Hacker News Reader

Comment by rzerowan | Hacker News Reader

Paradoxically this is one of those features/requirements that i feel should be on the end-user-device with zero knowledge proof.

It would make sense to have the enduser verification ondevice with a simple reply to any online property : Passed age verification/or not.

Otherwise the centralization and eventual leak of this data is a can of worms in waiting.

View on HN

Here [1] is the zero knowledge solution. It has existed for ages but not adopted likely due to not providing a name, SSN, location and credit card. No third parties, no dependency on CDN's, no sharing or leaking ... anything.

Given that solution is unlikely to be legislated into action I would suggest people are just going to share adult content on Usenet, Tor, P2P, within G/PG rated video games by plonking down a virtual theater and streaming from a throw-away VM and fully automating syncing with LFTP+mirror+SFTP, sharing USB NVME drives, mobile ephemeral websites over WiFi and other methods when people get tired of this Top/Bottom relationship lobbyists want us to participate in. As a plus side, driving people underground means zero tracking, rules, taxes, obligations, leaking email addresses, etc...

[1] - https://news.ycombinator.com/item?id=46152074

Any on-device solution that simply sends back a yes/no result as you describe is guaranteed to have one of two problems:

1) It is vulnerable to modifications and hacks on the local device that get it to send back a "yes" result without actually verifying anything

2) It requires the device to use some kind of closed, proprietary system that allows the service to guarantee that #1 cannot happen

Now, in general, the tech world is pretty happy to accept #2, but many of the people around here would object to it on very reasonable grounds.

I think that the improved version of age verification is to ask the yes/no question to a government third party based on a signed payload that your local device offers the service. The government already has your identifying data, they only need to certify on behalf of which person the question is asked.

So then you're just back to the even more basic problem of "is the person using this device the same person that the payload was signed on behalf of?"

Yep. But in my mind that's being mitigated by the real measure for identity proof, which is some type of electronic ids.

Which a) has a whole host of other concerns associated with it, and b) still does not solve that problem, because it's not at all hard for a child (especially a teenager!) to sneak their parent's ID, use it to authenticate for a service, then put it back.

After all, are most services going to require the ID to be present for every session? Or are they going to require a one-time authentication for the account?

I don't want it in my hardware but I'd buy an accessory that does this.

Would you be OK with everyone who wants to browse the web unhindered being required to buy an accessory that does this...?

And if it’s such a high adoption rate for an “optional” accessory, may as well just build it right in…

Oh look, we’re back where we started. The only winning move is to not play.

I mean most mobile devices have already accepted closed ROMs in their baseband and all/most browsers that try to interact with streaming sits require Widevine . As longas its going to hapen one way or another better it be local , and not a gov thing or a monopoly.

At the end of the day the tool should be there enforcement down to the relevant local authorities or not.

OK, but what about your desktop computer?

EU implementation of age verification is actually base don zero knowledge proofs https://ageverification.dev/

If I remember right, a problem with this is that you need to get those proofs by submitting your id or similar, you only get a limited amount of proofs at a time, they expire in maybe a few months, and you can only get them using a government specific app that is only for "secure" devices. Instead of being tracked by the site you're being tracked by the government, you now need a Google Android phone in order to browse adult sites on your PC, and depending on your habits you may need to re-show your id potentially multiple times a day unless you opt to being tracked by the sites instead.

It really should be just once that you need to show your id and then you should be able to generate as many proofs as you need whenever you need on any computer device, but they have an obsession on making very sure that it cannot be circumvented, as if it was insanely important.

Isn't .dev a TLD operated by Google?

How European can it be?

This looks like a private consortium of usual suspects Tales and T-Systems squandering taxpayers money, not an official thing.

Hasn't this been made "optional", aka not going to happen, in the digital wallet specification?

That page says ZKP are a "future roadmap" thing, to be maybe possible wink wink maybe implemented int he "future".

Currently, it does not implement ZKP, and further requires proprietary Google Play Integrity use, making it an absolute toxic cesspool.

Exactly, on my Play Station I setup for my son I enter his real birthday, then Sony knows what can he do in the Store or chat etc. So we could have the big tech Apple, Google, Microsoft, Canonical ensure to make an idiot prof setup screen and the parent is responsible to set the age of the birthday of the child if they give a device to them . Then the store can be filtered and the browser can have a standard way of adding in the headers an age range or something.

Big tech did not want to cooperate to do this for some weird reason so now we get a much more complicated solution.

Yes I know that if your kid uses a live USB stick he could watch porn on his laptop but IMO is much easier for such a smart kid to find a website that does not respect the browser headers and torrent adult content.

Reply on news.ycombinator.com