Comment by andrewla | Hacker News Reader

Comment by andrewla | Hacker News Reader

Parent Full thread

I'm maybe a bit of an outlier here in that I do think that this is a genuine grassroots good faith effort to "protect the children" that does not have sinister ulterior motives. I know plenty of parents who have expressed enthusiasm for the idea of age-restricting websites.

"Why now" I think is pretty obvious -- the age limitations that exist currently are easily circumvented, but have given enough of a plausible deniability aspect that politicians have been able to skate by. There has been increasing research and media dedicated to the idea that there are aspects of the internet which we should be shielding children from. While many of this research is dubious, there's a rising moral panic around it.

The core of the problem is that there is no possible implementation of age verification that does not also require identity verification. In this I am in strong agreement with the article, but the use of paranoid and dramatic language as in this article only alienates people who find the conspiratorial tone to be reverse polarizing.

I agree only in the sense that Meta wants the OS to tell them the user’s age - BOTH for the ulterior motive of better ad targeting / fingerprinting, but also because shifting the liability gets the numerous current and future child safety lawsuits off the back.

This would be fine if it was actually done perfectly - ie. Devices get a signed ticket from the government identity provider, device can provides a cryptographically verifiable ticket to the site that its a valid identity and their age is within the $x age range but not tied to the user’s actual identity / document, and the device doesn’t ask the government identity provider to mint a new ticket each time it needs to attest (maybe 500 tickets are minted at a time and you auto renew 500 more each month)

However the likelihood of this actually being done correctly is slim to none.

There is no "done correctly". Intrinsically you simply cannot do this, and you have to accept this as almost axiomatic.

If the online age token is not attached to a human identity in a strong way, then it can be transferred to others without friction. The only way we can make it sticky is a mix of technological solutions (how we tie to identity) and real-world systems -- having the ability to prosecute misuse and to link to a physical identity.

I've been able to age restrict websites with my childrens' devices for years? Privately, on the device. The website side is pure moatism.

Yes but your approach requires parenting, which is unacceptable to many people with children.

If you mean this to say "this is probably the best we as a society can do on balance from a 'worse-is-better' approach" then I'm pretty much in agreement.

But obviously this doesn't "solve the problem". It's another bandaid with an extensive list of failure modes and tradeoffs. It falls into the class of "the age limitations that exist currently are easily circumvented" type of solution.

In my opinion it is fine to leave it there and accept the tradeoffs. We could mandate better website marking, and mandate better device or app-level mechanisms, and improve monitoring and restricting tools, or we could do even less and keep it more or less heterogenous.

But I do not agree that it is "moatism" to talk about it on the website side. There is a real and genuine desire to actually have the kinds of age restrictions that are only possible with strong user identity broadly deployed. Refusing to engage because of imputation of malign motives on the other party's part is not going to persuade anyone, especially if they do not personally have those malign motives.

The <meta name="rating"> html tag has existed since like the 90s. If you legitimately just want to 'protect the children' just enact legislation saying that adult content is responsible for setting this tag. Then parents can decide what their children can and can't see via browser settings. No giant biometric database, no invasive user mapping, no leaks, no creeping techno-feudalist state.

Collecting user biometric data and trying it to a nominally anonymous user identity is not required here.

This is 100% 'won't someone please think of the children' pearl clutching to hide what's actually going on - furthering control of the online exchange of ideas.

It won’t work, it’s just another crank of the enshittification ratchet that will make everyone’s life worse. Well, everyone except those who control a lot of wealth and power, they’ll still be comfortably isolated from the people they abuse.

Reply on news.ycombinator.com