Hacker News

When you place all the requirements on a software product like what the government has to, then it’s going to be expensive. Anyone who thinks that the total cost of a privacy protecting, government accredited, widely available, reliable, audited, and domestically produced age verification system isn’t going to be in the hundreds of millions has never actually shipped something comparable.

It is literally illegal to slap a few lines of glue code and say “there’s your age verification, look how cheap it is.” The public would be happy about saving money right up until there’s a massive privacy breach and all the ways you cut corners are exposed.

I don’t know if leaving the standards unspecified is the right thing to do (it’s probably not), but don’t pretend like a government verified solution could ever be cheap when dealing with citizens’ identities.

Tim Berners lee thought about this solidproject.org

Problem: the millisecond this system is rolled out, personal data will be attached to it, not least because I'm just going to generate unlimited 18+ tokens and sell them for $10 apiece

Oh no, then the government will know how old I am!! (/s)

Because that's their goal. Make you scared about using things that are even legal but private/embarrassing.

My bank has an API endpoint that (basically) returns your name and age (in this use case). It can return more for signing electronic docs etc. and is basically your digital ID.

https://en.wikipedia.org/wiki/BankID

Need to buy "toys", vape products, alcohol... anything adult online?

There's a 3rd party web app (you rightfully don't trust) as an age check in the shopping cart / user account of any of these adult shops, and this has multiple ways of verifying your age - and one of them is the bank's api, you pick it, your bank's identity sharing page loads, you log in, it shows exactly what information will be shared in a bullet point list, you tap OK, immediately a request like "this app wants to know your age, please verify" pops up in your smart banking app on your phone, you tap ok, fingerprint scan, DONE.

Problem solved. The 3rd party app knows just what it needs to. All of this takes maybe a minute and your personal info is perfectly safe (unless you don't trust your bank at which point you have bigger problems to worry about...)

Yet it is still not a perfect solution. Arguably worse, for possible freedom of speech aspects, than current state.

https://www.eff.org/deeplinks/2025/04/age-verification-europ...

Yes, this is correct. As I understand it, the server asks the application some questions ("is the user above 18?" "are they a resident of country X?" or whatever), you confirm that you want to share the answer, and the application just gets "yes" or "no" to each question.

Because then you get situations like OP and that happened with Tea?

The problem is that said companies have no interest in doing more than the barest minimum to keep the details safe.

Hardware attestation would be enough to clamp down on almost anything, ensuring the hardware and the os guarantee the outcome is not manipulated.

Not the broken anti-competitive Google play store integrity (which is passing for any handset not patched for the last 8 years but with Google buttplug in it, effectively nullifying assurances from the attestation), but a proper hw attestation.

I understand, and think that there’s an acceptance criteria for some level of fraud tbh.

You're treating this as a computer security problem when it's actually a political problem. It doesn't have to work to be mandated. It doesn't even have to work, for everyone to get a pat on the back and a raise for implementing it. Keeping minors away from porn isn't the point, the point is more like to scare people about being surveilled so they voluntarily won't watch it.

Do these systems prevent linkability or allow the use of pseudonyms?

As in, if I repeatedly ask for age verification to the same service, does it know:

1) the identity of the user making the request, and 2) whether repeated requests comes from the same user (even if they don't know who it is?)

No, but I can tell you that the moment you open the browser console, it stops scanning and marks the scan as failed.

The vendor is https://www.k-id.com in Discord's case

> I miss the days of forums, and wish something like them could thrive again instead of rather private, but importantly ephemeral chats.

Open source projects have long had ephemeral chats, private to the people in the chat at that moment - it just used to be called IRC.

I've been hired and have hired people through the Discord community. It's no different than Hacker News in this respect, where I've done the same. Professionalism is orthogonal, though I will agree that ephemeral chats have serious drawbacks for project-oriented communities.

its seems even more self defeating when its a FOSS project whose only way to connect with the community is a Discord space.

Yes? I expect that "take a weekend to France to bypass age verification" and "subscribe to NordVPN to bypass age verification" are both legal while "take a weekend to France to see the Eiffel tower" and "use NordVPN to increase your security" are both legal.

Did you never wonder why VPN ads don't really list any actual use cases, yet they're wildly popular? If you know what you need it for, the ad doesn't have to tell you - just has to tell you which company to give your money to.

Yet TFA shows the character used to beat the verification is a game character based on the likeness of an actor famous for the role he pays the game character is based. So you’re saying what, that the system isn’t aware it was trained on this person, the training isn’t looking that person is known to the training, or the system just doesn’t work as advertised?

Listen to that guy!

Uploading your passport to a random company is a worse solution, and it is being rolled out now.

The California legislature is already working on forcing operating systems to attest the age of the user at the account level. See the recent gut-and-amend of AB1043 [0], which was a privacy bill [1] just a few months ago:

> This bill would require, among other things related to age verification on the internet, a covered manufacturer to provide an accessible interface at account setup that requires an account holder, as defined, to indicate the birth date, age, or both, of the user of that device for the sole purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store and to provide a developer, as defined, who has requested a signal with respect to a particular user with a digital signal via a real-time application programming interface regarding whether a user is in any of several age brackets, as prescribed. The bill would define “covered manufacturer” to mean a person who is a manufacturer of a device, an operating system for a device, or a covered application store. The bill would require a developer to request a signal with respect to a particular user from a covered manufacturer when that user requests to download an application.

> This bill would punish noncompliance with a civil penalty to be enforced by the Attorney General, as prescribed.

[0] https://legiscan.com/CA/text/AB1043/2025 [1] https://legiscan.com/CA/text/AB1043/id/3134744

If you want to know more about this lovely bait-and-switch tactic used by the Golden State's legislature, see here: https://californiaglobe.com/uncategorized/gut-and-amend-bill...

This is a first step to shutting down anonymous accounts - here in Russia for example the account must be linked at least to a phone number or to a government ID and I see no reason why other governments don't want to do the same.

The UK doesn’t have any form of identity that can be used like this. There’s a very very vocal group of people who oppose the idea to the point that it hasn’t gained traction.

The Netherlands has this system but it is ripe for abuse. We still have a few Christ clowns and there's a big fascist party at the moment.

How about we don't make lists of people visiting porn sites? How about we accept that children are part of society and not try to put them in little cages like songbirds?