Online Age Verification

[Crazyroostereye]

This thread is intended on the Discussion about Age Verification across the Web. And to discuss the Issues with them regarding Privacy and Societally. About Places that are Implementing them and how they intend to do so.
This topic has become more Important than ever to Discuss after the Online Safety Act in the UK, The proposed Kids Online Safety Act in the US and the Age Verification Proposal in the EU, and more have hit the Scene. All these Acts are about or include Aspects of Online Age Verification.

We can already see in the UK with the Online Safety Act and the establishment of Age Verification Platforms like Persona. That throw Privacy completely out of the Window and the fact Platforms for example AA or the Suicide Prevention Chats are also affected, making it harder to get in contact with these Services and binding an Identity to the formally Anonymous Communications.

Ill start with the thing that Age Verification online isn't a bad thing. There is content online that should not be viewed by Minors, and having a way of Preventing Minors to view it that isn't a Button saying "are you old enough?".
But the Issues we are seeing for example in the UK, is firstly the Broad amount of Platforms that are required to have something like that. And the way they Verify with either Selfies or Pictures of their Government ID. All things that are collected by the Age Verification services. And can be bound to an Account. This is a risk of Data Leaks and more.

But on the other hand there is the EU which is starting a Pilot Program with an App, that has been Developed in the Open, that should Verify your Age on online Platforms using Cryptographically generated Certificates. On my First read of it, it looks like a great Privacy Preserving way of verifying your Age. As it doesn't contain any Info about you. It only tells the Service, you are old enough. But I do not know enough about it to know the Issues and Flaws it has.

What are your thought?

[rejectconvenience]

I agree to an extent. Obviously kids should not be able to access inappropriate content, and ideally, they shouldn't really be on social media platforms like Instagram. There are studies that highlight the fact that these platforms are doing an enormous amount of harm to children, and finding solutions to helping stop that problem is something that has my full support. My issue with the way this is being handled is twofold:

1. Forcing risk to everyone, including minors. Data is data, and anywhere where someone has to provide more data is a risk. There are certainly ways around this, and on the surface, the EU Digital Identity Wallet seems like a compelling way to handle this. I need to obviously look deeper into it, but so far, I like the amount of thought they've put into it. One of my worries is.. this is just for the EU. I mean, it could be adopted by other regions, but the US hasn't shown an amazing track record of following the EU when it comes to wrangling up big tech.

2. I worked in a school district for a majority of my career in IT, and if I learned anything, it's that kids will always find a way around these systems. Always. Even in the cases of these recent events with apps asking for scans of faces, kids found a way around it one day one using video games. We really need to keep that in mind when approaching this, as maybe talking to kids will help a lot. If you put a big sticker on the cookie jar saying "no kids allowed" and put it on the top shelf, that's an invite for them to find a chair. We can certainly try to play the cat and mouse game, but I can see how it would hit the same privacy concerns of point 1 rather quickly. I don't have a clear solution here, I mean I don't have kids. I just know that making a tool to prevent them from accessing things they're not supposed to is not going to stop them. I don't care how advanced and secure we think it is. They're very good at getting around that.

I'm really curious what others think, for sure. I'm also going to be talking to my friends that have children and get their input. Optimistically, I'd love to say it's just as simple as "teach parents to use parental controls", but I know that's not very realistic. That's part of what I want to learn from parents. I was hoping to make a video on this in a couple months, but given how much has changed in recent times, I want to give this some more time to talk with people and try to be able to offer real actionable solutions. That, of course, requires a heck of a lot more time.

[Crazyroostereye]

I couldn't agree more, while I find certain measures should be implemented, the approach we should be taking is that of Education and Parental Control. Topics like Internet and Digital Safety and Well being should be educated better in School. Furthermore, I think Parents should be also better Educated at Monitoring their Children's Online Activity and how to approach that. Beyond that I think implementing and maybe Legislatively encouraging better Parental Control systems on Platforms and Services. Maybe Design a Unifying Protocol so that Parents don't have fine tune the Parental Control over a Dozen different Services would be great.

2. I worked in a school district for a majority of my career in IT, and if I learned anything, it's that kids will always find a way around these systems. Always. Even in the cases of these recent events with apps asking for scans of faces, kids found a way around it one day one using video games. We really need to keep that in mind when approaching this, as maybe talking to kids will help a lot. If you put a big sticker on the cookie jar saying "no kids allowed" and put it on the top shelf, that's an invite for them to find a chair. We can certainly try to play the cat and mouse game, but I can see how it would hit the same privacy concerns of point 1 rather quickly. I don't have a clear solution here, I mean I don't have kids. I just know that making a tool to prevent them from accessing things they're not supposed to is not going to stop them. I don't care how advanced and secure we think it is. They're very good at getting around that.

Yes Children are the Best in finding flaws and Issues in anything. They will always find a way. Even with the Fancy EU app I can imagine they will find Master Cert that someone leaked, probably the German Government, and will be using that for a while. This is defiantly what will happen.

The one upside I can see of all this Age Verification Non sense is that we might increase Tech Literacy back up in the Junger generation while they try to work around these Systems.

[zonk]

What sort of things are we trying to protect children from seeing anyway? I can't really think of anything that would irreparably scar a child that wouldn't also scar an adult.

I encountered hardcore pornography at the age of 10 because of a bad influence of a friend, and I think I turned out the best out of anyone I grew up with and am doing a lot better than the adults who raised me. Sure, I don't think it was appropriate for me to be looking at that; there are many issues with learning about sex through pornography, but there is this meme that it will scar or corrupt the minds of the children by their mere seeing of it, and I just don't think that is true. The idea that we need to do away with online anonymity in the name of protecting kids from encountering sexual imagery is therefore ridiculous to me.

I was playing violent and graphic video games like Diablo at an even earlier age than that, with supervision from my father. I think parents should have the discretion to show things to their children, and it should also be their responsibility to control their children's online activities. Social media is absolutely damaging to children (I would argue more than violent and sexual imagery), but the parents are the ones enabling their kids to get on them in the first place. It should not be the place of the state to decide that on behalf of everyone else and sacrifice everyone's rights for them.

As with most societal ills, this is a problem of education and discipline, not legislation.

[CitricScion]

Opinion zone

My position when it comes to the problem that age verification is trying to fix is this: we should not adopt a solution that jeopardizes the basic digital freedom of the rest of the country, including those kids once they grow up. To prevent kids from seeing certain content on platforms that make up the mainstream of internet usage, you cannot mandate that effectively every user needs to confirm their real identity. I don't know what the best solution is, but you don't to give yourself a master key to spying on an entire populace in the name of "maybe this is keep kids safe."

To exaggerate a bit, the logic that says that we need to take freedom-destroying steps in order to protect kids could be allowed to dismantle all rights that keep law enforcement from doing anything. If you believe that fundamentally law enforcement is good and therefore needs full access to anything and everything in order to do there jobs, then logically you should have no freedoms if the state thinks they need to cross a boundary. The reason we don't go that far is because we understand that governments can't be trusted with absolute power. That is why we need to have our rights respected, and demand that to be so.

Personally, I am also of the opinion that the state is not everyone's dad. Parents should not be pushing the responsibility of keeping their kids safe onto the government. Again, there are limits here, but when the real answer to keeping your kid safe is to maybe not give them a phone until their older, then I don't have as much room for grace when the cost is basic human freedom in the fact of 21st century governments.

Potential solution zone

All that said, it does seem like there may be a way to privately confirm to a website that a user is an adult without sharing any information with the website. Google has open sourced an age verification system that implements "zero knowledge proof." I believe this is the system that the EU is looking to integrate into the digital wallet initiative.

The basic idea behind zero knowledge proof is that you could scan your ID with a special, audited app; that app would record the simple yes or no for whether you are over 18 years old; and when you are trying to access a site or part of a site that needs that information you could use this ZKP app to prove your age. As far as I can tell, this could be like when you set up TOTP authentication, where all you do is scan a QR code from the service, download the shared secret, and then you're good with an offline app that will always let you login.

It seems to me like there may be a path forward the respects the private of users while also adding friction to the process of accessing sensitive content (let's be real, there isn't much friction today). However, I still have concerns with this:

1. Will this be an open protocol? Today, you can set up any authenticator to keep your codes. You don't have to use Google Authenticator or Microsoft Authenticator. In the case of Microsoft I know for a fact that you can use a third party authenticator even for a Microsoft account.
2. Will we have access to open source apps that do this? Any app that comes out will be audited, but making sure we have an open source option makes it so that we can fully understand what data is or is not being stored in the app, and whay information is actually sent to a website that is asking for age verification.

If the answer to any of these questions is no, I would be concerned that these digital IDs or age verification tools will be used as the central point for identifying citizen activity across the internet. Forget needing to rely on an email address, IP address, phone number, or even browser fingerprinting. You might be required essentially log into every website with your idea and there will be no mystery as to what you do, who you are, and how the government could come after you.

While a potential solution to this situation may exist, the threat to freedom is colossal and unignorable.

PS - I am a parent and I still think all of these things lol