Hacker News Reader

Comment by sicktriple | Hacker News Reader

The government isn't typically facilitating the check. In order to verify your age, you will be required to hand over your ID to a third party, who's privacy and security practices are likely: "Trust me bro."

Seeing as how these companies get hacked all the time, (https://krebsonsecurity.com/2026/09/fbi-probes-service-selli...) , I don't think it's unreasonable to resist this.

Furthermore, I think many folks have reservations about requiring an ID checkpoint to utilize a computer. Obviously it's not that bad yet, but I don't think it's hyperbolic to state that the landscape is certainly trending in that direction, and it's absolutely not unreasonable to point out that governments and institutions to have a material interest in setting up access controls on who can and can't use the internet (read: participate in society).

View on HN

Right, I'm not a fan of the ID check or identity/age verification. I'm just trying to understand the conspiracy theory kind of idea that "they're trying to get all our IDs!!!1!!" sentiment.

"The government already has our IDs" is missing the correlation between the ID and the service. They know your face and your name but not what you do on the internet. The website knows what you do on the internet but it isn't tied to your name. It's the tying them together which is the problem.

Which is why the people trying to do it always pull out the misdirect about ZK proofs. Those don't fix anything because a system that actually preserved privacy wouldn't be able to prove that the user is over 18, only that someone is over 18, not necessarily them. And that in turn means you're setting up a rug pull. You roll out a system which is indistinguishable from the perspective of ordinary people from the one that screws them, and then that system can't actually exclude minors so what follows is calls to change it to stop protecting privacy, at which point the people trying to collect everyone's ID will be arguing that you already have to show ID.

It also presumes you would even get a privacy-preserving implementation to begin with, which a pretty credulous assumption given how these things usually go.

It's not possible to prove the user is anything ever. It probably never will be. Likely what will happen instead is that the person in the ID will become personally liable for accounts verified with that ID. Which is even more reason to reject ID verification.

> Likely what will happen instead is that the person in the ID will become personally liable for accounts verified with that ID.

Exactly. Which in turn requires you to have some way of tying those accounts to that ID, which was supposed to be the thing to be prevented.

Reply on news.ycombinator.com