Hacker News Reader

Comment by viraptor | Hacker News Reader

Requiring photo IDs is not the only solution. Things don't have to be implemented that way. I can be both for privacy in this case and limits on social media. Australia already requires you to register for voting and other things, so the trivial solution here is: give out anonymous time-limited tokens from the gov site, with no logging. Essentially a signed timestamp + random number.

> People who asked for social media bans for kids got what they wanted.

This is BS and not productive. We can do better.

View on HN

So instead of using a photo ID so that everything is logged, register your every interaction online with the government directly. The government which also has your photo ID on record.

There's zero difference. Either way, the government will have you monitoring your every single little comment online and having it forever tied to your person. And that'll have a chilling effect on individual liberties.

> So instead of using a photo ID so that everything is logged, register your every interaction online with the government directly.

Not just register, but ask permission for and give the government a veto on.

No, not every interaction. Given a token without user id, companies can check it's valid without contacting any government service and without knowing your identity.

And then the government sees where those tokens are used and they can easily monitor your every action, and revoke your ability to use certain sites if they don't like what you're saying.

North Korea wishes they came up with an idea this good.

Signature schemes can be validated without the signers involvement. No tokens need to go back to the government

And they do this over a network we know governments are constantly spying on?

This scenario doesn't make sense. Either govs can spy on your traffic and see everything (and don't need tokens for spying), or they can't and wouldn't be able to see the token. There's no scenario for: they can only spy on their tokens in your traffic.

Because it's possible to protect yourself against that with anonymity. That goes out the window the moment tokens tied to your real identity get involved.

Not to mention that it's likely they wouldn't be able to spy on absolutely everything you do, just parts of it. The tokens would be an obvious point of interest.

On top of that, it's probably a lot easier for the government to justify this kind of spying. They could probably twist information about token use as being some kind of "metadata", therefore "okay to spy on".

> Australia already requires you to register for voting and other things, so the trivial solution here is: give out anonymous time-limited tokens from the gov site

Which “gov site”? Registering for voting does not give you an electronic log in of any kind.

My gov id. I'm not saying that there's currently a registration online for voting, but that since you're required to register anyway, the system exists that can be extended to generating those tokens.

And realistically, most people do have mygov id already.

> most people do have mygov id

It was renamed myid, and less than half of all Australians use it.

> no logging

If you think that the AIC/NIC doesn't have its tentacles in there already, then I have a bridge to sell you.

It was almost exactly half last year. The number will only go up.

I'm not sure what you mean by the logging part. Yes they can either log or not log it. The system can be designed for either. If your default position is "government will always lie given the chance" that's fine I guess. But then you need to assume they're monitoring your ISP anyway.

There needs to be some terms clarified. mygov vs mygovid vs myid.

Agreed, "myid" used to be called "mygovid".

But myid/mygovid is NOT mygov. I'm guessing the rename is likely because of that confusion.

mygov usage is high, 26 million accounts, according to [1] 2023 report.

Myid usage seems middling. 13 million according to [2] 2024 article.

Which platform to use for what and how I leave to you.

I don't want this. I don't want the government's aim for auditable provability of every item watched/interacted with in the name of "won't somebody think of the children!!!" level of authoritarianism.

There are plenty of households without kids. Why are they having to pay a privacy price?

[0] https://my.gov.au/en/about/help/digital-id

[1] https://my.gov.au/content/dam/mygov/documents/audit/response...

[2] https://www.ato.gov.au/media-centre/mygovid-being-renamed-my...

I agree the naming is a mess. There is the Australian Digital ID system (https://www.digitalidsystem.gov.au/how-the-system-works) which allows third party providers.

Whatever the capabilities of the Australian government ID services, there is a way to issue privacy-preserving tokens that could do all the things you'd need without being trackable the system was properly designed. (I have not studied the protocols of the Digital ID spec to say whether that's the case).

I agree with you that technically it can be done. Which is why I said:

"I don't want the government's aim for auditable provability"

I mean, technically they could do it and provide at least a modicum of privacy protection. But I will bet they won't because whoever is implementing it will want to be able to point to specifics - specific people, specific times, specific places - so they can cover their arse come the next moral panic moment.

Not that poster but since Covid, most people have a registration on the MyGov app that handles medicare, tax etc. You could easily add a one-time token mechanism to that app

> give out anonymous time-limited tokens from the gov site, with no logging

Awful idea.

This gives the government the power to deny you access to mass communication by deciding that you're no longer allowed to verify with these platforms.

"Been protesting the wrong things? Been talking about the wrong war crimes? Been advocating for the wrong LGBT policies? Failed to pay child support? Failed to pay back-taxes? Sorry you're no longer eligible for authenticating with social media services. You're too dangerous."

That is not beyond the pale for the Australian government.

You're also at the mercy of them to actually adhere to the "no logging" part, with absolutely no mechanism to verify that. And it can be changed at any time, in targeted ways, again with no way for you to know.

A better idea would be to sell anonymous age verification cards at adult stores, liquor stores, tobacco stores, etc. Paid in cash. An even better idea is to not do any of this and spend the money on a campaign to educate parents and institutions on how to use existing parental controls.

> This gives the government the power to deny you access to mass communication

They already can in the ID scenarios. Since they issue IDs.

> You're also at the mercy of them to actually adhere to the "no logging" part

That's part of the equation. To be tracked, two parties have to fail: the issuing side needs to log the details and the verifying side needs to log the details, and then agree to share them when they don't have to. There are existing laws that would enable this in simpler ways.

> to sell anonymous age verification cards at adult stores, liquor stores, tobacco stores, etc. Paid in cash.

What you mean is: share your ID details with those places repeatedly and require people to travel to them from remote areas (there's lots of places where that would mean a day trip at least). I'm not sure that's better. Also making that process time-limited would be really costly.

> An even better idea is to not do any of this

Sure, but that's not the scenario we're in anymore.

> so the trivial solution here is: give out anonymous time-limited tokens from the gov site, with no logging. Essentially a signed timestamp + random number

The trivial workaround is for people to create ad supported websites to hand out those tokens.

If there’s no logging then they can’t determine who’s abusing it or if they’ve even generated a different token recently, so people can generate and hand out all the tokens they want.

So then the goalposts move again, and now there’s some logging in this hypothetical solution to prevent abuse, but of course this means we’ve arrived at the situation where accessing any website first requires everyone to do a nice little logged handshake with the government to determine if they have permission. What could go wrong?

The real workaround is for people (including kids) to buy themselves a VPN subscription for a couple bucks per month and leave all of this behind while the old people are letting jumping through hoops.

The proposal is for SIGNED tokens i.e. only the govt can issue them, and you need a govt issued ID to generate them. The latter mechanism allows rate limiting. This fixes the problem you outline.

Reply on news.ycombinator.com