Comment by rswail

4 hours ago

Governments already have everyone's ID, including DOB. They say that the problem is non-adults accessing adult sites and services. So therefore, the sites need to know that users are over 18 (or the selected government age).

There should be a standardized government ID service/API that allows a person to let it disclose their age (or other user selected information) to a requesting site/service. That's all that is needed if the government ID service has appropriate 2FA and security.

Both the request and the response can be appropriately anonymized so that the government doesn't know the site, and the site doesn't know the person's identity.

Why isn't this a thing yet? As far as I know, no one has proposed it.

13 comments

rswail

Reply
mr_mitm  4 hours ago

The german gov id supports that. They have a PKI and the id is a smart card with a cert and private key on it [0]. It lets you answer the question "are you over 18" with a zero knowledge proof. I guess it only proves you have in your possession a valid id AND know the PIN to it, but that should be fine. France apparently has this, too, according to the article.

[0] https://www.personalausweisportal.de/Webs/PA/EN/government/t..., https://www.bsi.bund.de/EN/Themen/Oeffentliche-Verwaltung/El...

pimterry  4 hours ago

This has been widely discussed, and initial implementations exist: the EU digital wallets are doing exactly this. https://ec.europa.eu/digital-building-blocks/sites/spaces/EU....

In theory, every EU state will have to support this soon so users can use it to verify age privately online. Still work to do to roll this out for real, but the technological part is very much already happening and I think the rollout plan is committed.

codedokode  3 hours ago

No. You seem to not understand how government works. It will never be anonymized so it's an awful idea, you basically suggest to link accounts to a passport.

qnpnpmqppnp  2 hours ago

> Both the request and the response can be appropriately anonymized so that the government doesn't know the site, and the site doesn't know the person's identity.

Yes that's how it's done in France for instance, and generally how it's being discussed in the EU.

mcv  4 hours ago

Exactly. Governments that really care about age verification should provide the tools to do so. They have the means to do so without violating privacy. Something like the Dutch DigiD service (the one they're about to sell to the US despite literally everybody opposing that) would be a great basis for this; just add an age verification service to it. They already know who you are in the most legal sense possible.

pembrook  4 hours ago

> if the government ID service has appropriate 2FA and security.

You're kidding right?

  • drysine  3 hours ago

    Why?

    In Russia we have gosuslugi.ru (state services), which nowadays requires 2FA and hasn't been compromised in any major way so far.

    Among other things they provide a way for a third party to use it as identification service and a user chooses which data about himself he wants to share. No anonymity, though, and I don't see how it can be implemented so that the verification provider doesn't know which service is requiring age verification.

    • pembrook  3 hours ago

      You seriously think Russia's state services are not compromised by intelligence?

      Also, yea, no anonymity is the problem. Why would you want your government to be able to track every single website you've ever visited -- especially considering we're talking about an autocratic regime?

      I'm astonished at the naivety on display on a community called "Hacker news."

      1 reply →