Hacker News Reader

Comment by fabian2k | Hacker News Reader

It's even more restrictive than than, for age verification you only get back whether the person is above the age limit or not, it's a boolean response.

So I think from that view the eID works pretty well, it provides the minimal necessary information. The bigger issue with something like this is if you use them to enforce real name policies or stuff like that.

View on HN

Presumably the request contains some nonce, otherwise this is trivial to replay?

But even then, I can volunteer my ID, keep it permanently attached to a computer running a server that allows certain requests (like the boolean age check), and then provide an API / client that allows anyone anywhere to use it to pass.

No risk to me (none of my data leaks), presumably no rate limits (the card has no way to track time; at best it could store recent request timestamps but I doubt it does).

In fact even better, use stolen or lost cards. Owner will get a new one, but the old one has no way of knowing it's voided. We can build a network that is able to sign whatever info (age, gender, city, name) you want, as long as we have one ID with such info.

It would probably be enough to stop an unsophisticated eight year old from seeing porn.

If it turns out to be a real issue, we could figure out a way to implement pairwise pseudonyms, so that each ID has a pseudonym with each service that is unlinkable to other services. If you see a million requests from a pseudonym, that pseudonym probably an ID being abused and you can block it.

>But even then, I can volunteer my ID, keep it permanently attached to a computer running a server that allows certain requests (like the boolean age check), and then provide an API / client that allows anyone anywhere to use it to pass.

That’s not technical problem and it doesn’t have to be a technical solution to it. You will be committing fraud and maybe a few other crimes if underage users are involved. As soon as you will start advertising the service, you will be on law enforcement radar. Or maybe you don’t advertise it, but one of the boys using it will brag at school and get someone’s attention…

Yes and access to porn is not a technical problem. I don't see why my privacy is to be compromised because of incompetent parents.

You are not entitled to unrestricted access to any online services on condition of anonymity neither it is even possible in real world. 1) There’s always someone who knows and whom you implicitly trust. 2) trusting some random ISP or VPN provider but not IdP or specialized verification proxy is rather irrational.

You need a PIN.

That still results in the government knowing you connected to that website though.

Edit: unless there’s a blind middleman that has tight data policies?

I think it does not know. The app is open source and it just sends the Boolean. The government just gives out the id cards - they are not involved in the verification process

I know the whitelabel EU app is open source but are the derivatives going to be? As far as I understand it, every EU country will release its own version of the app.

I am talking about the German AusweisApp:

https://github.com/Governikus/AusweisApp

And it's actually a good thing and not bad. EU version explicitly requests Google or Apple attestation, which at least on Android is astonishing overreach, since theres Hardware Attestation API that can confirm the platform integrity better (instead of confirming old, unpatched handsets with leaked keys are secure, LOL).

Hopefully some countries will do it the correct way.

Not really (as far as the website and the government doesn't collaborate and share information with each other).

AFAIK the EU age verification app works by requesting bunch of digitally signed "proof of age" tokens (openid verifiable credentials) from a government institution and sends (uses up) one when you want to prove your age to a website. The website can check the validity of these tokens without connecting to the government institution.

They are even trying to do some form of blind signature or zero-knowledge proof to have better protections.

https://ageverification.dev/av-doc-technical-specification/d...

Age verification laws are easy to circumvent and they are bad for many other reason though.

...Unless the government is specifically looking out for this, that's easy to game by just submitting a bunch of requests for age validation with incrementing ages.

Is that worth it? No idea—but I'm willing to bet some surveillance advertisers think it's worth it.

I haven't read the spec so I'm not sure if you can request that or only 18+.

However doing dozens of requests requires the user's approval each time which may raise red flags and I can imagine your certificate revoked.

Reply on news.ycombinator.com