Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

As an adult I can’t remember ever having to put my face into a permanent database and be tracked every time I browsed in a bookstore. So this is not a helpful analogy.


There's no reason that online age verification has to require any of that, so your attempted proof that their analogy is not helpful fails.


Of course some kind of untraceable verification could exist (e.g., a perfectly implemented zero-knowledge proof protocol), and some things might even use it. But if any online age verification in actual use results in traceable identifiable access, then my point stands.


Can you provide an example of how an age verification system wouldn’t require providing some identifying information to the government or a company when accessing content?


An example is the EU Digital Identity Wallet that the EU is in the midst of implementing. This is a system to allow you to store a copy of your ID documents on a device you own that included a secure element. Most people will use their smartphone.

The agency that issues your documents can give you a digital copy that is cryptographically bound to the secure elements in your device.

When you want to prove your age to a web site it uses a zero knowledge proof (ZKP) based protocol to prove to the site that the documents bound to your secure element show that age. Nothing but the fact that they show that age and that they are bound to your element is disclosed to the site.

The ZKP proof protocol communication is just between your device the site. The government that issued your ID is not involved, so they don't know where you have used the ID or even if you have used the ID.

BTW, this is not limited to age. It can be used with any data on your ID. For example if German political forum wanted to verify you were German before allowing you to post you could use this system to disclose to them that your ID has "Germany" in the country field and that would be all that is disclosed.

For those outside the EU, Google has released an open source library for implementing things like this [1].

[1] https://news.ycombinator.com/item?id=44457390


>There's no reason that online age verification has to require any of that

You are correct.

That said, please tell me which online age verification mechanism doesn't store such PII and/or is immune to hacks/breaches/data thefts.

Please only reference those mechanisms that are actually in use, not hypothetical or experimental mechanisms that are not used for such a purpose.

No rush. I'll wait. Although the actuaries say I'll likely only live another twenty years or so.


The EU Digital Identity Wallet is such a system and is currently undergoing testing in a pilot program. They are on track to finish testing this year and member states are expected to start deploying to the public in 2026.


To rephrase, the best example of such a system that you could come up with does not exist yet.


>To rephrase, the best example of such a system that you could come up with does not exist yet.

And is limited to just a subset (albeit one of significant size) of the folks subjected to such "age verification."




Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: