Hacker News Reader

Comment by edent | Hacker News Reader

I don't think that's quite accurate.

Most age verification services use either government providers or 3rd party providers. I show my passport (or whatever) to the third-party. They relay to the site "this user is / isn't over 18". They don't send the DoB, address, photo etc.

So the online service only receives a binary yes/no and nothing else. I don't lose any privacy there.

The third-party knows that you wanted to be verified on service xyz, but not what you do there. Depending on the service I'm using, I may or may not care that they know.

Handing over a passport / licence to get into a bar leaks more information than that.

View on HN

> I don't lose any privacy there.

By sending your gov ID(s) to a third party? You do! They will leak (or leak and then sell) your ID with your name to those who wants to buy it. With services you've ever authorized with them, and probably the list of services you visit with timestamps. As it's NOT the one-time token, I'm pretty sure it has to be renewed from time to time (12h expiration? 1h? Who knows).

This is a system designed for tracking and control.

You've just leaked your identity to the third party!

These third parties tend to be US based, as well. That always raises privacy questions due to "Safe Harbor". It was completely stupid of the government not to even provide a UK age verification service before putting this in place.

It isn't a leak if you do it intentionally.

There are lots of age-verification providers in the UK / EU. The industry had plenty of notice this was coming and reacted accordingly.

> It isn't a leak if you do it intentionally.

"Do it intentionally" is a funny way to spell "I'm forcing you to do it by law and if you don't you won't be allowed to communicate with other humans in a digital form or access digital content".

And even then it's still a leak when the provider inevitably gets hacked and all your data is out there and you have no legal recourse to get reasonable compensation for it.

Shouldn't it at least just give the user a site agnostic token they can relay themselves? Why does the verifier need the site?

Absolutely. But I assume they want to know which site has made the request so they can bill them properly.

But if you allow that, the third-party has your id and a list of ALL adult sites you visit. If that leaks it's even worse than a single site leaking your id.

So if it's really like that then what stops me charging people $5 to verify their account for them? Would I get in trouble for doing that? If so, that just proves it wasn't anonymous and people were right to get me to verify for them.

Unsurprisingly, the regulations require that providers take adequate steps to verify identities.

In the UK, that usually means being certified by https://accscheme.com/registry/ or similar. Just saying "I asked some random provider to verify" isn't going to cut it.

Incidentally, $5 is around 10x more expensive than most providers.

Where would their definition of 'verify' be documented?

In the US, the recent federal bill aimed at age verification is more of an 'honor system', where just a yes/no box would suffice. Their position seems to be that it's not the government's job to try to prove you're not lying.

Japan does the same thing when you buy beer or cigarettes, you just tap "I'm at least 20" on the screen and off you go.

It is all documented at https://www.ofcom.org.uk/online-safety/illegal-and-harmful-c...

Endless captcha loops for me :/

So it's not anonymous after all?

how long does the bar retain access to your ID?

how can you trust 3rd party providers?

I don't know if you've been to a bar recently. Lots of them stick IDs in a scanner. I handed over my passport to a hotel recently, they took it away and photocopied it.

I'd rather trust an organisation which stakes its business on being secure than handing over my ID to anyone.

I have never been 'carded' in a bar in my life. Maybe that's a US thing. Bars here are required to make sure you're old enough but if it's obvious they don't have to card anyone.

its definitely a US/CA thing.

The penalties of serving alcohol to under aged are high, potentially losing your license to sell alcohol. Regulators perform random checks with plants to verify proper protocols are followed.

Reply on news.ycombinator.com