its been said 1000 times here, but: age verification doesn't have to be a nightmare dystopia of 24/7 fine-grained tracking and recording unless you are somehow hoping to achieve 100% success rate (something we have not done with any other law ever). there are several reasonable proposals that would be 90%+ successful without stepping on anyone's toes.

i am convinced that enough people in power know it, too, but see this as their chance to get the full-dystopia version rolled out.

Heck—in most cases, we can't even tell the difference between humans and bots anymore! And it's true that we basically accept that some bots will slip through the cracks—but identifying bots also strikes me as significantly easier than identifying children.

Website you want to visit generates a one-time private/public key for the purpose of this login attempt, hashes your random number, and sends the hash back to you.

You connect to the government auth platform, auth yourself to your government, and ask them to sign the hash you received.

You pass the signed hash as well as the original random number to the website you wanted to access (the original random number is used by the website to store the one-time key they generated for you). They can see it is signed by the government. They can see it is made with the hash they provided.

You get access to whatever content you wanted. The website doesn't know who you are. The government doesn't know where you logged in. Sure, it won't hold up against collusion between website and government, but nothing would.

the principles explained above are slight adaptations of PKCE authentication.

The government issues an eID to your wallet. The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID. The government signs individual attributes combined with the public key with the government private key. The government certificate containing the public key is, well, public.

One of the attributes is ‘over_18’ (In the EU eID scheme countries can add other over_XX attributes if they want, but over_18 is mandatory).

When a website wants to requests attributes, in this case the over_18 attribute, they send a request to the user’s wallet app, including a challenge. The wallet sends back a package including the government-signed attribute, which contains the device public key and the over_18 attribute plus a response to the challenge (proving the credential didn’t get transferred).

The website only sees the ‘over_18’ attribute, which is backed by the government signature. They don’t see any other attributes (the wallet app shows in advance which attributes you are sharing). The government never sees which website wants to know if you’re 18+.

Of course this is all a bit simplified, check OIDC4VCI and OIDC4VP for details.

The only real issue is the wallet app and device binding. Because a compromised device could allow credentials to be transferred some form of attestation of device and wallet app is required. In practice this means no rooted/jailbroken phones.

Not true. The device's public key is also sent, which functions as a stable device identifier.

We've spent years trying to get away from stable tracking IDs and fingerprinting. Returning to a system where devices are sending a stable ID to a website to prove ownership is a step backward.

There are proposed mitigations like issuing multiple sets of credentials or rotating them, but we're not going to get an infinite number of keypairs for every website or session in the secure enclave in practice.

Another reason why these proposals aren't getting much uptake is that they aren't addressing what the lawmakers are pursuing: They don't want anonymous authorization tied to the device. They want IDs tied to accounts and a way to discourage people from sharing IDs. In the anonymous systems it only takes one person a few minutes to put an over-18 identity into a device and there's no way to determine if someone is abusing the system by stealing IDs or if someone's 18 year old brother is setting up all of their younger brothers' phones for $5 each.

The situation gets stickier when you acknowledge that it's not possible to limit all of these websites to only mobile phone devices with secure enclaves that are not jailbroken. Once you open a door to desktop devices and other OSes accessing these sites, you open the door to replaying and proxying attacks, where someone will produce those `over_18` attestations on-demand for you, possibly for a minimal price. This brings us back to the public stable identifier to discourage fraud, which means governments won't be happy to issue as many keypairs as we want, which means we're back to semi-stable fingerprints.

This is covered by allowing for single-use credentials. IIRC the EU personal IDs will use this. Basically, the wallet requests a batch of single-use eIDs that all use different device key-pairs. Each credential is only used for one request and then deleted. The wallet will automatically request new credentials in batches when they run out. The old key-pairs are deleted along with the credential so you don’t run out of space in the secure enclave.

> Another reason why these proposals aren't getting much uptake

I’m not sure what you mean by not much uptake, EU countries are required to issue and accept them for official business by the end of 2026

Personally - this is less acceptable to me than just having the site collect my image/id.

I'd support just putting the id in a dedicated device (ex - gov issues smart key) or just accepting that sometimes people will share id info (just like... physical ids).

It doesn't even close all the doors to transferring ids - since I can still just hand someone a phone (just like... physical ids).

Yeah, and no Linux PCs, no custom builds of web browsers (which would effectively become open source in theory only)—basically the end of any kind of open platform. I would much rather just scan my ID!

So people in dubious legal circumstances are locked out the internet?

Do regular desktop and laptop computers have the same secure enclave feature?

And there it is.

And now you're going to tell every state to do it again, but this time it's got a chip in it so "just trust the government, man".

This will go well.

sure, i'll put my favorite two. though you'll find much more detailed and thought-out versions of these (and others) in the dozens of other giant threads on the same topic.

- buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is non-identifying.

- websites issue content tags, browsers consume them, you enter your age into the OS during setup.

Why should I pay continuously to prove I'm an adult? And those cards will be getting sold to kids faster than you can blink. I bet a lot of parents would buy them for their kids.

That changes the default from "anyone can do anything" to "gotta ask parents". Defaults matter at scale. It adds friction.

there's a reason i said 90% and not 100% effective. alcohol and tobacco get resold to kids, too.

its obviously just an illustrative guess. but if the penalty of possessing the card is similar to underage possession of alcohol/tobacco, and larger penalties if a store/person is found providing a card to someone underage, i see no reason why it wouldnt have a similar success rate as alcohol/tobacco.

hopefully some parent steps in if their kid is on the dark web trying to make purchases with their parent's credit card.

Good. I should be able to make judgement calls about what my children can or can’t access outside of school.

It’s better if they do it under my supervision than against my back, aided by a predator whose only moat is lending their ID, or their face.

You need to pay for a drivers license or a passport and so on. So there is an intrinsic cost to prove who you are where you are from and what your birthday is already.

You have to pay for all sorts of small things to participate in normal society. This isn't a serious criticism.

By definition this is not a life critical thing, it's something that is procured in order to access specific services on the internet, which is not free.

I have a government ID and I didn't pay for it. I can use it to travel to nearby countries in lieu of a passport. The assumption that IDs are necessarily non-free (to the issuee) is pretty funny to me.

>it's something that is procured in order to access specific services on the internet, which is not free.

The maintenance of the Internet is already paid for through ISP contracts.

Let websites issue a "window.isUserOver(16)" call once and then move forward based on the response to that query.

This doesn't have to be perfect.

We agree it doesn't need to be 100% perfect. But it needs to be at least, like, 60% perfect, right? And unless you make it at least a bit hard to bypass, it will stop virtually no one.

Installing a new browser is already a bit hard for most people. I think you are a little skewed in your thinking being online on HN.

You also aren't thinking about age. Certainly 16 and 18 year old probably can get a new browser installed. But a 14 year old? 12 year old? 10 year old? That barrier is a lot higher the younger a kid is.

To effectively keep adult content away from kids, it merely requires secure boot and closed app stores, which are already widespread. And they are only required on the devices actually given to kids, rather than every single computing device.

But this proposal has another problem: it's easy for a website to run isUserOver(n) in a loop to derive the exact age. And on a persistent account, it can be queried every day to derive an exact birthday! Which comes back to my main point that the only technical schemes we should be considering are ones where information strictly flows one way - the website/app supplies information to the browser/OS, which then [may] implement parental control policy. anything else fundamentally boils down to a mandate for identity verification.

...I guess I don't really see the difference.

Closed app stores are widespread on some platforms but certainly not others, and I for one would really like them to not spread any further.

But in general there is a huge difference between the freedom-destroying properties of secure boot with closed app stores, and the next step of remote attestation. Remote attestation lets the server insist that you only run software fully of their choosing rather than your choosing, as a condition of interacting with them. This completely destroys the idea of protocols that mediate between two parties with diverging interests, and computationally disenfranchises users. Imagine the next generation of the Cloudflare nagwall that doesn't let you past unless you buy a new computer, and that new computer must be running MSWin/OSX and MSIE/Chrome.

(also note that my use of "secure boot" here includes systems like on Pixels where you can straightforwardly unlock the bootloader (erasing the data on the device), install whatever you want, and then relock. I still find these systems philosophically objectionable, but pragmatically they're okay)

Kids aren't going to trade Pokemon cards in the playground anymore...

They could also trade porn-filled thumb drive or old-school glossy paper magazine. There no way to prevent kid's exposure to stuff at a 100% success rate.

There no way to avoid exposure completely

As soon as you loosen off the requirements to "reasonable effort", you can start looking at account age, facial features, social attestation, and include retrospective tools to revisit someone's verification if they get in and start acting like a child. Heuristically messy but far from impossible to demand a stronger form of verification if their original might have been borderline.

The goal is broad coverage, not complete. Screening doesn't have to get 100% to have an effect.

Whenever you want to prove your adult you go to "am I an adult.gov" and you use your credit card or whatever to prove you are an adult. At which point you get a 1-time 5-digit code that is UNIVERSAL TO EVERY SINGLE HUMAN and good for 1 hour (everybody who uses the site gets the same code that hour).

Then when you want to look at porn or something, you use this code. Boom simple and done.

There are even much better much more private techniques that use cryptography, and AI is happy to explain these graduate-degree level topics to you at your own pace.

Of course there are situations where people steal things, and use deep-fakes, etc, but those exist in every model.

Design a scheme that equips parents with better tools to be better parents, rather than one that reduces the scope of parenting responsibilities.

But, for some reason, little twelve year old Jimmy obtaining access to porn evokes some kind of far more visceral reaction in Jimmy's parents (or if not Jimmy's parents, some "busybody" who wants to "protect all the children") than Jimmy managing to get himself a pack of Salem's or a Pabst Blue Ribbon tallboy.

AFAIK you don’t need ID to buy juice, sugar, and yeast to make your own alcohol, so I think it should be the same for computer parts.

I and pretty much everyone else in my childhood TeamSpeak server did at roughly 14 years of age.

Maybe for the next few years you'll be able to do that. Analogy: back in the day you could just build your own airplane and fly it around. There were no regulations.

Consider "log in with apple" as it is today. Depending on what you share, a relying website might not even get your name or email.

It seems like all the tech stack is there to implement a very simple and privacy-persevering solution.

It does not even smell of state censorship because a website does not have to check your age if it decides to be "non compliant".

Why isn't it implemented like that? Based on the comments it seems more like a "free-for-all implement-your-own-PPI-handling-thon".

This will ofc make life harder for a some groups of people - like people without / limited access to IDs etc. And i do not even argue that the whole thing is necessary.

But there seem to be vastly superior technical means to implement that, aren't there?

Knowing who someone is in general is different from having a photo of their face or government ID confirmation.

I presume you're concerned by the attesting party's knowledge of both the signature and identify information. Yes, in principle these can be linked, but in practice, it may be difficult or made very difficult, and today, very little of our online activity is really anonymous anyway. It is generally not too difficult to infer identity based on the content someone generates and the bread crumbs they leave behind.

Of course, if the intent is to use age verification as a wedge to monitor everyone, then it will be difficult politically to secure the protections needed to prevent that sort of data fusion.

But some of the easiest middle ground solutions that solve 90% of the problem are things like simple math problems. Get asked "3+7" and that will pretty quickly filter out almost anyone under the age of 6. If you can accept that there are some smart 4 or 5 year olds who can do simple math, congrats you recognize there's a 10%.

there are thousands of comments on these threads every time it comes up. there's tons of what i consider reasonable solutions proposed. there's examples below, too, which don't require face scans.

>Concretely, half the websites I visit from the UK want me to either scan my face or upload ID documents

yeah, i agree that really sucks.

i think its a pretty decent step up from that, but i know what you mean.

>I don't think the politicians will be satisfied.

and that circles back to my original point. the politicians aren't satisfied with a "mostly effective" solution (e.g. OS-enforced age attestation) as they are with literally every other law, and instead are taking advantage of the issue to justify mass surveillance.

There is a signaling function these laws serve: things are the products we consider acceptable in society. We have these rules for cigarettes, booze, and vapes.

That said, privacy being sacrificed for signals, is an unacceptable trade, especially when better solutions can be crafted.

Do not support daughter fuckers in goverment!

what kind of websites are you visiting to get age checked on half of the sites you visit? i've only been asked to verify for dating apps and "sexy stuff". and i definitely don't spend 50% of my total browsing time on those sites.

maybe this says more about the kind of content/sites you're accessing if it is really as high as 50%? UK age verification mostly only applies to sites which might end up hosting the content quoted below.

> pornographic images, and content that encourages, promotes, or provides instructions for eating disorders, self-harm, or suicide.

or you're just being hyperbolic? 79% of statistics are made up, after all.

I don't use that; it's worse for your brain than any regulated substance. Kick your reddit habit while you can.

Google safe search: I've only seen this from my PAYG mobile phone, because I've never bothered to lift the adult content lock on that after more than a decade, and Google is the only place I've seen ask, actually. Even so it rarely happens.

Discord: the mere idea of being in an adult-content-related discord group is enough to make my skin crawl.

Worth noting that of these three, only one of them is a UK-only decision, as far as I am aware: Google Safe Search respects UK phone companies' default adult content block on PAYG. They are about the only company that does. Reddit and Discord have made this decision globally, have they not? Because there are US state laws too.

On that website, you can click "give me a verification code", it gives you a code that is single use and only valid 24 hours. You type that into whatever 18+ website you need to, they use a public API provided by the government to just check "yes this is a valid code and the user is 18" - bang, done, verified. The website knows nothing about you at all, except for the fact that you're 18.

In fact, the UK government ALREADY HAS THIS. For the EU settlement scheme, you can give your employeer(or anyone else who needs it) a special magic code that they type in on the government website, and it just says "yet his person has the right to reside in the UK" without spilling any of your personal information at all. The code is single use and valid a limited amount of time. And you can do the same with your driving licence, where anyone can verify you hold a valid licence without actually seeing it or any details on it.

Like, am I being stupid here? It seems like an almost trivial solution to the problem, especially given that it already exists for at least 2 services named above.

And yes, I know people will say "oh but that requires the government having this data on you, and that's bad" or "but then the government will know you've authenticated with pornhub!".

And yes, both of these are true - but on point 1 - like, I'd love some ideal situation where the government can simultaniously give me a passport or a driving licence AND not have any information about me at the same time, but that ain't happening, and on point 2 - yes, but that's still infinitely preferable to the current implementation, and it can be easily solved with legislation saying that the code authentication service doesn't log who requested verification, it just answers with yes/no and that's it.

This is unacceptable tyranny on its face.

...how? All they know is you've authenticated with service X. And like I said, we can make legislation to say they are not allowed to keep the record of who authenticated.

Besides, let's not let perfect be the enemy of the good - in the UK all ISPs are required to keep a full year of your browsing history, and 17 government agencies can access this data(including DEFRA - the agriculture agency lol). So like....the "the government will have a full history of your browsing" is a ship that sailed a few years ago. Obviously I don't agree with it, and I think we should be on the streets of London and protesting this, but here we are as a country.

So like yeah, I get your point. But UK is particularily fucked on this point, let's not make it even more fucked with the way things currently are, the authentication can and should be done better.

And "the government will know you've authenticated with pornhub" is extremely harmful, in my opinion.

I have personally had to remove NCII for teens and young adults. Grooming is a thing, self harm communities are a thing, as is sextortion.All of it at internet scale.

And this ignores the parts where the platforms released features they knew from their own tests, were harmful to teens.

It is convenient to dismiss them, because it makes it easier to hold positions that depend on them being minor harms.

Who are these adults giving children their verification codes for adult websites?

>>If you want to crack down on code sharing

Right now, all the kid has to do is grab their parents passport while they are not home or asleep, scan it on their phone and they are in. It takes 30 seconds.

With the codes they would either need to convince their parents to generate a code for them, or find someone online who will - which of the current solutions seems less prone to abuse to you?

Again, let's not let perfect be the enemy of the good.

I guess I could make an ID (not a counterfeit government ID) that uses the same encoding for the birthday.

The general consensus and what the article is alluding to is that it will be probably implemented in a way that allows individual tracking and identification.

we're on a discussion board, so i started a discussion. that was the point.

It’s also the very cool, nuanced and technical tooling that people here tend to enjoy figuring out, and building.

It side steps the thought terminating tar pits of “privacy at all costs” or “save the children”.

I have a feeling my definition of having my toes stepped on differs dramatically from yours.

> i am convinced that enough people in power know it, too, but see this as their chance to get the full-dystopia version rolled out.

Well there's plenty of idiots in power and I'm sure they have no idea. But there absolutely are evil ones who simply want more power and don't care what happens after they have it.

If this were actually about protecting children, maybe you could get something passed that wasn't just ground work for a panopticon hellscape. But it's not about children at all - the people truly worried about that are just useful idiots - it's about power, and so you can't pass anything without having the surveillance infrastructure forced in.

Or there's probably some kind of correlation trail possible that will track you even with the anonymous systems.

I believe you are missing the point. "To protect kids" is just a cover, the nightmare dystopia is the real goal. So age verification have to be a nightmare dystopia or it would be useless for those, who push for it.

did i miss the point? because my last sentence literally says this.

But I feel there's not a lot of trust that whatever implementation we could end up with wouldn't be such a dystopia. The real world equivalent would be checkpoints at every intersection verifying the driver's age, the cashier who carded the 20 yo with a beer now does it for everyone, makes a copy of your ID and stores it in a big folder shared with their 427 "business partners".

Imo we should scrap the whole idea of age verification. Kids get a kidPhone with kidOS, whitelist of age-appropriate resources & capabilities. You wouldn't let an 8 yo drive on the highway, yet they can have a supercar to drive unsupervised on the information highway, no biggie. Internet is full of adults doing all sort of stuff while kids need supervision and education: design safe spaces for children, not checkpoints at every corner.

That it is technically possible to do age verification in a privacy-preserving way is thus entirely irrelevant.

They want all online activity tied to ID so they can violently, illegally retaliate in the dark of night against protected expression online that they don’t like.

That’s all this is. Privacy-preserving techniques are irrelevant because they do not accomplish this goal.

Banning Instagram ain’t gonna fix that.

This is not in any way whatsoever about children.

It's to suppress free speech and arrest people that post anything against the government's narrative.

Many people have already been arrested in the UK for this. This is the next logical step.

Personally I don't care how much age sniffing is mandatory in that I think it is inacceptable on any level. Do you try to insinuate that a little bit of tracking is ok? Because I can not buy into that premise. To me the whole assumption is wrong from the get go.

no, and you can read through other comments here and on the many threads of the same topic for proposals which have no tracking.

no, it means that <10% of kids under 16 or whatever age will still make it onto instagram

there are laws against underage drinking and buying alcohol. some kids still get access to alcohol. the law is mostly successful, with an acceptable amount of failure rate.

same concept.

Then your 10% becomes problematic because you are either restricting or granting access based on invalid information. So in your world here we then need ways for people who were incorrectly gated to reach out and be corrected somehow.

Correct. The goal here isn't "to save kids". That's just one of the Horsemen of the Infocalypse [0] used to market taking away our freedom.

0 - https://en.wikipedia.org/wiki/Four_Horsemen_of_the_Infocalyp...

Who wants this? God damn everyone. And in so much as Facebook might do something with the data, what they really want is a legal moat of sufficient depth to drown possible competitors.

Either way the solution again is not age gating, it's real meaningful data privacy laws that if enacted would have a huge effect on many companies today.

The other problem you're up against is in the low-friction online environment, 90% easily turns into a much lower percentage. Which will actually manifest itself as the initial methods that achieved "90%" being declared insufficient in favor of stronger methods of identity verification.

I say this as a parent staring down having to deal with the dumpster fire that is the modern web in the next short year or two - the only sane way to address this problem is through client-side parental control software that works based on website/app tags supplied by the server / app creator / etc. There is indeed a market failure here, so the sensible regulation is to make websites over a certain size publish labels about the suitability of their content for age brackets, whether a site is social media, contains user generated content, has algorithmic feeds, and so on - affirmative assertions about the content that carry legal weight and liability for them not being true. Device manufacturers over a certain size would need to include parental control software that can be enabled during the setup process.

If parental controls are enabled and a website has not published tags (too small, foreign jurisdiction, misconfiguration, etc), then it simply fails closed and refuses to display the site. This keeps decisions about content suitability in the hands of parents where it belongs, rather than putting it in the hands of corporate attorneys who will often make decisions directly contrary to what parents want! Remember this whole topic is being pushed by big tech to absolve themselves of liability for pushing harmful products!

well, i mean, you put a decently reasonable one in your own comment: "client-side parental control software that works based on website/app tags supplied by the server / app creator / etc."

another sibling comment mentions alcohol sales. government could issue a scratch card with UUID that's valid for some time, sold at anywhere alcohol/tobacco is already sold. most people are already comfortable with flashing an id at the beer store.

read any other the other dozen similar threads with hundreds of comments, and there are a handful of other neat ideas usually voted pretty high up.

Or I guess in the case of the US... maybe even just steal it considering how lax people seem to be with theft.

and yet, most kids aren't walking around hammered. the penalties of underage possession and supplying to underage kids deters most people.

i will reemphasize that literally no law is 100% effective, so its silly to talk about age verification as if it has to be the first one to be 100% effective.

The details of the setup are very important as they lay out which way the situation will be pushed as the calls invariably continue. There are many other neat ideas that are voted high up, that still fundamentally still just boil down to identity verification! This why we need to talk specifics - even most programmers are bad at designing secure systems, as it requires the additional skill of adversarial thinking.

For instance, the scratch card idea you bring up fails with the same problem - it still puts the onus for yes/no decisions on the companies, meaning when the scratch cards are declared not good enough, those companies will then move on to additional methods - and it would be a tall order to craft legislation that prohibited companies from employing any other identity verification methods beyond the scratch cards. And in case it's not obvious, the scratch cards will readily be seen as not good enough - if they're truly private, it's easy for anyone to make a couple extra bucks by buying some (up to the limit), and then selling the tokens online.

(never mind that many beer stores have moved to online verification of licenses where they scan your ID# and it gets backhauled to some centralized database, so even buying beer isn't appropriately described as "flash your ID" any more)

(also note that any "age verification" or "identity verification" scheme does not merely absolve big tech of liability, rather it moves that legal liability on to parents themselves! )

The shit is horrible if 100% successful, and yet not worth doing if it isn't.

If we are all subject to the same monitoring and there are no exceptions, that would be fair. However, if some people are exempt from monitoring because of their connections, relations, etc. then that would be unfair.

And if some people are allowed to harass and stalk others based on some attribute (race, religion, nationality, etc.) because they are in a monitoring position (while others are not) then that would be unfair as well.

We need full transparency.

As a rhetorical trick this is generally ineffective.

When there are no consequences, it by definition isn't.

And that's what I am saying - we should still ask for transparency even in the environment of no consequences.

It's also possible that people are not sure about the lack of consequences, and again, transparency then prevents them doing bad thing even if actually there are no consequences.

But of course tautology is tautological by definition. (I am almost 50 and kinda tired of these eristic games on the Internet.)

A couple years ago I would have tended to agree with you, transparency would be a good first step. But then I have recently seen demonstrated that transparency just proves that you do not need to hide corruption as long as a powerful bloc of voters actually agrees with your corrupt position. I think what we really are going to need is consequences defined ahead of time, along with an enforcement mechanism not easily corrupted itself. This is hard. But it is a topic we will hopefully be spending quality time working out over the next few years anyway.

Wasn’t that in the Chat Control proposal? i.e. politicians and other important individuals are exempt

Chat control is a lot of things, but Slavery 2.0 is not one of them. The hyperbole only hurts your position.

Not everyone is an exhibitionist. Some people thrive when they are very public about their life. Some prefer a much more private life.

fair != equal

Ah, so except for THE ENTIRE FUCKING PROBLEM, this is fine.

>And if some people are allowed to harass and stalk others based on some attribute (race, religion, nationality, etc.) because they are in a monitoring position (while others are not) then that would be unfair as well.

Yes, we wouldn't want racial profiling in our Orwellian hellscape. That would truly put it over the edge.

It might be fair, by some definition, but it would still be wrong. The government shouldn't be monitoring us to the extent required to implement age verification on the 'net.

These people are obsessed with risk mitigation that it's not even worth having tech class anymore. No risk. 100% control all the time.

Further to that, companies are required to do this in a strict data minimization approach, results need to be anonymized and destroyed immediately after the check is complete.

The internet has grown into a bit of a letdown to some degree, especially social media. If I have to upload an ID or insert a grey hair into a scanner, that website or app will be dead to me and I will move on to something else or nothing at all.

Let's actually create and maintain a society.

There are still places in the world where you and your family can literally fend for yourself against nature and rival gangs and so on if you're just super attached to the concept though, it's not like this option has been foreclosed.

Just for example Russia build infrastructure for blocks website for child safety, but it started to used much further

It would be nice if the author actually spelled out the specific weaknesses of those approaches or even just referenced those laws instead of fear-mongering about "spying on kids", but I suppose that would be to much to ask of someone who made a career out of vibes based rage. Ironic that Doctorow is so eager to capitalize on the enshittification of journalism.

Even if these governments come up with a zero knowledge system, it's only one click away from being replaced with a full-knowledge system, because the user is already used to it. These governments have already tried spying on everyone (and they almost certainly still do).

If they're not, I should be able to opt-out of them.

    - purely random
    - sponsored but without user tracking (like old school TV ads)
       - sponsored for user selected geographical area feed
       - sponsored for user current location geographical area feed
    - follow "friends" or influencers
    - purely timeline

    - discussion boards
      - timeline (IRC like)
      - threaded
      - user votes (not magic platform votes)

    - follow keywords

Edit: huh, I'm probably stupid, but can you explain more?

But surely we can do better than either of these extremes.

Protection of kids is definitely the most common arguments for them.

But I also grew with a different internet than we have now. There’s a level of targeted manipulation that’s novel. I’m not sure the cat goes back in the bag no matter what we do.

Perhaps it's the parents who are too dumb to understand how to configure a network?

* as your kid's legal guardian you're legally liable for whatever the fuck your kid does, including but not limited to harming themselves: Parents should care for their kids

* platforms will do their best to not be available to minors unless minors are actually their core audience, will inform monthly how they did that, and the bottom 10% of achievers will pay an escalating percentual of their valuation as fine for each instance where they're found lacking: Platforms should care about kids as a category of people

* posession of personally identifiable information about an unrelated minor by any unrelated person/company without a clear and preapproved reason is grounds for a child abuse investigation on every person anywhere in the chain of custody of said data: Children's PII should be such a hassle to manage it's not worth taking

Their parenting equipped me well to deal with weird, dangerous or otherwise harmful things I encountered. They were the kind of parents who would let us play in the woods till 9 in the evening, no questions asked if there were scratched knees or dirty cloths. If there was something they thought might be problematic, they talked to us in a way that left the ultimate decision how to deal with a situation with us, displaying a high level of trust into our ability to make good decisions ourselves (and sometimes letting us make bad ones just to talk about it after the fact).

Turns out if you want your kid to be able to deal with unexpected situations you need them to deal with situations, period. And the opposite of that is what I even back then saw with many of my friends parents: trying to shield their kid from every encountering (and mastering!) even the tiniest of dangers themselves, alone. You think you tell your kid about the dangers of the world, so they know, but the actual lesson you teach is that only their parent knows what is and isn't dangerous and that they themselves can't be trusted to judge it. That is a bad lesson.

Don't get me wrong, we did stupid stuff, like jumping of bridges into rivers and so on. But we were very careful about how we did it, diving beforehand, etc. The real stupid stuff in my youth was all done by other kids that had never learned to judge risks themselves and who in one brazen attempt of rebellion bit off more than they could chew in one go. That landed them in the hospital. My brother and I were the only kids in our friends circle who made it to 18 without having broken a single bone in our bodies, despite being regular skateboarders, snowboarders, climbers, cliff jumpers and all other kinds of borderline insane past-times, some of which don't even have a name.

One aspect: Since my parents had no idea what was on the internet and how to protect against specific dangers lurking within it an educational method that didn't have to rely on them knowing and enumerating every danger in the world proved to be a really smart choice in hindsight. Since the landscapes of social media especially for kids and young teenagers is shifting constantly at a high pace, any parenting ideas would need to keep track of all this as well. I can't even imagine how that would work.

The alternative is to ban everything. But how do they build a healthy immune system if they are never even exposed to the mild dangers first?

Maybe our children will figure it out as they become parents. I hope so.

I don't know that universal tracking is the answer. I also don't think unrestricted access to children by manipulative predators (companies in this case) is the right answer. But then, I don't think they should have unrestricted access to adults either.

What's with the "we can't do that" helplessness that pervades this topic?

Thank you.

It has never been about "protecting the children" either. That was always a lie - the red herring. Many pointed that out from the get go too.

The much more fascinating thing is how legislation is still being actively changed to sustain that narrative. This is like a pre-scripted event what we are seeing here. I find it quite fascinating. It shows how real lobbyism actually works.

My prediction is that mandatory age sniffing will come, they will continue to claim it is all for children, and the openness of the world wide web will factually be transformed into a two-class apartheid system. The latter has already happened actually - you have walled gardens e. g. discord rather than oldschool phpBB webforums (aka privately controlled access to information), Google already ruined its search engine, AI slop continues to ruin more here. These are all not isolated. This is a deliberate mega-slop attack, combined with payments to key lobbyists. We see a degradation of services here. That they attack VPNs is very logical - after all VPNs allow people to break out of the global ghetto system they are building here. They want to know who is who.

Interestingly I see this attack also related to them trying to abolish the right to repair movement. Now, there is no direct connection here, but right to repair also attempts to put people at the center - you purchased something, you should be able to freely change it to your own liking, without some random private company being able to proxy-deny any change to that. With mandatory age sniffing coming, it also means that people will lose the ability to change software. Recently a university here in Europe started to demand that students must own a smartphone AND must install an app from a private company (via google store) in order to be able to read email sent to them via a webmail account. I also found this fascinating, because now people need to submit to Google, in order to study in a small european country, if they study at that university (which is paid for by taxpayers by the way). These interdependencies will keep on increasing here. Even Linux will fall victim - systemd already added data fields to track your age. More to come in the future despite Poettering's claim that it is all very, very harmless. Until it is not. And then it is too late.

If we unified and refused, it wouldn't happen. It couldn't happen. I am begging my fellow developers in this space to remember that you are WORKERS. The owning class will throw you into the meat grinder with every other worker the second it's convenient to their wealth extraction.

Throw down your tools and say no.

If you find yourself tasked with implementing age verification shit you think is profoundly unethical, don't build it.

If you find yourself building products you know to be harmful, refuse.

If you find yourself put against a wall to ship garbage you know doesn't work to check boxes for some fucking CEO, stop.

We are the tip of the spear in the global effort to make the world more surveilled, more dangerous, less free, and more expensive. We have a CHOICE and we have to start making it.

And yes, it may cost you your job. It'll certainly cost you status. Your boss will hate you. But the last year or so has made it abundantly clear that whatever professional "safety" we feel is not warranted. We are just as replaceable as the delivery drivers who get caught pissing in bottles.

That's cute. About half my coworkers are socialists and the other half fire breathing MAGA. The only thing we have united on was that we don't talk politics at work. But I assure you, there is not universal agreement at all that authoritarian technology is bad. Some people, including many developers, absolutely support it.

What you propose requires agreeing on the definition of harmful. And immediately it fails.

And people here are NOT asking why its even needed at all. This is what those ethics classes are for - not asking HOW to make, but whether we should at all.

And invasive country identity level online personas is NEVER something we should ever go for. This is basically "FLOCK ONLINE". And we see how devastating Flock is, even when pigs only have access.

No ID scans. No eyeball scans. No face scans. Im done with all of it.

This isn’t a simple solution to the problem but it reminds me that it is not a new problem. We should remember that

I also acknowledge that there is a reasonable debate to be had if the disadvantages to adults and businesses from imposing these rules are worth the harms prevented.

There is also a reasonable debate to be had about the merits of various technical and legal schemes being implemented to achieve these goals.

But this take is neither of those. For one, surveillance isn't the number one harm being prevented (even though, a number of legal codes attempt to make this the case).

As has been pointed out previously, there absolutely can be age verification that is without surveillance. The fact that these solutions aren't always legally mandated and therefore age verification can be used to increase surveillance is a reasonable thing to attempt to amend to the implementations of these laws.

> I also acknowledge that there is a reasonable debate to be had if the disadvantages to adults and businesses from imposing these rules are worth the harms prevented

Nobody on the "we need age verification" side wants a debate. They want to run face first in to dumb legislation giving governments and companies even more power to track every movement and know exactly who you are.

Of course, YMMV.

That said, if such a nanny state is inevitable: zero-knowledge-proof-based age verification would not only be possible, it would further protect these kids from a bad state actor. In that spirit, I agree with your last point. The fact that any other alternatives are even being considered makes it on principle a non-starter to me, because it betrays the actual goals of the political actors involved.

> "Age verification" means that everyone who does anything online will have to submit to fine-grained tracking and recording of all their online activities.