HN Reader

Just make the isp the gateway. Nobody under 18 needs the internet. If a parent lets their kid onto the internet, prosecute the parent. It’s pretty simple really. People just want to pretend it’s harder than it is because they have some conflict because removing under 18 from the net cuts into profits or makes it harder to parent. Boo hoo.

I'm never verifying my ID to access anything on the internet. I'll just stop using it.

Cryptographically there are techniques that let you prove you're one of the several hundred million adults in the US that don't reveal anything about which adult you are. It's much less complicated than bitcoin.

I'm bringing this up because it's the perfect litmus test to show whether you really care about age verification, or if you want personal trackability for all internet behavior.

I'd be okay with this for certain situations (e.g. a forum that doesn't want to foreign agitators to pretend they are US voters), but the whole porn thing is a ridiculous farce because there are still going to always be millions of non-us porn sites that don't enforce US laws.

Are we to assume that the people at the EFF haven't heard of how European nations, like Denmark, are building government infrastructure to verify your age without disclosing sensitive information?

Are we also at assume that the EFF fail to see the similarity of age-gating porn websites and age-gating entrance to strip clubs?

That doesn't seem likely to me, and I find it way more likely that the EFF is purposefully excluding the best argument against their chosen position.

Paradoxically this is one of those features/requirements that i feel should be on the end-user-device with zero knowledge proof.

It would make sense to have the enduser verification ondevice with a simple reply to any online property : Passed age verification/or not.

Otherwise the centralization and eventual leak of this data is a can of worms in waiting.

The core issue here, as often, is that it pits ethical and economic concerns against one another. There has been a systemic choice by web/tech companies to prioritize maximum profit, often at the expense of necessary user support and compliance. Because of that, user support/relations are deficient and there is little accountability for what they're doing, even if, as we often read here, a tech company cancels user accounts, projects, or monetary accounts, without anyone or anywhere to appeal. Age verification presents the same problem. If companies maintained a professional, human-centered user relations function, they could implement a non-intrusive, real-time validation process. If we were in the real world, with for example a barman needing an ID, that single person could confirm the age without copying or indefinitely keeping the ID card. The digital equivalent would be a decent support representative who could conduct a live brief video interaction to confirm a user's age, without even storing a copy of the ID, and who could even require the parents to be there with the minors signing in. That would address both the need for verification and the data minimization problem. Yes, that would cost the companies a lot of money, but that would solve both problems at the same time: verifying the user's age and ensuring privacy. And guess what, the same person could also serve as an entry point for other issues that no one can really appeal against now, like the frozen accounts and other horror stories mentioned above. Yes, parental control is necessary, but it is insufficient. Zero-Knowledge Proof thingies could allow a device to validate parts of the process, but the possibilities of circumventing this are so enormous and endless that they look to me as completely insecure (and using a third party validating this adds another layer of trouble). The most effective way would be to reintroduce a human element in the process, but we have already given up, because we are at the mercy of the web companies due to their free tools. The governments trying to introduce some ethics to those processes are not the problem at all, they should be commended for that. We are the problem because we accept that what should be the web companies' responsibilities is not being fulfilled because we don't want them to make less money as we would lose some freebies. That's on us, not on the laws. So the answer to "Why isn't online age verification just like showing your ID in person?" is : because we collectively accept it is not exactly showing our ID in person.

I don’t like this article. Irrelevant technical nuance is comingled with a philosophical opposition. The technical issues are all solvable. The free speech argument is foolish too: if limiting who can jerk off to pornography is an issue of free speech, surely so is limiting who can enter a bar and converse with the patrons.

Opposition to ID checks because you believe the internet should be open and free is reasonable but this article twists itself into knots throwing everything at the wall. And it is reasonable to believe it is a free speech issue. But we can’t say, at the same time, that the same arguments don’t apply outside of the internet.

(Convenience stores scan ID, bars scan ID, hotels take copies of passports…)

This tries to make a logical argument against an attack that isn’t that - it’s linked to age and „think of the children“ precisely because it isn’t really disprovable and anyone daring to take a stance against it can be hit with a „oh so you’re against protecting children“.

Scratch out the age in „online age verification“ and you get to real reason

In my opinion, access to internet should always be behind a device controlled by an adult. And it should be this adult's responsibility to set appropriate restrictions for minors.

Discussion on the mentioned age verification hub here: https://news.ycombinator.com/item?id=46223389

Look at the Overton window rapidly shrinking. Thanks EFF!

If age verification has to be a thing (which isn't necessarily clear), then it should be up to the client to provide age indication to the server.

It could be through a header, or something like this: https://developer.chrome.com/blog/digital-credentials-api-or...

However, I have the feeling that none of these solutions will get wide enough buy in and adoption to be a viable solution to website owners.

It's not about age verification and it never was, that is a distraction at best and a delusion at worst. This is about tying your real name to all of your online activities, and about getting the current generation of children used to it and accepting of it before they reach voting age.