Item — HN Reader

I find myself stuck on the fence with age checks.

Companies have show that they are incapable or unwilling to address the problems they cause. And market forces are not working to correct things. It’s also pretty obvious that saying “parent should take responsibility” is also not working. Just observe the world around you to know it’s a non starter.

This is where regulation is supposed to come in.

At the same time, companies have shown that they will abuse any personal information that is shared with them and we are now giving them more details about ourselves…

19 comments

I don't want the market solving this. If we are going to do age checks it should be based on public key cryptography, be open source, and handled by the government. You verify with the government (or don't since they already know your age), you get some form of cryptographic attestation, present said attestation to websites/apps.

I'm not a fan of age verification in the first place, but I am extremely not a fan of random third parties doing the verifying.

Why do we need to verify age?

You can't tell me that these social media companies don't already know exactly how old someone is just based on the enormous data that is collected.

A big concern around age verification is that some people will be locked out because they can't prove their age.

Your solution here has the same flaw, I think. If the algorithm thinks I'm underage, I'm locked out.

Because it's all about bringing in digital ID and gated internet. Not age.

They would prefer to know, not estimate, which is why they are pushing these initiatives basically on their own accord.

Also, if you've ever played with this kind of data, there is immense overlap between how some adults and some kids use the internet. Is this user legally a child, or just emotionally a child? Similar to the problem of "There is overlap between the smartest bears and dumbest tourists" in designing bear proof garbage cans.

This is scary though too. If the gov managed a key server like this, almost all companies would start requiring it. But this effectively gives the gov a very easy way to lock you out of everything.

You're seriously proposing letting governments decide which of their citizens are allowed unrestricted access to the internet?

Of all the 3rd parties who could be responsible for this, I trust the government the least.

But really the best solution here is no third party. The device owner (e.g. parents) should be responsible for setting the user's age when setting up the device. Anything that tries to take that responsibility away from parents and give it to a third party is necessarily going to be highly authoritarian; putting that third party in the role of parent for everyone, adults included.

If it has to happen, this is exactly how it should. Please feel for those of us in the UK who are currently denied access to some pretty significant services unless we send our passport to a random third party.

That makes the most sense.

And, that public key of yours must be used only on given platforms. You want to participate on Facebook or Reddit, then you use that public key to prove who you are. Which platforms require verification is another issue.

But it should still be legal and allowed to access conventional forums, Usenet , tor accessible discord servers without having to prove who you are.

Otherwise , the right to organize is over and we effectively live in an authoritarian regime .

I’m from The Government, and I’m here to help.

One not entirely inaccurate definition of government is a loose agglomeration of third parties.

Or, less flatteringly, a stupendously large way too loose agglomeration of way too many third parties welding way too much power way too arbitrarily.

Why not just let the parents set an age on the device via parental controls? Why do we need a whole cryptographic system and the government in between, for something that is really just a way to say « this device doesn’t want to have adult content »? It’s way simpler to have that at the device level, and would enable even adults who don’t want adult content to block it for themselves

Edit: I just realized that’s exactly what Android is announcing in the article, so that’s pretty neat

I want the market solving this but I don’t want to give any information to anyone who asks. I want Apple to verify me once, and then others to trust Apple that the device accessing their service is owned by someone over 18.

I’ll bet that most people are in the same boat - they trust their device manufacturer with information like their credit card number, but not anyone else.

And I think it’s a pragmatic compromise.

I don't want anyone to solving this.

This is problem generated by govt, and they just want to solve it with "children safety" as excuse. This is parents problem, not my problem.

It is a scary thought but I kind of like this idea. Having a yubi key that is issued by the government that is unique to you and has your age saved on it, it's by far the most private and secure way to verify your age.

No. It should be none of that. It should be a checkbox either set by the phone store when you buy the phone or set during the first boot process.

In this case will it be a transparent traceability and the mapping to user real identity close to 100%?

>It’s also pretty obvious that saying “parent should take responsibility” is also not working. Just observe the world around you to know it’s a non starter.

Then who should? Government, where each implementation strips away rights to privacy - which in some countries, including mine, are a constitutional right? Where it expands powers of government to track everyone's activity online - and remember we're one election away from total policy shift(just like with latest US elections)?

Free market? The profitable solution is, depending on environment - either ignore the problem(profit from ads served to children, no extra work necessary), or strip away all privacy (to filter out bots and get paid more per ad).

The sad reality is that "parent should take responsibility" is least bad option available, and takes into the account individual development of a child.

Even creation of a highly regulated child only internet creates more problems - as now that becomes a highly profitable target for bad actors(both individual abusers, and companies trying to serve ads)

Let's also not forget that many of the problems this supposedly solves are not even specific to children. The attention economy is bad for everyone.

In principle, it is possible to make a privacy-preserving age check.

Site/app asks "≥18?", device generates a UUID specifically for that [app/domain + device], the device passes that UUID to government database along with the "≥18?" question and the ID card info but not the app/domain, government database gives the answer and signs just the UUID and the answer and doesn't include any ID card info.

Government doesn't know what you're looking at, website doesn't know your ID.

(There's probably also better ways to do all this, I'm not a cryptographer and I expect that will be obvious from this comment to people who are).

We have cars, and kids are not allowed to drive them. Yet we do not have mechanisms in place to ensure kids aren't driving cars because the responsibility falls on the parents, and it works. By and large, parents understand the threats and navigate this requirement perfectly fine; outliers are few enough that we can deal with them on an individual basis.

The reason the current system doesn't work when it comes to unfettered internet access is either that parents by and large don't actually agree with the threat assessment of said internet access for kids, or they ignore it because the consequences of doing so are disproportionately small. Personally, my vote is that they just don't think it's that big of a problem.

To me, the ideal solution would be more granular and better parental control configurations, especially on the web. Pair that with preconfigured devices that have "unremovable" parental controls, branded as "kids/youth phones." If parents care about this, they'll buy those phones for their kids and the problem is solved. If they don't, then this isn't something parents want, and we shouldn't really pursue it further.

Parents haven't asked for help keeping their children from driving their car though.

> The reason the current system doesn't work when it comes to unfettered internet access is either that parents by and large don't actually agree with the threat assessment of said internet access for kids, or they ignore it because the consequences of doing so are disproportionately small.

Sometimes parents know their children, and what's best for them, better than faceless politicians (who we've seen are often attracted to said children for some reason).

Growing up in my household there was a time when I was allowed to read and watch whatever I found interesting. My younger brother was not. That was because my parents knew us and judged that at my level of maturity I was unlikely to be negatively impacted, whereas my brother would get nightmares or copy-cat things he saw that he definitely shouldn't.

That's how it should be. Yes, there are bad parents who will decide poorly. That's the cost of freedom.

The EU actually has a very good, privacy protecting way of doing this based on zero knowledge proofs.

Unfortunately they completely botched it by having the proof-of-concept app rely on Apple & Googles integrity APIs - which a bunch of countries copied.

ZKPs may as well just be unencrypted HTTP headers which would be way simpler and easier to implement. All a ZKP proves is that at least one person in the world is over 18.

The EU app is still shitty and unfixable, because it requires that you send personal information to a third party. The only acceptable and privacy respecting option is self declaration, which doesn't need any ZKP or any other bullshit.

I have a feeling that, in order to protect privacy, those regulations must fall on the parents too. It is their primary responsibility to take care of their children. Maintaining your kids digital hygiene should be important to the lawmakers and the child protections services.

What should they do about it?

There should be a law that forces social media companies to use a different algorithm for anyone under a certain age and be required to disclose it to the public. Possibly different algorithm depending on age group.

There should however be no force age verification. Social media companies already know how old you are or very close to it using the data they collect everyday. Using this data they should be required to use "best effort" to determine which algorithm you fall in. Nothing is 100% and we should stop pretending it is, sure some kids will find a way around but they would also if there is a age verification system.

> There should be a law that forces social media companies to use a different algorithm for anyone under a certain age and be required to disclose it to the public. Possibly different algorithm depending on age group.

Frankly, in that case I want the kids algorithm. It is preferable for me as an adult, I do not want the intentionally harmful one either.

Children here are a distraction. Any harm these companies are causing to children is also being inflicted on adults. The correct solution is to end the harmful behavior for all, not set up required identity verification.

> It’s also pretty obvious that saying “parent should take responsibility” is also not working. Just observe the world around you to know it’s a non starter.

That's like saying "take a look at owners of fast sport cars, it's obvious this is not working and they have too many accidents." If you want to patronize other parents and think the government should be more responsible and parents less responsible, please state that honestly. Don't make up alleged "facts" to make a point.

Otherwise, I'll just say "it's obvious you're wrong, just observe the world around you and you know age verification is a non starter."

> Companies have show that they are incapable or unwilling to address the problems they cause

> This is where regulation is supposed to come in.

This is such a misdirected effort... Why the heck are we focusing on addressing those problems for a small subset of population (kids) while creating even bigger problems for the rest? Lets regulate those companies into actually addressing the problems they cause for everyone!

> companies have shown that they will abuse any personal information that is shared with them

This is the rot at the center of tech IMO. We have all these wondrous toys but we can't do something as simple as verify age without abuse. What's the point of all this tech if we can't trust any of it?

> This is where regulation is supposed to come in.

And who do you think pushes/pais for regulations ? The same companies which are "regulated".

> It’s also pretty obvious that saying “parent should take responsibility” is also not working.

So punish those people.

Stop letting them neglect the responsibility a parent innately has to their child

and to the rest of us.

Stop punishing me by asking for ID when I buy alcohol!

Related recent discussion: https://news.ycombinator.com/item?id=49084938

> This is where regulation is supposed to come in.

Yes, agreed. However regulation does not necessarily have to mean age checks.

The most obvious low hanging fruit to start off with is open and interoperable content filtering infrastructure (ie parental controls) so that there's some common standard that literally everything supports out of the box. It needs to all work together - the current situation tends to be spotty and unreliable thus parents tend not to bother trying to use it.

Start with an extensible metadata format that enables websites to self-classify pages. Account for things like loading alternative resources on the same page. Mandate that all websites and app stores include such metadata and that all browsers and operating systems have some baseline functionality for making use of such data in a sensible manner.

Only after that has completely and utterly failed should we even begin to consider highly invasive measures such as mandating government ID checks.

There's nothing to be confused about, this isn't about age verification. It's about increasing surveillance and ending anonymity.

The "think of the children" shit is just a tactic to make emotional, non-critical-thinking people into die-hard soldiers for the cause that get angry when you argue against it.

"Oh you're against protecting children? What are you, some kind of pedophile?"

Parents should take responsibility and not let their children smoke, and we still banned selling cigarets to children. Just because something should be some way, doesn't mean as a society we shouldn't do anything about it.

In any case, the story with parents and addictive devices is even harder for parents than e.g. cigarets. For example, a LOT of schools in the UK think that it's good to give childrens ipads to study, and there's nothing that parents can do to prevent this. In this specific situation saying that "parents should take responsibility" is unfair to parents, because their only option to avoid this is home schooling.

That's a false equivalence. The only thing we should be doing is tackling addictive algorithms for everyone, and providing purely optional parental controls that are disabled by default.

100%, it's not like adults are immune to misinformation, social media addiction or scams. Those platforms should be safe for all people regardless of their age, nationality, sexual orientation, gender or religion.

The parenting argument is a complete cop-out. There's no universe where you can be shoulder hovering 24/7. This could've been solved years ago with robust parental controls. But companies like Google just didn't want to because they wanted to shove ads in kids' faces.

I think we can approach this from more than one angle. Yes, it cannot be entirely on parents, but parents should bear some responsibility to not just hand a device over to their children with unrestricted access to the entire internet.

Parenting doesn't have to mean become a helicopter either. In fact, that's the worst kind of parenting because it doesn't prepare the kid for a future without a parent around.

Good parenting is not shoulder hovering... It's teaching and instilling values and lessons that get the child to make the right choices in regard to what they do with technology. Like how we teach kids not to talk to strangers.

Parents should be teaching kids from a early age how to use technology responsibly.

I think you've done a great job identifying the three main options and why two of them (parents, censorship-by-default) just will not work. That leaves regulation; the only way we will prevent children—or anyone—from coming to harm is to stop companies from producing this harmful content in the first place.

Either that, or just accept the harm.

Who decides what is harm? An unelected bureaucrat? Now you’re going into censorship area