the world unfortunate enough to have roving gangs of police going door to door and searching homes without warrants. This facilitates it on a scale that's never really been seen before in human history.
> This issue here isn't surveillance as per a signed warrant. I don't think anybody's really arguing against that.
Everybody who talks about cryptography is arguing about that! With the digital technology we have, the options are very simple: either every man in the middle can read (even the villain), or nobody can (not even the justice departments). There's no middle ground.
> REMOTE PRIVACY NEVER EXISTED BEFORE A FEW DECADES AGO!
That is plain wrong.
You could absolutely send a letter anonymously without showing your ID. You could use a phone booth without showing your ID. Increasingly more countries demand ID verification for such things like getting a SIM card that used to be remote privacy.
But much more importantly you are making a false differentiation between 'remote' and local privacy. Before the internet that made some amount of sense. What you do in the locality of your home is private and what you do in public is not, such as buying a book in a store.
However two things have fundamentally changed since then:
1. This difference largely does not exist anymore. Things that used to be in your home and private and are now in some way or another in internet connected computers that act as surveillance devices. Your movie and book library used to sit on a bookshelf in the privacy of your home and only you would know when you watch a movie. Today it sits on Amazon's or Netflix servers and they know exactly what and when you watch and read. In fact turning the digital library you "bought" into something you own by converting them into a format you can store locally and use without restrictions and surveillance (local privacy) is illegal and punishable with jail time under the DMCA.
Notes written in a note book used to be local privacy, now they are written on a computer that automatically, without consent uploads them to "the cloud", a server controlled by a large corporation that acts as a panopticon for the state.
I could go on forever. Our lives are increasingly digital. That in itself would not necessitate being "remote", but in reality that is what follows, because people do not control their devices. Instead these devices are surveillance appliances controlled by corporations and increasingly the state.
2. Technology did not just enable the means for more anonymity, but also for a completely new, fundamentally different level of automated, all encompassing surveillance.
Before the internet you went into a store and bought a book with cash. You were not anonymous in the strict sense, the cashier could see you and might even recognize you, but you did not have to show your ID for everything you buy. The cashier did not create a log with your legal name and all the items you bought. Sure, the cashier might know you bought that book, but no one else did. There was no central surveillance log of every purchase accessible to corporations and the state.
Today credit cards are exactly that. Many countries have begun attacking cash as part of the war on privacy. We are heading towards a world where you effectively have to show your ID for absolutely everything you buy and every purchase will be logged.
CCTV is old, but the footage used to sit on tapes in the possession of individual stores and tracking someone's movements with this was a massive amount of work that would only make sense for specific investigations like murder cases.
Now CCTV is everywhere and systems like Palantir collect them all in a central system that logs everyone's movements all the time. The government can just search for "people who met with X in the last month" and get a log of all these people, their complete movement profiles, the people they met with etc.
Letters weren't exactly well protected, but no one would read your letters because it was infeasible. Now we have the infrastructure to automatically read all messages sent by anyone and the government can just get notified of anyone who voices in private communications that they do not like strawberries or the ruling political party.
Western democracies are building the wet dream of the Stasi, something that just a few years ago was supposedly an authoritarian dystopia and our great enemy. We were supposedly so much better than the bad guys of the Stasi. Now we are building a future where we are still different from the Stasi, because we are making it outdated.
While you could send a letter anonymously, it was also trivial for the government to read any letter it wanted.
The problem is we have switched from a world where it was easy to let the government read selected communications (single phones, letters), to one where it's hard not to give them access to everything or nothing.
Personally, if there was some 'magic wand' way I could let the government keep it's previous levels of control in the internet age (they could individually pick users and put work into monitoring their communications, with a clear low limit on the number they can previously watch), I personally would.
But that's hard to do -- it's not obvious it's possible at all, so we need to define a 'new normal', but let's not pretend we aren't taking a huge amount of existing power away from governments with large scale encryption.
Yup, demoractic governments existed before the internet and repressive dictators have risen with it.
The idea that being anonymous online will save a society from a dictator/repression is wishful thinking.
Only good faith engagement with an existing democractic system will ensure the success of democracy, but that is too hard for most poeple.
99.9% on anonymous engagement online is bad faith.
> The idea that being anonymous online will save a society from a dictator/repression is wishful thinking.
Strawman.
> Only good faith engagement with an existing democractic system will ensure the success of democracy
This isn’t true. Voters are occasionally very willing to vote in demagogues, authoritarians, and fascists.
The founding fathers knew that democracy came with it the chance of mob rule.
The solution isn’t to guarantee that nobody has any anonymity online. It’s to make society more resilient by increasing media literacy. Countries which border Russia (notably Finland and Ukraine) are doing an amazing job at resisting the industrial volume of manufactured propaganda. Countries with gullible people just become victims to it.
No, it won’t. The internet is just getting smaller from my perspective because there’s no way I’m handing over my identification and allowing every connection made to a server to be tracked back to me.
It’s simply not on the cards, and I live a frugal enough life in a high paying industry that I can retire in a few years. If I was willing to bank on inheritance then I could retire now.
I feel for the people that are forced to engage though. But too many of them simply don’t care about privacy, which is why we’re here.
Also a very good game, https://store.steampowered.com/app/239030/Papers_Please/
Better, official link https://papersplea.se/ since it has been released on multiple platforms
Do you think that this will lead to a new version of a alternative "internet" where people try to avoid the government control? And is that even possible? Or will we all just comply?
Only if it can be turned into gray market business: additional layers of proxies and VPNs, and whatever new is invented.
As simple "I care about privacy" need is not a reason to bother with setup for a regular person. So it could work only if it's as easy, as current internet. And for profit businesses provide it.
As for another protocol all together: there are some experiments already, but again, why use those?
Yeah profits is a problem.
I consider mesh-nets for home use... We already use walkies in the house...
No. Tor does most of this and the number of users is trivial.
Could tor become forbidden?
only for a short while longer. US, EU, China, and Russia are all on the same page about you-vill-ovn-nothing-und-you-vill-be-happy kind of future, and they will bully the rest of the world into compliance.
It is such a sick idea. But i cant really figurer out if they want to force this on us or they just anticipate that type of poverty will become normal for the new "middle class" and they want to make everyone accept it with some "crisis argumentation".
Far worse than "decimate", which implies that nine tenths of it survives.
We'll move permanently to the dark web, then. Ideally, we should maintain resilient wireless community networks that can withstand government abuse, as well.
Do you think there could be legislation that prohibits use of tor and mesh?
Absolutely. If they end up making access to the deep and dark web impossible through commercial Internet infrastructure, the next logical step is cracking down on alternative Internet infrastructure. Overlay networks like I2P, Tor or Hyphanet can be a temporary safe haven, but ultimately a government can make it extremely hard for uncontrolled platforms to stay up. I guess we'll have to fight for it if push comes to shove, and it's looking very bleak.
I agree. Even creating a mesh node could become an illegal act
There will be your internet-connected computer which will be assumed to be compromised, & which little, if anything of use will be kept on, & then there will be the airgapped system you do work on, which will probably be the last trusted version of a Linux distro you have multiple copies stashed away of. It will be a very old-fashioned experience, & moving/sharing data will become a dicey business.
Yes I fear this is true. It does not sound like progress ;(
Renaissance of LAN parties and SneakerNets?
The sad thing is that any actual bad actor will find a way to circumvent this, but it will just invade your privacy and lead to a worse Cambridge Analytica-style breach of privacy.
The day reddit asks me to upload an ID to shitpost about the NBA is the day I stop using reddit.
You don't need to sell this THAT hard.
Haha stop already friend
This seems more like a technical problem that we could actually solve well if we wanted to and had competent people advising the governments. You go to DMV and they generate a keypair and an entry in a DB. App looks up your age with your public key + signed private key authorization from you. Apps can ask for specific checks like is_over_21, is_citizen or whatever without any more data. Something like that, details are probably off ;) The whole infrastructure could be open source. Age verification doesn't need to equal identity verification by a 3rd party company that will leak your IDs.
None of this is necessary. First, the only devices that actually need to be gated are cell phones.
The user agent should simply send the user’s age of the parental lock is set up and the websites required to respect this.
Parental controls and the OS should be robust enough to not let kids bypass it (e.g.: by installing a browser that skips the header, or blocking proxy websites)
Done.
Cellphones only because those are the devices kids can have on them all the time and can easily use in private unsupervised.
Never underestimate the resolve of a teenager who is being kept from something they want. And once they solve it, they will spread the word for clout.
The system doesn't need to be impenetrable. There might even be legitimate reasons for kids to circumvent it.
They want it to equal identity verification! When virtually every top tech executive who wants a favor is at the inauguration and you have companies doing 180 degrees on support for something they previously furiously opposed, someone is getting something they wanted. It seems naive to think otherwise. Furthermore, the current administration in the U.S. fired or ignored the competent people to which you’re referring, and those people oppose a centralized repository of various metadata because it creates a central point of failure, otherwise known as a target, that is generally a bad idea for both our nation and our citizens. Of course there are agencies in the federal government that possess this information already, but they possess it for their purposes only. This is good because it means that it’s both more difficult to abuse internally in addition to being more cumbersome to collect externally.
It's a political problem, not a technical problem.
Yeah this is a basic problem that's been solved since the advent of PGP. As many other posters have said, this isn't about age verification.
There's still a whole DB matching IDs to keys waiting to be leaked. The US government can't even keep it's own personnel records safe and you think this won't get stolen and used to target people?
This still criminalizes sharing "adult" information with people who are not on the government's approved list (the things states do to crush dissent are not safe for children.)
why would any site on the internet need to give a damn about is_citizen? That's just gross to me at the mere suggestion. If it's a government service site, then they already know that information. If you're trying to use something like social media, then it couldn't possibly matter less.
To use frontier AI
Might want to check https://github.com/helloyanis/agechecker.net-bypass/ and help.
Who'd have guessed hitting the library would become an act of rebellious defiance
How is hitting the library an act of rebellious defiance? Getting a library card requires an ID and proof of address. The library then tracks which books you've signed out. Unless you're reading the books inside the library without signing them out.
My library, at least, is fanatical about their patron's privacy.
I don't know what their retention time is on circulation records, but beyond aggregate statistics for culling materials that aren't circulating I bet it isn't too long. Now I want to go check.
My library also only keeps 24 hours of video surveillance because they didn't want to be able to fulfill requests from the cops for footage of patrons. I really liked that.
Edit: In the patron portal it permits me to disable "borrowing history" and says it permanently deletes my records. I do contract IT work for them so next time I'm engaged I'll ask about the details. They're moving to Koha later this year (free / open-source ILS) so I could go look at the code to see what it does (which is nice).
On the theme of their privacy fanaticism:
Over a decade ago the library got a grant to do outdoor public WiFi in the park behind their building. As part of that grant they needed to report the number of distinct users using the WiFi each day. Their UniFi controller tracks MAC addresses of associated stations. I used a query against the underlying MongoDB to get the usage reports to satisfy the grant.
To minimize the potential of tracking individual users the library director had me write a script to grovel thru MongoDB, do a SHA-1 hash of each public MAC address tracked concatenated with a randomly-generated salt for that day, then write back the first 48 bits of the hash over the original MAC. The library gets their daily statistics and long-term traffic trend data, they don't double-count associations for the same device in the same day, but they can't track individual people over a span of multiple days.
Now that devices randomly-generating MACs are mainstream it's much less necessary. I thought it was really cool she thought this. (The whole salting/hashing bit was my idea. She just wanted to be able to fulfill the grant reporting requirements amd be unable to track people.)
A library is supported by local property taxes, so requiring proof of residence serves a practical purpose. Of course they are going to track loaned books too. This is not the same thing, by any stretch. If they are somehow making that information available beyond the scope of the library system it is a breach of trust.
Start your own library.
Write your own books.
Make your own music.
My library card has no picture on it. Me and 100 of my closest friends could easily share the same card.
I'm pretty sure I didn't provide an address or an id when I got my library card.
In the US? I think you most likely need to provide proof of an address
I'm pretty sure I had to provide some proof of residency for a library card from my town or state in the US.
I think some will just limit the books you can take out at a time if you don't have proof.
What if you are homeless? Can you at least sit and read there?
Certainly, but I think you need to have a library card to use the computers.
I do see folks who look homeless using the computers, so I assume there must be a special accommodation for them.
But, if you’re just a regular middle class joe looking for anonymity on the internet, I don’t think the library is the place for you—it’s tied to your library card which knows your address, and anyway what would you want to be private that you would be ok to broadcast in an open library setting? Nobody watching corn or browsing whatever successor to Silk Road.
Usually the login screen says something about fairly restrictive terms of use, even for the WiFi on a personal device, and I don’t know if you can install software on the library computers.
When I look around at library patrons using the computers, it’s usually lower income folks applying to jobs or similar, and people playing chess.
You can. You just have to ignore all the privileged people being annoyed that they have to see you. They love posting on Nextdoor about how much they hate homeless people.
Do you know any librarians? Public libraries have always been a bit punk rock.
In your country maybe.. In mine it's super boring and intellectual
The punk rock is? I would be interested in checking that out! (/s)
Punk rock has always been right wing. Libraries are about as far from this as they can get.
Has always been anarchical, so in essence it's in opposition to any form of authority that's predominant at the time. It makes zero sense to call it left or right wing.
>Punk rock has always been right wing.
What???
The anti-authoritarian, anti-government, anti-fascist, anti-capitalist music genre punk rock? Always right wing?
I mean, Nazis have always been attracted to punk because they like the loud noise but are too stupid to understand lyrics, but they tend to get their shit kicked in by punks more often than not. I don't think that's the same thing.
Sure thing, i.e. Egor Letov
The Ramones were divided politically, if I remember rightly. One of them was on the moderate right.
In the UK, there was also the Rock against Communism movement which came out of the far right faction of punk and was a response to Rock against Racism.
I've seen a lot of confidently incorrect takes on this site, but "punk rock is right wing" may be the worst.
Some punk rock is. The idea that it is always on the left was not true, even in the early days.
There is a myth that punk has always been left wing. Most of it has been, but right wing punk has been there from the beginning and still is around.
That's one of the reasons why I opted for multiple citizenships. I was fortunate to have the option to rehash parts of my name, and I am using my birthplace country's passport as a throwaway for everything, and my other citizenships docs only the governments and legal system know about.
Plus, like others mentioned, I am preparing my future self to be in a total offline/unplugged world and be a semi-ghost digitally, and even now in 2026 I found a bunch opportunities already doing it in a semi-agorist way (e.g. second hand, cash on hand, offline remote physical work, hunting/fishing, farming/a little farm, etc).
Soon you'll need a passport to read a Wikipedia article
> Soon you'll need a passport to read a Wikipedia article
Hopefully you'll need a passport to edit a Wikipedia article, since they can't be bothered doing anything about all the neckbeards writing them.
Just a minor nitpick: "decimate" means killing one out of then.
Try "devastate" maybe.
doesnt' impact the author's original meaning.
This just legitimises the existing practices. They already know who you are.
"just"?
This could be good to make the lack of privacy online more explicit to users, and actually cause people to be more cautious online, which all the snowden revelations failed to do. If we start using the internet the same way we use government websites, log in, do the thing, log out.
I feel we are still living in this bubble that treats the internet as some sort of utopian democratic institution. For certain people with strong mental gating it can be the case. But I'd say it's a massive projection from intelligent technologists on the rest of humanity. Most people really need some guardrails to avoid becoming hopelessly addicted to the worst material.
I hope this creates pressure for new technologies and media that answer some of the problems of communication which the internet couldn't. I guess people will find new bubbles of anonymity like Signal/Whatsapp groups to get information and discuss. Hopefully which reward some degree of contribution and proper thinking. Revive the genuine social sphere rather than tuning into the corporate filtered simulacrum of a town square. The truth I've seen is that the current internet is pure poison to most minds, and anonymity is just one less bit of friction to mindlessness.
Feels like identity control is not such a bad thing (prevents bots, identity thefts, cyberbullying, ect...). The questions is not "if it happens", its more a "who controls it?". If an NGO controls it, or a company that has "no political or national ownership", or something that is decentralized like BTC is, it's not a problem, but if it's a huge corp that only belongs to one single company which is backed and "piloted" by a government, that's when problems emerge.
First observation: if you use social media, your privacy is already decimated.
So the article is not really defending privacy; it's simply defending social media. (Under-16s are an important demographic they don't want to lose).
That said, the article is forced to concede:
> Australia does order that personal information collected for age verification “must be destroyed once all purposes have been met.”
Let's repeat:
Social media MUST DESTROY all personal information collected for age verification.
But let's be honest: if you really value your privacy, you shouldn't be using social media.
How is it any different from being required to identify yourself to get a phone or electricity account? Identifying yourself on the internet is long overdue.
It is fine in some cases. But what is at stake here is not identifying yourself in a couple of common sense situations.
It is enabling control infrastructure for governments whom are becoming increasingly undemocratic in a society where the elite gets more and more influence and where the middle class is becoming ruined.
Thought experiment: How do you get a phone or electricity in the most impoverished, backwards parts of the USA?
You need to identify yourself to the phone and electricity utilities so they know where to send your monthly bill. My ISP knows my name because I pay them for connectivity. I am okay with this.
If I misbehave here, dang can just ban me. There's no reason HN needs to know my real name. The only reason to mandate blanket age and identity verification is to control online speech.
You aren't required to identify yourself to get a phone. You can get a prepaid phone with no ID.
You are required to identify yourself for an electricity account because it is essentially extending you credit. You use the electricity first, and then they bill you for it later. They also only identify the person who is receiving the bill. You could have a house with a dozen people in it but the electric company only knows the name of the person responsible for the bill.
You are free to identify yourself on the internet right now. People who are intelligent and/or believe in freedom and free speech are opposed to this authoritarian power grab.
> You aren't required to identify yourself to get a phone. You can get a prepaid phone with no ID.
Requiring ID to buy a prepaid SIM card has become the norm across the developed world. There are still a few holdout countries, but they won’t hold out for long.
You say that as though it's a feature rather than a bug. Being able to have an anonymous SIM card is a useful privacy and security feature, to avoid things like "tell me the ID of everyone in the vicinity of this protest". (And that's one reason governments try to break that.)
My sympathies are increasingly with the Chinese model of development. So, yes, policies that confront the major challenge of our era – ensuring social harmony among the chaos of modern media and communications – are good features.
> ensuring social harmony among the chaos of modern media and communications
Harmony is another word for suppression of dissent, and that's the effect it'll have.
There's a long history of tools being promoted for one purpose and used for another. Tools supposedly intended to restrict "porn" get used to restrict LGBT healthcare and resources. Tools supposedly intended to promote "harmony" on social media get used to track down activists and protestors.
The obvious response to such overreach is to refuse to allow such tools to exist. It's not that the tools invite abuse; it's that all use of such tools is abuse.
> You aren't required to identify yourself to get a phone. You can get a prepaid phone with no ID.
Not in Australia
I think it was Ethan Zuckerman who once said that Congress is ill-equipped and incompetent to solve this kind of problem and that we need to design systems that guarantee outcomes and cites Signal as an example. We need to have that mindset now: a clarion call to software engineers.
Meta has spent $2B lobbying for Age Verification Tech: https://news.ycombinator.com/item?id=47410870
There is absolutely no privacy on the internet, Snowden told us 13 years ago but we all forgot.
The government already knows everything about us, and I mean everything. It is extremely naive to think they don't or that you are safe behind a VPN.
The government is largely incompetent about proactively sifting through vast amounts of information for relevant bits.
That’s minimal defense, but it’s worth remembering the difference between what it in theory knows and what its actually paying attention to.
If they already know everything, why is there always a push toward adding friction to the process they already know everything about?
There is a difference between the NSA knowing and being every petty burocrat being a trivial administrative subpoena away from everything.
Age verification is identity verification... except when it's in California or Illinois?
Sounds better in German: https://mises.org/mises-wire/papiere-bitte-papers-please
The goal should be to not repeat Star Wars - new technology that gives power and advantages is always adopted by companies first, then governments, and then it’s used to subjugate people. In Star Wars you have the trade federation abusing little planets. Little planet leaders go to government for help and vote a more “strong” approach to government that will “fight for the little guy”. An authoritarian leader steps in and uses the new technology to subjugate galaxies. In Foundation that leader can also clone himself, leading to 1000 years of fascism. Today prize camels and horses are being cloned in the middle east. Fiction is a guidebook sometimes.
You're on HN. You likely have lots of extra money.
Donate to FIRE: https://www.fire.org/donate
Donate to the EFF: https://supporters.eff.org/donate
Any others?
I'm pretty sure this is a "pick your poison" problem. We as a society are damned no matter what we do or do not do. For my part, we need to do something, because things are not fine the way they are, including the half ass Australian solution. We can't keep putting the onus on private enterprise to address social issues.
I may sound crazy for saying so, but I think the answer is more government run infrastructure for enabling identity-based operations, like payments and authentication, with rules about standards, open source, contractor selection, and audit that make operation transparent. It can work if technical operations are legislated instead of "left for the engineers to figure out." Then at least the evolution of systems can become real political issues that map to election cycles.
My stance is probably a polarizing one, but this is precisely why we need to be able to debate the minutae of these systems through our political discourse instead of just "will we; won't we" legislation. This should be debated in democratic process.
We could try investing in positive infrastructure that improves peoples life's in stead of creating the panopticon torment nexus. Things like third spaces where people can spend time is save spaces where they form communities and public transit so that people can get to those places. Incentivize positive behaviors instead of closing off public spaces and pricing more and more people out of being able to do anything with the minuscule amount of free time they have besides going on the internet.
That sounds like a great idea, but I think we should also try to solve human trafficking online.
Creating a surveillance state isn't going to solve human trafficing.
Allowing the relevant authorities to control, shut down and arrest serious crimes doesn't turn a country into a surveillance state.
Poor surveillance controls do though - let's perhaps fix those instead of allowing garbage like Flock to spread and then hand wring? EU started with GDPR, let's see others follow and build on it?
As the parent poster pointed out, doing nothing and pretending this doesn’t happen doesn’t fly anymore.
I guess, welcome to the middle age of tech? The part where you have to pick up the pieces and clean up the mess that you see around you.
> including the half ass Australian solution.
It was designed to be half-arsed so Digital ID can come along and save the day. Australia's Digital ID opens up to the private sector on 30 November.
And yet as the article mentioned, the "problem" is a lie... an excuse to justify the surveillance state.
I think the lie is to look at the problems we have that the internet has enabled and say "things are ok as they are don't try to do anything to solve it."
Things are, in fact, okay as they are, attempts to impose identity requirements would make things less okay, and people trying to claim they aren't okay need to be defeated.
Putting your head in the sand from position of wealthy privilege doesn't change the reality.
Oh, a great many things are broken and need fixing. "The internet doesn't have enough surveillance and deanonymization" is just not one of those things.
If the problem is "social media bad for kids" then any parent that allows their children to access social media is as guilty of abuse or neglect as a parent that lets them play in traffic. Throw the parents in prison and put the kids in foster care. Problem solved.
People make problems where there are none. Parents all around me are giving smartphones to their eight year olds without supervision.
I have kids and no amount of bullshit is going to convince me this is necessary for social interaction of any kind. If anything the "phone kids" are the weird ones.
People are creating this problem. You can easily, very easily, say "no" to a kid. I pay to keep you bloody alive and I will defend your sanity with everything I got because these kids are our future. Being disliked or "hated" by them is the least of my worries. Are we adults or what?
Sometimes I think there is a severe lack of "adulting" lately. No amount of legislation will fix that.
Well, as I said, we figured out ways to make parents big-r Responsible by applying harsh penalties when they abuse or neglect their children. We spend countless billions on government agenices whose sole purpose is to intervene when parents fail their children. We should use this pre-existing system to deal with the problem of parents allowing their children to use social media.
If you think any attempt at a solve goes immediately to 11, sure, but I hope you believe in nuance or else we’re all lost.
That is a bold statement to make, and I wonder how many more people would be willing to make the same statement whenever these conversations come up on HN.
This was in part caused by the general public’s comfort with federated identity for OAuth. If everyone already has one anyway (the thinking may go), why not mandate it?
it is the fight, but the game is already over.
what do people think the billions of billions of pattern matching used in ads will be used for?
people think 'anonymous' credentialing will work here?
they've captured scroll patterns, typing patterns, language patterns, all sorts of fingerprinting.
the game unfortunately is basically already over.
Unrelated, but you remind me of how absolutely useless ad technology is. The literal second I cross the border into Spain on holiday all I see is completely Spanish ads for stuff I never heard of and aren't even appropriate for my gender. This is for a ten year old YT account that basically knows everything there is to know about me. Even when I continue and look for English videos they keep shoving Spanish bullshit into my face.
Even at home I still get ads for music festivals, shoes and toothpaste, none of which are withing a thousand yards of my personal preference. The times I saw an ad for mechanical keyboards, interesting APIs, IDEs etc I can count on literally one hand and that's being online for decades.
iPhones' builtin autocomplete, Netflix and Spotify's recommendations all have robbed me of the illusion that smart people are actually working on this problem. If they are, it ain't working. The money printer works but not because of clever tech. YT's ad tech basically boils down to a geolocation of IP and I sometimes even question that.
privacy online is already largely gone
"X will decimate your privacy" [please accept the following tracking cookies, including for 3rd party ad analytics from a company whose CEO has called its users "dumb fucks" for trusting him with their data]
Don't get me wrong, just because it's a hypocritical headline doesn't mean it's incorrect. Just still rankles to see it, is all.
If they wanted to verify your age or that you are a real person with ID/selfie it could always be done on device locally to respect privacy which of course they don't because its not about that I even googled just now and see is solutions for this like PrivateID
I can’t think of a better solution to the issue of children being so aggressively harmed by the internet. That doesn’t remove any of the problems associated with this.
It’s not just kids. Adults are having their brains fried on AI generated political videos online right now. The state of the internet is an absolute disaster.
An enormous portion of the world is effectively addicted to a drug.
Solution: Maximize the distance between yourself and the people
Rather than becoming a social outcast I’d rather support any proposed laws that take down the social media companies.
You can definitely drop social media and not become a social outcast. Group threads on Signal are great!
I think he questioned the wisdom of isolating yourself from "people" in general.
On a related note I would like to add that social activity of any online kind is completely useless and can be get rid of immediately and without any adverse side effects whatsoever.
I'm pretty convinced the next generations will view being online as cheap and stupid. Offline is where the real value is.
Parents taking responsibility for their kids.
I grew up in a neighborhood full of drug dealers. Street sellers, not the classy Walter White kind.
Ironically being on a computer all day kept me out of trouble.
But with these laws in place I guess you might as well start doing stupid ish in real life.
The thing is, those dealers can end up in jail for selling drugs.
More to the point, if a kid walked into a convenience store and the clerk sold them a pack of cigarettes, the clerk wouldn't get off the hook by claiming, "well, the parents are responsible for their kids." I'm also not sure how one would justify holding parents legally liable for crimes they played no role in committing.
I'm not saying that I agree with these laws. They appear to be taking things too far. But that has more to do with there being no clear way to define sites that are only of interest to adults (no gatekeeping needed) and sites that should be restricted to adults.
>I'm also not sure how one would justify holding parents legally liable for crimes they played no role in committing.
This is already a thing.
https://www.bu.edu/articles/2024/charging-parents-for-childs...
Once upon a time they idea that Americans would surrender all of their God Given rights for an illusion of security was considered absurd, but that's where we're at.
I'm glad computers came in and saved you from your otherwise-inevitable life of cartel involvement, but I don't see what this has to do with the en-masse mental poisoning of children? I'm not even talking about politics yet. Cyber-bullying is insane.
Either way, I genuinely don't believe "let's just hope parents... start doing better?" is a solution.
Parents do need to do better.
Work on building self confidence.
My family relentlessly called me stupid and lazy to the point where a cyberbully would of been an upgrade.
You can always turn your phone off.
A lot of God awful parents treat their kids like trash and blame everyone else when Timmy doesn't get into Harvard.
Of all the people I've met with rough upbringings not a single one blamed anything outside of bad parenting.
Being a parent ( especially a step parent) is extremely hard.
100 years ago bad parents blamed dime novels.
50 years ago it was rock music.
We need to calibrate the incentives. Parents can be held accountable for neglect and abuse. Giving your kids phones and letting them use it without supervision is abuse. Enforce it. Denormalize this bullshit.
I have knives in my kitchen. Do I give it to them and let them run around the neighborhood? I could but there are consequences and I would be held accountable for it.
Social media = knives or as some other commenter pointed out, similar to letting your kids play in traffic.
So what happens when parents don't?
Too bad?
What happens when parents don’t lock the liquor cabinet? When they smoke in front of their kids? When they leave porn laying on the table?
Too bad!
>What happens when parents don’t lock the liquor cabinet? When they smoke in front of their kids? When they leave porn laying on the table?
The state can't control those things, it can control putting an age restriction on certain websites. Unless you are advocating for the complete abolition of all age restrictions throughout society.
You need an ID to access cigarettes and liquor and porn (from a physical store)...
My parents always kept a few bottles of wine in a cabinet in the living room. If 8 year old me wanted wine, I could have drunk a whole bottle while they were away and there was no way they could have stopped me. Yet I didn't drink my parents' wine, nor did I grow up alcoholic.
You could and when you would end up in the hospital your parents would have gotten a visit by people with sticks.
You can let your kid play in traffic. You can let your kid run around with knives. Sure, but when shit hits the fan you'll be luck to pay a hefty fine and lose all social credibility you had. In the worst case you're looking at jail time. Those sort of incentives will tend to smooth these issues out.
Kudos for resisting alcohol as an eight year old. How does that apply to all the kiddos whose lives are impacted by social media? Kind of a "them problem"?
Yes, it is. Kids get screwed up in all kinds of ways that we do nothing about. We could eliminate a lot of harm by prohibiting religious indoctrination, for instance, but that's unlikely to happen.
How is it more like leaving a liquor cabinet open than not buckling them up with seatbelts?
I'm glad we're discussing parental liability. It seems no one else is advocating for "social media access is criminal neglect," so I appreciate the novelty.
I would love to have this be the argument. Parents would typically agree that giving your kids heroin, for instance, should result in prison time. Yet I doubt they would argue the same for social media! Perhaps there should be discussions about what neglect looks like with regards to internet access and whether or not we need societal boundaries around this, enforced via punishing parents, rather than punishing everyone.
Giving children access to social media should have the same parental neglect charges as giving them heroin.
The current strategy of yelling "parent's should parent" does nothing to influence any sort of result. It's simply ineffective and makes people who say it look like slogan slingers rather than cooperating in any meaningful change.
> Giving children access to social media should have the same parental neglect charges as giving them heroin.
This is probably the most interesting angle of discussion I’ve seen in the past few days on this topic.
We are in the 80s smoking phase. It's still all OK and it's normalized. We're seeing the first blips of trouble on the horizon.
In, say, about a decade this tech bullshit will be regarded as the relentless toxic insanity that it was and we'll be better for it. Social tech CEOs will be lucky to evade prison if I had my way.
Most people want to operate within the boundaries of their society.
A simple G/PG/PG-13/R header for websites would solve 97% of actual issues anyone could care to present. (violence, porn, etc)
Forcing people to identify themselves will not solve skinner boxes, gambling-for-children, focus-degrading slop, etc.
Bluey-themed slot machines are still harmful.
There is a real problem here to be solved.
Whenever I speak to someone who's planning to vote Reform (UK hard-right party) their views are primarily shaped by seeing AI slop videos on TikTok/Instagram, showing immigrants doing crimes etc etc
Reform will probably win the next election because of this, unless we find a way to make platforms manage the situation.
Interesting example: https://www.londoncentric.media/p/london-tiktok-fake-news-cr...
The simplest cure, even though it is US law but would also benefit the UK, would be to repeal Section 230 safe-harbors when the platform uses an algorithm to curate content. If they are covered by the "safe harbor" then they are not responsible for the content. Otherwise, they'd be liable for libel/defamation/conspiracy stuff.
https://en.wikipedia.org/wiki/Section_230
A "safe harbor" is a section of the law where they basically say "as long as you do X, those other laws won't apply". https://en.wikipedia.org/wiki/Safe_harbor_(law)#
I think thats kinda the point. Tracking everything everyone does in an identifiable manner is extremely lucrative.
> * whether you’re protected from hackers or data breaches*
Not a matter of if, but when, a breach happens.
My what now? What privacy do I have on the corporate internet? I'm already being observed. My data integrated in vast "AI" models that try to predict me. We have seen tons of examples of the current tech giants farming out content moderation, hiring empoverished workers in the 3rd world to view all my videos and listen to all my conversations.
What privacy are we protecting here?
What privacy? With the enactment of the USA PATRIOT Act in 2001 it was game over. Were you not born then?
Privacy or accountability, pick one. Everyone holds your identity or pointers to it. They - pinky promise - won’t weaponize it until it becomes advantageous or ordered by the government.
In the end someone has to be held accountable. Society does not work without accountability and never has. We were living in temporary illusory world made by nerds. Now the rest joins in.
Interesting trivia: 90% of people don’t know the definition of decimate
Is a 10% reduction that bad?
The discussion is not about whether it's a good or bad idea, but whether we will yield the power to these people to ratchet in further oppressive laws onto formerly free countries.
Tech companies should ignore it and just publicly name whoever attempts to prosecute them and see how the population responds. I think people today are orders of magnitude more informed about their privacy and the consequences of digital ID laws. A few countries are on the edge of revolt at the moment anyway, and this would be a good way to get young people into the streets.
20 years ago, people would have had no defense against it or understanding of what was being imposed on them. Today, normal people use Signal and encrypted messengers, faraday bags, and leave their phones at home. Where we were nerdy security guys back then, non-technologist women and girls use spy tradecraft level electronic opsec for their own safety and security from middle school. People are much more sophisticated about their privacy now. They're ready to take this on.
The laws coming into force are on people who are not in favour of them, and I'm so optimistic that I will not interrupt the enemies of privacy and human dignity while they are making a mistake.
>Tech companies should ignore it and just publicly name whoever attempts to prosecute them
The most powerful tech companies are in favor of this.
It's just the web we're losing. The internet is still free. As for the web, good riddance, let's build something new.
The internet is not free. We've been running out of IP addresses for ages and most people don't have direct internet access these days so are completely dependent on man-in-the-middle servers. All it would take is a broad ban on VPN and end-to-end encryption. Governments have been wanting to ban strong encryption ever since the public got access to it in the 90s (see PGP/Zimmermann).
Is the general public really so politically illiterate that you have to call autocracy for papers, please era? We are screwed.
I am glad that more and more people wake up to the highly criminal age sniffing movement. That age sniffing movement, sometimes called age verification to insinuate a more harmless movemet, wants to destroy the anonymous internet as we knew it; see their fight against VPNs. This is not accidental - this is very integral to this evil movement.
The only logical consequence and response to that is to completely abolish those lobbyists that work against freedom.
It won’t decimate my privacy, it’ll just digitally marginalize me. I don’t have any ID that any of these sites will accept.
my toaster is about to ask for my social security number
320 comments and no one has mentioned Gaza
try out nostr instead of just complaining and whining
So everyone is on the same page on this issue. The First Amendment is the right to anonymous free speech. I doubt they teach it in the govt schools but the Federalist papers, which argued for the US Constitution, was published anonymously.
I'm not sure "social media" is the best example. You've never had complete freedom of speech on there.
It's been true for decades in the USA that if they want to arrest you, they will. The age verification doesn't make this situation better, but at this point it's almost just a formality.
Freedom of speech is contextually misunderstood. It's about political speech and the commons. Social Media is overwhelmingly private space, subject to contract terms and conditions. It may be a de-facto commons to some people but I do not believe this axiomatically, or legally makes it so, for the purposes of law and constitution. Law and constitutional bounds on speech online hit the international nature of the media very quickly.
Extra-territorial issue are huge here. What is the limit of the boundary on a given nations constitution and law? How much does the economy of the user, the hosting company, the owning company, the receiving parties matter?
Social Media has advertising and publishers. It has people who can effect editorial control over what is seen and by who and to who it is "said" -And that imposes obligations on them, and on people lodging content. Differentially depending on their economy, the reach of law, registration of legally incorporated entities.
All of this is being implemented somewhat haphazardly internationally, enforced differently, subject to legal and financial and social pressures differently depending on the times and the context.
If you want to ask questions about America, about Americans, using American companies, speaking to Americans, believe me you don't neccessarily have a simpler task here. It may well be clearer to some of you, but to me, its just as fraught.
It's just not clear to me "free speech" is the bastion rule which applies here. The EFF may think so, I don't think they have actually demonstrated it all the way to the end.
The internet is dieing just like mobile phones before that. Correction: mobiles were stillborn due to no open standards or O/S. Cant even buy a modern TV without privacy concerns -- lel.
And we all know why lolberts are worried about kids and privacy online... Regret voting for Trump yet, chuds? You can't hide once we know who you are.
Have you ever heard the joke, how do you know if someone does CrossFit? Don’t worry, they’ll tell you
In my experience Trump supporters aren’t exactly quiet about it.
Oh, not all of them. There were too many for that to be all of them. But this "secret ballot" nonsense won't protect them for much longer. Consequences.
All I can say is I will never vote for any politician who votes for any form of this. Even if the bill fails to pass, they will never, ever get my vote.
My Google account is 21 years old already. Is that enough of a proof?
I hold an unpopular opinion here, but well regulated digital IDs might not be a benefit to us all.
Almost all big tech giants are frankly paper tigers (can I survive without facebook, sure, without next day delivery, harder, without banking or secure ways to talk to my utility providers, waaay harder.
Having a way to get rid of bots that sour our Online discussions, lovely. To reduce billion in bank fraud, sounds great.
I feel as privacy advocates we need to be clear on the difference between secrecy (that’s gone unless you stay offline.) and privacy (your neighbour knows you are having sex in the afternoons but does not say anything.
This would never be used to do evil of course...
Singing: nobody wants this everybody hates you! Governments burning their capital hard to try to prove what tough guys they are against the Declaration of Independence of Cyberspace.
Wait till someone liberates all this poorly protected data
My privacy is already decimated. For 2 decades we’ve already known about the NSA slurping up everything[1] on top of the Snowden leaks.
Then you have the mega corps like Facebook who can figure out every detail about you even from merely _not_ using their system because of the hole you leave in your social network that does use them.
The only privacy left is from anonymous troll farms claiming to be an American while talking about how the Texas oblast is valuable for its warm water ports.
I am fine for privacy on consumption of content, but you should be forced to identify yourself for posting so the common man at least has a chance to evaluate your statements instead of being misled, all while, as stated above, our governments and corporations don’t have that limitation.
[1] https://en.wikipedia.org/wiki/Room_641A
> ...you should be forced to identify yourself for posting...
The Supreme Court has repeatedly held that the right to anonymous speech is inherent in the first amendment [1] [2]. See also The Federalist Papers or Common Sense, without which the US might not exist at all.
[1] https://www.law.cornell.edu/supremecourt/text/362/60
[2] https://www.law.cornell.edu/supct/html/93-986.ZO.html
That’s pre the ability for foreign actors to engage in our public square en masse. I think technology has changed the situation.
Free speech absolutism that ends up in creating an environment where real speech is drowned out by lies is not valuable to me. It’s like the paradox of tolerance.
The first amendment doesn't have a clause that exempts Americans from anonymous speech if it's possible a foreigner could inadvertently take advantage of the freedom too.
You may as well advocate for no one to be allowed to drive cars because of the possibility of someone getting into a car accident.
Or (in case you're a fan of the second amendment) - advocate for guns not being allowed to be sold to law-abiding citizens because of the possibility of the gun later working its way into the hands of someone who would use it for a mass shooting.
Freedoms exist with the understanding that both positive and negative consequences can result from them. The argument is that the good vastly out-weighs the bad and are worth preserving.
> The first amendment doesn't have a clause that exempts Americans from anonymous speech if it's possible a foreigner could inadvertently take advantage of the freedom too.
Cool, ignore my point about technology changing the situation. I assume you’ll ignore Jefferson talking about how the constitution should be changed every 19-20 years because the world changed.
> You may as well advocate for no one to be allowed to drive cars because of the possibility of someone getting into a car accident.
That’s the literal reality with mandated car insurance. If you don’t have car insurance you can be banned from driving. What was your point here?
> Or (in case you're a fan of the second amendment) - advocate for guns not being allowed to be sold to law-abiding citizens because of the possibility of the gun later working its way into the hands of someone who would use it for a mass shooting.
I’m not an advocate for the 2nd amendment since the majority of people I’ve met advocating for it as a defense against tyranny are full throated proponents for the tyrannical leaders because they don’t like the cultural norms of anyone outside their tribe. I can’t think of a single 2nd amendment advocate who is ready to stand up to the government against rights violations and would be happy to hear from you of an example.
> Freedoms exist with the understanding that both positive and negative consequences can result from them. The argument is that the good vastly out-weighs the bad and are worth preserving.
Yea, the freedom to swing your fist ends at my nose. Freedom of speech to explicitly lie like Steve Bannon organized and many others using the “flood the zone” strategy seems to the be at the end of my nose. If you are actively lying to manipulate me or others knowledge of reality, that is not feee speech, that’s Machiavellian manipulation.
> Cool, ignore my point about technology changing the situation. I assume you’ll ignore Jefferson talking about how the constitution should be changed every 19-20 years because the world changed.
The Constitution doesn't have a "except when technology gets advanced enough" clause either. I checked.
You wanting the Constitution to change is something else entirely - and that's not what you're advocating for.
> That’s the literal reality with mandated car insurance. If you don’t have car insurance you can be banned from driving. What was your point here?
I fail to see what car insurance analogizes to here.
>Yea, the freedom to swing your fist ends at my nose. Freedom of speech to explicitly lie like Steve Bannon organized and many others using the “flood the zone” strategy seems to the be at the end of my nose. If you are actively lying to manipulate me or others knowledge of reality, that is not feee speech, that’s Machiavellian manipulation.
Speech is not violence. Comparing it to violence diminishes the suffefing and harm faced by people who have been a victim of violence.
You have the freedom to pay attention to whatever you want to - as do media outlets and political consultants.
Why should the entire country suffer because the media frequented by political-news-saturated people is so easily disatractable? They have the option to just...not...cover irrelevant nonsense.
It's not the option they choose to take though. See: The reflecting pool news cycle.
we can design better online spaces, the incentives are not currently aligned
And I _can_ climb to the top of Mount Everest theoretically but it’s highly unlikely given the real world constraints.
I’d prefer a pragmatic solution and there is no pragmatic solution that gives us privacy back given the government and megacorps ability to pierce the vast majority of forms of privacy. The only thing anonymous speech is getting us currently is being manipulated by bad actors who are lying about their position.
I fundamentally do not want a world where I get the bad ends of both sides of semi anonymous speech where the government and megacorps know everything about me, but I just have to trust the account I am speaking to isn’t a bot or a worker in some foreign psyop shop, or even domestic psyop shop, lying to me.
I do not value free speech if it functionally disabled via the amount of lies permeating it. Free speech is useless if it’s nothing but a sea of “flood the zone” lies with the intent to make the truth unknowable, like how Russia or actors like Steve Bannon have manipulated the public square to be.
So much bad speech / misinformation is not anonymous, look at the kind of stuff the US President, Admin, and Gov't are proud posting, or the left/right-wing influencers. Forcing "papers please" on everyone is not going to meaningfully change the situation (imo). It will give the autocrats an inch and then they will take more. Eventually they will be able to police online speech.
---
From: On Tyranny by Timothy Snyder, Chapter 1 title & intro
Do not obey in advance.
Most of the power of authoritarianism is freely given. In times like these, individuals think ahead about what a more repressive government will want, and then offer themselves without being asked. A citizen who adapts in this way is teaching power what it can do.
https://ia801505.us.archive.org/11/items/on-tyranny-twenty-l...
I am not obeying in advance. My privacy was obliterated with the government before I could even vote, with the data science of mega corps, and with the double digit number of times companies leaked my data based on have I been pwned numbers.
I am not under the impression I have any sort of privacy on the internet anymore, other than from other regular civilians.
What I have to deal with is bots, foreign actors, and domestic actors all flooding the zone with lies that I cannot discern from the truth but that companies and the government can.
Making posting a non anonymous activity equalizes the playing field between me and governments/corporations.
If you are arguing that we should keep this thin skin of anonymity that doesn’t stop the bad actors, then I assume you just want them to keep power or that you don’t actually believe that they have managed to track our behavior.
I disagree because the people who have the most important things to say have the most to lose by saying it.
Also anonymity can actually improve social media polarization (see Chris Bail’s research)
Can you link said research? I have never seen anything but division pushed by anonymity.
Also again, the corporations and governments(for certain levels of government like the members of the Five Eyes) can pierce this veil of anonymity, the people who have a lot to lose already are risking it by speaking.
Edit: this also isn’t a newly diagnosed phenomena, I remember seeing this satirical description of the behavior as a kid back when Web 2.0 and social media was starting to change the internet[1]
[1] https://www.penny-arcade.com/comic/2004/03/19/green-blackboa...
> My privacy is already decimated. For 2 decades we’ve already known about the NSA slurping up everything[1] on top of the Snowden leaks.
If you were correct, there would be no need for them to push these new laws. The fact is, you will have less privacy after these identification requirements are fully enforced.
Anything to close Pandora's box. "They" liked the eras they could control the communications, and therefore the narrative. Boomers on their last legs, question is, will the future undo the unjustness that was forced upon them? Restore the rungs of the ladders that were removed, so they could have a chance too? Or are they going to stay in the fear narrative, and make this tragedy worse?
if i run a pain vanilla website with no need for user accounts, do i have to age verify? will icann also ask for id when i register a new domain?
The internet will just stop being the "cool place". Young people will need to find some other avenue or medium to congregate away from their nannies' watchful eyes. That has been the one constant across the multiple technological revolutions we've had in the last few decades, younger generations looking for a place to call their own. Meta, etc. obviously know this, hence the "metaverse" and AI slop. But what they refuse to believe is that it can't be manufactured and forced top-down, it needs to be bottom-up.
What scary me a lot, is the amount of people here or in real life that are not concerned about that, and that are like "it is to protect the children, so whatever it is, it worth it. And what else we can do?". And often it goes on with things like "anyway, social media are bad, they ruin people even adult, so good thing". Literally they all look like repeating a carefully crafted propaganda without that much more deep thinking.
Basically, to mean it is brain rot. The problem is that it might concern a big part of the population and that is why we have such laws.
To me, it is exactly what was described in G. Orwell "Animal farm" book. Pigs are now in control and big part of the crowd are "sheeps".
Afterward, we always have hard time to understand how people could have let Nazi, Stasi, or Stalin come in power and do such awful things. But it never came in one day, and with the "i don't care, they probably now better" attitude of the current western country populations, you understand easily how all of that could have happened in a first place.
In the recent, and most recent history, let's not forget what happened to Putin's Russia. Russia was opening and on a very good course for individual freedom and rights, then a ex-KGB officer took control of the power and little by little, year after year, suppressed freedom, privacy, and opposition to reach the point of today where the country is a total nightmare for human rights and liberty.
Mate, you have to revise your stance on Russia, more people are imprisoned annually in the UK for speaking than people in Russia in a decade. The UK banned RT while you can access any western propaganda outpost from within Russia.
You’re on Hacker News, this website is known for attracting open minded free thinkers that do not fall under the influence of government financed propaganda. Learn and reassess your thoughts.
>you can access any western propaganda outpost from within Russia
You cannot without VPN. Anyway, this stupid polarizing "my cow is dead, but neighbor's two cows dead so I am happy" approach is just sad and enables more govt tyranny globally.
For the prison it might be true because opponents in Russia are already dead... Like Navalny and the mission in his underwear.
Online privacy is already an illusion.
I mean, your ISP knows your IP, the government can know your IP, Google knows your IP, Meta knows your IP, all the websites you log on know who you are and what you're IP is, and forward your data to 3rd parties, many of these connect the dots between the various websites you visit.
If there is one benefit to true ID verification on the internet, is that people won't feel as if they're browsing things anonymously while they're not.
Maybe it will kill social media? And maybe that's a good thing?
If it was just social media and pornography, I wouldn't be too bothered but it's not.
Imagine there’s a hit list circulating on Signal with your name on it, and an anonymous user is offering $5,000 for your head.
Or imagine your daughter is getting blackmailed by some anonymous pedophile freak over Snapchat.
Nah, I need stronger arguments for why anonymity on the web is a human right.