Hacker News Reader

Comment by jmogly | Hacker News Reader

To get to the gist; you shouldn’t need to show pornhub your ID to verify your age. You should be able to verify your age with an identity provider that issues you a signed token for example.

The signed material does not contain any identifiable information about you, and sites like pornhub can verify the token with the identity provider to verify your age.

View on HN

This is an improvement because only the identity provider(s) have your ID, but now you also have a central database of all the age-verification-requiring sites that many people use, along with those peoples’ ID.

You could argue that the sites requesting access tokens won’t be cached/s but I’m practice that’s not how it’ll work. You could also have a separate request-forwarder service that sits between the age-verifier and the site-that-you-don’t-want-logged, I guess, which would make it harder to get all the required info in one place.

What stops an adult from creating these anonymous tokens and then letting others use them?

What stops an adult from buying alcohol and letting an under-18 drink it?

Nothing, which is why these laws are useless (to protect children), but very useful to monitor everyone.

What answer are you even looking for? There’s no proactive law enforcement waiting to bust down your door if you give underage kids alcohol. (Note this is true of nearly all crimes.)

But if a kid dies of alcohol poisoning or drunk driving, you can certainly get in serious legal trouble. Those two things (not wanting kids to be harmed by alcohol, and not wanting legal trouble) stop a very large number of adults from giving minors alcohol.

I am simply making the point that no verification system is going to be perfect, it's an impossible goal.

I also would personally prefer we not destroy the internet in pursuit of that goal.

What stops adults from giving children drugs and alcohol?

You put severe penalties on the crime, then you catch people doing the crime. Offer a reward fo catching people, and I'm sure a few kids will hand people in for the reward. They'll be able to prove they got a token from someone (as they'll have it), then we investigate.

Make them extremely time limited like an OTP token?

Require a token to be provided by the requester that is used to sign the response token so its limited to a single use

Tokens need to be single use or you create a new side channel already. Time limiting is also a challenge without creating a side channel, though possible with a similar mechanism to 2FA.

Will the identity provider be able to match my token with me?

How does it guarantee anonymity?

i.e. in this scenario will they know that my token was passed to PornHub?

No, they do not provide a raw token you forward to the relying party, so it cannot be looked up later. And the data they do provide is compared against a public key that guarantees it is non-unique to you.

Look up Zero Knowledge Proofs, or Kagi's Privacy Pass, if you want to see details.

Reply on news.ycombinator.com