hckrnws

I work at a European identity wallet system that uses a zero knowledge proof age identification system. It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth. As long as you trust the government that gave out the ID, you can trust the attribute, and anonymously verify somebodies age.

I think there are many pros and cons to be said about age verification, but I think this method solves most problems this article supposes, if it is combined with other common practices in the EU such as deleting inactive accounts and such. These limitations are real, but tractable. IDs can be issued to younger teenagers, wallet infrastructure matures over time, and countries without strong identity systems primarily undermine their own age bans. Jurisdictions that accept facial estimation as sufficient verification are not taking enforcement seriously in the first place. The trap described in this article is a product of the current paradigm, not an inevitability.

According to the EU Identity Wallet's documentation, the EU's planned system requires highly invasive age verification to obtain 30 single use, easily trackable tokens that expire after 3 months. It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering". You have to blindly trust that the tokens will not be tracked, which is a total no-go for privacy.

These massive privacy issues have all been raised on their Github, and the team behind the wallet have been ignoring them.

  > It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering".

Maybe worse, it encourages the push of personal computers to be more mobile like (the fact that we treat phones as different from computers is already a silly concept).

So when are we going to build a new internet? Anyone playing around with things like Reticulum? LoRA? Mesh networks?

"Anyone playing around with things like Reticulum? LoRA? Mesh networks?"

I'm curious about the 'day after' scenario: what's the move if the state decides to regulate these into "illegality" because they bypass official channels? We have to remember that the devices aren't the problem... the real hurdle is the bureaucratic gatekeeping of communication. The problem are people, not devices.

It could be a difficult battle for them to fight. We'd just have to make it too costly. Make them go hunt down all the relays. Scatter them everywhere. A $5 ESP32 isn't a good relay but they still have to hunt it down and that'll cost a lot more than $5.

So the answer is the same as any war: you make it too expensive to keep fighting. It's the same reason a bunch of barely trained people in the desert won a war against a force with far greater military power. It's the same reason a bunch of jungle people defeated the country that just won a world war. It's also the same reason a bunch of rednecks defeated the largest military in the world (at the time) and were able to create an even larger empire.

It's not hard to make them give up. It's going to be a cat and mouse game but it already is

There's not enough people to care.

They have the propaganda advantage (think of the children, those who undermine the system are pedophiles by definition). They have the law (just reclassify such activity as aiding and abetting the distribution of child pornography). They have the scare tactics (nobody wants 30 years in prison and an entry on the sexual offender's register).

This war will be won with words and at most a few arrests, just to make an example, just like the war on terror and anonymous financial activity.

Privacy just doesn't matter for 99+% of the population as much as we think, which is very much unlike piracy or drugs for example. If this wasn't the case, we'd all be using Signal and Monero right now.

  > There's not enough people to care.

But what, you're going to give up without a fight?

Even if you won't fight then why fight for your enemy by telling others not to fight?

This comes to mind at once: https://meshtastic.org/

But yes, your point is largely valid as long as enough people are willing to jump the ship.

So does the original thing I mentioned

https://reticulum.network/

I appreciate what you're trying to say, but here's a counter-example: .22lr ammunition is also extremely inexpensive per unit, but I can't buy that at all in Ireland without extensive, recurring background checks and a demonstrated continuing need for access. If a government decides you don't get to have something, they are well within their power to effectively eliminate it. I can no more make an ESP32 at home than ammunition. I reckon it's harder, in fact.

[To the government Cornholio reading this and panicking because I mentioned a gun thing: no, I'm not threatening you.]

As long as there's a country willing to build and sell ESP32s, I think it would be fairly easy to get hold of them. How does a customs agent distinguish between an ESP32 and another microcontroller? These things are in every gadget. Is a government really going to ban all electronics?

Just look at how ineffective governments are at stopping drugs. If people are motivated to smuggle things, they will. Is there going to be a booming black market in ESP32s? Probably not. But will motivated people manage to import them? Almost certainly.

First off, guns aren't a subcomponent of a vast majority of modern items. The ESP32 was an example but the reality is anything with a radio. Be it WiFi, Bluetooth, or anything.

Second off, guns are incredibly easy to make. Easy enough that they make them in prisons and Japan. But you know what's a million times easier than that? Radio. It's a common first electronics project. You can literally make it out of a few resisters, capacitors, and some wire.

Literally the cost of fighting this type of technology is taking down all wireless infrastructure. ALL of it. And even then it's still a god awfully expensive thing to fight because anyone with a hot pointy object, an electricity source, and some things that are slightly bad at conducting electricity can make a radio

>As long as there's a country willing to build and sell ESP32s, I think it would be fairly easy to get hold of them.

You could say the same about firearms.

>Is a government really going to ban all electronics?

All electronics that can be freely programmed by the owner, not impossible.

  > All electronics that can be freely programmed by the owner, not impossible.

Even Google and Apple can't keep themselves from getting jailbroken. You think that's going to be true about a $5 toy with a WiFi or Bluetooth chip in it.

It'll be too expensive

The power imbalance is not in favor of the individual citizen. Fairly simple to enact a law saying "unlicenced importation of electronic devices is an offence", only license major retailers, and have Customs seize anything that doesn't come with the right paperwork attached (which they already do). Drugs are far easier to make than silicon chips, despite how clever people like Sam Zeloof may be.

To have a firearms permit here, I need a "Good Reason" - that's the language from the law verbatim. "I like guns" is not a Good Reason. In that vein, what would be your Good Reason for receiving an import license to bring in technology which is apparently widely used by radicals to defy duly-ratified legislation about communications visibility and enable the creation of side channels which break the law and can be used to proliferate CSAM, drugs, and terrorism? I'm sure any sane person would agree that those are bad things which need to be stopped. Perhaps you should take up a different hobby, like jogging.

And there we have it!

  > despite how clever people like Sam Zeloof may be.

  > The power imbalance is not in favor of the individual citizen.

1. Nobody cares enough to do all this except some nerds on HN.

2. Spurious radio transmissions from your spark gap set will be tracked down in an afternoon by government foxhunters, and then you'll be in jail for breaking the law.

I don't understand why people think they can meaningfully kinetically resist. The discussion now needs to be convincing the random voter why this is a problem for them, or the game is lost.

Anyone remember when the discussions about classifying the internet as a utility and Akit’s stupid Reese cup coffee mug. It feels so long ago given how much has transpired since.

MeshCore is spreading quite rapidly - it uses solar powered repeaters and that helps a lot. :)

I'm kinda sold by reticulum since it's independent of a lot of factors. You can also bridge it with meshcore or meshtastic.

This is exactly the argument that is (correctly) levied against firearm restrictions.

https://www.youtube.com/watch?v=XTnYVh7K6xQ

There are (to make up a number) ten desirable properties of the modern internet, and so far it's "Pick two", but novel combinations of the things you mentioned offer "Pick three" or possibly "Pick four" if adoption picks up.

For text, phone, and even image communication in urban and suburban areas, it sounds like there's real promise here. But we're not going to achieve parity with a global fiber + datacenter network by any means.

You don't need all ten to, say, organize a revolt.

Hell, I don't know why we don't just start building a guerrilla network around the Bay. Just start gluing repeaters to things. You could do LoRA like in that video but even WiFi has decent range. Maybe not in the km range but it's also a $5 device. And we don't need to limit ourselves to that cheap of stuff.

We don't need to replace global fiber, we just need to demonstrate enough to inspire others. I'd be perfectly happy if we got just an old web text only system up.

Honestly, would be a lot easier if we could get encryption rules lifted from HAM operations. That's what's needed for long range, even if we won't get the high data rates. We don't need a YouTube to make a difference

> So when are we going to build a new internet?

Finally, the year of IPFS. Government messing too much with the internet will end up pushing people to use more "dangerous" internets that are completely unregulated and that is surely the opposite of the the stated purpose to protect young people.

IPFS doesn't even try to do any kind of anonymity or censorship resistance. In a practical sense it's probably worse than BitTorrent, although neither one of them is up to the task. Actually resilient data distribution is hard, and I don't think there are any systems that have all the needed elements.

... and if you create one, they can, and it's starting to look like they will, outlaw using it, regardless of what you use it for.

I should have said "I2P" instead of "IPFS".

A new internet to do what? What is the proposed goal of a new network?

The internet is a global communication system. So to do what? To do exactly that. The difference though is that it isn't controlled by anyone. It doesn't need to be, so no one needs to have that power, no one should have that power. A global communication system where conversations are private by default, just like they are online.

The problem with the current system is that the information was just too free. You could just drop in on anyone's conversation, like it or not. People started hoarding that information and look what we got: surveillance capitalism. The system reinforces itself to watch you, to tell you what to do, what to think, not just what to buy. And the system just wants to keep growing, so it's just going to continue to do that more and more. Sure, there's some nice things we get for the loss of all our privacy, but it comes at the cost of your humanity. They'll be costs to this new system too. It won't be all rainbows and sunshine, but I think it'll be better than this gloomy smog ridden world we have now.

We live in a time where it's actually possible to have a functioning world with no kings. Personally, I'm tired of them, aren't you?

The infrastructure requirements around routing and switching equipment, transoceanic cables, and satellites mean someone not users has always been in control. Barring some form of anarcho-socialist mass movement around DIY long haul networking infrastructure this seems unavoidable.

The problem with the current system is the intersection of human nature and capitalism. Individuals have willingly adopted technology that aggressively surveils them in exchange for notional convenience and by and large are blandly unconcerned with the implications thereof. This also seems unavoidable as long as data collection and brokerage is permitted and profitable, and people value entertainment over critical thinking. This outcome was very accurately predicted by netizens when online advertisements first started popping up and a lot of time was spent wargaming what would happen if mass adoption lead to the net being a viable sales and marketing target.

After 35 years of observation I've had about enough of global communications systems and everything that comes from them. At this point there is very little one could say to convince me that the internet hasn't been one of our species largest fuckups.

I would assume it would be not be regulated by government, so without constraints on age, restrictions on what you can do - you know, like reality.

And I know that government attempts to regulate reality too, but if you drive at 35 where the limit is 30, or speak to someone dodgy to get some marijuana or whatever, and get away with these and other heinous crimes, you're good!

The distinction really is whether you bake regulation into the technology or not. And it seems that technology is actually the new legal system. Or perhaps that should be the 'pre-legal system' as it won't allow you to do those things it determines as 'wrong'. Which is absolutely fine if you think government really does know best, or hell on earth for everyone else.

The last 35 years have very vividly demonstrated that there needs to be some adults in the room. Without exception every major tech company has implemented practices so overtly hostile to the userbase that the government has been more or less forced to get involved, mostly in the form of fines that have done very little to disincentivize whatever problematic bullshit the company in question was originally caught at. Suggesting that even less regulation would somehow magically cause tech firms to align goals with their userbase seems baseless to say the least.

You seem to think that government and corporations are on opposing sides. I don't think this is the case. Governments want the data corporations collect. Both are encouraging the other. There are no adults in the room. Having (corporate or government) children in control of that every individual's private information won't help.

I assure you I think no such thing. I am painfully aware of legislative capture. Proposing an environment where we go from shitty, poorly enforced regulation to none at all solves nothing. It's also worth pointing out that government performing poorly is an indictment of the individuals elected to govern, not the concept of governance.

>regulatory capture

It's not other operating systems fault that they failed to invest into security. They should try and catch up instead of blaming people for not trusting their security on "regulatory capture".

Buddy, you're on HN. No one is going to buy that bullshit here. Thanks for the laugh, but seriously, don't insult us like that again. We may be dumb, but not that dumb

Which is exactly why I have to advocate for it here. There are literally people on this website who think their operating is secure, but in actuality they are one curl | bash or npm install away from having all of their login credentials stolen. No matter how smart they think they are in being able to avoid malware, that strategy does not scale.

Bubblewrap containers to keep all of my environments separate on my laptop works just fine without giving up control to Google.

You are also one lockpick away from having all valuables in your home stolen. So what?

And if competitor locks were unpickable it wouldn't be regulatory capture to require unpickable locks for people to store valuables in a home. Just because people got away with bad locks for many years, that doesn't mean we have to accept that level of security.

> EU's planned system requires highly invasive age verification

EUDI wallets are connected to your government issued ID. There is no "highly invasive age verification".

We are literally sending a request to our government's server to sign, with their private key, message "this john smith born on 1970-01-01 is aged over 18" + jwt iat. There are 3 claims in there. They are hashed with different salts. This all is signed by the government.

You get it with the salts. When you want to prove you are 18+ you include salt for the "is aged over 18" claim, and the signed document with all the salts and the other side can validate if the document is signed and if your claim matches the document.

No face scanning, no driver license uploading to god-knows-where, no anything.

> to obtain 30 single use, easily trackable tokens that expire after 3 months

This is the fallback mechanism. You are supposed to use bbs+ signatures that are zero knowledge, are computed on the device and so on. It is supposed to provide the "unlinkability". I don't feel competent enough to explain how those work.

> jailbreaking / "prevent tampering"

This is true. The eidas directive requires that secret material lives in a dedicated hardware / secure element. It's really not much different than what a banking app would require.

> You have to blindly trust that the tokens will not be tracked

This is not true, the law requires core apps to be opensource. Polish EUDI wallet has been even decompiled by a youtuber to compare it with sources and check if the rumors about spying are true. So you can check yourself if the app tracks you.

Also we can't have a meaningful discussion without expanding on definition of "tracking".

Can the site owner track you when you verify if you are 18+? Not really, each token is unique, there should be no correlation here.

Can the government track you? No, not alone.

Can the site owner and the government collude to track you? Yes they can! Government can track all salts for your tokens, site can collect all salts, they can compare notes. There are so called policy mitigations currently: audits and requirements for governments to remove salts from memory the moment stuff is issued.

Can they lie? Sure.

Can the site owner and the government collude to track you if you are using bbs+? No. Math says no.

Can they lie if you are using bbs+? Math says no.

> Can the site owner and the government collude to track you? Yes they can! Government can track all salts for your tokens, site can collect all salts, they can compare notes. There are so called policy mitigations currently: audits and requirements for governments to remove salts from memory the moment stuff is issued.

It's not zero knowledge for me then. Also - if there is ANY possibility to track anyone. And/or centrally mark someone "nonverified" then it makes more problems than solves.

Even if I trust my govt (no way), even if it'd be fully ZK with no way to track anyone… still govt would have a way to just block some individual "because".

And the best part… Age verification will not solve "children problem". I think it's parents problem to take care of their children, AV will be pretty easy to bypass - kid will just borrow ID for a moment and… voila! Govts (or some people) are creating problem and solution that do not exists.

I do not like way internet went, I do not like more way it's headed now.

I'll bite.

> It's not zero knowledge for me then. Also - if there is ANY possibility to track anyone. And/or centrally mark someone "nonverified" then it makes more problems than solves.

> Even if I trust my govt (no way), even if it'd be fully ZK with no way to track anyone… still govt would have a way to just block some individual "because".

Is this even actually possible? If you want any sort of identity verification you HAVE to trust someone, whether age or full ID. Literally impossible.

Zero trust systems in society don't work. If you don't care "who" then yes, zero trust is just fine... but then what's the point of "age verification"?

The whole point is that mandating websites to require age verification is more authoritarian than people are pretending it is.

I was more responding to the part about not trusting your own gov cuz how do you build a system where you don't trust a central authority when identity is required.

I don't think it's possible.

You have to trust someone to verify age.

You don't have to trust somebody not to track how the resulting credential is used. And that is what "zero knowledge" means. It means that after you finish the protocol, nobody has learned anything but what they were supposed to learn (in this case, "the person at the other end of this connection is over 18"). If it leaks anything else about the person, it's not zero knowledge. If somebody learns which of the issued credentials was used, it's not zero knowledge. If parties can collude to get information they're not supposed to get, it's not zero knowledge.

It's a technical term of art, not some politician's bullshit. And it isn't complicated to understand.

> This is not true, the law requires core apps to be opensource. Polish EUDI wallet has been even decompiled by a youtuber to compare it with sources and check if the rumors about spying are true. So you can check yourself if the app tracks you.

The "open source" apps connect to proprietary backends run by a third party that you have to blindly trust. If EUDI wallets were truly open source and free from blindly trusting any authority, then you could simply remove that requirement and issue your own tokens without the use of potentially malicious third party.

> issue your own tokens

I mean, you can. It's like with TLS certificates. The standard is there. The code is there. You can issue your own.

The question is, who will trust you?

It is not at all like TLS. With TLS you at least can get your own certificate signed by an official CA, and use that private key on whatever system you want.

It is literally TLS in a trench coat with some json sprinkled on top.

Where I think we are not in agreement the question of "who to trust" and "for what purposes".

Are you going to trust me when I tell you that I'm over 18 if I provide you with the document signed by my cousin, Honest Ahmed?

Are you going to trust me when I show you the document signed by my government?

(this is the trick question, you don't have a choice, law says you must; there's a list of who you need to trust and for what purposes; like a certificate root store in your browser)

You forgot to mention the additional remote attestation shackles you put on that trenchcoat.

Note that I - as opposed to the posts parent - used an official trusted CA as an example.

TLS: I see your ID with some governments signature in your hand, I trust you to be you. EUDI: I see a note you wrote and I see some signed documents that you have just been to the government brain scanner, which attests you are not faking that note, and as a nice side effect the scanner scans other things in your brain, e.g. that you watch every advert diligently, send your current location regularly to your local police office and other things.

The problem is you are not creating a government issued single purpose device but you are confiscating something many user experience as a brain extension to be under the government's control as a whole.

> if I provide you with the document signed by my cousin, Honest Ahmed?

You surely mean Honest Achmed? He gets a bad rap: https://bugzilla.mozilla.org/show_bug.cgi?id=647959

> It's really not much different than what a banking app would require.

I can use my banking services through the web. Codifying the Google/Apple monopoly in law is gross.

> I can use my banking services through the web.

Not for much longer. Stealing your data on mobile device is way too lucrative for the banks to pass on. All while pretending it's done for security.

Sadly true, while scammers run rampant regardless. It’s depressing to watch everything get worse.

Many banks have gone the way of requiring 2FA on an unrooted phone, but giving you a way out by also offering you 2FA via smartcard (using a smartcard reader and a bank-issued card). I suspect a similar thing could be done here, with the smartcard providing the trusted hardware/secure element?

In the context of world politics and the hunt for sovereign hosting etc it also seems incredibly weird to put all of EUs identity handling in the hands of two American companies.

For clarity, the US could over night make all European digital wallets nonfunctional by requiring app stores to remove them and have them uninstalled remotely (iirc there is such a feature but it’s very rarely used). Likely? No, still a very strange thing to put into law though.

> Government can track all salts for your tokens, site can collect all salts, they can compare notes.

That is not zero knowledge. Given that actual zero-knowledge systems are well understood, the only reason to deploy a system that allows that would be if you planned to abuse it.

What is your definition of zero knowledge?

https://en.wikipedia.org/wiki/Zero-knowledge_proof

By this definition bbs+ signatures are ZK.

Zero knowledge in such a system requires a minimum of 3 independent parties. There are quite a few solutions out there, I think the most developed ones are online voting systems, because tracking and de duplication is essential.

The impossibly high bar they set "Perfect" at in order to make it the enemy of good, and fight against any progress being made to keep children out of adult spaces.

That being said, it's my personal opinion that I'd love to simply have my device store a token and send it to any site when requested. I'd then like those sites to give me toggles to remove all non-verified content - and therefore my internet experience could be sans-juvenile squeakers.

> This is true. The eidas directive requires that secret material lives in a dedicated hardware / secure element. It's really not much different than what a banking app would require.

Except the state is not a bank, of which there are many. The state is not optional, and trusting an American company with, of all things, the digital precondition for social existence, is suicidal.

> This is true. The eidas directive requires that secret material lives in a dedicated hardware / secure element. It's really not much different than what a banking app would require.

Most banking apps run on GrapheneOS, will this? Nearly all EU banking websites run on Firefox on Linux, will this?

Why did you not quote the App Store/Google Play Services part, which is much worse?

> There are so called policy mitigations currently: audits and requirements for governments to remove salts from memory the moment stuff is issued.

I'm sure this will be as diligently carried out as GDPR enforcement. [0].

[0] https://noyb.eu/en/project/dpa/dpc-ireland

> jailbreaking / "prevent tampering"

Now your EU government requires you to have an unmodified Google or Apple device to use any age restricted services. Cementing the US mobile OS duopoly and locking out any free systems and desktop etc. forever.

Any governmental service taking part in this is a violation of civil rights and even if you don't care about those, maybe you care about digital sovereignty.

This is so lightly handwaved away, almost as if attention needs to be drawn away. By the looks of this I'd say the end of general computing might be the actual goal, and all the age verification is just yet another "think of the children" pretense?

I totally agree that one of the biggest vulnerabilities in EU digital ID scheme are US corporations :).

At least that establishes that you don't care about civil rights :|

*corporations in general

Great comment all around but

> jailbreaking / "prevent tampering"

> This is true. The eidas directive requires that secret material lives in a dedicated hardware / secure element. It's really not much different than what a banking app would require.

This is unacceptable. So much talk about independence from the US, you simply cannot make it a hard requirement to use the duopoly to be a citizen (as if it wasn't a quasi-hard requirement already)!

Funny how they just handwave it like it's a totally normal thing, like the insane situation with banking apps. Most people don't care as they run with whatever's available without modification, but we still should fight for the right to run the code we want on devices we own.

Consider the car analogy: if you want to drive on public roads, you need to drive an attested, unmodified vehicle that complies with the relevant regulations. If you want to play around and modify the car, that's fine, but then you don't get to use it around other people. You're also not allowed to buy some random, unknown Chinese or Indian car and drive it on the road. People already accept this when framed as a safety issue. I suspect they care more about their cars than their phones, and won't care about the requirements on the phone anyway because they're not planning to modify it, and as long as WhatsApp and Instagram keep letting them exchange shopping list additions and pictures of vacation cocktails, then what's the problem?

To be clear, I'm not in favor of a participation-in-society ban for jailbreaking your phone, but there's already precedent for it.

The analogy is a bit shaky IMO, as you can certify individual, heavily modified, foreign or even self-built cars in EU member states.

For cars, the local certification authority themselves decides what is road-worthy or not, not VW et al. You can add third party parts without the manufacturers consent. This is not the case for Android or iOS attestation, you're pretty much at the mercy of the foreign manufacturer and their local laws.

May I infer from your response that your quarrel is not with a central authority having the final word in what code you're allowed to execute on your own device, but rather that it should be the government and not a corporation signing the binaries that are permitted to run?

If you're expecting a perfect analogy, you're not going to find one. Law in its application also doesn't deal in exactness, but in generalities and vibes: that's why lawyers argue, and judges decide.

I'm familiar with the process for individually certifying unique and modified vehicles in several European countries. Invariably, the process is costly and onerous, which serves as a deterrent.

Cars can and do kill 1,500,000 people every single year, equivalent to a jumbo jet full of people every couple hours, plus an equal number of crippled and injured, plus untold number of pollution deaths. That's a ridiculous comparison (if anything cars are not regulated enough). Who am I endangering when running microg on my phone??

I will continue advocating for the devil, then! These are the top bogeymen we need to thwart in order to protect...

-children and women, harmed through unregulated and unobserved communications enabling human trafficking and the spread of CSAM.

-social healthcare systems, harmed by enabling the proliferation of illegal drugs, which leads to the over-taxing of an already straining public good, reducing access to people who would need help outside of drug-caused issues.

-society at large, harmed by enabling drug-funded terrorists to trade in weapons and coordinate their destructive actions out of sight of law enforcement.

For your and others' safety, please leave your signing keys at the door.

> We are literally sending a request to our government's server to sign, with their private key, message "this john smith born on 1970-01-01 is aged over 18" + jwt iat. There are 3 claims in there. They are hashed with different salts. This all is signed by the government.

If the "18+ claim" can't be linked to your identity and doesn't have any rate limits, someone can set up a token-as-a-service to sell tokens on the black market.

> Government can track all salts for your tokens, site can collect all salts, they can compare notes. There are so called policy mitigations currently: audits and requirements for governments to remove salts from memory the moment stuff is issued.

> Can the site owner and the government collude to track you if you are using bbs+? No. Math says no.

How does the math say no? Big tech companies already log absolutely everything. What's going to stop the government from keeping all the salts they're issuing and then mandating that site operators add the salts to their existing logs?

> Can they lie? Sure.

Well, they've lied to us over and over when it comes to surveillance, so I think at this point it's reasonable to assume they're lying unless it's technically impossible. Where's the in-person key verification that used to be in Whatsapp? How do the authorities get notified when someone makes a poorly thought out joke using Snapchat private messages before getting on a plane? Why is there a war on end-to-end encryption?

We're going to pay a fortune for these supposed zero knowledge systems and that's what it's about. Select companies are going to get paid to issue tokens and the scale is going to create a few new billionaires.

The people in charge are going to gain a ton of power when they betray everyone and disenfranchise us.

> someone can set up a token-as-a-service to sell tokens on the black market

They can! Singing requires either PIN or finger on the fingerprint, and signed "proof" is valid for like 60 seconds. This whole end-to-end attestation with play integrity is supposed to make setting up token-as-a-service things impractical.

> What's going to stop the government from keeping all the salts they're issuing and then mandating that site operators add the salts to their existing logs?

> How does the math say no

BBS+ signatures. Hashes you receive from the government and hashes you send to the site operator are different and not correlated.

> Singing requires either PIN or finger on the fingerprint, and signed "proof" is valid for like 60 seconds. This whole end-to-end attestation with play integrity is supposed to make setting up token-as-a-service things impractical.

So how would I use this on Linux then? Because I'd be rather unhappy if a bunch of websites became unusable on Linux due to government-mandated security restrictions.

My (Canadian) government's health portal already refuses to load if you use Linux (despite it being 100% web-based), meaning that I'm completely unable to book vaccinations or view procedure results without workarounds. Luckily it only checks the user agent, so it's pretty easy to override this right now, but that wouldn't be possible if cryptography/attestation were involved.

> how would I use this on Linux

Governments and businesses have already decided that it's fine to mandate that you own an unmodified smartphone made by one of the major manufacturers, so it's not much of a stretch to assume that they will also eventually require you to run an attested OS image made by one of the two major manufacturers. The fact that some run Linux internally isn't going to help your case: governments do a lot of things internally that you're not allowed to do. I used to watch cops in Amsterdam park on the sidewalk to go get a kebab, for example.

> We are literally sending a request to our government's server to sign

You've already lost. You're at the government's mercy. They can simply refuse to sign.

"Mr. John Smith, we noticed you've published some poorly-worded comments online. Why are you locked out of your account, you say? Oh, that's just an unfortunate technical issue with our signing system, happens all the time. Anyway, this is a friendly reminder for you to improve your online etiquette. Have a nice day."

There's really two cases here.

You live in a democracy?

YES) the violation you describe is verifiable to a journalist. You publish story, and you keep the government accountable.

NO) Why are you even discussing if age verification is a good idea or not, you freak. It's not really up to you anyway. Go fix your country first.

You mean the journalists that are pro age-verification and pro banning everything that's slightly critical and constantly demonize everyone going against them?

Or you live in a democracy so you throw a fit until your government backs down. No amount of journalists is going to change the US or the UK at this point.

Plenty of democracies in Europe and elsewhere regularly and repeatedly fail to actually represent the desires and interests of the citizenry, but they keep getting reelected anyway. Why should this time be any different?

I'm sure they do fail, but at least they have the theoretical ability for citizens to more directly challenge crimes comitted by the government itself. Unlike the U.S., which removed it by statutes, most other common law countries, and all civil law countries, citizens retain the ability to force criminal prosecution (either by private prosecution or by appeal to a magistrate with proof a crime has been committed).

I have no idea what this has to do with the EU implementing age verification because politicians want it, and the powerlessness of EU citizens to arrest or impede the government's machinations. Feels Gish Gallopy.

What I can say that's at least tangentially relevant to the topic at hand is that I've lived for a couple of decades in both the USA and the EU, being a citizen of both, and have found Americans generally much more politically informed and involved. I find Europeans, particularly Irish, very well informed about U.S. politics that they are powerless to influence, and next to oblivious of anything going on at home. Given that Ireland has the EU Presidency right now and is choosing to use its bully pulpit to advocate for British-style draconian Internet regulation, that's doubly a shame.

Do you trust today's democracy to be a democracy tomorrow?

Never. Cede. Ground. You'll never get it back, and one day the rights will be gone.

Age verification in Australia had like 70% popularity.

That is an astounding consensus in a system which regularly decides elections by 51%.

You're not getting mandated from up high: it is democratically enormously popular to do this.

Australia has two major parties that agree on absolutely everything, and a virtually non-existent civil society. No true free debate can take place in such circumstances. The Australian government loves falsely claiming a popular imprimatur for policies that have never been properly debated or put before the people.

The only reason we have any rights left is because the Australian government is - thankfully - comically incompetent.

"Australia is a lucky country" is a quote every Australian knows. Few know the full quote: "Australia is a lucky country, run mainly by second rate people who share its luck. It lives on other people's ideas, and, although its ordinary people are adaptable, most of its leaders (in all fields) so lack curiosity about the events that surround them that they are often taken by surprise." - Donald Horne.

I encourage all my teenage countrymen to use as many social media apps as they desire. Mullvad is a decent VPN and you can pay for it anonymously. Freedom of speech and freedom of association are your human rights. No government gets to take them away from you.

That's a fallacy. You don't have any evidence to support the claim that this system of age verification is popular and more importantly, whether it would remain popular if people had a full understanding of how it worked and how it can be abused.

It might be popular to have age verification conceptually and only as long as it's only used "as advertised", which is not the same thing.

This is one of the biggest issues of democracy. As long as your propaganda machine is strong enough (and anti-privacy propaganda is one of the strongest) you can pass just about anything and pretend that society put on the shackles of surveillance and coercive control voluntarily.

People just submitted it. I don't know why. They "trust me". Dumb fucks.

No you're switching intent around here: age verification for social media is very popular.

Whether any given implementation is popular is a different question.

But people aren't attacking implementations: they're attacking the concept as though people don't want it.

But in surveys they do: by a huge margin, politically.

It's like how a generic candidate tends to reliably poll higher then a specific person.

"Why does this keep coming up" has the trivial answer of "because people overwhelmingly keep asking for it".

You can complain about the people being decieved if you want, but they still vote regardless.

Thanks for posting this.

The inherent problem with all zero knowledge identity solutions is that they also prevent any of the safeguards that governments want for ID checking.

A true zero knowledge ID check with blind signatures wouldn't work because it would only take a single leaked ID for everyone to authenticate their accounts with the same leaked ID. So the providers start putting in restrictions and logging and other features that defeat the zero knowledge part that everyone thought they were getting.

> A true zero knowledge ID check with blind signatures

That is not true and "true zero knowledge ID check" + "age verification" with blind signatures is what's being implemented by the EU ID project.

So someone's id leaks. It happens. In EUDI there are things called "cryptographic accumulators of non-revocation proofs". If your ID leaks it goes into the accumulator. Similar to the certificate revocation lists. During check, you include claims "im over 18" and "my id is not in the accumulator".

This is included in the standard.

This is also (I can only assume) one of the reasons why EUDI wallets require play integrity / attestation / secure element on the device. So your private key won't be easily leaked and no one can steal your ID.

You're assuming the leak was accidental, the person knows about it, and they didn't intend for others to use it.

What happens when someone sets up a marketplace where people can sell those blind signatures using their ID for $2 each? And then kids just pay $2 to have someone else blindly use their ID to validate the account, because supposedly the system is structured so that nobody can tell which ID was used or tie it back to the account?

E.g. the German ID card can all on it's own, just using a server certificate configured/parametrized for this and signed by the government, do a simultaneous pseudonym passkey mint and age gate check. That way you could easily block ID reuse; note that the passkey is locked to the card not the person as it's cryptographically derived from the pair of the card's private internal key, and the server's private key that goes to the certificate.

Access to this part of the card is secured by PAKE between the transport layer (TLS) encrypting and user interface providing NFC reader (for example phone with the app, or dedicated hardware) using a PIN.

That's where the google play integrity / attestation comes into the effect.

In theory you cannot export your private key from the device (from the secure element), so for each $2 someone would have to quickly unlock their phone, scan code via the app and so on.

Private keys from secure elements leak all the time. There will be a flawed implementation that someone exploits, an insider will smuggle a key out etc.

This is why true zero-knowledge systems for this sort of thing aren't practical and will never be. Because a SINGLE leak will break it and there will be no way to even detect it.

The attestation systems you reference don't even allow true zero knowledge attestation, they involve a trusted intermediary to convert your burned-in private key to a temporary key which you use for attestation with a third party.

And the temporary key isn't even a product of a blind signature. And it's rate limited. So if a service selling these temporary keys shows up they will be able to easily trace it to the burned-in key responsible - then revoke it and if possible initiate legal action.

This also means that whenever you register to a service using one of these schemes you are registering with your real identity, it's only a question of how hard and how many parties need to collude to extract it.

And in the event that they really do blindly sign tokens generated on your device, then their scheme will not survive adoption. As it gets adopted, the value of these blind signatures will rise and services that sell them will pop up. There will be no way of tracing the sold blind signature to the compromised/colluding device and rate limiting will merely necessitate a farm of such devices as opposed to a single leaked key.

*Note that Blind Signatures are Zero Knowledge.

Can you tell me when a private key has leaked from the Secure Enclave on a iPhone?

This specific problem is solved by requiring that any anonymous ZK ID once used for an account be marked on an immutable ledger preventing multiple uses of the same ID. Sharing it would be pointless as multiple attempts to use it get burned. Yet none of those sites know who you are, only that you have a unique valid ID pass. They just have to check any login attempts against that ledger - easy enough.

> They just have to check any login attempts against that ledger - easy enough.

So like CT logs, but several orders of magnitude bigger? I thought centralized TLS revocation lists failed due to scale. How will this differ?

Just crypto tie them to the server/site and let them do it, CRLs were an issue due to distribution to every device, not because of a hastable like sparse set structure being too much. Also this isn't every connection, but only every time you (attempt to) verify your age.

I mean that's kind of a problem with ANY solution. There will be workarounds and ways to break it. There is no perfect solution outside someone standing over you while on the internet. We need to look at this more like age checks on porn sites and gaming platforms where you just put in a birthdate. Obviously someone can lie, but that point isn't to be a perfect wall but a hurdle to clear to make sure users are aware of the content and that any sort of nanny software to block if set up.

> I mean that's kind of a problem with ANY solution. There will be workarounds and ways to break it.

That's unnecessarily reductive.

Yes, every solution will have problems, but not all solutions have similar problems.

If a solution has problems such that it can be immediately reduced to security theater and bypassed by any teenager who cares, it's just extra hassle and privacy degradation for the rest of us.

These details matter. If a weak solution is regulated into law and the government discovers kids are easily bypassing it, they will immediately pivot into requiring more restrictions on it.

Extra hassle is manageable. Sites or programs that want you to put in a birthday are extra hassle but objectively better than something like submitting an ID. Privacy degradation is also manageable as well. It just depends on the solution.

We've had decades of age gating being "are you 18+ or not" yet it is only now that talks of something more enforceable are coming up. This discussion is largely about how one can create a sense of safety and protection. For the more extreme end it's face scans and submitting ID. Even though these are bypassed by any teenager who cares they are still being pushed seriously because it instills that sense of safety and protection for children. Security theater is just a part of managing the internet and not going away unfortunately.

> age checks on porn sites and gaming platforms where you just put in a birthdate

That's the only solution that truly protects user privacy and security. Video games and especially mature content should not require age verification. People's lives can be permanently destroyed over perfectly legal sexual fantasies, and thus anything that increases the risk of the information being tracked is unacceptable.

> It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering".

IIRC that was only for a prototype or reference implementation.

> It also bans jailbreaking/rooting your device, and requires GooglePlay Services/IOS equivalent be installed to "prevent tampering".

The EUDI spec is tech neutral.

What the EUDI mandates is a high level of assurance under the eIDAS 2.0 regulation and the use of a secure element or a trusted execution environment to store the key.

I'm sorry to say it but the fact it bans jailbreaking/rooting your device really makes me believe "think of the children" isn't their real goal.

There's some clever kids out there but come on.

Link?

https://github.com/eu-digital-identity-wallet/av-doc-technic...

https://www.forbes.com/sites/federicoguerrini/2025/08/10/who...

I feel like you're glossing over a lot of uncomfortable but important implementation details here. None of this works without effectively banning personal computing and tying the whole system to secure attestation (which in practice means non-jailbroken apple & android devices). No thanks.

Can we go back to defaulting to parenting instead of nanny-states? Maybe make "age sensitive" websites include this fact into a header (or whatever) so that parents can decide who in their household can access which content. Instead of having some overreaching corpo-government implementing draconian "verification" systems.

If I want to live under the thumb of a strongly verified "benevolent" dictatorship, I'll move to China. No need to create a second China at home.

> It derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information such as the date of birth.

How? If it’s analyzes my ID 100% client side I can fake any info I want. If my ID goes to a server, it’s compromised IMO.

I think the zero proof systems being touted are like ephemeral messaging in Snapchat. That is, we’re being sold something that’s impossible and it only “works” because most people don’t understand enough to know it’s an embellishment of capabilities. The bad actors will abuse it.

Zero proof only works with some kind of attestation, maybe from the government, and there needs to be some amount of tracking or statistics or rate limiting to make sure everyone in a city isn’t sharing the same ID.

Some tracking turns into tracking everything, probably with an opaque system, and the justification that the “bad guys” can’t know how it works. We’ve seen it over and over with big tech. Accounts get banned or something breaks and you can’t get any info because you might be a bad guy.

Does your system work without sending my ID to a server and without relying on another party for attestation?

There's no dynamic analysis done, necessarily. In the Swiss design, fex, SD-JWTs are used for selective disclosure. For those, any information that you can disclose is pre-hashed and included in the signed credential. So `over_18: true` is provided as one of those hashes and I just show this to the verifier.

The verifier gets no other information than the strictly necessary (issuer, expiry, that kind of thing) and the over 18 bit, but can trust that it's from a real credential.

That's not strictly a zero knowledge proof based system, though, but it is prvacy-preserving.

The issuer knows everything and can help track if the wish to. The issue here is lack of trust in any corporate or government entity.

Well, yes, if they use something completely different to what's published and designed.

But no, we're not talking about the case where there's no trust at all in the government, because then you don't get verifiable credentials at all. We're talking about building privacy-preserving credentials that actually have a use.

> If it’s analyzes my ID 100% client side I can fake any info I want. If my ID goes to a server,

amplifying your point, there is effectively no way for the layperson to make this distinction. And because the app needs to send data over an encrypted channel, it would be difficult at best for a sophisticated person to determine whether their info is being sent over the wire.

> And because the app needs to send data over an encrypted channel, it would be difficult at best for a sophisticated person to determine whether their info is being sent over the wire.

Devices are built from the ground up to prevent even sophisticated users from tapping them to verify we aren't being lied to. The average person thinks that "hackers" will mobilize if things get too bad and they're completely wrong.

Tamper proof, encrypted chains of trust start from the second a device gets power and it's infecting everything from appliances to phones to computers. Get ready for a future where your rented toaster has parts serialization that can't be bypassed.

Oh -- how do I ensure that the device is running only the software I installed, with exactly the patches I added, rather than a possibly malicious vendor -- for example, if the local government of the country I'm visiting has a court order for phone vendors to silently backdoor phones, it would be nice to know that only the software I personally signed is running.

As someone that patches their OS on the regular, this would be pretty interesting.

This is a fairly weak argument though: the layperson also cannot verify the software updates we push to their phone/computer or any number of other critical devices in the chain.

All of this is reputation management: if technical experts broadly agree the system does what it says, then all of us have to accept that in aggregate that's probably good enough and significantly better then many other areas.

Yes it does actually. You load your ID into your phone with the MRZ and NFC. The cryptographic proof inside your ID is used to verify that it was issued by an official government. So your ID is not being sent to a central server.

The reusing another ID is an issue. In some countries they will have a in person check to verify only you can load your ID into your phone. But then you still have the problem of sending a verification QR code to someone else and have them verify it. This might be solved by rolling time-gated QR codes and by making it illegal to verify someone else's verifications. But this is a valid concern and a problem that still needs solving.

Attestation from government sounds like the ideal solution. This could actually provide _more_ privacy because we can begin using attestation for things we currently use IDs for such as “Has the privilege of driving a car” or “Can purchase alcohol”

Amazing how fast these systems go from "zero knowledge" to "route the request through the government system every time you use your ID"

there is no "route the request through the government system every time you use your ID".

you get your sd-jwt document signed once and you reuse it for like 30 days or so.

I was responding to the comment above mine, which was calling for attestation from the government for specific privileges.

> you get your sd-jwt document signed once and you reuse it for like 30 days or so

So it still gets routed through the government once a month if you plan on using it.

Yes we are still talking about attestation from the government for the specific privilege part.

You get your document with fields like "can drive", "is over 18" and so on. It's valid for some time; physical ID is valid for like 10 years and then you have to get a new document, this digital one is valid for lets say 30 days and if it expires you get a new one.

Then you present only those fields you want, when you want, without anyone talking to the government at all. All the other party needs to check is "is the document valid" and "do presented fields match the document". Like checking a tls certificate for a given domain name or purpose.

Strictly speaking there is no "routing through the government" of any information. The government just "issues a certificate" valid for X days without knowledge with whom, how or when you are using it.

> Strictly speaking there is no "routing through the government" of any information. The government just "issues a certificate" valid for X days without knowledge with whom, how or when you are using it.

I don't understand how you keep claiming there is no "routing through the government" right next to your explanations that the government is the one providing the documents every 30 days.

Obviously something in the document is tied to your ID and the government has mechanisms to revoke it. No matter how many layers you put on top of that, this all has to come back to the government's control.

I understand that the salts can be sent to 3rd party websites. However there's obviously a reason that those are only valid for 30 days instead of indefinitely.

Yes, something in the document is tied to my ID. There's my name in there for example :). I don't have to share that information, because what government signed is a uniquely salted hash of my name and passed the salt to me.

If I choose to share that salt, and provide my name, someone could hash all that information and compare it to the government-issued document to verify if my name really is john smith (or if my claim "I'm over 18" is valid).

If I don't, they have no way of knowing.

> no "routing through the government"

> government is the one providing the documents

I'm also lost. I mean, this is the government issued ID we are talking about, right? How are you expected to get it if not from the government? "Are you over 18" claim is part of that government issued ID.

They don't have to know which sites or when you are visiting, but they do have to issue you the document.

(To be clear, there are also other options, it doesn't have strictly to be government; for example banks around here can provide ID documents - for their clients. There's a list of who is trusted for what https://eidas.ec.europa.eu/efda/trust-services/browse/eidas/...).

> However there's obviously a reason that those are only valid for 30 days instead of indefinitely.

It's the same reason why we prefer tls certificates with short lifespans.

Technically, if your phone needs to be remote attested, it can be considered a government system, not a user's system.

That's true, but it never really was your system, right? It's government issued app on a government approved device.

Why would I allow a government to tell me which devices I own can or cannot be approved? People have a short memory of history. Government works for the people, not the other way around.

Nope, it is my system currently. I hope we won't go back to GDR where the government needed to approve eachtypewriter.

Except it wouldn't need to be every request. Just the first one.

All these services have accounts, and the only time you need to do an age check is when the account is created.

> If my ID goes to a server, it’s compromised IMO

Might be breaking news, but the state already has your passport ID in a server.

I would much prefer to see a ZK system that, by design, CANNOT reveal info neither to the website nor to the authority. e.g. in the new EU system, it is (afaik) conceivable that the ID authority could collude with social network providers, or with government or with police etc. That's not great IMO.

How about a system like Google Authenticator in which google knows nothing about which websites I'm logging into. Except, obviously, it'd have to be some kind of cryptographically signed response. e.g., website puts up a QR code (according to some standard) asking "is the user 18+", I scan with the phone, and the ID app, without accessing internet (like google authenticator) responds.

I suppose that might need a secure computing environment, so no rooted phone etc. But, of course, there's a simple workaround. Any adult can give their phone to a child. As long as that vulnerability is there, there's no such thing as a guarantee on the responses no matter what way you build it.

In your system, can companies verify age offline, or do they need to send a token to the Government's authority to verify it (letting the Government identify and track users)?

Switzerland is working on a system that does the former, but if Government really wants to identify users, they can still ask the company to provide the age verification tokens they collected, since the Government hosts a centralized database that associates people with their issued tokens.

Aren't the companies also expected to do revocation checking, essentially creating a record of who identified where, with a fig leaf of "pseudonymity" (that is one database join away from being worthless)?

The revocation checking is implemented in a way where the government doesn't know who you checked and you can even cache the information (if that's good enough for you) so they won't notice at all.

That assumes the companies store the individual tokens, as does the government. Neither of which are part of the design, but could be done if both sides desired it.

The Swiss design actually doesn't store the issued tokens centrally. It only stores a trust root centrally and then a verifier only checks the signature comes from that trust root (slightly simplified).

If companies are required to verify age, then it's in their best interest to store all tokens, just in case they are ever accused of not verifying it.

The Swiss E-ID system stores people identifiers and token status lists in their so-called "Base Registry". From https://swiyu-admin-ch.github.io/technology-stack/#credentia...

> Decentralized Identifiers (DID) developed by the W3C represent an identifier standard that provides a subject-controlled method for identifying individuals, organizations, or objects online. In the swiyu Trust Infrastructure, DIDs are utilized as a standard identifier for issuers and verifiers. They are centrally hosted on the swiyu Base Registry.

> In this protocol, the trusted authority issues certifications (“trust statements”) concerning the identity (i.e., who is the real-world identity controlling a DID) and legitimacy (i.e., who is allowed to issue or verify credentials of a specific VC schema) about an entity as SD-JWT VC and publishes these trust statements in the trust registry.

> Token Status Lists are signed, maintained and published by the credential issuers but hosted on the Base Registry.

That's not how that works - they can prove they check by showing logs, rather than VPs. There's even legal limits on what identifiers they can store and for how long. But even ignoring that, they'd be storing only very limited disclosures.

The base registry stores identifiers of issuers and verifiers, not credential holders.

Even the status register does not contain the tokens themselves:

> Within these status lists, each index (i.e., status entry) documents the validity of one VC. The corresponding index is captured in the VC’s metadata to allow for a decentralized status information retrieval that does not require verifiers or the VC holder to contact the issuer.

Of course, each issuer needs to maintain a list of the credentials they have issued in order to be able to ever revoke them. That's unavoidable.

> But even ignoring that, they'd be storing only very limited disclosures.

Just to be clear, here I am not concerned about the verifiers, I am concerned about the authority (Government).

> The base registry stores identifiers of issuers and verifiers, not credential holders.

If the verifiers provide the verification tokens to the Government, can't the Government identify the original issuer even if they don't store them? Don't these tokens contain the DID of the issuer? Please correct me if I'm wrong, maybe I didn't get this part right.

> That's not how that works - they can prove they check by showing logs, rather than VPs

Logs can be manipulated, VPs can't. If I had a company and I was forced to verify users, I'd try to store those VPs for as long as possible, for my own protection.

> There's even legal limits on what identifiers they can store and for how long

I was not aware of this. Is that documented anywhere?

At least the US bills I've read make it illegal to store any information provided as part of age verification. Are the EU versions not the same?

this is slightly better but not the hero we want or need. zeero knowledge proofs are improvement over uploading raw documents, trust is still an issue here. why should users have to authenticate with a government-backed identity wallet to access platforms to play games or access a website in the first place. we didnt have any of these guards in the 90s and early 2000s and everybody turned out just fine . in fact the average gen z is in a lot worse place than we used to be despite that we had complete raw algorithm supervision free access to the internet with far more disturbing content (remember ogrish and KaZaA)

The average person does not understand the math behind zero-knowledge proofs. They only see that state infrastructure is gatekeeping their web access. Furthermore, if the wallet relies on a centralized server for live revocation checks, the identity provider might still be able to log those authentication requests, effectively breaking anonymity at the state level.

On a practical level, this method verifies the presence of an authorized device rather than the actual human looking at the screen. Unless the wallet demands a live biometric scan for every single age check, they will simply bypass the system using a shared family computer or a parent's unlocked phone. We used to find our way around any sort of nanny software (remember net nanny)

what you are describing still remains a bubble and I really hope Americans aren't looking at EU for any sort of public policy directions here.

> we didnt have any of these guards in the 90s and early 2000s and everybody turned out just fine

One of the most highly valued tech companies of today makes a software that sometimes talks its user's into killing themselves. Some guy put "uwu notices bulge" on a bullet casing and shot Charlie Kirk: things turned out fine indeed.

People killed both themselves and others way before the internet even existed.

Requiring everyone to show their id on every website will not change that. It will limit free speech though.

If the age verification is going to mandate government issued ID, the government issuer can be the Trust Anchor issuing a Digitally Signed Credential for the zero knowledge proof - using any available open source zero-knowledge process:

1) zkcreds-rs (zk-creds) [1]

2) zkLogin (Sui Foundation) [2]

3) TLSNotary [3]

4) DECO (Chainlink/Cornell) [4]

5) Anon-Aadhaar [5]

[1] https://github.com/rozbb/zkcreds-rs

[2] https://github.com/mystenlabs/sui/tree/main/sdk/zklogin

[3] https://github.com/tlsnotary/tlsn

[4] https://chain.link/education/zero-knowledge-proof-zkp#preser...

[5] https://github.com/anon-aadhaar/anon-aadhaar

Apologies that I'm latching onto your post for visibility, but for the sake of discussion - the European Identity Digital Wallet project specification and standardisation process is in the open and lives on github (yeah, the irony isn't lost on me :) ):

https://github.com/eu-digital-identity-wallet

https://eudi.dev/latest/

Everything's very much WIP, but it aims to provide a detailed Archictecture and Reference Framework/Technical Specifications and a reference implementation as a guideline for national implementations:

https://github.com/eu-digital-identity-wallet/eudi-doc-archi...

https://github.com/eu-digital-identity-wallet/eudi-wallet-re...

https://github.com/eu-digital-identity-wallet/eudi-doc-stand...

You'll find several (still evolving) Technical Specifications regarding ZKPs (including a discussion area) in the latter.

> work at a European identity wallet system that uses a zero knowledge proof age identification system

> derives an age attribute such as "over 18" from a passport or ID, without disclosing any other information

Well, as soon someone points their chinaphone camera on a passport, it is already over.

This whole setup is a nightmare fuel.

You want to check over 18? Fine, let adults set their kids devices in a "child" mode. Problem solved.

No need to create a stasi dreamland.

> Jurisdictions that accept facial estimation as sufficient verification are not taking enforcement seriously in the first place.

Or they want to spy on people.

I was working on a similar concept as a hobby project with PKI. The idea being that governments would have a digital registry with citizen information and issue a certificate to be stored in a Secure Enclave on a device.

When a client attempts to access an age-restricted URL, the server redirects to a custom URI scheme which begins a negotiation for requesting verification. The server signs a message and provides it to the client. The client verifies there’s not additional info or metadata before encrypting. It then forwards to the government server. The government server decrypts the message and signs a response. This goes back to the client which forwards to the server.

I haven’t fully ironed out all the details but got so far as nearly completing the server-client negotiation. The tricky part is ensuring each stage prevents MitM tampering while allowing the client to see what is in a request so that there’s no metadata which would allow a site to track the user, nor a government to track sites a user accesses.

If the website and state want to collude to track the user they don't need to send any in-band metadata.

You mean that system that requires either to use an original unmodified Android phone, or a iOS phone and it does not work in absolutely anything else?

No it is open-source and portable to any platform you want. We currently support iOS and Android through Play store and F-droid, but that is just because most of the market is there at the moment.

What about the "App and device verification based on Google Play Integrity API and Apple App Attestation" that was in the readme?

Was this discarded? Is it not necessary anymore? Can someone without writing their own implementation use the app without using any of those two?

What about devices without a hardware-based trusted computing module? Am I now limited to what hardware I can run before I even get to my custom software?

That's really awesome. I hope that soon we will also have humanity verification without sacrificing our anonymity.

With LLMs and paid actors wreaking havoc on social media I do think that social media needs pivot towards allowing only human users on it. I wrote about this here: https://blog.picheta.me/post/the-future-of-social-media-is-h...

This is true, but I think it's more that those jurisdictions don't actually care about something solving this securely so much as they want face scans for other purposes?

I think there's a tradeoff triangle here, not dissimilar to Zooko's triangle or the CAP theorem, where the three aspects are age verification, privacy, and the freedom to run custom software on devices of your choosing.

You can have no system at all, which gives you freedom and privacy, but not age verification. You can have ID uploads, which give you age verification and freedom, but not privacy. You can have a ZKP-based system, which gives you age verification and privacy, but not freedom. This is because you need a way to prevent one unscrupulous ID owner from issuing millions of valid assertions for any interested user.

One question I have, that perhaps you might be able to answer (though I see you've gotten too many replies to this comment already): I'm aware of a number of such systems being developed, and "is over 18" is always the example given.

Are there, say, two other potential use cases that anyone has come up with yet?

In Amsterdam 1850 the municipality kept track of people's names, address, age, gender and religion (bevolkingsregister). It meant nothing at this time, but 90 years later the Nazi used these lists to murder jewish people going house by house. Thanks for the partisans setting this archive ablaze, life were saved.

I'm not saying it's right or wrong, you tell me, I just want to point at this random timeline.

I shudder when I think of how effective the Stasi would have been in the digital age. The only thing checking them was the labour demands of surveillance.

When Trump came into power a second time, and the ICE-nazification became apparent, I reached out to my government and asked them what they were doing to make it harder for "Trumpism" to happen here. No reply. Just crickets.

Hoovering up less data would be a really fucking good start. There's something about babies and bathwater, but by god this has proven to be very dangerous bathwater time and time again.

> As long as you trust the government that gave out the ID

I'm a citizen of a European Union member, I trust my government to issue me an ID and use said ID in my interactions with the state, I do not trust my state with anything more than that.

That is exactly the trust I mean. You need to trust that country X gives out valid IDs. If you have sketchy company Y giving out IDs to everyone, you probably would not trust any attributes derived from that ID. If you trust that a country gives out valid IDs, you can trust the information derived from that ID. You do not really need to trust your government any more than that for this system to work.

Ok, I will do my homework on the proposal of the EU Identity Wallet but from my skimming on topics about it, it the tokens derived from my ID would be able to de-anonymise me online.

This part of trust was not about you trusting the government though so it is okay.

You have a much more trustworthy government than mine, sadly.

Immigrants do not have an ID for up to a few years when they move to Germany. Just this week the Berlin immigration office stopped issuing plastic residence cards for budget reasons, so people get a sticker in their passport.

Passport recognition is also spotty. The ID verification providers used by banks do not recognise Indian passports.

Will we exclude a few million people because it’s too expensive to verify that they are over 18?

Add this to “falsehoods programmers believe about ID verification”.

> Will we exclude a few million people because it’s too expensive to verify that they are over 18?

Yes. We absolutely will. KYC services is something that no one wants and everyone hates, thus there is no motivation to make it better. And if any, "better" might mean more invasive, because that means more data to mine and sell.

So, sure, excluding millions of people from KYC because it's cheaper to reject them than it is to study their documents - is the right decision business wise.

I am speaking as a person in the very same position.

In Austria you don't need an Austrian passport/Personalausweis for a Digital ID registration. Your original passport (or equivalent) in combination with a certificate of residence, student permit or similar is fine.

No, we will exclude a few people because Germany doesn't have its shit together when it comes to digital stuff. Then hopefully people will complain and things will improve.

As soon as age-gated access depends on a government-issued credential, you're implicitly tying participation to state identity infrastructure

What is wrong with inactive accounts, why do they need to be deleted?

I have a few questions.

In that system does the age verification result come with some sort of ID linked to my government issued ID card? Say, if I delete my account on a platform after verifying and then create a new one, will the platform get the same ID in the second verification, allowing it to connect the two and track me? Or is this ID global, potentially allowing to track me through all platforms I verified my age on?

What a verification process looks like from the user perspective? Do I have to, as it happens now, pull out my phone, use it as a card reader (because I don't have a dedicated NFC device on my computer), enter the pin, and then I'll be verified on my computer so I can start browsing social media feed? Or, perhaps, you guys have come up with a simpler mechanism?

The wallet ecosystem is still really varied at the moment. Our implementation is unlinkable. So an issuer cannot track where you use the attribute. And a verifier cannot see that you've used the same attribute multiple times with their system. This is great for privacy and tracking protection, but not so great for other things. For example, people sending their QR codes to other people with the correct attribute (like maybe an underage person sending an 18+ check to an adult), is hard to solve for because they are unlinkable.

Most systems right now have you load data in your phone. Then when a check happens, you scan a QR code. You then get a screen on your phone saying X wants to know Y and Z about you, do you want to share this information? Then you just choose yes or no.

For your social media example. You would just get a QR code on your pc, then pull out your phone, scan and verify, then start browsing social media on your pc.

In the Swiss system, it depends on what they verified. If they required your full ID, that has a document number like a passport and they could track that.

If they did the right thing and only asked for the over 18 bit, then they wouldn't have a trackable identifier.

You are describing a situation where a pairwise pseudonymous identifier is generated. I don't think any real system does this with government IDs, but it might be possible.

This is really cool and I want it for inter-government identification. Eg country B can check a ZK proof that I'm a citizen of country A, allowed to drive, not a criminal, have a degree, etx

This is the way. It annoys me to no end when e.g. the German chancellor demands clearnames in social media. The real issue are bots and algorithmically enhanced reach. Proof of personhood in a privacy-preserving way is enough to fix this. But it should be mandatory for social media in the EU. You don't need to expose people to the doxxing mob to protect our democracy.

Tbh, when I read that "platforms face a choice between excluding lawful users and monitoring everyone." I don't have much understanding.

No gov. ID, no participation. It's not like you cannot go outside and talk to people anymore so let's not pretend that being on insta is some sort of universal human right and anybody barred from it is some sort of terrible tragedy.

Not only EU -- Digital ID on iPhone does this today, and is accepted by many USA airports for travel, etc., with rollout for DLs.

Huh?

I just don't want to have to ID myself at every corner of the internet. Whether the site receives my details or not.

I've heard they even want to mandate periodic re-checks now which is insane. The internet should remain free.

Besides, if parents don't want to give access to social media they can just not give their kids a phone, or just use the many parental control features available on it. Every phone has this these days.

And even if the government wants to ban this stuff for all kids (which I would not agree with but ok I don't have kids so I don't really care and parents do seem to want this), they don't have to enforce it this way. They can just make the parents liable if the kids are found to have access.

To me this is just another attempt at internet censorship and control.

Correct. A ZK Proof backed identity system is a significant bump up in both privacy and security to even what we have right now.

Everyone does realize we're being constantly tracked by telemetry, right?

A proper ZK economy would mitigate the vast majority of that tracking (by taking away any excuse for those in power to do so under the guise of "security") and create a market for truly-secure hardware devices, while still keeping the whole world at maximal security and about as close to theoretical optimum privacy as you're going to get. We could literally blanket the streets with cameras (as if they aren't already) and still have guarantees we're not being tracked or stored on any unless we violate explicit rules we pre-agree to and are enforceable by our lawyers. ZK makes explicit data custody rules the norm, rather than it all just flowing up to whatever behemoth silently owns us all.

Explain how the plastering of streets with cameras can be done in a privacy-preserving way?

Well it could. Laws that simply ban any public-facing camera from doing anything except write to encrypted storage, which can only be opened with a court warrant.

I know laws are boring and tech is exciting, but sometimes there's no technological solution to a societal problem. Good old laws, police, fines, prison, is all you need.

First let me clearly state that I appreciate the amount of thought you guys are putting into creating better systems that have high privacy guarantees. I concede to you, that in some situations, your system leads to better privacy.

But I don't look at this on a purely technological level. These identity-based systems are instruments of control. Right now everything is still in flux with how these tools will be used and how accessible they are to the general population and the many minorities therein. I simply don't trust our politicians to do the right thing short-term and long-term. The establishment of the GDPR has been a major victory for better privacy legislation and now the Commission wants to hollow it out. The Commission also wants chat control to increase the amount of mass surveillance in Europe.

There is a potential future, where we all win. But I am highly skeptical, that in the current political climate, we will end up there.

ZK proof can't solve the TOCTOU problem.

No one would be foolish enough to trust their government nor the EU. You should be ashamed of working for such "people". Thanks for helping implementing a surveillance state.

You don't have to trust your government to employ them, the key is to bake in and maintain rigorous checks and balances, demand transparency, routinely audit and fire people for corruption, etc.

For me it is disqualified for usage because I need to buy into a Google or Apple ecosystem. At least the reference implementation does. This is just the next level of enshitification. And no, I don't need a digital blockwart at all.

And I have zero illusion privacy is compromised, it is trivial to identify devices these days, so it doesn't even work technically.

Next sentence we hear some empty bickering about digital sovereignty. This is all bullshit.

We support F-droid, so you could get a degoogled android version and use that to load the app on your phone. The app could also be ported to other platforms, but right now there is really no market for it.

That sill forces me into a Google ecosystem. F-Droid is better than the Play Store, but issues remain.

There is certainly a market for desktop OS as well. This creates a market for freedom.gov, shady as it is.

Good luck finding the single government in the world that actually wants that, rather than it being a pretext for control that is too sweet to pass up. If you manage to find them, post an article on HN about it as top places to move to.

The system you're describing is good for the masses, not for those with power.

The requirement to use google or apple services is a deal breaker. If I can't verify my age using an EU wallet without having an account with a US tech company what is the point of any of this?

Where can we learn more about your architecture?

Someone brought up the need for device attestation for trust purposes (to avoid token smuggling for example). That would surely defeat the purpose (and make things much much worse for freedom overall). If you have a solution that doesn't require device attestation, how does that solve the smuggling issue (are tokens time-gated, is there a limit to token generation, other things)?

We do not require an attestation and things like token smuggling is still a problem we need to solve. We have a system that prioritizes unlinkability. So an issuer cannot track the attribute they give you. And a verifier cannot link multiple disclosures with the same attribute. This privacy really helps things like token smuggling however. Time-gated tokens may increase the difficulty, but will probably not make it impossible. Making it illegal to verify someone else's qr codes could also help of course.

It's this I believe: https://www.w3.org/TR/vc-data-model-2.0/

A Verifiable Credential fundamentally doesn't solve the problem of "sharing", "smuggling". All it takes is one verified adult to "leak" their VC somewhere, and millions of underage people would be able to use it to "prove" they are over 18.

This would only work with something like MS TPM 2 / Apple Secure Enclave (device attestation), which is anti-freedom by design. I was curious if they found a way around that (maybe with time/rate limits, or some actual useful use of blockchain tech).

You could use an oblivious pairwise pseudonym, and then you do not require hardware attestation. But that does essentially limit one ID to one account per service.

Lmao how is the Secure Enclqve anti-freedom?

Besides the privacy argument (the claim that the UID can't be used for tracking via derivation is shaky at best, and not much different than MS's EK), there is the freedom argument: as in, who owns the device - the user, or Apple?

If Apple can remotely lock the device that an user bought mistakenly (for example because some corporation somewhere fat-fingers some entries), that fundamentally means the user doesn't own the device they bought and paid for. Add on top DRM and all the other evil that comes along with attestation.

Plus, you can still disable TPM2 (if you don't want to run Windows on your machine), you can never disable Apple's implementation.

I'd like to add we are discussing communication over the internet. It is an open standard. I should be allowed to build my own pcb without a secure element and talk to anyone over http so long as I am abiding by the correct rfcs.

[dead]

Yeah, but how to convince investors that trusting the government-issued ID is good enough? /s

> As long as you trust the government…

You should never trust the government

Age verification is very hard, because parents will give their children their unlocked account, and children will steal their parents' unlocked account. If that's criminalized (like alcohol), it will happen too often to prosecute (much more frequently than alcohol, which is rarely prosecuted anyways). I don't see a solution that isn't a fundamental culture shift.

If there's a fundamental culture shift, there's an easy way to prevent children from using the internet:

- Don't give them an unlocked device until they're adults

- "Locked" devices and accounts have a whitelist of data and websites verified by some organization to be age-appropriate (this may include sites that allow uploads and even subdomains, as long as they're checked on upload)

The only legal change necessary is to prevent selling unlocked devices without ID. Parents would take their devices from children and form locked software and whitelisting organizations.

I don't understand how this is any better.

It's my job as a parent (and I have several kids...) to monitor the things they consume and talk with them about it.

I don't want some blanket ban on content unless it's "age appropriate", because I don't approve that content being banned. (honestly - the idea of "age appropriate" is insulting in the first place)

Fuck man, I can even legally give my kids alcohol - I don't see why it's appropriate to enforce what content I allow them to see.

And I have absolutely all of the same tools you just discussed today. I can lock devices down just fine.

Age verification is a scam to increase corporate/governmental control. Period.

You should be able to choose what's age-appropriate for your kids. Giving them access to e.g. "PG-13" media when they're 9 isn't the problem. Giving mature kids unrestricted access isn't a problem. The problem is culture:

- Many parents don't think about restricting their kids' online exposure at all. And I think a larger issue than NSFW is the amount of time kids are spending: 5 hours according to this survey from 2 years ago https://www.apa.org/monitor/2024/04/teen-social-use-mental-h.... Educating parents may be all that is needed to fix this, since most parents care about their kids and restrict them in other ways like junk food

- Parents that want to restrict their kids struggle with ineffective parental controls: https://beasthacker.com/til/parental-controls-arent-for-pare.... Optional parental controls would fix this

> Parents that want to restrict their kids struggle with ineffective parental controls: https://beasthacker.com/til/parental-controls-arent-for-pare.... Optional parental controls would fix this

I don't think they will, and this is because there's an inherent conflict of interest from these large tech companies about actually protecting my kids.

To be blunt: They don't give a fuck, they make money. They will pick money over kids EVERY time.

My current answer is that absolutely none of my children are allowed anywhere near these devices. Mandating shitty age verification laws isn't going to somehow make these companies act responsibly... it's just going to drive alternatives that are actually respectful out of business with additional legislative burden, while Google and Apple continue to act irresponsibly and unethically.

Further - it continues to enshrine the idea that parent's aren't responsible for their kids (see your first point)... The parents that are already neglecting this space will point to laws like this and go "look, the government is doing this for me!". Which is exactly wrong, and exactly what these companies want parents to think (again - the alternative, that parents actually engage and realize just how fucking morally bankrupt these bastards are, hurts bottom lines)

If you want change - remove the damn duopoly. Break them up. Force open markets. Force inter-compatibility.

This is not rocket science. This is basic political science we've known about for literally hundreds of years, the only difference is that our government in the US has been fucking useless because of regulatory capture (of which this will worsen) and the perceived national security & economic value of "owning" the tech stack used internationally.

"Security" when used in these contexts has very little to do with protecting you, or me, or our kids. It has a whole lot to do with protecting corporate bottom lines and governmental control.

Part of the issue with phones is that they are already controlled by the Google/Apple duopoly, and hence heavily optimized for constant distraction and addiction. These laws only cement that duopoly and provide fewer means to build more friendly platforms.

While I don't appreciate the implementation of "security" generally involving monopolization, I think it's important to note that you only need age verification for things that are irrelevant to children. In fact the entire point is to exclude children. So a non-Google/Apple device is still perfectly usable for them if (or even specifically because) it cannot pass age verification/attestation. Really the main concern should be use of attestation for banking/government stuff.

> Parents that want to restrict their kids struggle with ineffective parental controls: https://beasthacker.com/til/parental-controls-arent-for-pare.... Optional parental controls would fix this

Did you mean "mandatory" parental controls? All current systems are optional and as you describe they are frequently ineffective, so not clear why keeping things like they are would be different.

The current systems are not ineffective because they’re optional, they could be more effective and stay optional.

I also don’t mean “mandatory” as in “the software manufacturer must implement parental controls” like the Colorado bill. There only needs to exist one decent operating system, one decent messaging service, etc. with good parental controls; parents can use those technologies and block the others. Although regulators could pressure specific popular platforms like YouTube, and maybe that would be fine, I think it would be better to incentivize and support add-ons or alternatives (e.g. kid-safe YouTube frontend).

> Fuck man, I can even legally give my kids alcohol - I don't see why it's appropriate to enforce what content I allow them to see.

In the USA it depends on the state. Federal guidelines for alcohol law does suggest exemptions for children drinking under the supervision of their parents, but that's not uniformly adopted. 19 states have no such exceptions, and in many of the remaining 31, restaurants may be banned from allowing alcohol consumption by minors even when their parents are there.

You're assuming that this person is in the US. Alcohol is treated far more liberally in other places. For example, in some places it is legal for restaurants to serve alcohol to minors who are accompanied by a parent...

Another thing: I fundamentally disagree with certain age rarings for kids content. Some explicit violence is rated OK for young audiences, but insert a swear word or a some skin and the age rating is bumped up? This rating system is nonhelp at all. I have to review each bit of content anyway before I can be certain.

Starting a comment with "In the USA..." is the exact opposite of assuming a person is in the US.

If you are from the US, it might sounds like it's the opposite, because you are so used to assuming everything is about the US unless stated otherwise

> I don't want some blanket ban on content unless it's "age appropriate"

I'm currently struggling with FitBit. Since about the start of the year, my kids can no longer sync their watches to their phones. The "solution" is to completely disable all parental controls on their Google accounts.

I was going to recommend the Gadgetbridge app, but it seems to have little or no support for Fitbit. I does support hundreds of devices, though. I used it extensively with a Mi Band 3, but have yet to try it with my Garmin.

Your kids can’t buy alcohol though. If you want to unlock your phone and let your kids read smut then more power to you. Age gates do not and never will stop that. But I sure as hell don’t want companies selling porn to 5 yr olds.

this seems to be an issue of being able to be a parent, period.

yup we should all be able, to talk to our kids instead of screaming at them.

The law is there to protect children in the case they have absent/neglectful parents. Unfortunately not every child has a parent as aware as you.

And to prevent companies from targeting children inappropriately.

People angrily replying to the top comment on this article are going to be pissed when they find out about this guy.

> Age verification is very hard, because parents will give their children their unlocked account, and children will steal their parents' unlocked account

More simply: If ID checks are fully anonymous (as many here propose when the topic comes up) then every kid will just have their friends’ older sibling ID verify their account one afternoon. Or they’ll steal their parents’ ID when they’re not looking.

Discussions about kids and technology on HN are very weird to me these days because so many commenters have seemingly forgotten what it’s like to be a kid with technology. Before this current wave of ID check discussions it was common to proudly share stories of evading content controls or restrictions as a kid. Yet once the ID check topic comes up we’re supposed to imagine kids will just give up and go with the law? Yeah right.

Circumventing controls as a kid is what taught me enough about computers to get the job that made college affordable (in those days you could just boot windows to a livecd Linux distro and have your way with the filesystem, first you feel like a hacker, later the adults are paying you to recover data).

If we must have controls, I hope the process of circumventing them continues to teach skills that are useful for other things.

The older sibling should be old enough to know better. Or if they're still a kid, they can have their privileges temporarily revoked.

This problem probably can't be solved entirely technologically, but technology can definitely be a part of solving it. I'm sure it's possible to make parental controls that most kids can't bypass, because companies can make DRM that most adults can't bypass.

> The older sibling should be old enough to know better.

This is exactly what I meant by my above comment: It’s like the pro-ID check commenters have become completely disconnected from how young people work.

Someone’s 18 year old sibling isn’t going to be stopped by “should know better”. They probably disagree with the law on principal and think it’s dumb, so they’re just helping out.

True, hence the culture shift is necessary.

But imagine if a locked device was treated like alcohol. Most kids get access to alcohol at some point despite it being illegal, often from older siblings, and rarely with legal consequences for the adult. But it's much less of an issue, because most kids don't get it consistently. Furthermore, "good" kids understand that it's bad, and even some "bad" kids understand that they must limit themselves.

> "culture shift is necessary"

Is it though? When older sibling helps younger sibling with "accessing Steam", or something reasonable like that, even the most sensible and thoughtful older sibling won't be interested in "culture shifts" that block gaming fun.

The alcohol and seatbelt analogies try to elevate equivalence, but miss the mark by a lot. Even one drop of alcohol is obviously not suitable for underage. No seatbelt increases risk no matter your age. "Social media" exposure for the young person is often completely fine and full of "young person" content and activity.

>Or if they're still a kid, they can have their privileges temporarily revoked.

Since people are already talking about using the law instead of parenting this needs clarification. Are the parents the one that would revoke their privileges or the government?

The parents. They're the ones who configure the parental controls. e.g. if their 15-year old gets caught sharing his device with their 7-year old, they can temporarily give him 7-year old permissions as punishment.

> If ID checks are fully anonymous (as many here propose when the topic comes up) then every kid will just have their friends’ older sibling ID verify their account one afternoon.

Exactly the same way that kids used in former days to get cigarettes or alcohol: simply ask a friend or a sibling.

By the way: the owners of the "well-known" beverage shops made their own rules, which were in some sense more strict, but in other ways less strict than the laws:

For example some small shop in Germany sold beverages with little alcohol to basically everybody who did not look suspicious, but was insanely strict on selling cigarettes: even if the buyer was sufficiently old (which was in doubt strictly checked), the owner made serious attempts to refuse selling cigarettes if he had the slightest suspicion that the cigarettes were actually bought for some younger person. In other words: if you attempted to buy cigarettes, you were treated like a suspect if the owner knew that you had younger friends (and the owner knew this very well).

Probably will limit to one device per person, to save the children, so we won’t share with others.

(So you need to keep all your stuff into one device to be fully tracked easily. And have no control over your device, share your location… )

More simply: If ID checks are fully anonymous (as many here propose when the topic comes up) then every kid will just have their friends’ older sibling ID verify their account one afternoon. Or they’ll steal their parents’ ID when they’re not looking.

Digital ID with binary assertion in the device is an API call that Apple's app store curation can ensure is called on app launch or switch. Just checking on launch or focus resolves that problem. It's no longer the account being verified per se, it's the account and the use.

Completely agree. The internet works differently than how people want it to, and filtering services are notoriously easy to bypass. Even if these age-verification laws passed with resounding scope and support, what would stop anyone from merely hosting porn in Romania or some country that didn't care about US age-verification laws. The leads to run down would be legion. I think you could seriously degrade the porn industry (which I wouldn't necessarily mind) but it would be more or less impossible to prevent unauthorized internet users from accessing pornography. And of course that's the say nothing of the blast radius that would come with age-verification becoming entrenched on the internet.

> what would stop anyone from merely hosting porn in Romania or some country that didn't care about US age-verification laws

A government could implement the equivalent of China's great firewall. Even if it doesn't stop everyone, it would stop most people. The main problem I suspect is that it would be widely unpopular in the US or Europe, because (especially younger) people have become addicted to porn and brainrot, and these governments are still democracies.

That isn’t necessary because porn companies don’t exist to gift orgasms, but to make money. They need US citizens to pay them for premium content and subscriptions, and that dependency means they’ll have to comply with US laws.

Plenty of porn exists for free, posted online by models or digital artists. It's archived in places that circumvent copyright, don't require payment or accounts, and are easily accessible.

Sure: models need to advertise to find buyers too, but there's certainly not as many models or rehosts if there's no money to be made anywhere.

pornography is not a profitable industry. even famous participants like 'mia khalifa' only made GBP9.5k (USD 12.8k) lifetime earnings. The average onlyfans has about 21 fans, with an average subscription price of $7.20.

the future of the industry is probably ai slop, personalised ai, and so on

one of the purposes of the porn industry in 00s was money laundering: cash only, large stores with no CCTV, very sparse records, not possible to objectively value why a dvd was being sold for $85

The industry is profitable .. the onlyfans founder is now worth circa $8 billion.

Being grist in the mill of that industry, however, only leads to being ground up for the consumption of others.

The words of someone who does not actually look at pornography. The vast majority of pornography-by-consumption is free / ad-supported. Customers are not "paying" and those ads are usually the bottom of the barrel with regard to sleaziness or legality.

It’s still just a sales funnel for ads or subscriptions. Why do you think porn sites exist?

> A government could implement the equivalent of China's great firewall. Even if it doesn't stop everyone, it would stop most people.

Porn is not just political information about human right abuses, government overreach or heavily censored overview of concentration camps for "group X". People can live just fine with government censorship buying into any kind of propaganda.

Kids would find a way to access porn though. Whatever it VPNs, tor or USB stick black market. Government cant even win war on drugs and you expect them to successfully ban porn. What a joke.

It's as easy as parents keeping the default router password, a kid logging in and then setting up port forwarding to a device on a port that they're running a server on, tied to their current residential ip, and then pinging their friends that ip and allowing them all to connect and download whatever files or upload whatever files. The peer-to-peer network could really start establishing itself in ephemeral and very hard to track ways. All you need is one kid with access to a vpn to torrent without copyright concerns to seed the network. Or one kid to get its parents to buy a domain and use that as an anchor so that the dns to ip is set behind the scenes for the peers.

Even China hasn't been remotely successful at banning porn, and it already has the great firewall and porn is illegal there.

eh... they are more like `dumbocracies` with these measures. None of this is to protect children. Except to satisfy rabid parents who think the world needs to serve them.

It’s very odd to hear you complain about age verification but then be fine with ruining the porn industry

Age verification has always been about normalization of it, and about mitigating snow flake blame.

- I always give my children unlocked devices, because I know what they are doing

- Internet is not a safe space, and there will always be means of circumventing protections. Age verifications do not protect anybody

- Parents do not want to 'rise children' they give phones to kids and expects youtube to show kids only good stuff. They expect this from platform

The only needed culture shift is everyone should realize that it's ultimately the parents/teachers' duty to educate the kids.

If parents think it's okay for their kids to use Facebook/X/whatever somehow responsibly, they should not be punished or prosecuted for that. Yes, I do believe it applies to alcohol too.

It's how it works in physical world. We let the parents to decide whether hiking/swimming/football/walking to the school are too dangerous for their kids. We let the parents to decide which books are suitable for their kids. But somehow when it comes to the internet it's the government's job. I can't help but think there is an astroturf movement manufacturing the consent rn.

Just a personal anecdote from my life - I have set up Youtube account for my kid with correct age restrictions (he is 11). Also this account is under family plan so there are no ads.

My kid logs out of this account so he can watch restricted content. I wonder - what is PG rating for logged out experience?

> If there's a fundamental culture shift,

You mean this culture shift is needed for the masses but I don't think that's the case. In my widest social circle I am not aware of anyone giving alcohol to young kids (yes by the time they are 16ish yes but even that's rare). Most guardians would willingly do similar with locked devices.

The real problem is that the governments/companies won't get to spy on you if locked devices are given to children only. They want to spy on us all. That's the missing cultural shift.

> Most guardians would willingly do similar with locked devices.

Considering the echo chamber in which I was at school, my friends would have simply used some Raspberry Pi (or a similar device) to circumvent any restriction the parents imposed on the "normal" devices.

Oh yes: in my generation pupils

- were very knowledgeable in technology (much more than their parents and teachers) - at least the nerds who were actually interested in computers (if they hadn't been knowledgeable, they wouldn't have been capable of running DOS games),

- had a lot of time (no internet means lots of time and being very bored),

- were willing to invest this time into finding ways to circumvent technological restrictions imposed upon them (e.g. in the school network).

The kids in your social circle are used to not having access to alcohol, but they're not used to not having access to social media.

Hypothetically, if every kid in your social circle had their device "locked", the adults would probably have a very hard time the kids away from their devices, or just relent, because the kids would be very unhappy. Although maybe with today's knowledge, most people will naturally restrict new kids who've never had unrestricted access, causing a slow culture shift.

And we need a standard where websites can self-rate their own content. Then locked devices can just block all content that isn't rated "G" or whatever.

I imagine there would be a set of filters, including some on by default that most adults keep for themselves. For example, most people don't want to see gore. More would be OK with sexual content, even more would be OK with swear words, ...

Wrong incentive. If you don’t give a shit about exposing children to snuff or porn, but do give a shit about page views and ad revenue, you obviously don’t rate your content or rate it as G to increase that revenue.

So kids can drive at 16. But can’t get access to an unlocked phone until their 18? Who gets to decide the whitelist? The government?

I never specified age.

The whitelist would be decided by the market: the parents have the unlocked device, there are multiple solutions to lock it and they choose one. Which means that in theory, the dominant whitelist would be one that most parents agree is effective and reasonable; but seeing today's dominant products and vendor lock-in...

Similar to alcohol, the system doesn't prevent all underage access

> I don't see a solution that isn't a fundamental culture shift.

What shift?

I mean look, there's a point where the manufacturers back off and entrust the parents.

Any parent can be reckless and give their children all kinds of things - poison, weapons, pornographic magazines ... at some point the device has enough protective features and it is the parents responsibility.

Digital media use is easier to conceal than weapons. My parents did not protect me from it growing up because they were not responsible, and I was harmed as a result. To this day they still do not realize I was harmed, because I did not tell them and we are not on speaking terms. Trying to be honest would have resulted in further rejection from them. This was on a personality level and I had no way to deal with this as a developing human.

I could not control how my parents were going to raise me, I was only able to play with the hand I was dealt. I hate the idea that parents are sacrosanct and do not share blame in these situations. At the same time, if this is just the family situation you're given and you're handed a device unaware of the implications, who is going to protect you from yourself and others online if your parents won't? Should anyone?

>parents will give their children their unlocked account, and children will steal their parents' unlocked account.

I think either is better than the staus quo. In the first case the parent is waiving away the protections, and in the second the kid is.

Even if a kid buys alcohol, I think it's healthier that they do it by breaking rules and faking ids and knowing that they are doing something wrong, than just doing it and having no way to know it's wrong (except a popup that we have been trained by UX to close without reading (fuck cookie legislation))

That would be the status quo if we had better parental controls.

Trying to enforce parental controls via regulation may only be as effective as Europe enforcing the DMA against Apple. But maybe not, because there's a huge market; if Apple XOR Android does it, they'll gain market share. Or governments can try incentive instead of regulation (or both) and fund a phone with better parental controls. Europe wants to launch their own phone; such a feature would make it stand out even among Americans.

Prove of adulthood should be provided by the bank after logging into a bank account. I'm sure parents just would let their bank details be stolen and such.

Of course no personal details should be provided to the site that requests age confirmation. Just "barer of this token" is an adult.

The "Bank identity" system in Czech Republic (and likely other countries) can be used to log into to various government services. The idea is that you already authenticated to the bank when getting the account, so they can be sure it is really sou when you log in - so why not make it possible for you to log in to other services as well if you want to ?

> The "Bank identity" system in Czech Republic (and likely other countries) can be used to log into to various government services.

In Poland we have the same setup.

So we trust a bank more than the government that they won’t extend this to earn more money by disclosing more information? Bad idea. You need a neutral broker.

AFAIK today if you buy a device, the bank doesn't get the device-unique identifier, at best it sees the model number.

Verifying identity works best when the stakes are high. And there are highest in online banking.

Yes we need a fundamental shift where sharing of parent accounts is akin to atleast some sort of infraction or maybe even a misdemeanor.

This could help, but without the culture shift, way too many parents will intentionally and unintentionally break that law.

Just remove "parent" and "account" from the mix and all these. Tie the screen to the human and most of these challenges go away. This is what is trying to be achieved with these laws, so we may as well institute it that way.

Shouldn't it be done at the account level if you're going to do this? I am an admin. My kids have a non admin account. That seems pretty normal.

BTW this is a terrible idea. What if I can afford only one computer but have a household of four?

I actually don't hate this??? As long as parents can set up their own whitelists and it's not up to the government to have the final say on any particular block.

Parents can do this today if they wanted to

The problem of "kids accessing the Internet" is a purposeful distraction from the intent of these laws, which is population-level surveillance and Verified Ad Impressions.

Today, in practice it's not a choice, because even the most attentive parents fail to block internet access. Parental controls are ineffective, and all the kid's friends have access so they become alienated. https://beasthacker.com/til/parental-controls-arent-for-pare...

But laws alone won't fix this, and laws aren't necessary (except maybe a law that prevents kids from buying phones). In the article, the child's devices had parental controls, but they were ineffective. There's demand for a phone with better parental controls, so it will come, and more parents are denying access, so their kids will become less alienated.

That is actually a very good solution that is respecting privacy. And is much more effective than asking everyone for ID when opening a website or app.

How does this solve the problem at all? You're just making more problems. Now you have to deal with a black market of "unlocked" phones. You're having to deal with kids sharing unlocked phone. Would police have to wal around trying to buy unlocked phones to catch people selling them to minors? What about selling phones on the internet, would they check ID now?

SOME parents give their children access to their ID. That is NOT the same as ALL parents, and therefore is not a reason not to give those parents a helping hand.

Even just informing children that they're entering an adult space has some value, and if they then have to go ask their parents to borrow their wallet, that's good enough for me.

It would not be solved without a culture shift. But with a culture shift, giving a kid an unlocked device would be as rare as giving them drugs.

I'm sure it will occasionally happen. But kids are terrible at keeping secrets, so they will only have the unlocked device for temporary periods, and I believe infrequent use of the modern internet is much, much less damaging than the constant use we see problems from today. A rough analogy, comparing social media to alcohol: it's as if today kids are suffering from chronic alcoholism, and in the future, kids occasionally get ahold of a six pack.

What if my kids want to follow nand 2 tetris or build their own custom os from a Linux fork?

> It would not be solved without a culture shift. But with a culture shift, giving a kid an unlocked device would be as rare as giving them drugs.

You understand that to many people that is a very obvious reason why we should never do this and they do not want that culture shift, right?

Doesn't the proposal as it's being implemented in the EU solve the problem under the exact same argumentation? Why are you dismissing a one proposal to then make your own that has exactly the same probable challenges?

Definitively we should have constant verification of the current user with Face ID or similar tech. Every 5 minutes of usage, your camera is activated to check who’s using your phone and validates it. So much secure and safe. /s

This is Nirvana/Perfect Solution fallacy. That's like saying limiting smoking to 18 y/o was futile because teenagers could always have some other adult buy them cigs, or use fake IDs.

Ridiculous take.

Well, age verification is the "we have to do something about this nebulous problem even if the best thing we can think of actually makes everything worse for everyone but it makes us feel better" fallacy, which is equally ridiculous.

No, it's not the same. There are anonymous solutions that solve this problem that are perfectly acceptable. Not perfect for prevention, but a good compromise nonetheless. Like cig/alcohol underage consumption prevention.

There is no such thing as anonymous age verification in practice.

I think we totally disagree on the degree of how much this is actually a problem compared to how much we're willing to invest in it. Those anonymous solutions are fairly idealistic and Nirvana-esque themselves, I don't think they'd see wide adoption. Beyond that I'm firmly in the camp that age verification for the kids is a complete smokescreen for the actual intent of these efforts, which is more surveillance, so on principal I'm opposed to any movement in this direction and doubt we'll find common ground.

Yeah, sure, no matter the studies, no matter the developmental indices, ni matter the WHO, no matter the psychologists. Let's also talk about climate change and how it's up for debate?

We don't disagree on whether it is actually a problem, you just have your opinion about facts.

We are arguing different things. I have never stated "psychological effects of the Internet aren't real and therefore this discussion is moot." My argument is "psychological effects or not (and personally I think they are overplayed), the privacy tradeoff of trying to fix them is not worth it (and I doubt any vague gestures in the direction of age assurance would help)." You are focusing on the first parenthetical but the important part is outside it.

We also have no way to actually measure this even if we wanted to do an experiment. So comparing this very soft science to climate change is a bit out of pocket.

> We also have no way to actually measure this even if we wanted to do an experiment.

Sorry, WHAT? No way to measure it? My god, are we talking about the same thing? Are you sure you haven't missed past 12-24 months of increased reporting on the matter from several different angles, from cognitive skills, anxiety, sexual drive, and so on?

EOT for me.

I'm saying that, in today's culture, age-gating the internet is likely to be much less effective than age-gating alcohol or tobacco. Most kids spend an appalling amount of time on social media (think, 5 hours/day*); most kids didn't spend this much time or invest this much of their lives into drugs.

* according to this survey from over 2 years ago: https://www.apa.org/monitor/2024/04/teen-social-use-mental-h...

not saying that I support age verification in any form, but you seen the vape sales?

I like to believe that, even with the amount of kids vaping, there aren't nearly as many as kids on social media.

To give perspective: in my high school, there were a few kids who vaped in bathrooms, but the majority (including me) did not; we were told many times that it was unhealthy, and anyone caught vaping would be suspended. Everyone I know (including me) had social media, we were not told it was unhealthy (only to not use it too much, not give out PII, avoid bullying, etc.), and it wasn't even policed in some classrooms.

For the smoking analogy to fit, you'd have to have parents giving their children packs of cigarettes to play with and then being mad at Marlboro they figured out how to smoke them.

When I was a kid, my parents installed Net Nanny on our home computer. I installed a keylogger. No more Net Nanny; lots more EverQuest.

I don't like age verification in general, for anything. The age gates in our society are very subjective.

Many times my Dad would buy alcohol at the grocery store w/ me (underage) in tow, but they never asked for my ID or refused to sell to him. Now, when I go buy alcohol as an adult with my wife (we are both in our mid-late 30s) they ask to see her ID as well as mine? If she leaves her ID at home then she has to wait in the car because they will refuse the sale if she comes into the store and cannot prove her age.

Buying a case of beer with a group of 8 year olds? No problem. Bottle of wine for you and your wife? Let me get both IDs.

> When I was a kid, my parents installed Net Nanny on our home computer.

Putting up artificial walls is inviting someone to look behind them.

Back in 1999 I was attending a city university and their computer labs were a mix of older Pentium machines running Windows 98 secured by netnanny. They disabled floppy booting in the BIOS and password protected it. Thing is, the old Dell cases were real easy to pop open and pull the CMOS battery out. That killed the BIOS password so I was able to floppy boot the machine and rename netnanny.exe to nutnanny.exe and Win 98 ran unimpeded. When I was done I would rename the exe, reboot and go on about my day. Nice try, uni admins.

The US is strange about alcohol.

I remember plenty of times in my early 20s buying alcohol and they wanted to see the ID of everyone waiting on my car.

In Australia you buy alcohol at the drive through. One person is 18 and you’re good.

We'll try everything, it seems, other than holding parents accountable for what their children consume.

In the United States, you can get in trouble if you recklessly leave around or provide alcohol/guns/cigarettes for a minor to start using, yet somehow, the same social responsibility seems thrown out the window for parents and the web.

Yes, children are clever - I was one once. If you want to actually protect children and not create the surveillance state nightmare scenario we all know is going to happen (using protecting children as the guise, which is ironic, because often these systems are completely ineffective at doing so anyway) - then give parents strong monitoring and restriction tools and empower them to protect their children. They are in a much better and informed position to do so than a creepy surveillance nanny state.

That is, after all, the primary responsibility of a parent to begin with.

I know this is weird, but I'm in some ways not really sure who is on the side of freedom here. I get your position, but like. The whole idea of the promise of the internet has been destroyed by newsfeeds and mega-corps.

There is almost literally documented examples of Facebook executives twirling their mustaches wondering how they can get kids more addicted. This isn't a few bands with swear words, and in fact, I think that the damage these social media companies are doing is in fact, reducing the independence teens and kids that have that were the fears parents originally had.

I dunno, are you uncertain about your case at all or just like. I just like, can't help but start with fuck these companies. All other arguments are downstream of that. Better the nanny state than Nanny Zuck.

> I just like, can't help but start with fuck these companies. All other arguments are downstream of that.

The solution would then be to break them up or do things like require adversarial interoperability, rather than ineffective non-sequiturs like requiring them to ID everyone.

The perverse incentive comes from a single company sitting on a network effect. You have to use Facebook because other people use Facebook, so if the algorithm shows you trash and rage bait you can't unilaterally decide to leave without abandoning everyone still there, and the Facebook company gets to show ads to everyone who uses it and therefore wants to maximize everyone's time wasted on Facebook, so the algorithm shows you trash and rage bait.

Now suppose they're not allowed to restrict third party user agents. You get a messaging app and it can send messages to people on Facebook, Twitter, SMS, etc. all in the same interface. It can download the things in "your feed" and then put it in a different order, or filter things out, and again show content from multiple services in the same interface, including RSS. And then that user agent can do things like filter out adult content, if you want it to.

We need to fix the actual problem, which is that the hosting service shouldn't be in control of the user interface to the service.

Indeed "Interoperability" is what would hurt social media giants the most - Cory Doctorow recently held an excellent talk where he stated that back in the early 00s Facebook (and others) used interoperability to offer services that allowed to interact, push and pull to mySpace (the big dog back then) to siphon off their users and content. But once Facebook became the dominant player, they moved to make the exact tactics they used (Interoperability and automation) illegal. Talking about regulatory capture ...

> ineffective non-sequiturs like requiring them to ID everyone.

Is that really a non-sequitur though? Cigarettes are harmful and addictive so their sale is age gated. So too for alcohol. Gambling? Also yes. So wouldn't age gating social media be entirely consistent in that case?

Not that I'm necessarily in favor of it. I agree that various other regulations, particularly interoperability, would likely address at least some of the underlying concerns. But then I think it might not be such a bad idea to have all of the above rather than one or the other.

If I went to the store and asked for a pack of cigarettes, I show my ID (well, I would if I was carded, but I'm no longer carded :)) and the clerk looks at it, maybe scans it, then takes my money.

If I try to go to an adult website, or even just a discord server with adult content, I need to upload my ID. And now there's numerous third parties who now are looking at my ID, and I have no idea if I can trust them with my info. Indeed, I probably can't, given how many of them have already been breached.

Of all the people, PornHub actually has a pretty good write-up on this (1) (2), and they refer to "device-based" age verification, where you verify your identity once to say, Google or whoever. Then your device proves your age. Fewer middlemen. One source of truth.

I am not against age verification. I am against the surveillance state.

(1) https://www.pornhub.com/blog/age-verification-in-the-news

(2) https://www.xbiz.com/news/281228/opinion-why-device-based-ag...

> they refer to "device-based" age verification, where you verify your identity once to say, Google or whoever. Then your device proves your age. Fewer middlemen. One source of truth.

This is still an absurdity. You don't need the device to prove the age of the user to the service, you need the service to provide the age restriction of the content to the device. Then the device knows if the user is an adult or a kid and thereby knows whether to display the content, and you don't need Google to know that.

Major porn sites already send an RTA header. Social media could be required to do similar. However I think part of the concern here is that many parents don't bother to restrict things. So the question is if we want filtering similar to alcohol where minors aren't permitted to possess it, or similar to porn where the decision is left up to parents.

IRL

> If I went to the store and asked for a pack of cigarettes

online

> and I have no idea if I can trust them with my info

Why did you trust how your ID was scanned (if carded)?

With security cameras present, where did that scanned data end up?

nit: the Discord ID verification hasn't rolled out yet has it?

No, I believe it's next month though.

> Is that really a non-sequitur though?

You have something (human communication) which is not intrinsically harmful -- indeed it is intrinsically necessary -- but has been made harmful on purpose. That is very much unlike those other things, where the harm is in their very nature and isn't prevented by the provider just not being a schmuck on purpose.

That makes age gating a farce, because kids need to be able to communicate with other people, but you would end up in one of these scenarios, each of which is inane: 1) Providers all put up age restrictions and meaningfully enforce them and then teenagers are totally prohibited from communicating over the internet. 2) Providers all put up "age restrictions" which teenagers bypass in ten seconds and the whole thing is a pointless fraud. 3) You try to separate places for kids from places for adults, but then either a) Adults prefer adult spaces where they're not censored, so they congregate there and those spaces get the network effect, and then teens have to sneak in even if they're not looking for adult content because that's where the bulk of all content is, or b) Nobody likes to show ID even if they're an adult so adults congregate in the least restrictively moderated space where they don't have to show ID, and that space gets the network effect. Then to the extent that they censor, they're censoring the adults which is the thing that wasn't supposed to happen, and to the extent that they don't censor, you have a "kid space" that contains adult content.

It's a trash fire specifically because there's a network effect, which is an aggregating force causing adults and kids to be in the same space so they can communicate with each other. Then the space with the network effect would either have to censor the adults even though they can't leave because of the network effect, or not censor the adults and then have adult content in the space the kids have to be because of the network effect.

The way you fix this is not by trying to separate the kids ad adults into separate networks, it's by tagging specific content so the client device can choose not to display adult content if they're a kid. Which also solves the privacy issue because you don't have to provide any ID to the service when the choice of what content to display happens on the client and the service is only tasked with identifying the content.

> ... start with fuck these companies. Better the nanny state than Nanny Zuck.

I'm not sure how those two positions connect.

Execs bad, so laws requiring giving those execs everyone's IDs, instead of laws against twirled mustaches?

these are just bad arguments all around, including gov't with this upload id crap. Why aren't we making internet 18+? The only unrefutable answers I get are just downvotes which is ok I guess, sort of validates my point because there's no reason for kids to get unrestricted internet access and downvotes are easy.

How well would anything like that work in practice?

First of all, would we restrict all internet access, or just access to certain known sites and VPNs, letting everything else through because it's too insignificant even if it technically might merit being blocked for kids? I don't think a global internet block for minors is a good idea.

On wired internet, restricting access for devices that aren't clearly tied to individual users is problematic. Imposing age verification overhead on anyone who runs a network is unacceptable and unworkable. Locking non-mobile devices to individual users, in order to have mandatory software that blocks or sends age signals to the ISP, is also unacceptable and unworkable.

For mobile devices, maybe. There's a privacy problem if it's required for sim cards to be paid using credit cards, but if we do that, or if that's already effectively the case, I think it's fair that anyone who has an active credit card should be permitted on the "adult" internet. For multi-line accounts, we could make it a crime for the account holder to misrepresent age of the user of a line, i.e. to claim they're an adult when they're really a minor. Not very different from minors and cigarettes. It's not universally illegal for a parent to supply them, but it is in some places, and it should be.

I posted my plan forward but essentially kids get a whitelist at best. For example, a kid friendly access device allows a network connection to a vpn server certified safe for kids and then take it from there with whitelisted destinations. Blacklists are just whackamoles.

https://news.ycombinator.com/item?id=47122715#47131415

> I just like, can't help but start with fuck these companies. All other arguments are downstream of that. Better the nanny state than Nanny Zuck.

Wild times when we're seeing highest voted Hacker News commenters call for the nanny state.

If you're thinking these regulations will be limited to singular companies or platforms you don't use, there is no reason to believe that's true.

There was already outrage on Hacker News when Discord voluntarily introduced limited ID checks for certain features. The invitations to bring on the nanny state reverse course very quickly when people realize those regulations might impact the sites they use, too.

A lot of the comments I'm seeing assume that only Facebook or other platforms will be impacted, but there's now way that would be the case.

I don't even care about Discord adding ID verification to unlock certain features. Not going to give them my ID of course, just gonna use it as always. If they later tighten things to the point where it's unusable, sure, I'll quit Discord.

OK, here's another one.

How about taking all these websites that require PII onto their own members-only domain?

This actually should have been in place and well fleshed-out before Google & Microsoft started pushing their "account" nonsense.

>Better the nanny state than Nanny Zuck.

For me this is a crux, at least in principle. Once online media is so centralized... the from argument freedom is diminished.

There are differences between national government power and international oligopoly but... even that is starting to get complicated.

That said... This still leaves the problem in practice. We get decrees that age-restriction is mandatory. There will be bad compliance implementations. Privacy implications.

Meanwhile a while... how much will we actually gain when it comes to child protection.

You can come up will all sorts of examples proving "Facebook bad" but that doesn't mean these things are fixed when/if regulation actually comes into play.

Those execs were also using the tactics to addict adults, and while they may have targeted teens, the problem is, at its core: humans. So no amount of nannying by either the company nor the government will solve this issue.

Who would be responsible if a child developed alcohol addiction? A nicotine problem? Any other addiction?

Exactly. The same people that should be responsible for giving them unfettered access to an internet that is no longer safe. Even adults have to be wary of getting hooked on scrolling, and while I agree that the onus is on the companies, it has been demonstrated over and over again that they will not be held to account for their behavior.

So the only logical choice left that actually preserves freedom is for parents to get off their ass and keep their child safe. Parent's that don't use filtering and monitoring software with their children should be charged with neglect. They are for sending a kid into the cold without a coat, or letting them go hungry, why is it different sending them onto the internet?

And to your last point: You are dead wrong. No government anywhere in the world has demonstrated that they have the resources, expertise, or technical knowledge to solve this problem. The most famously successful attempt is the Chinese Great Firewall, which is breached routinely by folks. As soon as a government controls what speech you are allowed to consume, the next logical step for them is to restrict what speech you can say, because waging war on what people access will always fail. I mean, Facebook alone already contains tons of content that's against its terms of service, and they have more money than God, so either they actually want that content there, or they are too understaffed to deal with the volume, and the volume problem only ever increases.

So in my view, you are the one against freedom by advocating for the government to control the speech adults can access for the sake of "protecting the children" when the actual people that are socially, morally, and legally culpable for that protection are derelict in their duties.

> Who would be responsible if a child developed alcohol addiction? A nicotine problem? Any other addiction?

The government literally actively prevents people selling all these things to children, rather than permit a free for all and then expect parents to take responsibility for steering their kids away from them.

Meta for one has proven terminally irresponsible at acceptable stewardship.

Maybe it's about time that the proven predatory companies be restricted to something like their own adults-only internet cafes where age can be checked at the door.

They had their chance with the open internet and they blew it.

> Who would be responsible if a child developed alcohol addiction? A nicotine problem? Any other addiction?

I mean, historically speaking, we blamed the tobacco companies.

Did we? I know they lost some court cases, had to adjust advertising and so on, but was any tobacco company actually held accountable for the harm they caused? The answer is no because they all still exist and are profitable entities. Corporations that cause the harm they did should be subject to dissolution.

Also, if they were genuinely responsible, why can a child's parents be held accountable for them developing an addiction? The company was responsible, not the parent... do you see how ignorant that sounds?

The de jure minimium age to purchase tobacco is 21 now in the US, so I guess anyone see to sell tobacco products to those under that age could be held responsible as well.

They are held responsible by paying a fine to the government or losing their tobacco license, which is better than nothing, but doesn't actually fix the harm they caused already for the kid that's now hooked.

The legal system does nothing to fix the harm done by murder to the person who's now dead, either.

[dead]

Social media is like tobacco. We went after tobacco for targeting kids, we should do the same to social media. Highly engineered addictive content is not unlike what was done to cigarettes.

Yes, go after Facebook and their kind only, avoid collateral damage to the remaining regular old internet.

No, it isn't. Tobacco is a physical substance that alters users' biochemistry and creates a physical dependence. Social media is information conveyed via a computing device. You can criticize social media for what it is in its own right, without having to engage in these kinds of disingenuous equivocations.

Sounds like you need to read up on dopamine and addictions a bit more.

Gambling isn’t introducing substance into user system it is making use of existing brain chemicals.

Social media companies engineered every piece of addictive mechanisms from gambling to alter brain chemistry or reactions of users.

> Sounds like you need to read up on dopamine and addictions a bit more.

Nah, I just need to not equivocate between them. The use of the same term to describe activities that produce a dopamine response as is used for ingestion of chemicals that create a direct physical dependence is little more than a propaganda tactic.

The comment said social media is addictive "like tobacco." Not that it's literally a drug.

You're blurring the lines a bit. Gambling isn't inherently an addiction. Just like a good TV show isn't inherently addictive either. Social media trying to be more engaging shouldn't really be viewed as an evil action anymore than HBO trying to create compelling content is.

The problem with comparing social media use to tobacco is that they are completely different. It's like saying weed is just like heroin because they both make you feel good. It's reductive and not productive.

The completely anti-social media stance ignores the good parts of social media. People can connect from across the planet and found others who shares the same views or experiences. People who are marginalized can find community where none may exist in their local area. So we should approach this more carefully and grounded.

Maybe this will make it more clear, so big difference is that people can connect across the planet without "big social media".

There are internet forums, chats, e-mail, blogs, there is no inherent need for "big social media" as we know. I do understand those companies made it much easier for average person to participate but still using internet forum or e-mail isn't exactly rocket science.

Here we are on HN, where no one is changing the layout and not doing much to drive engagement. Some days I don't even open any discussion because there is a lot of stuff that is not interesting for me.

"Big social media" companies had already multiple people speaking up explaining that they specifically made changes to drive engagement to hook people up and keep them scrolling without "creating compelling content". They specifically tuned feed algorithms to promote lowest common denominator trash content that makes people react in anger/frustration/whatever and not "creating/promoting compelling content".

So now you're demonstrating that you can criticize social media for its own flaws without having to conflate it with something else. I don't disagree with anything you're saying here, but nothing you're saying here involves attempting to equivocate social media with physical substance abuse.

Comparing internet forums, chatrooms, email, and blogs to Facebook and TikTok seems like a bad joke. I don't think you recognize how impactful "Big Social Media" is. Facebook brought about the ability to easily reconnect with people you had lost touch with and stay in touch with them. Things like Instagram made photo sharing and discovery significantly easier than simply looking at what the most recent posted photos on Photobucket. TikTok mass marketed bite sized videos and community trends. These things either did not happen on other platforms or could not happen on them.

I think most people remember the earlier days of Twitter where having a centralized place with strong discoverability led to unique communities forming and expressing themselves. I shouldn't need to say this but, it obviously wasn't all sunshine and rainbows. So I'm not saying these platforms were perfect or without major issues. I am say that their unique nature is not something that can be replicated via other mediums. It simply doesn't scale.

Honestly I'm not seeing the issue with these platforms wanting to maximize time users spend on them. That's the goal of every business. What seems to get lost though is self control. TikTok being fun and enjoyable does not mean that you are incapable of closing the app. It's like banning phones from leaving your house because you are so addicted to texting and apps. You cannot fully control what comes up on most social media. But as any therapist will tell you, all you can control is your response. I just think there is a space for big social media sites in the world. I don't even use them, but I can recognize the impact they have made with the good and the bad.

Nothing is inherently an addiction. You can smoke a cigarette without it being an addiction.

No, nicotine is actually addictive in that it creates physical dependency.

I don't think I implied that. Of course, but the ability to regulate usage is hampered by nicotine. That does not mean one cigarette and you're addicted though.

You can make the point that social media has real positive benefits as well as negatives without minimizing the well proven fact that gambling creates a form of addiction in a significant proportion, though not all, of its users, one every bit as devastating as heroin or alcohol.

Seems like you're overestimating how many people are addicted to gambling. Much in the same way those who are anti-alcohol will conflate responsible drinking with alcoholism. Gambling can be just as terrible, but it is different than heroin and alcoholism since it does not have a chemically addictive component. Reducing all addictions to being the same thing is damaging to addicts and addiction recovery. Much the same way reducing all crime to the same thing is for inmates of the prison system. You're removing nuance and difference which helps promote understanding.

May I introduce you to the delta-FosB gene?

https://en.wikipedia.org/wiki/FOSB#DeltaFosB

Can I ask what exactly you're intending to say? I'd rather try to guess what you're implying.

You’re right, it’s actually worse than tobacco. Tobacco simply makes your body sick, but social media attacks the most vital part of us. Even the CDC has studied this: https://www.cdc.gov/mmwr/volumes/73/su/su7304a3.htm

This is a normative cultural question, not a medical one. The CDC is far outside its expertise and its proper remit by involving itself in this topic.

the mechanisms by which that information is being conveyed have been shown to be addictive as well, no?

No, addiction involves physical substances interacting with a person's biochemistry. Attempting to extend the concept of addiction to include positive emotions brought on by sensory experiences or behavior is a disingenuous rhetorical tactic.

It's simply not legitimate to redefine "addiction" as anything that people might have an emotional or psychological motivation to participate in.

People trying to use the same terminology to describe social media as is used to describe tobacco or alcohol are trying to sneakily attach the negative associations of those substances to something unrelated entirely to them.

This is a form of deception, and a silly one, since social media has lots of negative aspects that can be argued against in their own right, without needing to engage in manipulative dialog.

Whether you like it or not, addiction is most commonly used as a general term to refer to any sort of compulsive behavior that acts against one's own self interest. Not your strawman of "anything that people might have an emotional or psychological motivation to participate in."

There are plenty of perfectly valid parallels between addiction to alcohol, gambling, porn, social media, junk food, etc. Are you denying that?

You can't just declare anyone comparing them to be disingenuous or disrespectful to those who are addicted. In fact what really seems disingenuous is the huge volume of this kind of pedantry in the thread by you and the same few accounts. Feels like misdirection away from the actual discussion about how to truly mitigate these addictions. Would appreciate your actual thoughts on this.

Comparing Tobacco to Social Media is like comparing me to LeBron James. I'd rather have my kid smoke a pack of day than have social media accounts

Yes, it is: https://news.ycombinator.com/item?id=24579498

Screw over Meta then. Not everybody else.

Meta is the bozo in a panel van with no windows. All The legit porn sites put up Big Blinking Neon Signs.

I actually run an adults only community site and you are correct, I have it in a popup that appears on every "fresh" visit to the site, it's in the giant bold print you agree to when you register, and from a technical end, I send every possible header and other signal to let filtering software know it's an adult only space. If there is a child accessing that site, they are doing so because their parent didn't even attempt to prevent them from doing so. And now I'm having to look into ID verification services that are going to quintuple to costs of hosting this free community for people in a time where community is more important than ever.

Can't you just get people to email you an ID photo when they sign up?

Email is the digital equivalent of a postcard. I really want to argue that this is a bad idea (because it is), but depending how you set your email system up, it might actually compare favourably to using a third-party identity verification company.

Better to use some kind of secure drop web portal (perhaps https://securedrop.org/) that's actually designed for that kind of thing, though.

Honest question. Why do you care?

> Better the nanny state than Nanny Zuck.

why-not-both.jpg

Maximizing corporate freedom leads inevitably to corporate capture of government.

Opposing either government concentration of power alone or corporate concentration of power alone is doomed to failure. Only by opposing both is there any hope of achieving either.

Applying that principle to age-verification, which I think is inevitable: Prefer privacy-preserving decoupled age-verification services, where the service validates minimum age and presents a cryptographic token to the entity requiring age validation. Ideally, discourage entities from collecting hard identification by holding them accountable for data breaches; or since that's politically infeasible, model the service on PCI with fines for poor security.

The motivation for this regime is to prevent distribution services from holding identification data, reducing the information held by any single entity.

> Prefer privacy-preserving decoupled age-verification services, where the service validates minimum age and presents a cryptographic token to the entity requiring age validation.

This is the wrong implementation.

You require sites hosting adult content to send a header indicating what kind of content it is. Then the device can do what it wants with that information. A parent can then configure their child's device not to display it, without needing anybody to have an ID or expecting every government and lowest bidder to be able to implement the associated security correctly.

It doesn't matter what kind of cryptography you invent. They either won't use it to begin with or will shamelessly and with no accountability violate the invariants taken as hard requirements in your theoretical proof. If you have to show your ID to the lowest bidder, you're pwned, so use the system that doesn't have that.

This solves some probelms, such as children accessing porn sites (oh the horror). But it doesn't solve other problems, such as predators accessing children's spaces. YouTube Kids is purportedly a safe, limited place for kids - and yet, there are numerous disturbing videos that get past the automated censors. Pedophiles stalk places like Roblox.

> But it doesn't solve other problems, such as predators accessing children's spaces.

Neither do ID requirements. If you're purposely allowing in kids then you're allowing in everyone, because kids generally don't have ID.

Sure, but other forms of age verification requirements can, in principle, solve this (at the massive cost of many other privacy and compliance issues, as the article rightly points out). For example, periodic facial recognition-based age estimation can theoretically allow only kids' accounts to a certain space.

At which point you're still letting in every pedo who has a kid living with them or can grab one at a local school, and the child trafficking networks that by their nature have access to children or to cybercriminals who know how to fool the check with a fake camera, i.e. the worst of the worst.

Meanwhile you exclude the parent who is separated from their spouse and wants to check up on where their kid is hanging out when the kid is living with the other parent, and the investigative journalist who doesn't have a young kid or their kid is 16 but the detection system guesses they're 26.

And that's on top of having the lowest bidder building a biometrics database of children.

Then you do forensic and catch the predator instead of the age verification nonsense

Your proposed architecture also achieves the goal of discouraging content-distributing entities from holding hard identification data, so it sounds good to me.

> Better the nanny state than Nanny Zuck.

This is a huge self own. I can't believe I'm reading this on a website called "hacker news".

while i'm sympathetic to your position, the truth is that /that/ is where this site is now.

Why? Hackers need something to hack.

But you're right, 'twas a bit much.

>There is almost literally documented examples of Facebook executives twirling their mustaches wondering how they can get kids more addicted.

Then close their business. Age verification just makes their crimes even more annoying.

Yes, please close it!

Ah, oh, decision makers are shareholders themselves and are benefiting from this too.

> I just like, can't help but start with fuck these companies. All other arguments are downstream of that. Better the nanny state than Nanny Zuck.

How about we reject all institutional nannies?

It is much easier to implement user-controlled on-device settings than any sort of over-the-Internet verification scheme. Parents purchase their children's devices and can adjust those settings before giving it to their kids. This is the crux of the problem, and all other arguments are downstream of this.

My friends kids have access to his home servers. They don’t get to roam on the internet. It’s shocking to think parents might structure their child’s lives.

> I know this is weird, but I'm in some ways not really sure who is on the side of freedom here. I get your position, but like.

No one. You’ll see a few politicians and more individuals stuck to their principles, but anyone with major clout sees the writing on the wall and is simply working to entrench their power.

> Better the nanny state than Nanny Zuck.

Indeed, what lolberts fail to understand usually is not a choice between government vs “freedom” it’s a choice between the current government and whoever will fill up the power vacuum left by the government.

Don't conflate the Internet with Social Media. Social media is a service, just like FTP. The death of social media will not mean the death of the Internet. There's an argument that reducing social media use, by age verification or other means, will lead to a more free Internet due to reduced power of gatekeepers.

The problem is that internet is used nowadays for democratic purposes. Once you introduce a globally unique personal ID, you will be monitored. And boy, you will be monitored throughoutly. In case of any democratic process that needs to be undertaken in future against government, this very government will take the tools of identification and will knock to the doors of people who try to raise awareness and maybe mutiny. And this is what Orwell wrote about

Centralization and standardization are going to be the topic in the 21st century.

For all the complaining some U.S.-Americans seem to do about the EU approach to these issues, things like the Digital Markets Act aim to fix exactly these types of issues.

Heh, thank you.

I appreciate GPs point about giving “parents strong monitoring and restriction tools and empower them to protect their children”. That’s good. That acknowledges that we can and should give parents tools to deal with their kids and not let them fend for themselves (one nuclear family all alone) against the various algorithms, child group pressure, and so on.

But on the whole I’m tired of the road to serfdom framing on anything that regulates corporations.

Yes. Let’s be idealistic for a minute; the Internet was “supposed to” liberate us. Now we have to play Defense every damn day. And the best we have to offer is a false choice between nanny state and tech baron vulturism?

For a second just imagine. An Internet that empowers more than it enslaves. That makes us more equal. It’s difficult but you can try.

> documented examples of Facebook executives twirling their mustaches wondering how they can get kids more addicted

If you genuinely believe that this is about those moustache twirling executives, then I have a bridge to sell you.

Have you ever wondered why and how these systems are being implemented? Have you ever gone why Discord / Twitch / what have you and why now? Have you ever thought that this might be happening because of Nepal and the fears of another Arab spring?

https://www.aljazeera.com/news/2025/9/15/more-egalitarian-ho...

I think too many people on this platform don't understand what this is about. This is about power. It's not about what's good for you or the children. Or for the constituents. It's about power. Real power. Karp-ian "scare enemies and on occasion kill them" power.

There are many ways in which such a system could be implemented. They could have asked people to use a credit card. Adult entertainment services have been using this as a way to do tacit age verification for a very long time now. Or, they could have made a new zero-knowledge proof system. Or, ideally, they could have told the authorities to get bent. †

Tech is hardly the first industry to face significant (justifiable or unjustifiable) government backlash. I am hesitant to use them as examples as they're a net harm, whereas this is about preventing a societal net harm, but the fossil fuel and tobacco industries fought their governments for decades and straight up changed the political system to suit them. ††

FAANG are richer than they ever were. Even Discord can raise more and deploy more capital than most of the tobacco industry at the time. It's also a righteous cause. A cause most people can get behind (see: privacy as a selling point for Apple and the backlash to Ring). But they're not fighting this. They're leaning into it.

Let's take a look at what Discord asked people for a second, the face scan,

    If you choose Facial Age Estimation, you’ll be prompted to record a short video selfie of your face. The Facial Age Estimation technology runs entirely on your device in real time when you are performing the verification. That means that facial scans never leave your device, and Discord and vendors never receive it. We only get your age group.

There was an article that went viral for spoofing this, https://age-verifier.kibty.town/ // https://news.ycombinator.com/item?id=46982421 . In the article, the author found by examining the API response the system was sending,

    k-id, the age verification provider discord uses doesn't store or send your face to the server. instead, it sends a bunch of metadata about your face and general process details.

We're anthropomorphising machines. A machine doesn't need pictures; "a bunch of metadata" will do just fine.

We are assuming that the surveillance state will require humans sitting in a shadow-y room going over pictures and videos. It won't. You can just use a bunch of vectors and a large multi-modal model instead. Servers are cheap and never need to eat or sleep.

Certain firms are already doing this for the US Gov, https://x.com/vxunderground/status/2024188446214963351 / https://xcancel.com/vxunderground/status/2024188446214963351

We can assume de facto that Discord is also doing profiling along vectors (presumably behavioral and demographic features) which that author described as,

    after some trial and error, we narrowed the checked part to the prediction arrays, which are outputs, primaryOutputs and raws.

    turns out, both outputs and primaryOutputs are generated from raws. basically, the raw numbers are mapped to age outputs, and then the outliers get removed with z-score (once for primaryOutputs and twice for outputs).

In general, Discord seems to have fairly reliable data about the other applications the user is running. Discord also has data about your voice and now your face.

Is some or all of this data being turned into features that are being fed to this third-party k-ID? https://www.k-id.com/

https://www.forbes.com/sites/mattgardner1/2024/06/25/k-id-cl...

https://www.techinasia.com/a16z-lightspeed-bet-singapore-par...

k-ID is (at first glance) extracting fairly similar data from Snapchat, Twitch etc. With ID documents added into the mix, this certainly seems like a very interesting global profiling dataset backstopped with government documentation as ground truth.

I'm sure that's totally unrelated. :)

-

† like they already have for algorithmic social media and profiling, https://www.newyorker.com/magazine/2024/10/14/silicon-valley...

Somehow there's tens to hundreds of millions available for crypto causes and algorithmic social media crusades, but there's none for the "existential threat" of age verification.

†† Once again, this is old hat. See also: Turbotax, https://www.propublica.org/article/inside-turbotax-20-year-f...

yep, the ol four horseman of internet censorship lol

if folks actually wanted to protect minors they would age restrict internet ACCESS instead of letting adults personal details get spewed all over the world for bad actors to take advantage of.

> I know this is weird, but I'm in some ways not really sure who is on the side of freedom here.

That’s because “freedom” is complicated and doesn’t precisely map to the interests of any of the major actors. Its largely a war between parties seeking control for different elites for different purposes.

Yes, seeking more control for themselves and completely at the expense of everybody else's loss.

You sound like someone that would work for the CIA or FBI if they offered you a job. Those are the types of people that I cannot and will not ever trust. I do not respect your opinion.

You don't have to, but hilariously - I would never work for the CIA or FBA (I mean I can't, I think they require a college degree) but the most paranoid conspiracy-theorist libertarian hacker I ever knew did, and said it was the best work of his life. Ironic?

I'm going to move off-grid and become a sovereign citizen.

I don't get your point, at least not in relation to the GP post. I agree with GP, parents need to be more accountable. We as parents, and We should all be concerned about future children/generations, should be demanding more regulation to help force the change we need on this topic. We as a society need to treat SM like those other addictive product classes. The fact SM is addicting and execs try to juice it more, is frankly to be expected.

Vilify them all you want, but same has been done with nicotine products, alcohol products, etc. and to GPs point, we SM as a toy for our children to play with. We chose to change the rules (laws, regulations, etc) because capitalists can never be simply trusted to do what's best for anything except their bottom line. That's a fundamental law no different than inertia or gravity in a capitalistic society. That's why regulators exist. Until you regulate it, they will wear their villain badge and rake in the billions. It's easy to be disliked when the topic of your disdain is what makes you filthy rich (in other words, they don't care what you or I think of what they're doing).

not social media, treat the entire internet as fundamentally hazardous to kids because it is, just like cigarettes alcohol and porn. check IDs once when signing the contract that is required for internet access and all these problems go away.

That’s fair. I do think they’re some point where it gets too broad though. The definition part will be a tough balancing.

As an example, I’ve been a fairly strict parent with devices and content access. But, I do let my son play Switch games with his friends which requires the internet. I feel it’s ok in moderation, he plays no more than about 3 hours a week.

>I get your position ... There is almost literally documented examples of Facebook executives twirling their mustaches wondering how they can get kids more addicted. This isn't a few bands

Their position was to compare it to alcohol, guns, and tobacco, not bands using naughty words. Alcohol and tobacco definitely enter mustache swirling territory, getting children addicted and funding misinformation on the harms of their product.

> There is almost literally documented examples of…

lol

> Better the nanny state than Nanny Zuck.

The state can imprison you. Zuck can't.

Yet! ;-)

Nobody is putting a gun to your head and forcing you to use Facebook or whatever other site. I quit using most social media over a decade ago. If you don't want to use it, or you don't want your children to use it, then don't use it.

O yeah? Where’s that guy who couldn’t get a job 6 months ago because he refuses to use LinkedIn.

I am a bit confused by that comment. Are parents social responsible to prevent companies from selling alcohol/guns/cigarettes to minors? If a company set up shop in a school and sold those things to minors during school breaks, who has the social responsibility to stop that?

when I was a kid in the early 90's, my state (and many others) banned cigarette vending machines since there was no way to prevent them being used by minors, unless they were inside a bar, where minors were already not allowed.

The problem is, doing the analogous action with the entire internet is a privacy nightmare. You didn't have to tell 7-11 every item you bought at every store in the past 2 years and opt-in to telling them what other stores you go to for the next 5.

There is no digital equivalent of "flash an ID card and be done with it" in the surveillance state era of the internet. Using a CC is the closest we have and even then you're giving data away.

The analogous action is to only require age-restricted sites (or parts of sites) to check ID, not the entire Internet. e.g. no one is calling for mathisfun.com to check ID. I'd expect most parts of the web are child-friendly and would not be affected. Just like how almost all locations in physical space don't need to check ID.

Additionally, the laws I've read mandate that no data be retained, so you have stronger legal protections than typical credit card use, or even giving your ID to a store clerk for age restricted purchases (many stores will scan it without asking, and in some states scanning is required).

This might have the benefit of reversing the trend where everything on the internet was rolled in to social media. If social media is age restricted, news, announcements, etc will have to break out to dedicated websites if they want to be accessible by all ages.

just ban kids from the internet already. if a parent allows the kid to have a full function smartphone and the kids get caught with it then throw the parents in jail and kids in an orphanage. people will catch on.

Anything that can take user input, including any forum, would get popped.

I don't see why that would be the case. It's reasonable to allow services that have a policy forbidding such content and make good faith efforts to moderate and remove it promptly. Seems analogous to e.g. a building being vandalized with lewd drawings. Or laws about user submitted child pornography.

I expect most forums or discussion groups in practice actually don't have child-inappropriate content, and already moderate such things because the members don't want it.

You do not need to control the entire internet. Put time limits on connected devices. Use parental controls. Talk to your kids about what they do online. Set clear boundaries. Reward good behaviour. Talk to other parents to align these limits to avoid social issues among the kids.

We may be agreeing, I'm saying there is no battle tested, privacy safe technical method of verifying age online, and this the controls need to be in the physical environment and setting social standards for social media and phone use.

I think the argument is more around it being illegal so as to not be forced into playing "the bad guy". It's hard to prevent a level of entitlement and resentment if those less well parented have full access. If nobody is allowed then there's no parental friction at all.

Its unfortunate that the application of this rule is being performed at the software level via ad-hoc age verification as opposed to the device level (e.g. smartphones themselves). However that might require the rigimirole of the state forcibly confiscating smartphones from minors or worrying nepalise outcomes.

I'm saying hold parent's accountable for their children's online behavior and for their protection online, not companies (who want to profit off the kids, perverse incentive) or governments (who can barely be trusted to do this even if this was the only goal). For example if your kid starts making revenge CP of their classmates, and the parent could have reasonably mitigated or known about it, I think the parent absolutely should be held responsible.

Don't punish the rest of the web for crappy parenting and crappy incentives by companies/govts.

If we want parents to be accountable, then these platforms need to provide better tools to enable parents to do so. It is impossible to monitor the entirety of your child's behavior online through any of these platforms today. They are their own person, they make their own choices, and those choices are heavily influenced by a world the parents have increasingly less influence over, especially as they grow older.

On the flip side, I do think we should also hold companies more accountable for this. We collectively prevented companies from advertising tobacco to minors through regulation with a pretty massive success rate. These companies know how harmful social media can be on youth, and there is little to no effective regulation around how children learn about these platforms and get enticed into them.

I do not disagree with any of this, I was hoping it was implied by my original comment that this would be necessary.

This all needs to be modulated by the knowledge that some children benefit immensely from being able to hide parts of their lives from their parents, parts that their parents would disagree with greatly.

The clearest example is LGBTQ kids who want to talk to other LGBTQ kids, or enjoy LGBTQ content, without fundamentalist or just homophobic/transphobic parents finding out. Children of fundamentalist or cult members who want an escape from the cult are another common category.

I’m embarrassed to admit this hadn’t even occurred to me until I read your comment.

> I'm saying hold parent's accountable for their children's online behavior and for their protection online

You're saying the status quo and I think its fair to state you wouldn't intentionally design the status quo. Unless we have some wizard wheeze where we can easily arrest and detain or otherwise effectively punish parents without further reducing the quality of life for their children.

But it's not playing the bad guy. It's playing the good guy.

in the abstract but in the social of the home you have to be the bad guy. While good parents manage that, the bar is too high for society in general.

The bar isn't that high at all. It's just what norms you decide to set. You could make this argument for any particular parenting decision, from washing hands before food to saying no to the next desired purchase. It doesn't make sense to special-case this. At some point you're setting rules, and it's not that difficult. Just don't buy the device.

sorry but I feel like your standards are a bit higher than the average here. The bar is, and has to be extremely low, to hope for compliance.

This isn't a compliance based exercise. You can achieve compliance by setting no rules.

From the perspective of the kids you are the bad guy.

Parents can't easily prevent their kids from going to those kinds of stores once they're at the age where the parent doesn't need to keep an eye on them all the time and they can travel about on their own.

The difference though is that parents are generally the ones to give their kids their phones and devices. These devices could send headers to websites saying "I'm a kid" -- but this system doesn't exist, and parents apparently don't use existing parental controls properly or at all.

> These devices could send headers to websites saying "I'm a kid" -- but this system doesn't exist

And there would be ways to work around it. If people find that privacy-preserving age verification is not good enough because "some kids will work around it", then nothing is good enough, period. Some will always work around anything.

if a parent gives a kid a full on smartphone, charge the parent with child abuse just like feeding the kid alcohol, cigarettes or having sex with them. people will catch on.

Or people who aren't parents are yet again sharing strong opinions that are not based in reality. Plenty of parental controls are deployed, how long they last against a determined child is the real question. Here's a concrete example for you. Spotify has a web browser built in so that you can watch music videos, kids have figured out a way to use that to watch any video on YouTube--a 12 year old told me this. If you search on this subject you'll quickly learn this is well known and is generally being ignored by Spotify. Why not allow parents to disable the in-app web browser / video function?

It's not as easy as you may believe to prevent that type of access.

So what’s the alternative? Pretend we don’t live in a digitally connected society and set our kids up for failure when they get one years after their peers?

Let's assume for the sake of argument that social media is extremely harmful to children. Which means the answer to your question is "yes, obviously". If people were running around giving their kids fentanyl, you wouldn't say "but my kid's friends all use fentanyl and he'll be an outcast if he can't". You would say "any friends that he loses over this are well worth avoiding the damage". Why would it be different just because it's social media?

Phones, I mean. Sorry for the confusion there. I’m for holding off on social media.

Keeping your kids off social media is setting them up for success.

I’m talking about phones specifically. Agree re: social media.

The problem isn't with phones. We should have robust parental controls and the responsibility of parenting should be left to, wait for it... the parents.

The person before me is the one who brought up phones.

> The difference though is that parents are generally the ones to give their kids their phones and devices.

But either way I disagree. This comment sums up my point: https://news.ycombinator.com/item?id=47122715#47128105

ISPs and OSs should be the ones providing these tools and make is stupid easy to set up a child's account and have a walled garden for kids to use.

I live in the UK. By default your ISP will block "mature" content and you have to contact them to opt out. iOS, Android, Playstation, Xbox, Switch all have parental controls that are enforced at an account level.

A child with an iPhone, Xbox, and a Windows Laptop won't be able to install discord unless the parent explicitly lets them, or opts out of all the parental controls those platforms have to offer.

The tech is here already, this is not about keeping children safe.

You have to be very tech savvy to know that your kid asking to install Discord to talk to/play games with their friend group is as dangerous as it is.

A single google search will tell you pretty unanimously that discord isn’t for kids, is rated 13+ and has risks of talking to strangers.

Parts of discord are not safe at all for 13 year olds and currently there isn't a mechanism as far as I am aware to restrict a 13 year old from accessing them.

The solution to that is obviously some sort of Parental features, where a parent can create accounts for their kids with restricted access and/or monitoring capabilities. The solution isn't to require an ID from everyone just to "protect the kids"...

No, it's about corporate and government control. Thankfully, the UK government is clueless about tech, which means these controls can be bypassed relatively easily by using your own DNS or a public DNS server like Quad9.

The corporations in this case are fighting against this. This is about your government and its desire to squash opinions they don't like. They are already going so far as to jail people for posting opinions they don't like. This has absolutely nothing to do with children, children are just the excuse.

There's a law going through in some state that want's to do this, but also put the onus on the OS developers to detect age aligned behavior. How do you do this with Linux? It would kill the open computer and kill ownership over computing.

Why would it be a problem to do this sort of thing with linux? Linux allows for oauth, proxied networking, what have you -- unless they're using some super-secret-unpublished-protocol, linux will be fine

I'm against these age-verification laws, but to say it's impossible to comply with open-source software isn't really true.

The point is that you won't be able to just install a Linux distro of your choice in this world - your computer will only run approved OSs that have gone through some kind of certification process to make sure they enforce age-verification content. If, say, the Debian foundation doesn't want to add these mandatory controls because they feel it goes against the spirit of Debian (not to mention the huge issues with the GPL), then your new computer just won't be able to run Debian anymore. And something like Kali would be right out, of course, since anonymity is not compatible with age verification.

Or, Conversely, these systems won't be able to verify age and will just be shut out of adult content. Which is fine, just keep a windows machine around for porn and do your actual work on a real computer

> Which is fine

But it isn't fine. How long before that's no longer an option?

A few years ago it was "Apple won't let me side load apps, which is fine, I'll run android" now that's coming back and getting locked down even more.

How long before normal computers will all have signed bootloaders with only the OEM's OS of choice allowed to boot, 4 chains deep of verifying signatures on hardware security chips?

Mark Zuckerberg advocates for this, most people entrenched in this argument think it's worse. But I'm all for burning it to the ground so.

You must not have kids if you think it's easy to keep children off things that are bad for them.

[Any] task is much easier if you have the tools. Do/did you have a baby monitor? A technological tool, that allows you to "monitor" the baby while not being within an arms reach.

Do you have an A+++++ oven with three panes of glass? It's [relatively] safe to touch and instead of monitoring if a child is somewhere near the oven you have to monitor if the child does not actively open the oven. That's much easier.

Dumb question, not a parent — how old does a child have to be before they'll only touch the hot thing once so you don't need to guard it?

They learn to not intentionally touch the hot thing between 1 to 2 years, but then they still can fall on it or hit it during play.

As a parent you quickly learn that when you don't actively prevent major accidents it ends up costing you much more time, stress, screaming, etc.

It's really not some Herculean task to do so either, though.

I remember how my sister and I set up Google Family and fully locked down my niece her phone with app restrictions, screen time restrictions and a policy of accountability when we need to extend the screen time.

It worked really well up until she got a school managed chromebook for homework with no access controls.

Can't your router block by Mac address? Just limit the Chromebook to allowlisted sites. And also school-issued computers are known for Spyware and even worse. It should probably be segregated in a separate network or vlan.

Maybe you don't have kids of your own. Once you have 2 or 3, it is quite challenging to manage everything, especially over time.

Especially if they are older, like 8+ years old. They are resourceful, sneaky and relentless.

Which is exactly why all people everywhere giving up their privacy will also be ineffective.

Drugs, alcohol, cigarettes, pornography were all illegal for me to access as a kid but I wouldn’t have had any trouble getting any of it.

Maybe at 16, not at 8.

Many of my school colleagues started smoking around 10-11 years old. All of us had tasted alchol by then, and some of them were definitely drinking the occasional beer. Older kids sometimes brought porn magazines in school and would show younger kids too (still talking about pre-highscool here). Now, this was childhood in Romania in the 1990s and early 2000s, soon after the fall of communsim, so maybe not so applicable everywhere else, but still - I doubt that there is any problem for a resourceful 8-10 year old even today to get some of these things.

There’s a difference between “saw a playboy once” and having regular or semi regular access to it.

Same goes for alcohol and cigarettes.

In the US, if you had regular access to those things, you had parents who didn’t care.

It’s also not about kids on the margin. The vast majority of 8 year olds in the US have not tried alcohol, drugs, or cigarettes.

I can’t rely speak to post Cold War Romania.

The older kids are often the easy source for the younger kids. At 8 I had already seen a Playboy and knew kids who had seen harder stuff. I could have easily gotten a teenager to get me cigarettes (and drugs, but I didn’t know what those were really). I had also already tasted alcohol. Any of this I could have stolen from any number of places.

At 16 it was easier, but at 8 it wasn’t hard.

There’s a difference between “saw a playboy once” and having regular or semi regular access to it.

Same goes for alcohol and cigarettes.

If you had regular access to those things you had parents who didn’t care.

It’s also not about kids on the margin. The vast majority of 8 year olds have not tried alcohol, drugs, or cigarettes.

There’s also a difference between “saw my first” and “saw a playboy once.” I need you to understand I was a good kid whose parents cared until they divorced some years later. And yet I had multiple sources of access to this stuff without looking for it. Now, as an adult, I can see more ways I could have gotten it if I wanted it.

Again, if you occasionally caught a glimpse of a playboy, that’s not a significant problem.

If you were regularly smoking cigarettes, drinking alcohol, and reading porn magazines at 8 yeas, your parents fell down on the job. An 8 year old doesn’t have the wherewithal to hide that from parents who are paying attention.

> Now, as an adult, I can see more ways I could have gotten it if I wanted it.

Yeah a kid with the mind of an adult could access all kinds of illegal material.

Making it illegal to rob a bank doesn’t mean that’s it’s literally impossible. It’s about stopping enough people from trying that society functions.

The state of the world before the internet was that it was hard to keep a kid from ever glimpsing a titty, but it was relatively easy to keep a kid from having regular access to hard core porn-much, much easier than it is now. My take is that as a society we need to figure out some way to make this easy enough for parents to do that it becomes the default. Just like drugs, alcohol, and porno mags.

Another issue is that online porn and algorithmic brain rot is free (at least enough of it is). With IRL contraband, lack of money is a big limiting factor for kids. The IRL equivalent would be if the local liberal let 8 year olds checkout hard core porn DVDs.

Yeah. Anyway, porn, cigarettes, alcohol, and drugs were very accessible to me despite being a good kid with parents who cared in a world where those were all legally forbidden to me.

All this talk of “glimpses” is you trying to read too deep into a single example.

I’m not using my adult mind to figure out how I could have gotten this stuff as a kid. I’m using my adult mind to recognize that if I had been motivated as a kid, there are additional ways I. as a kid, would have been able to figure out how to get it.

I’m not throwing my hands up in the air and saying this is impossible or that we should just open up access. I’m saying requiring ID for access wasn’t effective before and it won’t be effective in a world with easier access. Yet the cost of that is quite high. Scan these threads for actual ideas, I’m not arguing for any particular one but there are plenty of them and some I think are good.

>Yeah. Anyway, porn, cigarettes, alcohol, and drugs were very accessible to me despite being a good kid with parents who cared in a world where those were all legally forbidden to me.

Were they accessible to you, or do you just think they were accessible to you? How many of these teenagers who would let you try a cigarette would have been willing to keep supplying you cigarettes regularly. How many would have been willing to keep buying you alcohol?

>All this talk of “glimpses” is you trying to read too deep into a single example.

No, it's glimpses, because it's about at the very least semi-regular access, not preventing every single child from having tiny amounts of alcohol. Look at my reply the other poster in this thread. There are dozens of studies that show conclusively that minimum age drinking laws reduce alcohol use among children, and reduce alcoholism later in life.

>I’m saying requiring ID for access wasn’t effective before

But yes it was effective. Read the studies. Minimum age drinking laws have been shown almost universally to be effective. Not at stopping every child from drinking but at harm reduction.

>I’m using my adult mind to recognize that if I had been motivated as a kid, there are additional ways I. as a kid, would have been able to figure out how to get it.

The level an effort an 8 year old would have to go through to get regular access to cigarettes and alcohol in the US, would require an enormous level of motivation which almost no 8 year old has, and it would be outright impossible to do without a semi-observant parent noticing.

That's the whole point of making it hard to do.

It takes much less effort for a kid to walk to the library and check out a hardcore porn DVD than it does for him to convince an 18 year old to buy one for him. Most kids just aren't going to go through the hassle of doing the latter, but they'd do the former in a heartbeat. All things being equal, greater motivation is required to overcome greater obstacles.

I’ve told you that access was not a problem at all. All your questioning is because you can’t grasp my lived reality. You think I’m mistaken, but actually I just don’t care to try to convince you because you’re already so sure.

Disinterest was what really “saved” me from these vices but lacking that, it was my parents. I also had access to perfectly legal things that were bad for me that I actually wanted and it was my parents who helped me there too; no mandatory ID required.

you are writing this as if you were never a kid yourself... there is absolutely nothing I wasn't able to "get" as a kid - some stuff I had to jump through some hoops but end-result would always end up being the same. if I wanted to watch hardcore porn, there was a way, if I wanted to smoke a cigarette, there was a way. if I wanted to drink, there was a way. and make it "forbidden" made it ever more appealing for me to get it as a kid. I grew up in society where alcohol was not a big deal, I was buying alcohol for my parents when I was 6-years old, would get sent to the store to get stuff and among the stuff was always beer and sometimes wine if my parents were expecting some guests. most of my friends growing up never thought of alcohol as something cool, we had easy access to it so it was like a rights of passage or anything like that and it showed, just about no one was doing any drinking while we were teenagers. when I came to america junior year of high school I was stunned at home much effort my schoolmates were making to acquire alcohol - could not really understand what the big deal is until I realized that was because it was forbidden and acquiring beer etc for a friday evening chill made one a cool kid.

the only barrier I have ever had to doing stupid things was the wrath of my parents. the punishment(s) levied when I did stupid shit was always such that I would very seldom-to-never-again consider doing whatever stupid shit I did. it always starts and ends with parents. you can put in whatever "laws" you want (which will always get weaponized politically at some point either immediately or at a later time) but end of the day the buck starts and stops with parents...

1. There is no scientific evidence that the "forbidden fruit" theory is correct. Studies of minimum drinking ages show a near universal reduction in drunk driving deaths, alcoholism, and crime rates.

https://pmc.ncbi.nlm.nih.gov/articles/PMC3018854/ https://pmc.ncbi.nlm.nih.gov/articles/PMC3586293/ https://pmc.ncbi.nlm.nih.gov/articles/PMC4961607/ https://www.nytimes.com/roomfordebate/2015/02/10/you-must-be... https://www.cdc.gov/alcohol/underage-drinking/minimum-legal-...

If you care to google it there are dozens of additional studies that all say the same thing.

2. You're writing this as if you don't understand what it's like growing up in a country where 8 year olds don't have easy access to alcohol, cigarettes, and drugs.

And you're writing this as if you don't understand what it's like growing up was a kid growing up in America specifically. My young children and the young children of everyone I now could not regularly drink alcohol or smoke cigarettes without their parents knowing about it. When I was 8 I couldn't have done either regularly without my parents knowing about it.

Again this isn't about stopping every single kid in the world from ever trying alcohol. This is about making it harder for them get and easier for parents to enforce.

>end of the day the buck starts and stops with parents...

That's a completely unrealistic view of the world and it's just flat out wrong on the face of it because every study we have on the subject shows that minimum drink age laws reduce harm--they work. If it were solely up to the parent they wouldn't work.

The easier you make it for parents to do the right thing, the more of them will do it.

over 10 years ago, I had an intern from Harvard CS tell me that privacy is irrelevant unless you're doing something that you want to hide. I was gobsmacked that someone would not cherish their privacy but since then I've realized many don't care at all and have the same attitude that "I don't have anything to hide."

Well that's your mistake right there. You hired someone from Harvard. Unless you are hiring that person to use their connections to market your product, there is no reason to hire someone from Harvard. They just bring bad ideology and STDs from Russian hookers to the table and nobody wants that.

PS This post is partly satire, I will leave it to you as to which part is serious.

> They are resourceful, sneaky and relentless.

... and honest:

- they will honestly tell you that they'd be very happy to see you dead when you impose restrictions upon them (people who are older will of course possibly get into legal trouble for such a statement)

- they will tell they they wish you'd never have given birth to them (or aborted them)

- they will tell you that since they never wanted to be born, they owe you nothing

- ...

Sounds like a kid in need of psychiatric help.

You barely ever had to deal with pubescent children? :-)

I raised kids. Never had to deal with anything like what is described. Sounds like someone read some questionable books on parenting, unfortunately followed the bad advice in those books and this is the result.

And this entire thing is about bad parenting. Its always easier to just give the kid a tablet and go back to whatever you were doing. Its always better to actually interact with the kid. That trade-off of time is important because if you mess up when they are young, you spend a lot more time handling issues later on. That time you gained by giving them a tablet will get payed back someday, usually with interest. That's what is happening here.

Please get the kids some help before we have to send you thoughts and prayers

I mean, that's really not normal puberty stuff, but... okay.

As a father of 3, one thing the wife and I had to learn over the course of the first two is that the modern world holds parents to impossible standards and a "fuck off" attitude is required for much of it.

We've had pediatricians shame us for feeding our kids what they're willing to eat and not magically forcing "a more varied diet" down their throats at every meal, despite them being perfectly healthy by every objective metric. There are laws making it technically illegal for us to leave our kids unsupervised at home for any period of time in any condition, even a few minutes if one of us is running slightly late from work/appointments.

Your not-quite-2-year-old is too tall for a rear-facing car-seat? You're a bad parent, possibly a criminal and putting them at risk by flipping the seat to face forward, a responsible parent spends hundreds of dollars they don't have on several different seats to maybe find one that fits better or have their kid ride uncomfortably and arguably unsafely with their legs hyper-extended up the seatback.

Miss a flu shot because you were busy? Careful you don't come off as an antivaxxer.

And all of this and more on top of changing diapers, doctors' appointments, daycare, preschool, school, family activities and full time jobs?

Yeah, when my kids are old enough to engage with social media I will teach them how to use it responsibly, warn them about the dangers, make myself available to them if they have any problems, enforce putting the phones down at dinner and and keep a loose eye on their usage. Fortunately/unfortunately for them they have a technically sophisticated father who knows how to log web activity on the family router without their knowledge. So if anything goes sideways I'll have some hard information to look at. Most families don't have that level of technical skill.

I was almost certainly never going to be a parent for other unrelated reasons, but you have just given me a whole other list of confirmations for that decision that I hadn't thought of before.

Thank you for that.

Well it's all more than worth it, at least for us. But that doesn't make some of the excess judgement tedious to deal with.

Kids are great at forcing you to prioritize. All of a sudden pre-ground coffee is worth it.

The school, in loco parentis.

Not responsible for selling to all minors, just theirs.

Well the parents entrust their kids to the school, so they would be the ones responsible for what goes on on their premises. In turn, school computers are famously locked down to the point of being absolutely useless.

That's really a district-by-district / school-by-school thing, some are significantly more locked down than others

Companies are legally prohibited from marketing and selling certain products like tobacco and alcohol because they historically tried to.

Parents are legally and socially expected to keep their kids away from tobacco and alcohol. You're breaking legal and social convention if you allow your kids to access dangerous drugs.

Capitalist social media is exactly as dangerous as alcohol and tobacco. Somebody should be held responsible for that, and the legal and social framework we already have for dealing with people who want to get kids addicted to shit works fairly well.

So we should ban social media is what you're saying but not what OC is saying.

Banning access to social media for kids under 18 similar to how tobacco and alcohol is banned to underage people would be the more direct line.

This argument is quite close to what gov'ts are "trying" to do here! And I tihnk you'll find very few people ammenable to the idea that we should allow cigarettes to be sold to underaged people (even if in practice they still get access).

The argument on the "don't do the social media ban" side is quite an uphill battle if you dig into this metaphor too much

All "social media" that uses recommendation algorithms should be unavaliable to children.

At least give it a try.

"Capitalist social media is exactly as dangerous as alcohol and tobacco. Somebody should be held responsible for that, and the legal and social framework we already have for dealing with people who want to get kids addicted to shit works fairly well."

They work hand in hand with governments around the world, that's why they get the tax breaks. In return they hand over details about your opinions, social networks and whereabouts, not to mention facial recognition data via Facebook. They aren't remotely capitalist in any real sense since they have a bad business model.

> Capitalist social media is exactly as dangerous as alcohol and tobacco.

Most actual studies done on this topic find very little evidence this is true.

It's a run-of-the-mill moral panic. People breathlessly repeating memes about whatever "kids these days" are up to and how horrible it is, as adults have done for thousands of years.

I expect some emotional attacks in response for questioning the big panic of the day, but before you do so please explore:

[1] Effects of reducing social media use are small and inconsistent: https://www.sciencedirect.com/science/article/pii/S266656032...

[2] Belief in "Social media addiction" is wholly explained by media framing and not an actual addiction: https://www.nature.com/articles/s41598-025-27053-2

[3] No causal link between time spent on social media and mental health harm: https://www.theguardian.com/media/2026/jan/14/social-media-t...

[4] The Flawed Evidence Behind Jonathan Haidt's Panic Farming: https://reason.com/2023/03/29/the-statistically-flawed-evide...

[flagged]

> give parents strong monitoring and restriction tools

The problem is that it's bloody hard to actually do this. I'm in a war with my 7yo about youtube; the terms of engagement are, I can block it however I want from the network side, and if he can get around it, he can watch.

Well, after many successful months of DNS block, he discovered proxies. After blocking enough of those to dissuade him, he discovered Firefox DNS-over-HTTPS, making it basically impossible to block him without blocking every Cloudflare IP or something. Would love to be wrong about that, but it seems like even just blocking a site is basically impossible without putting nanny-ware right on his machine; and that's only a bootable Linux USB stick away from being removed unless I lock down the BIOS and all that, and at that point it's not his computer and the rules of engagement have been voided.

For now I'm just using "policy" to stop him, but IMO the tools that parents have are weak unless you just want your kid to be an iPad user and never learn how a computer works at all.

As a parent of young children, this is your entire problem:

> the terms of engagement are, I can block it however I want from the network side, and if he can get around it, he can watch.

You're treating this as a technical problem, not a parental rules problem. Your own rules say he's allowed to watch!

You have to set the expectations and enforce it as a parent.

Depends on what the goal is. But yeah I agree if you really don't want them on YouTube (or whatever) and really do want them to tinker with their devices then you're likely going to have to eschew technical measures for more overt ones.

I think the point is that it's not enforceable.

I remember when I was a kid that age there were rules and some were technically enforced. But if you found a way around the technical enforcement you were in huge trouble. The equivalent here would he been, if you used a proxy to watch what you weren't meant to, then you lose all screen time indefinitely. Sneaking around parents' rules was absolutely not on.

Sounds like a smart kid, is part of you secretly proud of him for his tenacity?

Is it impractical to keep an eye on what he's doing on his computer, i.e. physically checking in on him from time to time?

How about holding him responsible for his own behavior, to develop respect for the rules you impose? Is it just hopeless, and if so how come? Is it impossible for him to understand why you don't want him watching certain content or why he should care about being worthy of your trust?

I'm not judging here, I'm genuinely curious.

Personally I wouldn't want to expose a child to "the algorithm" ie recommendations. It turns up useful stuff but (IMO) the stream contains an unacceptable concentration of radioactive waste and becomes increasingly concentrated if you click on any of it.

I might suggest explaining this to him, providing a uBlock filter to sanitize the page, and requiring use of said filter.

The obvious solution would be TLS interception and protocol whitelisting. Same as corporate IT. Stick the kids' devices on a separate vLAN if you don't want to catch all the other devices in the crossfire.

Still, there's an awful lot of excellent educational content on YouTube. It seems unfortunate to block access to that. Have you considered self hosting an alternative frontend for it?

Putting controls on the machine you want to restrict is pretty normal. While I agree with your first sentence that it's hard for parents to get proper monitoring tools, the rest of this sounds like a self-imposed problem. If you don't want to mess with the actual machine then run a proxy it has to use.

At this point why not just emancipate him. Hook him up with an easy remote job, put a lock on his bedroom and hand him the keys, and make him start paying rent. Because I’m having trouble figuring out what part of society you’re preparing him for at this stage. Respectfully.

Whats so hard about taking the iPad out of they're hands? or laptop or whatever, once you catch them on sites they shouldnt be on?

You're understating the US's policy on recklessness. We have "attractive nuisances," which means that if you put a trampoline in your backyard, and a kid passing through sees it, decides to do a sick jump off of it, and breaks their leg, that was partly your fault for having something so awesome that kids would probably like.

> which means that if you put a trampoline in your backyard, and a kid passing through sees it, decides to do a sick jump off of it, and breaks their leg, that was partly your fault for having something so awesome that kids would probably like.

That's not exactly accurate. The two key parts of the attractive nuisance law are a failure to secure something combined with the victim being too young to understand the risks.

So if you put a trampoline in your front yard, that's an easy attractive nuisance case.

If you put a pool in your back yard with a fence and a locked gate, it would be much harder to argue that it was an attractive nuisance.

If a 17 year old kid comes along and breaks into your back yard by hopping a 6-foot tall fence, you'd also have a hard time knowing they didn't understand that their activities came with some risk. Most cases are about very young children, though there are exceptions

>put a trampoline in your front yard

This is exactly what one of our neighbors did when I was growing up.

All the kids loved it.

There just weren't very many lawsuits back then like there are now after the number of attorneys proliferated so much.

To be as safe as they could, the parents put the trampoline in a pit where the bouncing surface was at ground level.

If you drove by, you wouldn't even be able to see it, or have any idea that it was there.

Unless there was somebody bouncing at the time.

You should have seen the look on peoples' faces when they drove down our street and saw that for the first time :)

It would not be quite that simple. The trampoline (or pool, or whatever) would have to be visible, in a place children were likely to be, not protected by any reasonable amount of care, and the kid would have to be young enough to not know any better.

The legal doctrine is also not specific to the US, of course.

And that law is incredibly and hideously stupid, as it's a heckler's veto on having cool stuff.

The Internet is basically the final frontier where this harmful law doesn't reach, though the Karens are really trying to expand their power there.

A monitoring solution might have worked for my case if my parents had monitored my Internet history, if they always made sure to check in on what I thought/felt from what I watched and made sure I felt secure in relying on them to back me up in the worst cases.

But I didn't have emotionally mature parents, and I'm sure so many children growing up now don't either. They're going to read arguments like these and say they're already doing enough. Maybe they truly believe they are, even if they're mistaken. Or maybe they won't read arguments like these at all. Parenting methods are diverse but smartphones are ubiquitous.

So yes, I agree that parents need to be held accountable, but I'm torn on if the legal avenue is feasible compared to the cultural one. Children also need more social support if they can't rely on their parents like in my case, or tech is going to eat them alive. Social solutions/public works are kind of boring compared to technology solutions, but society has been around longer than smartphones.

Should the state have force your parents to give you up for adoption? That's the social support the state can offer.

This is the real point that needs to be made.

You can argue that many parents are less than ideal parents, but that is not sufficient to justify having the state step in. You also have to show that the state is less bad.

Decades of data on the foster system strongly suggests otherwise. The state, by any objective measure, is terrible at raising children.

I don't think it would have helped, given the outcomes for foster children are near universally worse except in the most extreme cases of abuse. I did threaten to call CPS but I was, of course, berated for it and threatened that I would be taken away, so that shut me up. Since I was never assaulted I doubt it would have reached the standard for foster care anyway, yet the consequences still endure to this day.

I was told over and over by in hindsight unqualified persons that emotional abuse wasn't real abuse, so after a few years I was disinclined to seek help.

If I had had even one person that supported me unconditionally instead of none at all, even if that person wasn't a parent, I'm fairly certain I would have turned out differently. That was just a matter of luck, and I came out empty-handed. I never felt comfortable talking about what I was exposed to online with anyone, and that only hurt me further, but I was a child and couldn't see another option.

So the only options are no support or give you up for adoption? No middle ground is possible?

As a parent, I think you’re understating how difficult it is to provide a specific amount of internet access (and no more) to a motivated kid. Kids research and trade parental control exploits, and schools issue devices with weak controls whether parents like it or not. I’m way at the extreme end of trying to control access (other than parents who don’t allow any device usage at all) and it has been one loophole after another.

As somebody who is entirely for restrictions on internet / social media, I think you're missing the bigger picture here. First, you assume that parents have the technical knowhow to restrict their kids from specific sites. My parents used a lot of different tools when I was a kid, but between figuring out passwords, putting my fingerprint onto my mom's phone, and spoofing mac addresses, I always found a way around the restrictions so I could stay up later.

But let's assume the majority of parents can actually do this. The problem with social media is not an individual one! We've fallen into a Nash Equilibrium, a game theory trap where we all defect and use our phones. If you don't have a phone or social media nowadays you will have much more trouble socializing than those who do, even though everyone would be better off if nobody used phones. As a teenager, you don't want to be the only one without a phone or social media. And so I truly do think the only solution is with higher level coordination.

Now, it's possible that the government isn't the right organization to enforce this coordination. Unfortunately, we don't really have any other forms of community that work for this. People already get mad at HOA's for making them trim their lawn; imagine an HOA for blocking social media! I do think the idea of a community doing this would be great though, assuming (obviously) that it was easy to move on and out of, as well as local. This would also help adults!

So to be honest, I don't think parents have the individual power to fix this, even with their kids.

It's much easier to give individual users control over their own device than to give a centralized authority control over what happens on everyone's device over the Internet. Local user-controlled toggles are just easier to implement.

All parental moderation mechanisms can and should be implemented as opt-in on-device settings. What governments need to do is pressure companies to implement those on-device settings. And what we can do as open-source developers is beat them to the punch. Each parent will decide whether or not to use them. Some people will, some won't. It's not Bob's responsibility to parent Charlie's children. Bob and Charlie must parent their own children.

To the people arguing that parents are too dumb to control their children's tech usage because they themselves are tech-illiterate: millennia ago, we invented this new thing called fire. Most people were also "too dumb" to keep their children away from the shiny flames. People didn't know what it was or how dangerous it could be. So the tribe leader (who, by the way, gropes your children) proposed a solution: centralize control of all the fire. Only the tribe leader gets to use it to cook. Everyone else just needs to listen to him. Remember, it's all for you and your children's safety.

> we invented this new thing called fire [...] So the tribe leader (who, by the way, gropes your children) proposed a solution: centralize control of all the fire

Of all the things, a "save-the-children prolegomena to the Prometheus myth" certainly wasn't on my bingo card today. So thank you for that, but I'm not aware of any reports of fire-keeping in the way you've described. Societies and religions do have sacred traditions related to fire (like Zoroastrians) but that doesn't come with restrictions on practical use AFAIK.

I'll spell it out for you since you can't read between the lines. It's not actually about fire-keeping in tribes to protect children. It's about certain people (governments, corporations, organizations) wanting control over the Internet and everyone's digital communications. They don't want a free marketplace of ideas and uncensored channels of communication because their propaganda narratives would not survive.

The tribe leader refers to certain rich and powerful folks that have infiltrated governments and are running some of the largest businesses.

The fire refers to instant communication over the Internet. This relatively new technology has the potential to paralyze old power structures and reshape civilization. It's understandable why governments et al are panicking. They know their authority will wane under global free speech unless they do something.

Am I the only one that is repeatedly amused at how many smart people are just caving to making this about parents/children at all?

We've literally watched things unfold in real time out in the open in the last year I don't know how much more obvious it could be that child-protections are the bad-faith excuse the powers that be are using here. Combined with their control of broadcasting/social media, it's the very thing they're pushing narratives in lockstep over. All this to effectively tie online identities to real people. Quick and easy digital profiles/analytics on anyone, full reads on chat history assessments of idealogies/political affiliations/online activities at scale, that's all this ever was and I _know_ hackernews is smart enough to see that writing on the wall. Ofc porn sites were targeted first with legislation like this, pornography has always been a low-hanging fruit to run a smear campaign on political/idealogical dissidents. It wasn't enough, they want all platform activity in the datasets.

I can't help but feel like the longer we debate the merits of good parenting, the faster we're just going to speedrun losing the plot entirely. I think it goes without saying that no shit good parenting should be at play, but this is hardly even about that and I don't know why people take the time of day. It's become reddit-caliber discussion and everyone's just chasing the high of talking about how _they_ would parent in any given scenario, and such discussion does literally nothing to assess/respond to the realities in front of us. In case I'm not being clear, talking about how correct-parenting should be used in lieu of online verification laws is going to do literally nothing to stop this type of legislation from continually taking over. It's not like these discussions and ideas are going to get distilled into the dissent on the congressional floors that vote on these laws. It is in it's own way a slice of culture war that has permeated into the nerd-sphere.

I make this argument to neutralize the "protect the children" excuse and also delegitimize the age verification "solution" by pointing out that on-device settings are more effective and easier to implement yet rarely discussed.

There are some parents genuinely concerned with parenting. We should give them the tools to do that and thereby removing them from the discourse, then we can focus on the bad faith people that want more control. I think there are still enough well-meaning people in governments that if we popularize on-device settings, it will prevent age verification in at least a handful of countries, and that's good enough to keep the spark of the free Internet going until we figure out a more permanent solution.

> It's not like these discussions and ideas are going to get distilled into the dissent on the congressional floors that vote on these laws.

You think the idea of parents, not governments, being responsible for parenting doesn't translate well to voters? In the country founded on the idea of freedom from overreaching governance and personal responsibility?

that's not what i'm saying at all. i highlighted that that is quite literally the convenient narrative that's being used to get everyone squabbling amongst themselves. it is very clear that this is being used in bad-faith to get people to immediately side a certain way. yet here on hackernews we find dissenting viewpoints to that, rather than discussion about the entirety of it and what the real motives at play are. i am once again amused at the efficacy of the smokescreen here.

what i'm saying is these discussions around parenting have had zero impacts on preventing the passage/implementation of such legislation/policies to date despite many smart people in here understanding what's actually at stake. and it's very likely that these parenting discussions will again go on to have absolutely zero impact on preventing the continued impelmentation of id verification on platforms. these policies/legislations aren't simply being implemented because people have failed to fully thought-exercise out good/bad parenting styles enough yet in the marketplace of ideas, it's becoming a reality because we aren't collectively raising awareness of the downstream ways this legislation will be harnessed for shitty outcomes. we aren't talking about it for what it is, but instead talking about it in the way they want us to talk about it. these parenting discussion points have been beaten to death and nothing new or novel is being shared, and rather than looking straight at the wolves right here in the room with us (data brokerage & who benefits from this type of data brokerage & figuring out how to stop it) people just look at each other and get butthurt about idealogical parenting differences. it's literally a slice of the now-ever-so-common 2d culture war we're all acutely aware exists, right here on hackernews, and we're all actively participating.

I guess I disagree that there is some shadowy alternative motivation for these laws. If the goal was to link everyone's ID with their account they would be requiring everyone to send in their ID instead of making age estimation the first option. I'm also a bit confused about the data brokerage part. What do you imagine the data brokers get out of this?

This only works if I ban my child from having any friends since they all have unlimited mobile access to the internet.

Could your child not just call or text their friends? Or is the real expectation to not have to intervene at all about their preferred platform?

Only if all the other kids are not on social media. When I was in school, birthday parties and such were organised on facebook. If you were not on facebook, you weren't invited.

If everyone was banned from facebook we would have organised them via text messages or email. That's the main point of social media age restrictions, individually banning kids is too punishing on those kids so parents and teachers don't try. Doing it across the whole population is much better.

I think the idea is for the child see their friends in person... not call, text, or internet.

So even if their own child has no phone at all, they have access to the internet through other children's unlimited mobile access.

When I was growing up, we loved to lend the sheltered kids from the more conservative families media they weren’t supposed to have, like the Harry Potter books.

I'm saying they'll use their friend's devices.

Sorry, I know it's a hard line for parents to tread and it's really easy to criticize parenting decisions other people are making, but the "everyone else is doing it so I have to" always seems as lazy to me today, as it probably did to my parents when I said it to them as a teenager.

Is it more important to prevent your son from being weaponized and turned into a little ball of hate and anger, and your daughter from spending her teen years depressed and encouraged to develop eating disorders, or to make sure they can binge the same influencers as their "friends"?

We used to teach kids to be themselves and stand up for what they believe in and their own authenticity and uniqueness even in the face of bullying. That having less or other doesn’t mean your value is lesser or that you should be left out. Now we teach them… conform at all costs so you never have to risk being bullied or lonely?

> Now we teach them… conform at all costs so you never have to risk being bullied or lonely?

Literally every kid/teen-targeted movie has championed or contradicted this for decades. Yes even “back in the day.” Hell what is the end of Grease? Sandy changes who she is to conform with the greasers and everyone cheers including her man who allegedly liked her as she was before? I don’t even get what they’re saying at the end.

Conform, be an individual, the message is always shifting and always has. You’re a jock, you’re a nerd. Jocks beat up nerds and get the girls. Oh wait in this movie the nerds actually win and are rewarded for being themselves though.

There wasn’t some special time where you were taught the right lesson that everyone now is missing out on, and there were plenty of lessons passed on to you that we have thankfully eradicated I imagine. Growing up is complicated. Social dynamics are complicated. The way they are portrayed is also complicated. We’re all having to adapt and try our best here, no one has the exact answer

The number of times I objected to my parents rules because my friends didn’t have those rules and the response was: “I’m not their parent.”

Is it more important to prevent your child from <...>, or to not be seen as an adversarial monster?

presumably being a parent is different from being a your child’s friend. There is overlap, but yes, sometimes being a good parent requires “laying down the law”.

With that being said, i think explaining _in detail_ why you’re laying down certain rules can go a LONG way toward building some trust and productive dialogue with your child. Maybe you’ll find out they are more mature than you give them credit, can loosen up a bit. Or maybe a reasonable compromise can be found. Or maybe they’ll be bitter for a few months, but they’ll at least understand “why”.

Yes if they do bad things like drunk, have sex and do drugs.

I would start with banning cellphones.

My greatest fear for my future young adult children is that they're on their cell phone all day and never have time to get in trouble with their friends, so there's that. Yes, Let's start with banning the cell phones.

this is the biggest problem, so many parents are head-in-the-sand when it comes to things that can damage a child’s mind like screen time, yet no matter how much you protect them if it’s not a shared effort it all goes out the window, then the kid becomes incentivized to spend more time with friends just for the access, and can develop a sense that maybe mom and dad are just wrong because why aren’t so-and-so’s parents so strict?

because their parents didn’t read the research or don’t care about the opportunity cost because it can’t be that big of a deal or it would not be allowed or legal right? at least not until their kid gets into a jam or shows behavioral issues, but even then they don’t evaluate, they often just fall prey to the next monthly subscription to cancel out the effects of the first: medication

Do you believe the research shows that screens in and of themselves are so powerfully damaging that being exposed for, what, a few hours a week at a friend’s house will cause them to require psychiatric medication?

So many questions. Are you campaigning against billboards in your city? Do you avoid taking your kids to any business that has digital signage? I assume you completely abstain from all types of movies and TV? What about radio or books?

What are you, personally, doing on HN?

Fascinating.

it sounds like you already knew all of your assumptions were absurd yet you asked them anyways which ironically makes your comment the truly fascinating one

Individual Parents vs Meta Inc (1.66T mkt cap)

May the best legal person win!

Its more like age verification corporations, identity verification corporations, the child "safety" organizations that were lobbying for Chat Control versus individuals who want to protect their privacy.

> We'll try everything, it seems, other than holding parents accountable for what their children consume.

The mistake in this reasoning is assuming that they are actually interested in protecting the children.

This.

The world is becoming increasingly more uncertain geopolitically. We have incipient (and actual) wars coming, and near term potential for societal disruption from technological unemployment. Meanwhile social media has all but completely undermined broadcast media as a means of social control.

This isn't about protecting children. It's about preventing a repeated of the Arab Spring in western countries later this decade.

"Think of the children" is the oldest trick in the book, and should always be met with skepticism.

The Arab Spring was caused by a tripling of food prices. I somehow doubt something similar will happen in the west. As for the rest, ignoring the population's concerns (by suppressing social media) is the best way to cause political violence. So I see blocking the governments desires to shape political discourse as saving the politicians from themselves.

GP isn't interested in protecting children either. Punishing parents harder does nothing to improve the lives of children — in fact it makes them much worse, because now they are addicted to Facebook and their parents are in jail. It just makes certain people feel morally righteous that someone got punished.

Children are clever. I think the deeper issue is that very few parents care enough to actually articulate the danger to their kids.

As a kid, my dad sat me down and explained how porn could destroy my life. It's not hard to get people to act in their own self interest once they know what's destructive for them.

The problem is that most parents don't even understand just how damaging social media is.

"We'll try everything, it seems, other than holding parents accountable for what their children consume".

We'll try anything, it seems, other than hold internet companies accountable for the society destroying shit they publish.

And it's not jusy children who's lives they are destroying.

If you are interested in learning about the other perspective, you can watch some parents’ congressional testimony here https://youtu.be/y8ddg4460xc?si=-yYduYDppF4TQWqD.

The character.ai one is gut wrenching.

> then give parents strong monitoring and restriction tools and empower them to protect their children

I think this is the right way to solve the problem.

For example, I think websites should have a header or something that indicates a recommended age level, and what kinds of more mature content and interactions it has, so that filters can use that without having to use heuristics.

I agree with you that parents should be responsible, but your argument is clearly flawed.

> you can get in trouble if you recklessly leave around or provide alcohol/guns/cigarettes for a minor to start using

In the example here, there are 3 things where age verification is required AND parents have responsibility.

It’s not just one or the other.

The same responsibilities are not “thrown out”, they are never acknowledged in the first place.

As a parent blocking websights is a joy, maybe the rule should be to allow guardians more ability to control that. Trying to block some services is not trivial

As a human, I'd love to see the rest of you fools quit that. If HN ever starts to algorithm me I'll be gone too.

And as a bonus you can block your boomer parent's access to cnn and msnbc (or whatever its called now) and perhaps fox. It will make Thankgiving a lot more pleasant for all.

PS Mom, I don't know why cnn doesn't work anymore. ;)

If they live under my roof, it's my rules. Turn about is fair play.

As for news, the art of discovering what in your subjective reality exists in the objective reality is something I don't expect well ever get gud at.

I'm not Americans but isn't Fox the worst one out of those?

It's very easy to lock up alcohol/cigarettes, a child should never have access. Internet usage is more like broadcast media, a child should have regular access.

The positives and negatives of Internet usage are more extreme than broadcast media but less than alcohol/guns. The majority of people lack the skills to properly censor Internet without hovering over the child's shoulder full-time as you would with a gun. Best you can do is keep their PC near you, but it's not enough.

We agree that a creepy surveillance nanny state is not the solution, but training parents to do the censorship seems unattainable. As we do for guns/alcohol/cigarettes, mass education about the dangers is a good baseline.

EDIT: And some might disagree about never having access to alcohol!

Devices such as phones come with an option when you start the device asking simply is this for a child or an adult. Your router generally these days comes with a parental filter option on start up too. Heck we have chatgpt that can guide a parent through setting up a system if they want something more custom.

If people want to push, they should just push to make these set up options more ubiquitous, obvious and standardized. And perhaps fund some advertising for these features.

Router parental filters are accountability sinks. They don't actually work, and they can't because we spent the last 20 years redesigning network protocols to prevent middle boxes from tampering with connections.

In what sense? DNS blockers work generally do they not? Adguard also censors google search results.

I don't see why your kid should be browsing reddit.

I mean even only allow whitelisted sites. As I say this can be standardized further.

These measures I truly believe do not need to be 100% foolproof so long as the hurdle is high enough that children give up it's fine. And these measures could potentially notify a parent of a suspected breach or attempt to game it, without intruding too much into the child's privacy.

DNS blockers only work if the device/application is not adversarial or if you also have a smart enough firewall to block DoH, which is designed to blend in with web traffic. Once ECH is widespread, you'd likely need to MitM the device (so you need to install your CA, which is intentionally made very difficult and you might not even be able to do across all apps anymore on mobile devices? At least without enterprise MDM. And as was observed elsewhere[0], apps like spotify can contain a web browser), or perhaps use DNS requests as a trigger to briefly open a default deny outbound firewall.

Things have definitely been converging toward making it impossible for non-corporations to manage the devices they own, the network they run, etc.

[0] https://news.ycombinator.com/item?id=47128069

This is very interesting thanks.

I agree that ECH is perhaps a stumbling block although as you say MitM, this is indeed possible to pursue considering the whole set up child account on device thing going on with many of these devices.

On the rest of of your points fair enough, but again I ask is it actually proportionate? Are we talking about children or black hats?

The black hats in this case are the software vendors. If your software prevents any ability to inspect any of its traffic (so you can't use external filters), and the OS doesn't offer ways to override/hook into that, and if the inbuilt parental controls are insufficient, you can't do much.

What are you going to do when every application (including web browsers) simply ignores and bypass your DNS filtering "for security" and every site is opaque (e.g. wikipedia looks just like pornhub to your router and every site is using one of a small number of major frontend proxies like cloudflare that's actively specifically working toward traffic opacity)? It happens that every major commercial non-server OS vendor (except Redhat?) is an ad company now, so they all have a reason to block your ability to filter traffic/restrict your configuration to only what they allow. And they're all working toward that.

Good point well made.

This is where Apple, Microsoft and Android need to step up. Indeed they already have in many ways with things being better than they used to be.

There needs to be a strict (as in MDM level) parental control system.

Furthermore there needs to be a "School Mode" which allows the devices to be used educationally but not as a distraction. This would work far better than a ban.

I dunno man. IMHO, kids should not have access to devices of any kind until the brain develops. Im not sure what that number is, but lets say its 15. At that point, we as parents need to be role models and let kids make mistakes. There is this whole idea that if you focus too much on security, you open the door for increased risk. I feel this applies to this situation[0].

When I was a kid, when I reached a certain age, 13 I think, there was nothing my parents good could do to stop me from learning from my own mistakes. I think using blanket laws and tech to curb internet behavior is just going to backfire.

[0]: https://news.clemson.edu/the-safer-you-feel-the-less-safely-...

Microsoft has done a good job with Microsoft accounts and Microsoft Family Safety. It's about as user-friendly as you'll get outside of Apple, though the speed could be improved. And this only covers PCs, Android 's system is less good.

Even with this, the problem requires more than pushing a button. Time, thought, and adjustment are needed. Like home maintenance, its necessary but not everyone can do it without help.

Getting AI assistance is good advice.

They could provide all the tools in the world. Unless there’s legislation change to what children are allowed to consume legally, everyone will largely ignore it.

Ironically, the government that is pushing this only set a drinking age just a couple of years ago (as in the last 10 years). In case you believed this was actually about kids.

The speech that worked (mostly) on the children in my life involved the concept of 'cannot unsee', which they seemed to understand. There are some parallels to gun safety here because there are things that even the adults in your life try not to do and it seems perfectly reasonable to expect the same from children.

In fact being held to a standard that adults hold themselves to is frequently seen as a rite of passage. I'm a big girl now and I put on my big girl pants to prove it.

parents can be held liable for buying their kids cigarettes but, similarly, tobacco companies are (at least nominally) not supposed to target children in their advertising campaigns and in the design of their products.

It's obviously not a 1/1 comparison here, because providing ID to access the internet is not analogous to providing ID to purchase a pack of Cowboy Killers but we can extrapolate to a certain extent.

(inb4 DAE REGULATING FOR-PROFIT CORPORATIONS == NANNY STATE?!?!?!?!?)

You can expect the individual to compensate for a poorly structured society all you want.

> you can get in trouble if you recklessly leave around or provide alcohol/guns/cigarettes for a minor to start using

You can only expect so much from individual responsibility. At some point you need to structure society to compensate for the inevitable failures that occur.

> They are in a much better and informed position to do so than a creepy surveillance nanny state.

I'd rather live in a nanny state than ever trust american parenting. We've demonstrated a million times over that that doesn't work and produces even more fucked up people and abused children.

The richest brightest minds of our generation all being motivated towards one addictive goal, and we'll just put the responsibility on the parents...I think society can collectively do better.

If we expect Parents to treat Social Media like other unhealthy, dangerous, and highly addictive products, then that can never start with "just expect ignorant parents to all magically start doing something difficult, for no real reason".

It starts by banning kids from the internet, entirely. It starts with putting age restrictions on who can buy internet connected devices. It starts by arresting parents and teachers who hand pre-literacy kids an always-online iPad. It starts with an overwhelming propaganda campaign: Posters, Commercials, After-School Specials, D.A.R.E. officers, red ribbon week.

Then, ultimately, it still finishes with an age-gated internet where every adult is required to upload their extremely valuable personal information to for-profit companies, for free (With the added weight of being forced to agree to extreme ToS, like arbitration agreements).

So what do we do? I agree that the age of entry to the internet should match other vices (currently 21+ in the US, although really that should probably be 18+)...

It will never be acceptable for a single country's police state to extend across international borders, so... we just ban all of the UK and Australia from every web service until they get withdrawals and promise to stay nice? That could be a start.

But this whole situation in like 'freedom of speech' once you start picking and choosing what counts as "acceptable" speech, then suddenly you lose everything. You literally can't make everyone happy, because everything subjective is open to contradiction - and because there are freaks in the world who will never be satisfied by anything less than a complete global ban of everything.

Who gets a say? Do the Amish get to tell us what we are allowed to do? Where do you draw the line? You can't. Completely open is the only acceptable choice. But I still vote we start publicly mocking the parents who give their kids an ipad, and treat them like they just gave that kid a cigarette. Because seriously, they're ruining that kid.

I've already thought about it from the US's perspective and here's my path forward.

If government does not want kids to have access to the naughty bits of the internet but thinks there's something worth sharing with children then the government should provide a public internet for kids and THATS the site that will ask for a login known to belong to a kid. We already do public schooling with public funding and we do not let rando adults sit in classrooms with kids and they get a school id. Boot <18's off the public internet AT THE SOURCE when internet connectivity is PURCHASED / CONTRACTED FOR with a valid adult id / proof of age, but allow them vpn access into whatever the government thinks the child should have access to, like the schools page, I would say online encyclopedias or wikipedia type things but I'm not sure if government wants children to read about the variety of so many different things on this planet we're sorta trapped on and lets face it, restricting communications of the kids to points outside the control of parents is exactly what the government is complaining about, the government does not want kids to have free access to information.

Think of a phone or tablet that can only access the network through either a proxy or vpn but otherwise locked down. It certainly seems like it doesn't require much programming, heck have trump vibe code it for all I care.

I mean yeah, parents could just teach their kids the tough stuff because thats how it used to work anyways, well that and the libraries and schools but those can be pruned of bad books and bad teachers at the request of government anyways right? The kids could also be interviewed periodically by government to inventory what topics they have discussed with their parents to weed out the 't' or 'g' words.

I mean yeah I don't see a place for facebook in that intranet but isn't that sort of the point, we all know big social media will be incentivised to promote engagement with less regard for safety, so why do kids need facebook anyways? The instagrams and ticktalks are worse although maybe government should make a child friendly ticktalk type school social network, call it trumps school for kids for all I care, folks in power right now and a significant part of the US believe that trump knows whats good for kids right?

I mean obviously the libraries have to be REALLY REALLY cleaned up but thats just a detail. But why are parents forcing internet wierdos onto their kids with these smartphones / porno studios in their pockets? What do they think chester the molester on ticktalk is gonna have the kid upload their id? even if he does, do we really want that? c'mon man

The difference with guns, tobacco and alcohol is huge: all negatives aside, giving kids what they want makes the life of a parent so much easier. Take it away and many parents will fight. Sugar is in the same game.

I'm 40. Do I need to get my parents to vouch for me? Who vouches for them?

> then give parents strong monitoring and restriction tools

As written, this sounds very glib. I cannot take this comment seriously without a game theory scenario with multiple actors.

Should we allow kids to get cigarettes? Cocaine? Should all parents "just" be better parents and problem solved?

you can’t blame it on parents alone, but the odds are stacked against children and their parents, there are very smart people whose income depends on making sure you never leave your black mirror

the surveillance state is possible, achievable, and a few coordination games away from deployment with backing from a majority who should know better

inertia kills, I dunno

The greatest of uphill battles in today's current climate is trying to push anything in the realm of personal responsibility.

Politicians' whole basis for nearly every campaign is "you're helpless, let us fix it for you."

For the vast majority of problems plaguing society, the answer isn't government, it's for people changing their behavior. Same goes for parenting.

But unfortunately, "you're an adult, figure it out" isn't the greatest campaign slogan (if you want to win).

It wasn’t always this way: “Ask not what your country can do for you — ask what you can do for your country”

[dead]

What is your proposed recourse for me as a parent if your kid shows my kid gore videos?

What is your recourse if his kid gives yours a bottle of whisky?

Yes, children are clever - I was one once.

A counterargument to your point that children are clever - I was also one once.

The vast majority of parents aren't tech-savvy enough to be able to operate IT parental controls.

Except companies provide wholly inadequate safeguards and tools. They are buggy, inconsistent, easily circumvented, and even at time malicious. Consumers should be better able to hold providers accountable, before we start going after parents.

The only real solution is to keep children off of the internet and any internet connected device until they are older. The problem there is that everything is done on-line now and it is practically impossible to avoid it without penalizing your child.

If social media and its astroturfers want to avoid outright age bans, they need to stop actively exploiting children and accept other forms of regulation, and it needs to come with teeth.

How easy is it for kids to bypass Parental Controls on iOS devices?

Social engineering is the most effective strategy, because iOS screen time controls are so buggy that eventually parents throw up their hands in exasperation and enable broader access than they would otherwise choose.

It’s one setting to only allow a whitelist and not allow apps to be downloaded. Yes parents might actually need to learn technology

I use it, I am quite familiar with the bugs. The app controls randomly duplicate themselves and change in scope. It would almost be comical if it had not been happening for so many years to so many people. Apple knows, does not care.

When everything is turned off by default, iOS Screentime is very effective. It also has effective tools for to grant certain exceptions, facilitated by Messages. It also distinguishes between "daytime" and "downtime" for the purpose of certain apps and app attributes, like the contact list. For example, we have ourselves, grandparents and the neighbors as "all the time" contacts but their friends as daytime only. They don't retain their devices at night but it is possible for them to pull them from the charging cabinet.

> Except companies provide wholly inadequate safeguards and tools. They are buggy, inconsistent, easily circumvented, and even at time malicious. Consumers should be better able to hold providers accountable, before we start going after parents.

We could mandate that companies that market the products actually have to deliver effective solutions.

Cue blog posts about section 230 and how it’s impossible to do hard things and parents should be held accountable not companies, meager fines, captured bureaucrats, libertarians, and on and on…

Yes, but how on earth is their malicious compliance at providing parental controls a good reason to go for the surveillance state that hurts absolutely everyone?

Social media operators love the surveillance state idea. That's why they aren't pushing against this.

I even cancelled YT Premium because their "made for kids" system interfered with being able to use my paid adult account. I urge other people to do the same when the solutions offered are insufficient.

Step 0 is physical device access. Kids shouldn't have tablets or smartphones or personal laptops before age 16.

16 is a bit steep but I do generally agree with your sentiment. I wish there were more educational home computers like there were back in the day like the BBC micro. I have a startup idea to make something like that (mostly as a dumping ground for my plethora of OS-software and computer education ideas) but don't currently have the resources and have doubts on how successful something like that would even be in this day and age. I'm only 18ish (Not giving my actual age for privacy reasons but it's within a 5 year margin) and feel like my peers would rather be locked to platforms and consume than learn to create and actually use computers despite there being a very obvious need (I once had a 20 year old look at me like I had 2 heads for asking them to move something into a folder)

> Kids shouldn't have tablets or smartphones or personal laptops before age 16.

If you make such a restriction, they'll secretly buy some cheap "unrestricted" device like some Raspberry Pi (just like earlier generations bought their secret "boob magazines").

Parents should have an allowlist of devices to be able to join their network. And then they can require root certs or something for access outside of a narrow allow list. There's a host of ways to solve both problems. Just remember to check for hardware keyloggers on your (the parents') devices, as kids could use them or try evil maid attacks, etc. if they feel totally encaged.

This will only work in practice if one of the parents is a network technician. :-)

I've said it before but prohibition works, if the goal is to reduce usage. I don't see this as a realistic problem.

This is the craziest thing I’ve heard in a while. They shouldn’t have connected game systems either?

No, because those devices have little or no controls and those controls are easily bypassed and/or not honored by the platform.

I think they should. Theres a fine line between beneficial and detrimental. I had a 3DS growing up and could browse the web with its very gimped browser, and I think something like that is actually very good for a child (able to access the internet and view simple and informative sites while being too limited to access social media and the like)

The problem is unrestricted access to mobile devices. A game console or desktop PC isn't as big of a deal.

What’s the difference? They all reach the same internet

Have you ever visited any game store and turned off nsfw protection?

I love gaming, but I hate all the smutt games. It discredits the medium, essentially what has also happened to anime.

I'm kinda baffled about the Switch store's quantity of dating/whatever adult-ish games.

I don't really want to turn on age-based filters (to the point that I've never investigated if they even exist) but at this rate, there's hardly anything worth looking at in the recent feed.

The target demographics for Nintendo products have shifted from kids to.. kidults? Most kids nowadays play on phones or in rarer cases PC/Xbox, Nintendo's lost much of their cache (in my visible experience) save for children parented by the "mindful milennial" types

Makes sense but there's just... so much of it. That and all the shovelware.

It's just hard to imagine that's anything close to what Nintendo wants users to experience, but I guess they need the money.

They really could find a niche in making phones for kids that have walled-garden internet access, they were so good at doing so with the ds but alas..

I bet not many of us would be here now if we hadn't had our own computers before age 16.

Today's young people are already technologically retarded (in the literal sense) and barely know how to use Microsoft Word or navigate with a file explorer, this would make the problem significantly worse.

I hope they do pass a law like that, because it'd give my kids a gigantic advantage over the kids who had no access modern technology and the free flow of information until the age of 16. If you want to leave your kids completely unable to find any kind of gainful employment in the AI era, be my guest.

> If you want to leave your kids completely unable to find any kind of gainful employment in the AI era, be my guest.

Your kid is screwed either way. Unless he moves to India.

What? Are there billion dollar companies with huge staffs who are constantly trying to figure out how to sneak my child a gun all the time, at school, wherever they go?

I'd say this comparison is good -- we as a society have decided that people who provide alcohol, guns, and cigarettes are responsible if children are provided them. You don't get to say 'hey, you didn't watch your child, they wandered into my shop, I sold to them 2 liters of vodka and a shotgun'.

The parents themselves weren't raised with the digital literacy required.

This doesn't put the parents off the hooks, if you or anyone can share any resources that are as easily consumable, viral and applicable as the content that is the issue that can reach parents I would be happy to help it spread.

The reality is kids today are facing the most advanced algorithms and even the most competent parents have a high bar to reach.

The solution is simple.

I want to permit whatever the pixels are on a childs screen. Full stop. That hasn't been solved for a reason. Because developing such a gate would work and not allow algorithms to reach kids directly and indirectly.

The alternative is not ideal, but until there's something better, what it will be and that's well proven for the mental health side of things of raising resilient kids who don't become troubled young adults - no need for social media, or touch screens until 10-13.

There are lots of ways to create with technology, and learning to use words (llms) and keyboards seems to increasingly have merit.

> "The parents themselves weren't raised with the digital literacy required."

At this point, that isn't true anymore. There was social media when the parents were school aged. The world didn't start when you were 10 and the Internet is a half century old.

I thought the same thing until someone asked me how many of them have been able to overcome digital addiction and set a path ahead that's healthy.

Being literate in something isn't just knowing how to use it, but how to manage it's use for one's self and for others.

Once you see the importance of it, knowing where/how to start to manage what kids are exposed to that is age or developmentally appropriate for them is entirely a different skill to meet and manage the digtial literacy of another human, especially a child.

> then give parents strong monitoring and restriction tools and empower them to protect their children.

Because parents don’t abuse massive surveillance tools.

Given that most abuse happens in the family and by parents maybe it’s a bad idea to give them so much power

So we should trust the governments of the world? The same governments that don't seem to be doing anything about a large group of people that visited a specific island to abuse minors?

Where did I say that?

Exactly, nowhere.

If I‘m contra B, it doesn’t mean I pro A

What other realistic option is there if parents aren't going to be empowered to raise their own children?

don't you have to age verify to get alcohol? We don't leave that up to the parents. Feels like you defeated your own argument with your examples.

The internet is not an object, its a communication medium. That is an apples to organges argument, it doesn't wash.

incorrect. Same principle at play, you want access to something, that thing is age restricted, the vendor of the thing wants you to provide proof of age.

None of this push has anything to do with protecting children. Never has, never will. Stop helping them push the narrative, it's making the problem WAY worse.

ITT are a lot* of tech workers who made their money as a cog in the system poisoning the internet that future generations would have to swim in. I wonder if toxic waste companies also tell the parents it's strictly on them to keep their kids out of the lakes that are poisoned, but once flowed cleanly?

We live in a shared world with shared responsibilities. If you are working on a product, or ever did work on a product, that made the internet worse rather than better, you have a shared responsibility to right that wrong. And parents do have to protect their kids, but they can't do it alone with how systematically children are targeted today by predatory tech companies.

Age verification tech companies are lobbying heavily for governments to legally require their services. The proposed "solutions" are about funneling money into the hands of other tech companies and shady groups, while violating user privacy.

If anything, we should be banning the collection of any age related information to access social media and more mature content. We need companies to respect privacy, rather than legislation even more privacy violations.

If anything, we should be preventing young people from being exposed to the version of the internet that currently exists until the tech companies that made it this way offer a solution. I am all ears if you have an alternative that big tech can implement to ensure this is the case while they are given the task of cleaning up the mess they've made?

Bro the internet was made by everyday people. Corporations just imposed there shit on top of it. Im all for the corporate part going away, but I think its better if we make social media corporations transparent so we can target how they are operating those services. Age gating users is not the answer

I've been on the internet for more than 20 years. It got a lot worse in the last 10. Individuals maybe shaped it in the early days, but the disastrous mess we have today is from the monetization and ensuing garbage that was pushed onto the world by some very profitable tech companies.

Undo the damage or otherwise come up with a way to shield kids from it. I won't let my own kids anywhere near the open web the way it is today. It's poison for young minds and needs to be fixed or gated off. Like alcohol at this point.

It comes from a combination of things that always existed getting online and the monetization of the attention economy. Influence operations (both corporate and governmental) are the source of most of the problems. Bots, influencers pushing propaganda, etc. I suspect you are actually a bot but others might read this so...

The biggest changes to the Internet over the last few years are usually in the political spaces. There are a few other things but mostly its political. Those other things always existed but now they are online. But this isn't the fault of the communications medium, its the ills of society leaking into online spaces. If we banned those things online, you still as a parent have to worry about them happening IRL. Its better to talk to your kids about these dangers honestly and it always has been. Its always been easier to just prevent your children from being exposed to those dangers but that usually backfires later on. Banning unpopular political discourse to do that has never been the answer to these issues. But in this case, banning discourse is the goal and children are just the excuse. As proof of this, the same government pushing this only instituted a real drinking age in the last 10 years, in a country known for making liquor.

> I suspect you are actually a bot but others might read this so...

I'm floored lol. What gives you this impression?

The worst part of this inflammatory nonsense is that, sadly, I'm probably the only person that will read your full comment. And I fundamentally disagree with your thesis of attributing this to "politics". Social media and its effects were poisonous long before "politics" were so prominent. You could see it even during early Obama times. The simple infinite scroll and forcing individuals to so regularly compare themselves to each other was already awful long before "politics".

The last line in my statement answers your question. If you leave it up to government to try and regulate a medium you are asking for trouble. Its like telling a news source what they can and cant release news wise because a portion of the population (kids) are harmed by the information.

I understand where you are coming from but age gating is not the answer for a communication medium.

I'm asking you for the alternative. Every day this continues on is literally ruining lives before they start. Like lead in water, time is of the essence. So what is the alternative to fix it?

Support candidates that will put anti-trust first and end citizen united. Both of these issue make holding companies accountable for the harm that is being caused by lack of transparency impossible. The problem is corruption and corporations not being accountable to the people. When those problems get resolved. These issues will become less problematic.

I love the vision. Might take a decade or more to play out. We don't want a list generation in the interim, so what do we do asap to get it under control?

We don't. The problems are created by corporate greed, they are only solved by dealing with that. Making the internet less free as I said, isn't the answer, and there is no way to fix this in the short term without making the corruption worse.

Respectfully, I disagree and find your proposed solution, akin to "keep letting young people have their lives ruined", unsatisfactory. Which is probably why we're in this mess.

Its been my experience that our lives, whether they are ruined or not, are up to us. Making someone else responsibility only prolongs the problem. You either see that, or you don't. It's pretty clear at this point that corruption and greed is the problem and the fact that we cant see our way forward to being responsible adults is the part that is going to cause humanities downfall. When everything come crashing down, the people that will be left are the people that are taking responsibility for the problem and not making it someone else's.

> Its been my experience that our lives, whether they are ruined or not, are up to us.

This maybe applies to adults. It does not to children that cannot yet fend for themselves. You are basically throwing them to the wolves. This can be your choice, but it won't be mine.

We are not throwing them to the wolves. Our complacency created this problem and now kids are being affected by our actions and inactions. IMHO the best we can do as parents is try to protect them in a world gone mad. Appealing to governments and corporations that created this problem in the first place (with our acquiescence) is going to make the problem worse because we have evil people behind the scenes using this information against our wishes.

>If you are working on a product, or ever did work on a product, that made the internet worse rather than better, you have a shared responsibility to right that wrong.

This is how the "predatory debt" involved has built up, and grown exponentially until now, and the only thing Facebook considers as a solution would be to pay it down using other peoples' resources instead of their own.

No one else has matching leverage and the dollar figure would be many billions if not a full trillion or more, which is about what it's worth, and who else could afford that except Facebook?

So it has to come from the collective subtraction of everyone's complete privacy. Just to amount to something comparable.

Add that up and it shows you how valuable privacy really is and what it's worth in dollar figures.

Yes, do the math, privacy is worth more than Facebok no matter what, it always was and always will be.

You can't have both, so big tech should jettison Meta. Who else could afford it?

A more non-existential solution would be for Meta to fully fund a completely anonymous internet to replace the one that they soiled from the beginning, and let them keep the (anti-)social-media exclusive network separate.