Comment by O__________O | Hacker News Reader

Comment by O__________O | Hacker News Reader

Really strange to me that given its obviously possible to securely verify someone’s age without requiring personally identifiable information at the endpoint requiring verification (or for the system verifying attributes to know the endpoint requesting verification) that anyone would even want that information flowing through their systems — unless they wanted the information for other reasons. To me, unless the prior technological features I just mentioned are baked into the law, this feels like it’s either intentional or laws are being crafted by people that have no clue what they’re doing.

More generally speaking, governments should start seeing the hoarding of data by itself and others as a national security threat, open source any government systems — and offer bounties for anyone able to maintain the objectives of a system while reducing the system’s access to sensitive data.

______________

* EDIT: 100% sure that it’s technically possible to have an endpoint anonymously verify age and a verification system to do so without knowing the endpoint requesting the verification, but unable to find technical explanation of how this might be done using existing technology; might be wrong, but believe it included a combination of differential privacy and zero knowledge proofs. Does anyone have a link to detailed explanation of how to implement such a system?

It's the last one. It's just very poorly drafted legislation that hasn't been thought through. this is our one party rule in action. With no meaningful opposition, laws are not scrutinized and unintended consequences never considered.

There are 29 members of the state legislature who are not in the "one party" and exactly zero people voted against this bill at any stage. It passed 72-0 in one chamber and 33-0 in the other.

Arguably, "one party" in this sense could mean "rulers."

It could mean that, if you're juvenile or just stupid. It's a democratically-elected, bicameral, proportionally representative legislature with an independent executive elected in a non-partisan race.

Just look at AB5 for a perfect example.

It’s poorly thought out legislation, but it’s not like the GOP is known for writing good law.

IRMA [1] comes to mind. From their site:

With IRMA it is easy to log in and make yourself known, by disclosing only relevant attributes of yourself. For instance, in order to watch a certain movie online, you prove that you are older than 16, and nothing else.

Their docs[2] are pretty good.

[1] https://irma.app/?lang=en [2] https://irma.app/docs/what-is-irma/

Thanks, agree system provides privacy protecting attribute verification (age, legal-voter, citizen, income, etc) — but after quickly reviewing it, does not appear to support anonymously doing so in a way that only the user knows their identity and the endpoint identity — but neither the endpoint or government know both, even if they or an attacker have access to the security tokens from the endpoint and governments servers.

Did I miss something?

Another user suggested Privacy Pass system, which I have reviewed before and currently reviewing to see if it fits system profile I am describing:

https://news.ycombinator.com/item?id=33133758

You just have to be comfortable with a single application on your phone holding all your details for you, it having implemented the protocol perfectly, and having amazing protections around the handling of the third-party request phases.

And this is all to improve the privacy of children?

Simple questions: CD or vinyl? That will identify everyone old enough to remember. Then the classic: how do you tame a horse in minecraft, which identifies everyone under 18.

Understand the trick, but think we all know people are clever, especially when they’re motivated, and bypassing systems like that would likely be trivial and even potentially result in the endpoints requiring age verification helping bypass them covertly.

The goal isnt to actually block children. They goal is to satisfy the corporations legal obligations: whatever scheme requires the least effort, the least information from the applicant, but still meets the minimum standard.

Better idea: webcam verification of government ID. Client-side/in-browser AI software matches only name and birthday before passing OK to website. Zero information is actually transmited/stored. Patent please.

What is to stop someone from modifying chromium to always report "yes" in that case? Or is the idea that we will add another widevine style opaque binary blob to our system that handles this with an encrypted response that can't be examined by the user?

Nothing would stop someone from hacking the system if everything was client-side.

Not following, how would the system know the document was authentic without transmitting data; understand that client-side it would be easy to cross-reference the ID-face and Live-face and scan the barcode to extract any data attributes, such as age. Also, worth noting that assuming the individual had a smart phone, scanning document would likely provide no additional security and there numerous apps that provide real-time end user verification using biometrics.

Perfection is always the enemy of "good enough to meet legal oblugations". Compare the minimal ID checks for buying cigarettes ... or handguns.

This is not about perfection, as is, unless I missing something, your suggested solution does not solve the problem.

There are numerous ways for a system to authenticate a user without the endpoint requesting the authentication knowing who the user is — or the system verifying the user knowing what endpoint system is requesting the authentication; only the user knows both who they are and the endpoint they want access to.

If you attempted to set it to its dirtiest mode, the game Leisure Suit Larry would ask you a series of sports and pop culture questions from the 1970s in order to verify you were an adult (in the 1980s). Of course, kids just looked up the answers and swapped them on crib notes on the playground.

Somebody who was 10 when horses were added to minecraft is 19 now.

But minecraft has always been an "all ages" game, not a kids game. And it was first advertised/promoted on 4chan.

> CD or vinyl?

As someone who prefers tape I feel discriminated against.

You are. Tape is evil.

If having shock-resistant playback, analog audio, and easy recording is evil than call me Charles Manson, 'cause y'all can keep your record scratches and CD skips.

Reply on news.ycombinator.com