To be clear, I’m not advocating for online age verification. I’m very much against it in any form. I’m just curious from a technical standpoint if it’s possible somehow to construct an accurate age verification system that doesn’t compromise a user’s privacy? i.e., it doesn’t expose the person’s identity to anyone nor leaves behind a paper trail that can be traced to that person?
Nope, you always need a middle man to do the verification. That middle man has too much information.
Also, if you could solve for the middle man, there is no way to know the user belongs to the ID. It can easily be stolen.
Yes, but your government doesn’t want that.
Yes. Look up “zero knowledge proofs”
I mean “no, look up zero knowledge proofs”
Yesn’t
In my ideal world, it’s not an issue because parents don’t let kids under a certain age or demonstrated maturity level have computers in their room alone, and even better, they teach their kids how to not have problems with predators, porn, and the deluge of online weirdness and have open, honest talks about how some things are dangerous because they prey on you, some things are dangerous because they get you hooked on certain feelings, and some things are dangerous because they give you false impressions of the world and relationships.
We’re about as close to that world as interstellar exploration, I know. Imagine having parents who you don’t feel afraid to talk to about mature topics and personal matters.
And all that aside, why is it such a big deal that kids not see boobs but they can see violence and gore? Why is it magically okay for Timmy Neckbeard to watch strangle-fetish porn night and day as soon as he turns 18? Why do we scream about how porn is ruining kids minds but we’re not taking down the grifting “masculinity influencers” with as much zeal as we’re going after pornhub and other sites that are mostly just consenting adults doing fun biological acts together? Why do we say porn companies are evil and not do anything to make it less evil like better regulations and resources since we know people are going to find ways to make and view it anyway? (These aren’t questions for Lemmy but I would sure love to see communities start asking these questions to their elected representatives.)
Our species’ obsession with clear lines and labels is making us ignore where the actual problems are, we build fences around the outcomes not the sources. We create solutions to problems we don’t even want to look at directly. It’s like the government handing out umbrellas to combat the issue with the massive water main leak flooding the street.
Yes. There are many solutions.
Maybe the absolutely easiest to implement is just a signed message from an authority (gov.). You click a button on the website that requires verification, get a new tab to a gov. site with no identifiers from the site redirecting you and get a message you copy. The copied message is then pasted in to the site requiring verification. The site can then verify the message at their servers.
Hey benign and honorable govt!
Please tell the website “kill-your-govt .net” that I am old enough to join the revolution!!!
Kthxbai
edit: if this was pasted in both directions AND we trust that there is no identifying information in either ‘secret’ message, might work. Normies will not like the ctrl-c/ctrl-v workflow though.
That still creates a chain that can be followed. If the site you’re trying to enter is ever compromised, there will be record of your government code and whatever tracking is used to verify that you have entered your code.
I would be happy if the government was not involved in my online activities at all but I guess that ship is about to sail.
See also: timing attacks
This requires you to trust gov that they will not trace where the secret message is pasted.
If they can trace it, why would they need the code to do it? They know who you are already
How about
Middleman anonimizer, pornhub sends the message to a middleman, the middleman puts its own token on the request, sends that to the gov, the gov responds yes/no to the middleman on the authenticity of the message, the middleman forwards the response to pornhub. The gov doesn’t see pornhub, pornhub only gets the yes/no response, the middleman only sees the message with no ID and the response as well as the site.
Requires a separate middleman maintained by who the fuck knows. Pornhub keeps your IP, the gov keeps your name, the middleman only knows the number of visitors on pornhub.
If anyone is doing actual work trying to solve this please DM me, I’m interested in helping.
It’s possible with certificates and 2fa issued by a government, which already have all your data, that would only verify that you are over 18.
We already have that in Spain, sort of. We have a government app where you have a digital id stored and you can make it create a verify qr that only shows if the user is over 18 or under 18, no more data. The qr only last 5 minutes active.
It is necessary? Not for internet access. That’s a duty of the one paying for internet in the household, not the government. If they have underage kids under their responsibility it’s their duty to make sure that they get good education about what to see and what not and restrict access if needed. Having the government to universally interfere everyone it’s just plain bad.
No, It should be a browser setting. If parental controls are enabled, access should be denied to the site.
Even if it works, it’s a solution without a problem. If I can afford internet access, I am mature enough to see anything on the internet, and I am mature enough to decide which users can access my internet-connected network and whether they can have access to the whole internet. That’s all the age verification needed ever.
The request for age verification by each website is purely about unnecessary control and censorship.
Internet access is like $1 in most countries (Sim card data).
I don’t know about you, but the tooth fairy gave me enough money to pay for internet access before my skull was old enough to finish growing adult teeth…
In principle it should be possible to do a zero-knowledge proof.
This means that the website asking for age verification asks a yes/no question like “Is this user 18+?” and the age verification service (like a digital ID provided by the government or whatever) answers “yes” or “no” accordingly, but without telling anything else about the user. Also, the verification service should ideally not know who asked for the age verification.
So the site you want to visit only knows the thing they need to know: Whether you are 18+ or not. Nothing else. And the age verification service only knows somebody asked for age verification and provided the answer, but do not know which site you visited.
This is all possible, but I don’t have high hopes this is the intended implementation of any government seeking age verification, so don’t get your hopes up.
Does that mean the government sees all the sites I’ve visited?
No, that’s what I wrote as well. The identity service would not know what sites were visited or ideally not even how many sites were visited.
I worked in this field for 3 years, a lot of the core parts are written, but there are a few key pieces missing and no one has taken it to real production.
You can use a passport in pretty much any country and prove you’re over a certain age. Here is a demo: https://github.com/dog-18/dog18
The parts that are missing are primarily around making secure nullifiers, which prevents someone from reusing identities, but also without revealing any private information. We were pursuing research that allowed nullifier generation in MPC where none of the servers or the users knew the “salt” that their identity was hashed with, so no one could recover the original piece of unique data (like their passport number, even if a govt had a hunch about which passports signed up to a service) but it would also prevent them from signing up with multiple accounts. We got our funding cut pretty bad and management was a mess, so I left and that research I think was shut down. This really is the key part to actually make that viable in the real world though. It’s maybe a year worth of research and a year worth of production left to make that practical.
There are some pretty strong arguments that even zk proof is a flawed way of preserving privacy though, in a variety of ways. It prevents pseudonymity by enabling one-user-one-account, and it leaves users vulnerable to being coerced to reveal their full online activities by handing over cryptographic keys.
Got ready to read some bullshit,
Vitalik Buterin
nevermind. But damn, what a great read. I haven’t given much thought to on-chain ID in years and he lays it out pretty well. Still sounds like encrypted tokens are the way to go, but we all need to have multiple forms for it to protect anonymity.
If there’s one person who knows their applied zk proofs, it’s that guy.
Not monero or zcash devs?
Indeed, technologically it is absolutely possible in multiple ways.
But the tempting possibilities of doing more than that are just too great.
The one who asked the verification service also shouldn’t know who the verification service is, imho.
I’m not sure that is feasible, because in order to trust the answer, I feel the asker must know and trust the one providing the answer. It sounds like you’re imagining a system with many different ID providers? What prevents me from creating my own provider that just answers “Yes”, even for people under 18? If the site asking does not know it is my fake ID service providing the answer, I’m not sure they can trust any answer.
But I won’t pretend to be an expert on this topic, so perhaps it is feasible somehow.
the asker must know and trust the one providing the answer.
This is possible if there’s a central authority for that that everyone can agree to trust, like the government records directly. The issue is ensuring the rest of the chain remains anonymous so the only thing the authority gets is the request that an undisclosed service is verifying John Doe is 18+ and nothing else. And that’s not something many governments are going to want to allow with the increasingly alarming amount of authoritarian leadership.
doesn’t this just raise the authentication requirements? like in the uk we got added checks for who was could work, and lots of deliveroo drivers shared the login + password of someone they knew who was verified.
I think it should be easy to identify when an account is being shared. For example if it’s used from different ip addresses within a short amount of time
The problem is not the system or the idea of age verification
The problem is that no one on earth can be trusted with that level of monitoring, control and power.
You definitely can do this with cryptography, it’s a really hard problem, but I worked in this space for a number of years, it’s possible.
Like I implied, the problem isn’t the HOW to do it.
The problem is in giving any one person, government, corporation or company this amount of power and control.
And because it’s so powerful, no one who had it would want to give up control by making it anonymous or in objectively protecting privacy for the user.
Right, I understand that perspective, but there is a way to do this with multi-party computation and some other cryptography where no one would have the actual power/be able to see the data/have control. The main issue is it’s expensive to run and no one would be incentivized to run it.
Nah you can totally trust me, I’m too lazy to do anything nefarious
Wait until you have that power and you’re made offers that are hard to resist.
Great! … the solution to our problems … let’s all trust edgemaster72
Oh, oh shit, this has backfired massively, I didn’t think anyone would go along with it, that’s way too much responsibility
This is precisely what the chosen one would say!
Its possible.
Open source front-interfacing app + a secure element thing in the backgound.
You download an app. You verify your identity, then the app sets up a OTP thing with the shared secret seed lasting for 30 days. But every 30 seconds the OTP changes. Everyone doing a verification in these 30 days gets the same exact secret seed.
The seed hides in the secure element of your device. (it won’t be impossible to extract, but the average kid is not gonna be able hack a secure element) Every 30 seconds, it releases the new OTP to the Open source app. The app doesn’t connect to the internet once the OTP has already been set up. So nobody knows if you actually view the OTP code.
So the government only knows you have the verification OTP set up not which websites you visited, the website only knows you have a valid OTP from the government, but you could be any of the people in the past 30 days (which the company don’t even have access to).
Even if the company and government cooperates, they could only pin down the time of website registration and that you are one of the millions of people that did the verification and requested a OTP Seed.
(Idk the exact terminology for these things, but hopefully I make sense)
The seed hides in the secure element of your device. (it won’t be impossible to extract, but the average kid is not gonna be able hack a secure element).
But only one person needs to “hack” it on their device to publish the key, allowing everyone to use it without “hacking” their own device.
You can’t store a key on a device and keep it safe from the owner.
The government knows who you are. They know your age, your address and know you exist (probably).
You go to a site that requires ages verification. You say:please verify me with the government portal. You go to that portal to get a temporary id code to give to the site. The website says to the gov portal give me the name and age of the user with this temp ID. You approve that access. Portal sends age (or an is over 16/18/21 etc flag) to the site.
- Gov portal doesn’t need to know who the site is.
- You don’t provide a unique ID to the website, just a temporary one.
- as if codes are temporary, you must have access to the id/login now, not just at some point
- Site only gets the data you approve/it requested,.not everything.
The process can do with some streamlining, but should work in practice?
Ya you could definitely do this way too. There is a standard that google came up with called private state tokens that would allow you to do this in a pretty clean way, if you were cool with using your governments portal.
Essentially you would login to the govt portal, they would issue you some limited set of tokens (let’s say 5) that would expire after 30 days. You would go to an age restricted website and sign up and that would “burn” a token.
You could use ZK on top of this to make sure that the same email address or some other “nullifier” piece of information was used, to prevent an 18 yo kid from selling their tokens to 17 yos.
Zero-knowledge proof. Medium has a practical example, though unfortunately the article logs user data, so beware on that.
Depends on how reliable you need this system to be. For example, do you need to handle the scenario where an adult verifies their age to access a website, then lets a minor use that website in their place? That would be a much harder problem to solve than if you just need to verify that an adult was present on the other end at one point in time. For the latter, device-based age verification seems to be trivial to set up from a technical standpoint while fulfilling that criterion.
deleted by creator
