Item — HN Reader

Cryptographically there are techniques that let you prove you're one of the several hundred million adults in the US that don't reveal anything about which adult you are. It's much less complicated than bitcoin.

I'm bringing this up because it's the perfect litmus test to show whether you really care about age verification, or if you want personal trackability for all internet behavior.

I'd be okay with this for certain situations (e.g. a forum that doesn't want to foreign agitators to pretend they are US voters), but the whole porn thing is a ridiculous farce because there are still going to always be millions of non-us porn sites that don't enforce US laws.

2 comments

Not really. There are ways to prove ownership of one of several hundred million tokens. If you give out this many tokens, the odds that some will be stolen or sold must be fairly close to 1.

Agreed. But obtaining such a token/proof would still be an additional barrier kids would have to actively bypass, so while I don't think that's the best implementation I don't think it's correct to say there's no value there.

My bigger concern would be who gets to issue these tokens. If it's limited to a particular government, then that doesn't work very well on a global internet. And making the internet not global (blocking adults from accessing foreign websites that don't adhere to your scheme) is kinda authoritarian IMO.

If we're going to do age verification and blocking of adult sites, it needs to be local to the user's device (and thus under the control of parents, not governments).

E.g. Instead of mandating sites verify users, we mandate internet-capable devices sold to kids have certain content restrictions, the same way we mandate you can't sell alcohol to kids. To make this more effective than existing content filtering, implement some kind of legally-enforced content-labeling standards websites have to follow to be whitelisted on these devices. This way the rights, freedoms, and privacy of adults using adult devices is unaffected.

Aren't these all solved problems that we've worked out decades ago with certificates?

Certificates prove that a website/server (and sometimes the client) are who they say they are.

We force the website to renew their certificate from an issuer every year so that stolen tokens/certificates are less of a problem.

The issuer can protect or hide the identity of the certificate owner, and doesn't get any information about which clients accessed a server.

The real problem is just managing identities for millions of people. Some of those people will voluntarily use their credentials for someone under 18. Some will sell their identities. There is no technical solution to that.

Chat GPT would be happy to explain "Rate-limited anonymous credentials" to you. Just because you can't think of something doesn't mean brilliant mathematicians can't.

It would be much more valuable if you explained rate-limited anonymous credentials or provided an article (even wikipedia). ChatGPT is non-deterministic and telling someone to use it feels a bit cold for this website.

This has no bearing on my comment

Can you send a link or explain how this can be done?

As a not super tech savvy parent I find it impossible to keep my son off screens. He always finds a workaround. So I'm a fan of age verification especially after reading The Anxious Generation, despite all the hate it gets from hacker news.

Actually it's not super easy to explain to the layman, since it uses cryptography. But if you'd like to learn more ChatGPT is very knowledgeable.

But it sounds like your wish is to keep your kid off screens in general, which I don't think age verification would accomplish.

> the hate [age verification] gets

Age verification actually gets almost no hate. Society-wide surveillance gets a lot; age verification just happens to be the "think of the children" excuse to shoe-horn in the society-wide surveillance. As OP described, if the age verification is implemented as a "zero-knowledge proof" then we have age verification without society-wide surveillance and nobody is complaining.

https://en.wikipedia.org/wiki/Zero-knowledge_proof

Not OP and I don't claim a cryptographically secure solution. However https://news.ycombinator.com/item?id=46223051 is as good as the controls around other age-restricted products IRL: alcohol, tobacco, and adult magazines. And it preserves anonymity.

He’s talking about zero knowledge proofs - it’s a neat use of graph coloring where you send an encrypted proof that a graph can be colored with three colors and no neighbors with the same color. The verifier makes a challenge to prove two nodes don’t have the same color, and the prover provides a key to decrypted just those two nodes. This process is repeated a number of times (with new colored graphs) until the verifier approaches certainty that the prover will always be able to show all nodes have neighbors with different colors.

This coloring problem is NP complete and somehow the thing the prover is proving is encoded in the graph structure. At the end of the day, the only thing the verifier is sure of is that the prover can make the three colored graph, 1 bit that corresponds to the thing the verifier wants to know (eg - does the prover have a token that can show they are over 18).

For simple yes/no questions ("Is over 18?", "Is US resident?") then you should look back to David Chaum's blind signatures and the work that came out of that back in the 90s. The math is super-simple to understand and there are a ton of even easier metaphors with envelopes and carbon paper that you can use to explain to your grandmother. Once you get someone to grok blind signatures it is easy to lead them to zero-knowledge proofs.

This is far from the best way to do it, but this is a much easier to understand example of how it could be done without having to read about math:

There's a type of token called a JWT that's really common nowadays, which is composed of 3 parts: Metadata describing encryption for the third part, the actual base64-encoded data, and the encrypted signature. The second part would include "is over 18" and "expiration date" to limit reuse/abuse, and is trivially decoded by anyone to confirm there's no personal information in there.

You'd get this token from your government site and copy/paste it into the site needing verification. The government site would provide a standard public key that can be used with the third part of the JWT to confirm it hasn't been tampered with (verification is built-in to JWT libraries). There would only be one public key that rarely changes, allowing the site to cache it, preventing the government site from correlating users based on timestamps - they never see the JWT from the other site (verification is done locally), and the other site would only need to pull the public key once for however many thousands of people use it.

...that said technical issues aside, I kinda feel like this would be the most acceptable version simply because it doesn't require the average user to trust the math - they could go to a JWT-decoding website and look at it themselves.

How would you prevent the token from being used by a different person than it was issued to? This is the online equivalent of getting your older cousin to buy you alcohol from the store using their own valid ID

How do you prevent your house key being used by a different person, that it was not issued to?

I don’t get the analogy. I keep my house keys out of the hands of people I don’t want in. In this case, the age verification is being circumvented by someone simply asking another person to perform it on their behalf.

I guess the practical answer is that it’s impossible because there’s always the option to have an adult perform the verification and then hand over the device to the minor

Yes, the analogy is the burglar getting into the house by asking you to open your door for them. Adults are permitted to decide such a thing, because they know the risks and are expected to be able to reason about that. When an adult has decided, then there is no problem, as far as age verification is concerned. We have regulations when adults are in fact not able to decide such a thing "correctly".

We already have penalties for adults mistreating children by exposing them to dangerous things, but this is orthogonal to age verification.

Why do you want the online process to be more secure than the one using physical IDs?

Mostly because online process can scale a lot further and faster. An older cousin can only walk into a store to buy so much alcohol but a stolen token can be reused a million times in a second.

> hate

You meant logical criticism?

I mean one sided criticism that doesn't account for the damage done to kids by having no online limits, and assuming everyone in the world is as tech savvy as they are.