Lately there has been a lot of controversy about age verification and it’s implementation in places such as UK and US.
The main critic to this mechanism is due being done through facial recognition or a government ID which are privacy invasive.
So here is my question as someone who comes from IT, wouldn’t it be possible to create a device which just gives out true or false depending if the person is of age, given some kind of piece of DNA (hair, blood, nails) ?
I known there is carbon dating, but from what I understand is a bit of complicated process. The human body however shows it’s age visually and I would be interested to know if genetically there are some signs as well that could be somewhat used in a automatic process.
Again I come from IT, just curious about the implications and your takes on the problem.
The solution is really, stunningly simple:
Your gov issues official documents about you (driving license, passport, id cards…). They know your age.
Your gov is also a trustworthy institution since all those cited above are official documents that anyone, anywhere will accept as valid.
So here’s the solution: the gov creates a digital certificate in which the only stored data is your age, or even less: your adult state (as a boolean; if over 18 = TRUE).
The gov issues the cert on demand to any person after presenting any valid ID to prove who you are (it can be done online, with only the id verification being done in person). The cert is bound to your device, and if you change phone, you must migrate it so you can’t have it in two devices.
Since the issuer is a trusted authority, the cert can be used as a proof of age in any site needing it as the only thing they need is to read the cert and confirm the auth of the issuer.
And as the cert is only a boolean status saying if you are underage or adult, there is no privacy concerns as the one checking your age won’t know anything else about you.
There, you just solved a “huge” problem in a simple way and with no privacy concerns.
the only thing they need is to read the cert and confirm the auth of the issuer.
You just glossed over why this is a hard technical problem in the first place - They also need to check the cert isn’t revoked.
Otherwise, you can just hold onto a compromised cert, and reuse it.
Yeah that the obvious straightforward fix, but that’s not the point. They want to have some online system that really tracks your ID checks and where you’re checking it. :)
Shit. This is actually genius and really hard to simplify further. It also never will be implemented this way by my government.
I don’t know about the UK and the US. But Germany is in the middle of leaving the Fax era…30 years behind the rest of the world. I am right now waiting for a letter from my health insurance provider so I can use their app. It’s a week overdue.
Yeah I was overcomplicating things when a token approach maybe even generated with a card reader or through a gov platform is way more simple.
And would not be hard to implement now that I realise there are many solutions like that such as JWT, SSL, GPG, OTP, etc …
I like the idea :) It’s similar on how SSL certificates work !
That’s because it’s exactly the same thing.
Yeah, my idea comes from them. We are trying to find a “new” solution to a problem when there has been one ready for years and we only need to adapt it to this system.
As long as the key to create new certs is kept safe (and given that the auth is the govern itself, I’d say they will be kept safe), you don’t need to worry about false certs. And even if the key got stolen somehow, all you need to do is change it and deprecate the old one so new certs using the old key won’t be valid.
Not sure if you know this but in a lot of EU countries people have identity cards that are already smart cards and are used to digitally sign documents (with full legal validity) and login into public services.
Adding an extra certificate for the age verification would be very easy. They already have all the certification infrastructure in place and are used to it. However… like I said before it looks they really want to control where you validate your identity so they won’t do it in this way.
There’s also another thing to consider: a US citizen would never agree to have a unique digitally signed ID issued by the local state with an intermediate certificate issued and controlled by the federal govt. Note that if they implement the same model the EU is following both the local state and the federal govt would be able to revoke those ID (certificates) at any time.
People say that the US is turning into surveillance / china-like state but in reality the EU is way, way closer than that. Just look at what was done with the EU Digital COVID Certificate (EUDCC) recently:
The EUDCC was a digitally-signed document.[1] It was usually supplied in the form of a QR code, either contained in a PDF file, or as a printout. There are various mobile apps available to store and display the EUDCC (such as the Corona-Warn-App); alternatively, the EUDCC can be presented on paper.
Technically, the QR code contains a JSON document with the information payload. This JSON document is serialized using Concise Binary Object Representation (CBOR), and digitally signed according to CBOR Object Signing and Encryption (COSE). The resulting data is compressed with zlib and encoded into the final QR code
And yes, there were countries blocking you from going into a store to buy basic stuff without showing a valid COVID certificate. No vax or no proof of recovery = starve out. Add the inability to move between cities to that and you’re very, very close to the “democratic” China.
More here: https://github.com/ehn-dcc-development/eu-dcc-hcert-spec
Oh that makes sense an age certificate that only gov can generate. No ties to your identity whatsoever, still one could easily borrow someone else’s. Maybe it could work like JWT or OTPs, go to gov platform generate it being only valid for a couple mins and paste it in the website.
no ties to your identity whatsoever
Literally tied to your identity by the government
I was mentioning the token payload witch would be only the age or a boolean value.
the only way to borrow it is physically taking the phone, and even then, if the phone is locked, you need to unlock it. The cert by itself is bound to a device, if you give that device to someone else, that’s on you. It’s not a fault in the system but in the user.
Think of how 2fa apps work. They generally are locked under a code or biometrics, if someone else access to them, it’s because you gave them access, so it’s your responsibility.
Yeah . . . Now being devil’s advocate faceID would prevent that.
But still if instead of bounding a cert to a device we went to a gov platform for a limited time token/OTP it would work too. It could be shared too but so could u ask ur brother to show up in the facescan before entering a website.
Yes, but then, to generate the code, the gov has to know who’s asking for it. If the cert is locally stored in your phone, nobody can know who’s asking for it.
At least here in Portugal we have a eletronic ID platform that provides some services that could be one of them.
What I was saying was going to that platform or app ( they have a app I think too ) grab a token generated for that website specifically and paste it.
Than the website would receive the token and given a key received by the gov to operate in the contry gets the playload and checks if the person is of age.
Just geoblock those areas, and put up a page that tells which representatives did this, and maybe point to a petition.
Of course this is bad for privacy. But the fundamental idea of trying to age lock information is also flawed. The government, or corporations, should not be able to decide who can and can’t see certain information, especially not because of an arbitrary characteristic such as age, which does not correlate to maturity at all. This is dystopic.
I don’t think these systems should be implemented, the internet should be a free place and that’s it. Before anyone says “what about the kids oh my god” - this has nothing to do with kids, but the politicians like to use the kids as an excuse to do anything because if you add “kids” and “pornography” or even better “online abuse” and “kidnap” into the same phrase then they can shame you and shut down any argument against whatever they want to implement.
This age verification BS is just a first step into full identity verification online and also the govt knowing exactly you’re doing online, when and where. They also want to be able to instantly remove your ability to login into anything (or everything) they would like.
People say that the US is turning into surveillance / china-like state but in reality the EU is way, way closer than that. Just look at what was done with the EU Digital COVID Certificate (EUDCC) recently:
The EUDCC was a digitally-signed document. It was usually supplied in the form of a QR code, either contained in a PDF file, or as a printout. There are various mobile apps available to store and display the EUDCC (such as the Corona-Warn-App); alternatively, the EUDCC can be presented on paper.
Technically, the QR code contains a JSON document with the information payload. This JSON document is serialized using Concise Binary Object Representation (CBOR), and digitally signed according to CBOR Object Signing and Encryption (COSE). The resulting data is compressed with zlib and encoded into the final QR code
And yes, there were countries blocking you from going into a store to buy basic stuff without showing a valid COVID certificate. No vax or no proof of recovery = starve out. Add the inability to move between cities to that and you’re very, very close to the “democratic” China.
More here: https://github.com/ehn-dcc-development/eu-dcc-hcert-spec
There’s a difference though between counteracting the spread of a disease and looking at porn…
A few users (or maybe the same user and I just didn’t notice) have laid out a pretty good way of doing age verification via tokens so the site needing verification gets a token that just says you’re cool to enter the site, and you would get the token via the government who already has your ID and personal info anyway. The government doesn’t know what the token will be used for, and the things taking the token won’t know who you are.
Seems reasonable enough for me. However, I personally feel like the government shouldn’t be sticking their fucking noses in what is morally acceptable. If a horny 13 year old wants to see some titties online, why the fuck not? They’ll only end up weird about sexual stuff because you try to keep everything from them instead of teaching them anything.
Fwiw - The margin of error for carbon dating is probably not precise enough for age verification.
Try to think of how a bad actor might use what you are suggesting to steal someone’s identity. The trouble with any identity verification system is not just how inconvenient it is, but also how criminals will try to abuse the system.
Some kind of entity would have to be in charge of storing and verifying the DNA data. Once that database is created, there will always be the potential for exploitation. Also consider what happens if, or more likely when, that entity changes hands and is run by new people with new agendas? That might not work out so well for the people in that database.
The government has my fingerprints and my drivers license photo. I am not interested in sharing that with any for-profit company. I would be even more resistant to anyone wanting to collect my DNA regardless of the reason.
What I was implying was something local that somehow determined the age of someone, of course such device would have to sign that info with a gov key to limit explotation.
But still everything local, but having to sign the info to make it credible I think like someone suggested a gov issued temp token would be a better solution.
Or…they don’t fucking do any of it. It’s not their place to police people.
Germany has a government ID that can provide a yes/no answer without revealing anything else about owner
As with all other scientific things someone knows more than me, but I will give my opinion.
The last step is the greatest weakness. The result has to somehow be sent to the website and verified. If you have physical access to the device doing the verification then it will eventually be spoofed. A man in the middle attack would be easy enough given that the device absolutely has to go via a network the user controls.
Beyond the transmission issues, biologically there are not any markers that are a clear and simple age measure. Most biomarkers are more of a range with ages that correlate to some degree. You could say for example testosterone, but that goes up through puberty from a baseline in kids to an adult level, but the adult levels are really varied. Some people are higher than others and some XX people have higher testosterone levels than some XY people, and visa versa for oestrogen. So with the sex hormones out, you would want something that accumulates over time. Unfortunately that is going to vary by where a person lives and what they are exposed to. Honestly it is not at all workable.
That said, a simple solution which would make much more sense than any of this crap is to just have something on the internet account end. If the ISP can offer a check box for “Block adult sites and services” and people can opt in to that then kids will only get access to the full internet when their parents allow it or they are old enough to have their own device on their own internet plan.
If the government want to make a system to protect kids from adult stuff on the internet that is great. If they make it opt in that is all fine with me. But if they make it something you have to verify your age for, using things like state issued ID or facial inspection by an algorithm, then I think it is disastrous. It will be circumvented rapidly by people who are old enough to verify but simply do not want to. That technique will be shared with kids. Kids will be able to bypass it. This nanny state approach is not actually about protecting kids in my opinion. I think the companies involved will use the data, the face images for during verification, as training data for AI models, use the licence data for various profit driven business activities, and in the process make us all less secure. They will eventually have a leak or hack that exposes your data including what site you were on and your licence. The only question is when.
Tbh honest I am against the idea of blocking gov blocking websites.
Parents should be responsible for their kids online presence and exploration using existing tools for such control. For that though people would have to know how to use such tools and unfortunately many do not and there is a lack of programs to teach the parents how to use them.
But I agree with u I am overcomplicating things, was just letting my mind wander and now I am realising that a simple gov generated token or a key with which we could generate such token and pass it to website would be the easier and most logical way like a user pointed out.
This whole ID and face recon honestly could be replaced such system and I would be OK with it.
