Online age verification is coming, and privacy is on the chopping block | Hacker News Reader

Online age verification is coming, and privacy is on the chopping block

theverge.com

The issue that I have is that you have for-profit companies such as Yoti and others trying to embed themselves in the digital ID space. They feel a need to peddle their wares, and are happy to partner with sketchy politicians who are thrilled to play along in building big brother if it means that their political agenda (for example, blocking access to porn) is advanced.

Having some form of digital identity is not an intrinsically bad thing, but there are compromises at play. ePassports are a good example of something that tries to provide decentralisation and security at a large scale, but they need to be well scoped to the area that they're used in (for instance travel).

It is possible to build systems that provide short-lived attestation of facts that are scoped to a minimal level of data. We just need to choose to build them rather than allow our lives to become dictated by some horrifying future version of Experian/Yoti/friends.

The German eID already has this feature. You give it a number of years, and it replies with a simple yes or no.

The problem is that it's expensive to implement. Your options are A) going with an identity provider who charges you per session, B) interfacing with an eIDserver provider yourself (which the identity provider in A does for you) with all the necessary certifications, government red tape, and UX intricacies, or C) also building your own eIDserver, which is a lot more certifications and red tape, plus mandatory very specific hardware HSM that, to my knowledge, aren't even available anymore.

Add to that the users who, so far, are most likely confronted with this for the first time and the clunky "official" apps (though you could implement your own) that require your website to do funny stuff like redirecting to localhost.

Plus as a user I refuse to use it even if the consequence is that I have to skip the service in question. I may be in the minority to people that like being parented, but I don't see the incentive of a service to use this tech.

There are enough problems to be solved and age verification doesn't solve any at all.

I'm curious, is it not something that you can do automatically through some extension of ICAO 9303 by just talking to the chip directly?

I heavily doubt that any age verification system will prevail. Perhaps it even comes with a renaissance of systems that do not comply with age verification. For online transactions like shopping it is moot anyway.

But any other service won't get my ID and I left a lot of those behind already.

But I doubt there will be enough legislative clout to enforce anything here. Maybe the EU will reinforce its poor tech standing again (although much of this isn't only due to bad policy).

How could we have less privacy than we do now?

When did real Authentication of people go from being a "hard problem" to ideologically forbidden?

Reply on news.ycombinator.com