Hacker News Reader

Comment by ApolloFortyNine | Hacker News Reader

Any age verification should come with an OAUTH style government run API. The idea being you verify your ID with the government, and the service that required age verification gets back a true or false for does this user meet this age requirement. That way the amount of data shared is kept to a minimum.

The UK, and Brazil who passed a similar law, 'cheated' by just forcing private companies to figure it out.

View on HN

No, this is an absolutely terrible idea. You're suggesting a giant, centralized, government-run data silo, with all of your online activity tied to your real-world ID. This is far worse for privacy than any data broker, it's hard to even compare.

Honestly I'd rather have private companies figure it out. Then at least you'll get multiple options, including from privacy-first companies. But that still sucks, and my preference strongly goes towards OS-level Age Indication. Just as effective in practice, 100% private and offline.

Doesn't that exist in the U.S. already? DOGE worked to create the "one big, beautiful database" and now the federal government is buying information about citizens from data brokers.

>No, this is an absolutely terrible idea. You're suggesting a giant, centralized, government-run data silo, with all of your online activity tied to your real-world ID. This is far worse for privacy than any data broker, it's hard to even compare.

Not all your online activity, even if they kept logs it would be something like 'this site asked for age verification, we said yes'.

So they would have a list of sites, if they stored them and were allowed to store them. Which is something they can get from your ISP regardless.

It could be used for bad sure, lots of things can. In my perfect world this wouldn't exist at all like it hasn't for 30+ years. But putting the burden on private companies was always going to create other avenues for issues.

As someone from the UK, do you honestly believe the UK government would be happy with just "true or false" data?

Companies may get multiple options but you and I and Joe average are going to have to submit PII to several vendors chosen by someone else, exactly like the credit bureau system but without the regulations they have to follow.

The fact that the powers-that-be need to understand but choose not to is that what they want is literally impossible, even with mandatory government blood screenings to access computers. Anything short of requiring identification per POST is inadequate. This whole thing is a fools' errand and we must not give any ground.

The EU is already implementing this in the best way it's ever going to be implemented:

https://digital-strategy.ec.europa.eu/en/policies/eu-age-ver...

I really don't like this perfect law enforcement future, but this EU initiative is about the best design one can have.

Almost. Their apps will only work on Apple and Google-controlled phones.

There are no plans to allow separate, standard AOSP attestation methods for Android. Google's crooked* Play Integrity will be the only one.

*crooked because it confirms Android 8 are safe and with full integrity, even when they're rooted, full of malware and present spoofed certificate.

Really? Ugh, that's terrible. Teaches me to hope.

Their reference apps only work on those phones, but these aren't required: https://github.com/eu-digital-identity-wallet/eudi-app-andro...

The user of Play Integrity can choose to just block Android 8.

Wrong, because then that government knows exactly what services you have accessed. It's a huge and extremely dangerous privacy violation. The real solution to the age verification problem is not to have one. The Internet has existed for over 30 years without it; it's solution to a problem that does not exist.

Ironic that Brazil government tends to pay lip service to digital sovereignty while forcing their own citizens to handle their data to Zuckerberg and Peter Thiel.

Now your government knows you are a registered user of PornHub.

It will be fun when (not if) the database is leaked.

I don't think they meant literally Oauth but instead that you can get a verification request from the party that needs your age verified, get it signed by the government, and then send the assertion back to the relying party. It's not necessary for the government to send the signed verification request directly to Pornhub. It's not even necessary for the government to sign the assertion itself. A trusted device (like most consumer phones) could store the identity locally after government verification and then sign assertions itself after biometric or PIN verification, which is what most proposals look like.

I am not holding my breath.

> The UK, and Brazil who passed a similar law, 'cheated' by just forcing private companies to figure it out.

At least on the Brazilian case, it's outright illegal for a private company to implement the thing you are describing. So, if the government doesn't provide the service, there isn't much for them to figure out.

UK Gov sometimes likes to do things in very awkward ways, against any sort of worldly grain established. See the covid app.

However my Apple ID verified me based on my account age, I didn't need to provide anything.

In EU we have EIDAS, at least in some countries. It works. But mostly just for actual citizens.

Some kind of Digital ID?

The UK government proposed that and was met by the usual resistance to it.

Fuck that. California's way is the absolute maximum that should be done: When accounts get created on an operating system, allow the user to provide a completely unproven age. Then that age should be the only age check.

If the goal really is to just help parents prevent their kids from accessing inappropriate material, that's plenty. Anything else, and you're admitting the real goal is Big Brother style surveillance.

If the US had this, Trump would definitely be using it right now to send ICE to arrest people that said mean things about him on social media, didn't drop out of college, didn't bribe him enough, etc.

Reply on news.ycombinator.com