I wish I could force every legislator
in favor of Age Verification to watch this amazing talk by Carissa Véliz,
So that they understand the dangers
of the surveillance infrastructure they are currently putting in place.
You should watch it too: youtube.com/watch?v=xSPRouBvgF…
#Privacy #Democracy #HumanRights #AgeVerification #MassSurveillance #Fascism
How privacy can save your life | Carissa Véliz | TEDxPorto
Auf YouTube findest du die angesagtesten Videos und Tracks. Außerdem kannst du eigene Inhalte hochladen und mit Freunden oder gleich der ganzen Welt teilen.TEDx Talks (YouTube)
reshared this
. Self-publishing is self-marketing, so there we go.
divVerent
in reply to Em • • •There are technical solutions without mass surveillance.
But I am not optimistic enough to believe those will be demanded.
Specifically because of the lack of surveillance, and the lack of monopoly protection for big tech.
Pretty sure big tech lobbyists are making sure the worst approaches possible get put into law. Not because they are evil per se, but because it strengthens their monopolies.
Cassandrich
in reply to divVerent • • •@divVerent No there are not. This is a fundamental fact of mathematical logic. Given a proposed age verification system you can prove that it's either trivially bypassed (doesn't actually verify age) or violates key privacy properties.
Em's point is spot-on. If you think of this as a problem to be solved, you are going to be wrong and you are going to be a useful fool for fascists.
Ed Wiebe
in reply to Cassandrich • • •@dalias @divVerent Knowing how old someone is does not limit their speech nor their ability to vote (we verify age for that already, and for many other reasons). Age verification isn’t state censorship. I suppose it could be a way to limit anonymous speech. That isn’t a Right where I am from (nor is ‘free’ speech). I doubt anonymous speech is a Right anywhere.
I have no doubt it’s absolutely technically feasible in a way that infringes on no one’s privacy. Ultimately though, yes, it could be abused by bad actors. Like everything else in civilisation we need some balance of enforcement to deal with those people.
Cassandrich
in reply to Ed Wiebe • • •@edwiebe @divVerent There is no way to know how old someone is without attestation by some authority who knows their identity. This precludes participation by anyone not known to such an authority (undocumented, outside of jurisdiction, etc.) or for whom it is not safe to let that authority know they are participating. And this is only the tip of the iceberg.
You are dangerously wrong, and you should stop advocating about things you're dangerously wrong about.
Talya (she/her) 🏳️⚧️✡️
in reply to Cassandrich • • •@dalias @edwiebe @divVerent
while that's true, it is possible to make such an attestation without destroying privacy (see soatok.blog/2025/07/31/age-ver…).
however, even if you do that, it'll still be morally wrong in most cases.
and also, corporations are deliberately not going for the private solution, and governments are shifting the blame to users. the Czech government recently admitted social media is already illegal for teens (due to privacy laws), but they want new laws anyway.
Age Verification Doesn’t Need to Be a Privacy Footgun - Dhole Moments
Soatok (Dhole Moments)Cassandrich
in reply to Talya (she/her) 🏳️⚧️✡️ • • •⊥ᵒᵚ Cᵸᵎᶺᵋᶫ∸ᵒᵘ ☑️
in reply to Cassandrich • • •divVerent
in reply to Cassandrich • • •Precisely - also as I described.
The one way around that would be storing the secret for the ZKP in a TPM.
Yeah, right, with that you can still run your own proxy and provide the ZKP for someone else.
But it is possible to then also use some forms of remote attestation so this doesn't work. Like, yeah, you can forward the ZKP, but then only you can decrypt the connection and not your "customer", as the decryption key is in your TPM and can't get out.
Despite all that, in worst case you can run a web browser in a VNC session for others to use, with your age claim. Nothing can prevent that - other than the ZKP not being actually ZK.
And that, indeed, is why ZKP aren't gonna happen for this. Even if they're cryptographically ZK, they'll end up signing more than just the age - at which point it's a privacy violation again and also no stronger than merely claiming your age in the first place.
Ed Wiebe
in reply to Cassandrich • • •If you're suggesting every jurisdiction should allow unrestricted access to everything because some jurisdictions are authoritarian then I disagree.
divVerent
in reply to Cassandrich • • •In theory one could do this with a "trusted" third party and blind signatures.
Let every country on the world run a CA for age verification. CA generates a certificate for your age that reveals nothing about your identity.
Present these certificates. Extra cryptography to be used so the certificate cannot be used as an user ID (i.e. each time you present it, the data sent has to be different). E.g. a "zero knowledge protocol". Not even the government that ran the CA should be able to find out which person is presenting their certificate.
All this is solvable, but:
- Nothing stops you from copying someone else's certificate. Even if this were TPM-backed and it were actually secure, nothing stops you from using someone else's computer.
- Websites need to trust _every single country's_ CA. Even if this were feasible, it'd quickly run into issues like "which CA to use for people in Taiwan", and e.g. recognizing one could get you into trouble with the other.
- If only one country hands out certificates for people who haven't reached the
... Show more...In theory one could do this with a "trusted" third party and blind signatures.
Let every country on the world run a CA for age verification. CA generates a certificate for your age that reveals nothing about your identity.
Present these certificates. Extra cryptography to be used so the certificate cannot be used as an user ID (i.e. each time you present it, the data sent has to be different). E.g. a "zero knowledge protocol". Not even the government that ran the CA should be able to find out which person is presenting their certificate.
All this is solvable, but:
- Nothing stops you from copying someone else's certificate. Even if this were TPM-backed and it were actually secure, nothing stops you from using someone else's computer.
- Websites need to trust _every single country's_ CA. Even if this were feasible, it'd quickly run into issues like "which CA to use for people in Taiwan", and e.g. recognizing one could get you into trouble with the other.
- If only one country hands out certificates for people who haven't reached the proper age yet, the entire system breaks down. And some country sure will do that - at least for people paying enough.
- None of the major companies would ever implement a privacy protecting scheme anyway, if they can instead do mass surveillance.
At that point, it basically gains nothing vs my approach of the ban simply implemented client-side and voluntarily. Parents either block social media for their children, or they don't (and supervision necessarily ends once children can afford their own phone and internet connection). I have ideas to simplify that, but solutions for that already exist right now.
divVerent
in reply to Ed Wiebe • • •From what I understand, active verification does necessarily invade privacy.
But active verification is not necessary.
A mere social media ban under age X, if necessary, could simply be passed as a law, making the parents responsible for ensuring their children follow it. There already are existing laws of this kind for other areas of life. And as parents are responsible for supervising their children, they definitively can also be responsible here.
The opposite is true as well - while the child is supervised by their parents, such restrictions should not apply.
To support the ban, I still think it'd be useful to have an (optional at parents' discretion) software solution. Sure one could go all allowlist using e.g. Google Family Link, but I'd prefer if sites specified their purpose (and also some other properties, e.g. the severity of various kinds of NSFW content, potentially even at multiple levels of which the client can then pick one and specify in a header) for such software to use. That's trivial to do, it's just one file to be placed in the we
... Show more...From what I understand, active verification does necessarily invade privacy.
But active verification is not necessary.
A mere social media ban under age X, if necessary, could simply be passed as a law, making the parents responsible for ensuring their children follow it. There already are existing laws of this kind for other areas of life. And as parents are responsible for supervising their children, they definitively can also be responsible here.
The opposite is true as well - while the child is supervised by their parents, such restrictions should not apply.
To support the ban, I still think it'd be useful to have an (optional at parents' discretion) software solution. Sure one could go all allowlist using e.g. Google Family Link, but I'd prefer if sites specified their purpose (and also some other properties, e.g. the severity of various kinds of NSFW content, potentially even at multiple levels of which the client can then pick one and specify in a header) for such software to use. That's trivial to do, it's just one file to be placed in the web server's root and it'll work. Could store it in DNS instead, whatever, don't care.
Furthermore, while at it, we could combine this with a technical solution for COPPA and other regulations that ban tracking and surveilling children online. Namely, revive Do-Not-Track, and have aforementioned software automatically set the header for minors.
But, I hear Big Tech say, then what if adults set the header too?
Then you don't effing track them either.
But... what if everyone sets it?
Then the people have spoken.
Azarilhⓥ
in reply to Em • • •CynAq🤘
in reply to Azarilhⓥ • • •0x4d6165 (Julie)
in reply to Azarilhⓥ • • •Azarilhⓥ
in reply to 0x4d6165 (Julie) • • •Azarilhⓥ
in reply to Azarilhⓥ • • •So silly.
0x4d6165 (Julie)
in reply to Azarilhⓥ • • •Azarilhⓥ
in reply to 0x4d6165 (Julie) • • •@0x4d6165 The methods they use are terrible but it can be done safely, look at EU's proposed app which would make the government check your age, not random private companies. And the government would simply tell the website "yes" or "no", without any identifiable information. So the problem would not persist. It's also open source.
Would you still be against that? If so, why?
0x4d6165 (Julie)
in reply to Azarilhⓥ • • •Azarilhⓥ
in reply to 0x4d6165 (Julie) • • •0x4d6165 (Julie)
in reply to Azarilhⓥ • • •Azarilhⓥ
in reply to 0x4d6165 (Julie) • • •0x4d6165 (Julie)
in reply to Azarilhⓥ • • •Azarilhⓥ
in reply to 0x4d6165 (Julie) • • •0x4d6165 (Julie)
in reply to Azarilhⓥ • • •Azarilhⓥ
in reply to 0x4d6165 (Julie) • • •@0x4d6165 There already are digital ID systems like EU's proposal that are implemented by governments around the world. For instance, Sweden has it ( y'know, one of the most progressive countries in the world ), so does Denmark, Canada, etc. I don't see how they affected negatively anyone in particular.
I don't see "basics of authoritarianism" anywhere in here like USA is doing, where they censor queerness and spread disinformation to control people.
Jonathan Kamens 86 47
in reply to Azarilhⓥ • • •They can even be designed to prevent the authority providing the age verification from knowing what sites it's requested for.
More about this here: newamerica.org/oti/briefs/expl…
I'm not a fan of online age verification, but if governments are going to require it, we should be demanding that it be done this way.
@0x4d6165@transfem.social
Age Verification to Protect Youth Online: Using Zero Knowledge Proofs
New America0x4d6165 (Julie)
in reply to Jonathan Kamens 86 47 • • •0x4d6165 (Julie)
in reply to 0x4d6165 (Julie) • • •Jonathan Kamens 86 47
in reply to 0x4d6165 (Julie) • • •0x4d6165 (Julie)
in reply to Azarilhⓥ • • •you forgot Hungary is in the EU.
damn you really love boots huh
Azarilhⓥ
in reply to 0x4d6165 (Julie) • • •0x4d6165 (Julie)
in reply to Azarilhⓥ • • •0x4d6165 (Julie)
in reply to 0x4d6165 (Julie) • • •Azarilhⓥ
in reply to 0x4d6165 (Julie) • • •@0x4d6165 Just look up "sweden digital id".
We have eID here in Italy too, but it's not used for much.
Reginald
in reply to 0x4d6165 (Julie) • • •Sadly, capitalism is trying to make them the same. They used to look at your ID in clubs. Now they scan them, and no you don't get a disclosure of where that data goes and how it will be used.Is it kept by the club just to figure out if you have been banned or suspended from the club? Do they sell the data? Do they use a 3rd party app and have no idea what happens next?
@Azarilh
Azarilhⓥ
in reply to Reginald • • •Em
in reply to Azarilhⓥ • • •Azarilhⓥ
in reply to Em • • •Em
in reply to Azarilhⓥ • • •Ada
in reply to Em • • •it's kind of (also) a parenting problem?
Having a proper dialogue and clear rules for all technology usage, whether TV, Tablets, Games or Social media isn't a goal to aspire to, it's the minimum bar required for responsible usage.
Paul Sutton (zleap)
in reply to Ada • • •Parents, should also be expected to lead by example.
Serf de Web
in reply to Em • • •Em
in reply to Serf de Web • • •@serfdeweb People need to contact their representatives and complain loudly about it.
These legislations need to be repealed and prevented.
The political class needs to hear that citizens reject surveillance firmly, and the focus should be instead on creating platforms that are less addictive, more privacy-respectful, and safer for everyone, including adults.
The time to fight is now.
Rokosun reshared this.
G1N&T
in reply to Em • • •Ben
in reply to Em • • •Matthew
in reply to Ben • • •Ben
in reply to Matthew • • •Obey
Studiocanoe (Vimeo)Fennek | Commissions OPEN 🦊🐾
in reply to Ben • • •SIGSEGV44
in reply to Em • • •Paul Brzeski
in reply to Em • • •Hear hear!
I'm so tired of everyone like it's normal to upload official identification to every app and website. Without any proper background checks on those services!
This is literally how you get your identity stolen. So the exploitation isn't just happening at the panopticon level, these policies leave us all more vulnerable.
Even people who know better have to comply to function in this society. It's horrendous.
Cyberspice
in reply to Paul Brzeski • • •Newk
in reply to Em • • •Em
in reply to Newk • • •Gerard
in reply to Em • • •Hey parents, your kids are in danger! But don't worry about it. We'll take care of it for you.
All we need to do is just check their ages. It'll be just like getting ID'd in a shop. You remember that don't you? Nothing to worry about.
[quietly]We'll just take a photo of your children and their ID, put them in a database, track their every movement, record who their friends are, what they think, their every hope, dream and aspiration.
[back to normal volume]
So don't you worry, your children are safe with us and our billionaire backers, whoops, I mean with us, just us. We'll take care of everything. You can get back to feeding your own dopamine addictions, we'll claim your children are safer now, and big tech will have their giant, totally not sinister databases of real world identities that surely aren't going to come back to bite us later. Anyway that'll be for a different government to deal with.
N0tSure
in reply to Em • • •John Philip Bell
in reply to Em • • •But keep in mind as well, the proposed technical implementations are key to understanding and explaining how far from 'age verification' the goal is; how far down the surveillance road this all goes.
Age verification is a 'boolean' message to the relying party (or maybe a number of years old), not identity based at all.
If the requirement is 'you have to identify yourself (whispers "for age verification purposes") then the proposal is a requirement to remove privacy, not age verification.
Cassandrich
in reply to John Philip Bell • • •xs4me2
in reply to Em • • •Hans van der Graaf
in reply to Em • • •Yivi - Your digital identity in one app
Yivigrøtlaus fiskegrateng
in reply to Em • • •the FIRST PERSON NETWORK
the FIRST PERSON NETWORKCy
in reply to Em • • •Ben Todd
in reply to Em • • •Em
in reply to Ben Todd • • •Azarilhⓥ
in reply to Em • • •What i hate about age checks in social media is that they say it's to protect children from the toxicity of social media.
How about governments try to actually regulate social media instead of outright banning children? Social media can be a good source of social integration and information ( being a queer child that lives with queerphobe parents, for instance, may only get queer support from people on the internet :/ ). 1/2
Azarilhⓥ
in reply to Azarilhⓥ • • •Em
in reply to Azarilhⓥ • • •Mu
in reply to Em • • •I disagree.
As a society, we have decided to age -gate some things. I, personally, think it's a good thing to slow down the pervasiveness of social media, as I think it's a good thing to slow down most addictive things.
Martin EA7KRC
in reply to Em • • •Luna Lactea
in reply to Em • • •Em
Unknown parent • • •@Azarilh I do not have the time to review and speak about this specific product sadly. But in general, even if the token handed to the application requesting it is fully anonymized, the application collecting the initial data is still a potential attack vector and point of failure.
If it's proprietary, then it entirely relies on blind trust. If it's open source, then it must be fully audited regularly and built and reviewed with independent experts. But even if it was perfectly secure and private, the piece of ID showing the age must be uploaded somehow. Is the whole system secure? Where is this data stored? Does it get fully purged after or is the "deleted" information only flagged as deleted but kept in a database somewhere?
If all identifiable information is fully deleted, then what shows this token is reliably only used by an adult and not shared with a child? Where is this token stored? Can it be sold to others online? People have already done that with the
... Show more...@Azarilh I do not have the time to review and speak about this specific product sadly. But in general, even if the token handed to the application requesting it is fully anonymized, the application collecting the initial data is still a potential attack vector and point of failure.
If it's proprietary, then it entirely relies on blind trust. If it's open source, then it must be fully audited regularly and built and reviewed with independent experts. But even if it was perfectly secure and private, the piece of ID showing the age must be uploaded somehow. Is the whole system secure? Where is this data stored? Does it get fully purged after or is the "deleted" information only flagged as deleted but kept in a database somewhere?
If all identifiable information is fully deleted, then what shows this token is reliably only used by an adult and not shared with a child? Where is this token stored? Can it be sold to others online? People have already done that with the supposedly secure and supposedly private World App. If identifiable information is kept to prevent this, then all the other problems mentioned above remain.
And regardless of all of this, having to upload an official ID, even in the imaginary scenario where we would magically have a perfectly privacy-preserving technology, gatekeeps the use of devices and access to information and communication from many people who, for various reasons, cannot have this official ID. It closes down the internet. We should never agree to that, let alone contribute to facilitating it. More information here: eff.org/issues/age-verificatio…
Age Verification and Age Gating: Resource Hub
Electronic Frontier FoundationJonathan Kamens 86 47
in reply to Em • • •Zero Knowledge Proof age verification doesn't solve all of the problems you mentioned, but it solves most of them, in provably, cryptographically secure ways.
(1/2)