[1] Anonymous attestations by trusted authorities. IE a Login.gov service that returns a token indicating that the user is an adult without providing identification details about that user.
Your compromise sounds far worse to me than all the bots, extremists, vulgarity or whatever other problem it's supposed to solve.
Again, if done correctly, the thing you give them is not the actual thing you got from the government but rather the result of running that through a transformation. The transformed token can still be recognized as certifying your age, but if given to the government entity they would not be able to tell which token they issued it is based on.
Yeah, but in all likelihood _that isn't one of the options_.
The moral panics and "think of the children" and general ignorance around these things is going to drive action at some point.
The options are "implement the least bad thing we can" or "wait for legislators and regulators to dictate how it will work".
I'd rather see Apple (who already has some semblance of ability to verify your age as you usually have payment methods and things tied to your account) come in and implement some protocol involving a bunch of cryptography I can't even begin to understand that preserves privacy and anonymity, have that gain a foothold, and have eventual regulations either seen as unnecessary or effectively having to support this sort of workflow.
The alternative I see is at some point we're going to get a regulation that involves everyone having to send a photo of themselves holding up their driver's license all over the place in order to access half the internet.
I am so tired of the naivete that just because something isn't direct somehow translated to "we're safe from the possibility of". Especially from amongst an audience presumably composed of people who deal with manufacturing layers of indirection on a day-to-day basis.
Lets just do a thing that leads to a bad outcome. Don't worry, it doesn't directly lead to a bad outcome. You just need to aggregate a few other things first! 2 years later Oh my goodness, how could anyone have forseen someone would implement the requisite integrations with the right channels of indirection to cause the bad thing to happen!
Besides which, the described service, (provisioning a token signifying that the bearer is... Well... Anything really) without at some point on the backend having sufficient connection to a person in the data with whom you are claiming the assertion represented by your is true, and by extension, is capable of associating online traffic utilizing said token with a bearer identity is no different than just believing when the client clicks a button saying "yup, totes that". It is a non-solution. It does not solve the actual problem. You can't and nor should you even attempt to solve the stated problem. You're just mild inconveniences for the chance at creating slightly more remote, but far more severe problems.