Many might’ve seen the Australian ban of social media for <16 y.o with no idea of how to implement it. There have been mentions of “double blind age verification”, but I can’t find any information on it.
Out of curiosity, how would you implement this with privacy in mind if you really had to?
Frankly, the only sane option is an “Are you over the age of (whatever is necessary) and willing to view potentially disturbing adult content?” style confirmation.
Anything else is going to become problematic/abusive sooner or later.
Who has age authority? A state agency or service. Like the state issues an ID with age.
Preferable, we want the user to interact with a website, that website request age authentication, but not the website to talk to the government, but through the user.
Thus, something/somewhat like
- State agency issues a certificate to the user
- User assigns a password to encrypt the user certificate
- User connects to random website A
- Random website A creates an age verification request signed to only be resolveable by state agency but sends it to the user
- User sends the request to a state service with their user certificate for authentication
- State agency confirms-signs the response
- User passes the responds along to the random website A
There may be alternative, simpler, or less verbose/complicated alternatives. But I’m sure it would be possible, and I think it lays out how “double-blind”(?) could work.
The random website A does not know the identity or age of the user - only to the degree they requested to verify - and the state agency knows only of a request, not its origin or application - to the degree the request and user pass-along includes.
I never realised it was that simple to do. Thanks a lot to answer the OP question. I had the same for longer than I wish to admit given how easy the answer was!
It can’t. It requires invasion of privacy to verify information about the individual they don’t have the right to access.
Digital age verification goes against privacy. Let’s not delude ourselves into thinking it can.
A joke answer, but with the kernel of truth - IRL age verification often requires a trusted verifier (working under threat of substantial penalty) but often doesn’t require that verifier to maintain any documentation on individual verification actions
Ah, easy then: lower the drinking age from 18 to 16.
As in, you have to roll up to an “age verification bureau” and say “I’d like to sign up to $platform, please verify that I’m of legal age to use it and tell them so”, then you buy a “token” that you can enter upon signing up? Am I understanding that correctly?
I wasn’t thinking in detail, just addressing an assumption I think a lot of age verification discussions include, which is that the verifier would have to be trusted to maintain some sort of account for you, retaining your data etc.
I have no idea what the legislation says, but I’d be a happier privacy-conscious user if the verification platforms were independent (i.e. not in any other data business) and regulated, with a requirement they don’t retain my personal data at all (like the liquor store example)
So the verifier gathers data from you, matches it with a request from the platform, provides confirmation that some standard has been met, and deletes almost all personal information - I acknowledge that this may not rise to the double-blind standard of the original request
Edited to add:
-
you don’t have to ‘buy’ a token, the platform needs to pay verifiers as a cost of business
-
some other comments are asking how you prevent the verifier knowing the platform - to my mind you don’t, instead the verifier retains a request id record from the platform, but forgets entirely who you are
-
Sounds quite a lot like zero-knowledge proof
My friend has worked with a government to create zero-knowledge proof from IDs. Turns out there’s a lot of good software engineered to solve that problem.
The UX is still shit tho
Any open projects you could point to on the subject or articles about the government efforts? I would love to learn more on that!
https://github.com/openpassport-org/openpassport
I need to get back to Florent to ask him about his advances but this is the repo he worked on! Seems pretty exciting !
I’d lean on the ISPs. Your ISP knows what sites you visit, and they have your location and payment information. They can just insert some verification page when a classified IP is contacted. This gives them hardly any information beyond what they already have. And since they are mainly located in Australia, it is easy to enforce laws on them.
You have to lean on ISPs anyway because it is quite ridiculous to assume that the entire global internet will implement Australian laws. Does anyone believe that their Lemmy instance will implement some AI face scan or cryptography scheme?
You would have to block servers that do not comply with the law anyway. The effective solution would be a whitelist of services that have been vetted. In practice, I think we’ll see the digital equivalent of ok boomer.
If a whitelist seems extreme, then one should have another look at the problem. The point is to make sure that information is only accessed by citizens with official authorization. There is no technological difference between the infrastructure needed to enforce this (or copyrights) and some totalitarian hellscape.
This gives them hardly any information beyond what they already have.
Except now they know the individuals using your Internet.
Sure if you live alone they already can easily put that information together. However if you have a partner, a relative and children all living in one house they now know who is in that home.
Plus maybe no one in the house uses Twitter and Aunt Alice the Twitter user came to visit, does she need to reverify? Your ISP knows that now.
ISPs would be gaining a lot of new information.
It’s not necessary to expose the identities of the users. The age confirmation could happen via a password, PIN, or even a physical USB dongle. Tying such methods to a particular identity adds nothing to the age verification.
If that is not enough, then one would need a permanent, live webcam feed of the user. It could be monitored by AI, and/or police officers could make random checks.
Granted, one would have to make sure that not everyone behind the same router can use age-restricted services; eg with a VPN. That would let them assign connections to individual, anonymous adults. But I’d guess you could do that anyway with some confidence by analyzing usage patterns. Besides, information on who is in a home can also be found in other places such as social media or maybe company websites. So I do not think this is much new information.
But thinking about it, one could compartmentalize this.
The ISP only allows connections to whitelisted servers, including 1 or more government approved VPNs. The ISP refuses connection to these VPNs without age confirmation. The VPN provider does not need to be told the identity of the customer. There needs to be no persistence across sessions. The ISP need not know what sites are visited via VPN. While the VPN provider need not know about sites visited without.
If you do it that way, the ISP ends up knowing less than before.
Since both ISP and VPN servers and offices would be physically located in the country, one would have no problem enforcing prohibitions on data sharing, if desired by lawmakers.
Anyway, this is the only realistic approach in the whole thread. Everything else assumes that Australian law will be followed globally. And then the ISP still has all that usage data. Why not just use a blockchain…
I seem to remember Leisure Suit Larry verified age using trivia questions that only older people would answer correctly. I know this because at 8 years old I guessed enough of them on my father’s friends computer to play it.
I talked to a friend of mine last week and they didn’t know of the old PS/2 mouse/keyboard cable/sockets. They’ve seen it before, but it wasn’t familiar to them. Nobody only having used USB devices will remember those.
I was just getting used to PS/2 connectors replacing serial mice and keyboards and then friggin USB comes along…
Tell me when you’re getting used to USB so I can prepare for the next switch /s 😅
oof, I’d fail trivia questions for my age group because I had a… complicated childhood. But it would probably be a problem for foreigners who didn’t grow up the country. Imagine coming from Chile and having to know about Australian trivia from the 70s or something to sign up for a social media platform 😄
Recently I saw an article on more needs to be done about age verification because it’s easy for children to falsify it (and most do). On the other hand you have adults who falsify it because it’s nobody’s business how old you are.
Current protections that ask you to confirm your age are completely pointless.
Now if you were required to provide ID to access X service, would you? If we’re talking adult content then children will simply look elsewhere, taking them to potentially more dangerous areas of the internet. (Heck, so would adults) Same if you deny them social media.
But if we’re implementing verification regardless then it needs to come from a third party. And it also has to be easy. Like something you do only once.
First: I would allow children access to social media under a child account that has limited access and ability to be audited by a parent. This is important because you don’t want them going somewhere you have no control over. (Which they will)
Secondly: An age verification gateway that can be implemented by developers seeking to use it. Possibly managed by the government body responsible for issuing ID (or a partner). This would be taking a short video of yourself plus uploading ID. (Banks are doing this now)
Thirdly: ease of use. Majority of us have a google or apple account associated with whatever device we have. Let those accounts hook into the 2nd step and share if an account is a child/adult account with any social platforms you log in using it with.
Just a few thoughts that came to mind whilst waiting dinner. Feel free to tear it apart!
Ever heard of Id.me?
Choose the classic “are you 18 or older” dialog. KISS.
All I can think of are some variations of you trusting a service to validate your id and give you a token that just asserts your id has been validated.
But it’s still not really privacy preserving because it relies on trusting both parties to not collaborate against your privacy. if at some point the id provider decides to start keeping records of what tokens were generated from your id, and the service provider tracking what was consumes with that token, then you can still put it all back together.
That’s when you add an extra
point of failurevalidator.
Server 1 generates a token for server 2 to validate.
You send the token to server 2, who validates and generates you a token for server 3. Then finally server 3 validates the token and grants/denies your access.The more nodes you have across different countries, the harder it is for the last server to discover your identity.
Definitely not without its flaws, but I wonder if a decentralised node setup similar to the tor network could work.
Could we add a blockchain somewhere? They’re really good with the investors.
We can, but blockchain is old technology.
We should use an LLM to create and verify the tokens.
It can’t be. The entire concept is a Trojan horse to kill the anonymous internet.
Not a cryptographic expert by any means but maybe something like this would work. This’d be implemented in common places people shop: supermarkets for instance. You’d go up to customer service and show your ID for visual confirmation only; no records can be created. In return the service rep would give you a list of randomised GUIDs against which the only permissible record can be “has been taken”. Each time you need to prove your age you’d feed in one of those GUIDs.
this is an actual answer which is therefore interesting
Sadly, this type of scheme suffers from: 1) repudiation, and 2) transferability. An ideal system would be non-repudiable, meaning that when a GUID is used, it is unmistakably an action that could only be undertaken by the age-verified person. But a GUID cannot guarantee that, since it’s easy enough for an adult to start selling their valid GUIDs online to the highest bidder en-masse. And being a simple string, it can easily and confidentially be transferred to the buyer, so that no one but those two would know that the transaction actually took place, or which GUID was passed along.
As a general rule, when complex questions arise which might possibly be solved by encryption, it’s fairly safe to assume that expert cryptographers have already looked at the problem and that no easy or obvious solution exists. That’s not to say that cryptographers must never be questioned, but that the field is complicated enough that incomplete answers abound.
You upload identity to a site and it gives you a date stamped token which confirms your age.
Then when that token is uploaded to an SM site, it verfies the identity of the giver with the site that gives the token. The identity is a hash generated by the token site and contained in both the token and a namespace at the token site, so only the token site knows the real identity. Once the token has been confirmed, the namespace is re-used.
So you can’t really sell the token, because its linked back to the identity you uploaded to the token site. You need to be logged in to the token site.
To make sure we’re all on the same page, this proposal involves creating an account with a service provider, then uploading some sort of preexisting, established proof-of-identity (eg passport data page), and then requesting a token against that account. The token is timestamped and non-fungible, so that when the token is presented to an age-restricted website, that website can query the service provider to verify that: 1) the token is still valid, 2) the person associated with the token is at least a certain age.
If I understood that correctly, what you’re describing is an account service, not strictly a proof-of-age service. And we already have account services of varying degrees and complexity: Google Accounts, OAuth, etc. Basically any service where you log-in, since the point of logging in is to associate to a account, although one person can have multiple accounts. Passing around tokens isn’t strictly necessary since you can just ask the user to prove account ownership by signing into their Google Account, for example. An account service need not necessarily verify age, eg signing in to post a comment on a news article.
Compare this with an identity service like ID.me, which provide records on individual; there cannot be multiple records for the same live person. This type of service is distinct from an account service, but some accounts are necessarily tied to a single identity, such as online banking. But apart from KYC regulations or filing one’s taxes online, an identity service isn’t required for most day to day activities, and any additional uses pose identify theft concerns.
Proof-of-age – as I understand it from the Australian legislation – does not necessarily demand an identity service be used to satisfy the law, but the question in this Lemmy thread is whether that’s a distinction without a difference. We don’t want to be checking identities if we don’t have to, for privacy and identity theft reasons.
In short, can a person be uniquely, anonymously age-verified online? I suspect not. Your proposal might be reasonable for an identity service, but does not move us further towards a theoretical privacy-centric proof-of-age validation mechanism.
You can’t.
Age verification is not compatible with any remotely acceptable version of the internet. It’s an obscene privacy violation in all cases by definition.
Any implementation short of a webcam watching you while you use the site is less than trivial to bypass with someone else’s ID while opening numerous massive tracking/security holes for no reason.
Its possible to implement something that hides your actual age from a website, but the tricky part is hiding what website you’re visiting from an identity provider.
Let’s walk through a wrong solution to get some fundamentals. If you’re familiar with SSO login, a website makes a request token to login the user and makes claims (these request pieces of user information.) One could simply request “is the user older than 18?” And that hides the actual age and user identity.
The problem is how do you hide what website you’re going to from the identity provider? In most SSO style logins, you need to know the web page to redirect back to the original site. Thus leaking information about websites you probably don’t want to share.
The problem with proposals that focus on the crypto is that they actually have to be implemented using today’s browser and HTTP standards to get people to use them.
Could it be maybe a token signed by the verifying party living permanently on your computer (like cookie), and websites can request permission to query it to verify the age?
The hard part is browsers. Cookies and local storage are limited by the origin URL. You need it explicitly set on the domains you intend to visit, but those domains don’t know your age. The one that knows the age is the identity provider, but it can’t set it for all domains. There are other techniques that you could use, like a smart card combined with a browser extension to do local based user info attestation, but those are difficult to manage at a nation scale and I suspect people will struggle with them, though there are some countries that do have national smart cards (e.g. Estonia.)
Since age tends to not decrease, that may make sense: once you reach 18 you get a signed token you can use forever.
Your token might be used by someone else, though
Your token might be used by someone else, though
Yeah. I feel like that cool bad influence not-actually-my-uncle is gonna publish their porn access token everywhere.
Porn Access Token lmao
The problem is how do you hide what website you’re going to from the identity provider?
Not only don’t you need to, you would really have to know the generator of the token because it needs to verify that you are the user that was issued the token.
It can be done. The website provider can generate a request that it forwards to you. You then pass on this request to the age verifier, who can answer “yes person is over 16” without knowing why you want to know, or who generated the request.
The requester wouldn’t know your age, just that you were old enough.
There are a few problems.
One is that the website could embed some identifier in the signature of their request. But any information there can be easily send by the web site provider to the age verifier directly if they wanted so this is not a big problem.
Another problem is that the age verifier could look at times when requests were submitted and create a sort of “fingerprint” based on when requests arrived for different sites. This could be partially helped by having browsers request age verification randomly in the background any time you use a browser.
