Remix.run Logo
jsheard 9 hours ago

They already support ID checks as an alternative to face scanning, if the latter proves to be untenable then it's literally a case of flipping a switch to mandate ID instead.

Gigachad 8 hours ago | parent | next [-]

The long term solution would have to be some kind of integration with a government platform where the platform doesn’t see your ID and the government doesn’t see what you are signing up for.

I don’t this will happen in the US but I can see it in more privacy responding countries.

Apple and Google may also add some kind of “child flag” parents can enable which tells websites and apps this user is a child and all age checks should immediately fail.

xp84 5 hours ago | parent | next [-]

I do like the idea of the “this is a child” taint (ok, terrible name but I really think it should be a near-unremovable thing on a platform like Apple’s that’s so locked down/crypto signed etc).

Like, you’d enroll it by adding a DOB and the computer/phone/etc would just intentionally fail all compatible age checks until that date is 18 years in the past. To remove it (e.g. reuse a device for a non-child), an adult would need to show ID in person at Apple.

Government IDs could be used to do completely privacy preserving, basically OpenID Connect but with no identifying property, just an “isEighteenOrMore” property. However, i agree it’ll never happen in the US because “regular” people still don’t know how identity providers can attest without identifying, and thus would never agree to use their government ID to sign into a pornsite. And on top of all that yeah nobody trusts the government, basically in either party, so they’d be convinced the government was secretly keeping a record of which porn sites they use. Which to be fair is not entirely unlikely. Heck, they’d probably even do it by incompetence via logs or something and then have people get blackmailed!

RupertSalt 5 hours ago | parent [-]

When I played an MMOG, if the admins found out that a child was underage, it was customary for them to suspend their account until their 13th birthday. I thought this was a clever policy, but I just can't understand the reverse of authenticating someone's age based on that of their account...

rkagerer 4 hours ago | parent [-]

This assumes people are putting in their real birthdays, which IMO is a terrible practice to encourage.

I never put in my real birthday. It's just one more datapoint to leak in an inevitable hack and help scammers exploit me.

Just because a website sticks a field on a form, doesn't mean you need to fill it out.

I can think of maybe 1 website I use that has a legitimate use to know this info about me... and a dozen that use my fictious birthday for no other purpose than an excuse to market at me under the shallow guise of a 'Happy Birthday' email.

rmunn 3 hours ago | parent | next [-]

There are many websites that believe I was born on January 1st, in a year close to my actual birth year.

When it's actually required by some law or regulation (e.g. financial stuff) I give my actual birthday. But when some site is just wanting to comply with age verification? Yep, I'm over 30, so you don't need to see my identification. (Jedi hand wave).

RupertSalt an hour ago | parent [-]

Well, they would have the legal right to force-choke your account, or chain your partner to a golden bikini, when they discover that you weren't abiding by the Terms and Conditions which you agreed to. Seems fair.

RupertSalt 4 hours ago | parent | prev [-]

They were not, actually.

IIRC, it went like this: the account creation screen prompted them for a birthdate. They entered a fictitious one and pretended to be over 13. (I saw my niece do this in front of me, and I just sighed a very heavy sigh. She was way more interested in Club Penguin.)

Then later, they let the cat out of the bag. They tell their friends "lol I'm only 10! Today's my birthday, so give me a hat!" or something. And so if they claimed they're 10 they got 3 years suspension.

I think there was never any verification done, and no verification was possible: think about it, under COPPA, a service in the USA cannot collect PII from children under 13, so what do you do when a kid gives you two contradicting datapoints? Err on the side of caution.

I gave Yahoo! a false birthdate when I signed up. I was 27, but I also just felt they weren't entitled to knowing it. However, I soon found that maintaining a fraudulent identity is tiresome and error-prone. And Yahoo! wouldn't let me simply change my birthdate as often as I wanted to.

I once had a conversation with a friend about cheating on IRS taxes. She said "can you lie to a piece of paper?" like fudging numbers wasn't like lying to an auditor's face. It was a rhetorical question, of course.

Aurornis 7 hours ago | parent | prev | next [-]

> where the platform doesn’t see your ID

ID checks aren't very worthwhile if anyone can use any ID with no consequences.

How long would it take for someone's 18 year old brother to realize they can charge everyone $10 to "verify" everyone's accounts with their ID, because it doesn't matter whose ID is used?

BobaFloutist 6 hours ago | parent | next [-]

Ok, at which point an adult has taken responsibility for giving them access.

The older brother could also rent an R (or x) rated movie, buy cigarettes, lighters, dry ice, and give them to the kids. The point of the age check is to prevent kids from getting access without an adult in the loop, not to prevent an adult from providing kids access

Y-bar 17 minutes ago | parent [-]

This is a good point. We could extend it to computing devices: An adult gives a child access to a device, and now the adult is in the loop and takes responsibility. If said adult (parent, most often) want to automatically restrict certain activities/content on the device they can use the parental controls available. No panopticon required.

Gigachad 6 hours ago | parent | prev [-]

The system doesn’t have to be bulletproof. It just has to be better than the free for all it is today.

notpushkin 5 hours ago | parent | next [-]

Better?..

Dylan16807 4 hours ago | parent [-]

Yes, there are good use cases for an anonymous age gate. So making one would be better than today's situation.

5 hours ago | parent | prev [-]
[deleted]
shevy-java 3 hours ago | parent | prev | next [-]

I see this currently being pushed by some politicians in the EU. And I have a slight suspicion that some of these politicians are literally lobbyists.

The "oh my god, think of the children" is similar to "oh my god, think of the terrorists". I am not saying all of this is propaganda 1:1 or a lie, but a lot of it is and it is used as a rhetoric tool of influence by many politicians. Both seems to connect to many people who do not really think about who influences them.

Barrin92 7 hours ago | parent | prev [-]

this is already how the EU infrastructure for digital ID works, basically. Using public/private keys on your national id, the government functions as a root authority that you (and other trusted verifiers downstream) can identify you with and commercial platforms only get a yes/no when you want to identify yourself but have no access to any data.

South Korea also has had various versions of this even going back to ~2004 I think.

Semaphor 2 hours ago | parent [-]

Do all EU countries have that? I know our (German) ID works that way, using the FOSS AusweisApp, but I hadn’t heard of it being EU-wide (it should be, though).

fcatalan an hour ago | parent [-]

Spanish ID cards have had an X. 509 cert inside them for more than 10 years, I use it all the time to sign documents and access government sites. There is already legislation and a push for an EU-wide digital identity wallet that should be up and running this year, look up eidas 2.0 and the EUDI wallet.

That looks like it should make things like privacy compatible age verification "trivial".

Semaphor 27 minutes ago | parent [-]

Thanks, that looks very cool, and apparently close to coming into effect.

arcologies1985 8 hours ago | parent | prev | next [-]

They can't feasibly do this in the US since many people don't have drivers licenses or passports.

jsheard 8 hours ago | parent | next [-]

Don't you have to be over 18 to get a credit card in the US? How many wouldn't be able to present a CC or ID?

Aurornis 7 hours ago | parent | next [-]

Age verification requires a document that can be matched to your ID, such as by the photo on your ID card.

Credit cards don't have photos.

> How many Americans wouldn't be able to present a CC or ID?

The number of Americans who don't have a government issued photo ID is estimated around 1%. The number gets larger if you start going by technicalities like having an expired ID that hasn't been renewed yet.

The intersection between the 1% of 18+ Americans who don't have an ID and those who want to fully verify their Discord accounts is probably a very small number.

Gigachad 8 hours ago | parent | prev | next [-]

At least in Australia you absolutely can have a debit card under 18 and it’s extremely common for adults to not have a credit card.

jsheard 8 hours ago | parent [-]

> At least in Australia you absolutely can have a debit card under 18

Same in the UK, but Steam uses credit cards for age verification there and refuses if you provide a debit card instead. Evidently the payment backends can tell credit and debit apart.

monocasa 2 hours ago | parent [-]

> Evidently the payment backends can tell credit and debit apart.

Yeah those are parallel systems for reasons that amount to technical debt.

Denatonium 8 hours ago | parent | prev [-]

Only to have your own card. You can be an authorized user on a credit card even if you're under 18.

jsheard 8 hours ago | parent [-]

Ah right. That's no use for verification then, unless there's a way for payment gateways to distinguish the primary user from their authorized users.

carcabob 8 hours ago | parent | prev | next [-]

Those without driver's licenses or passports can get a state ID card instead, if I'm not mistaken. A pain, but an option.

edm0nd 8 hours ago | parent | prev | next [-]

wat. the majority of Americans have a DL, ID, or Passport. What a silly thing to say.

For DL alone:

>Data indicates that approximately 84% to 91% of all Americans hold a driver's license, with roughly 237.7 million licensed drivers in the U.S. as of 2023.

Add in an ID and Passport and we are likely closer to 99%

SoftTalker 4 hours ago | parent [-]

Yep. You basically cannot function in legal society without an ID. If you are an adult and don't have ID you are intentionally trying to live a cloaked life and it won't be very easy.

buzzerbetrayed 8 hours ago | parent | prev [-]

Yeah that’s not true. It’s a lie. And we all know why it’s a lie. Adults in the US with ID is 99%

bikezen 8 hours ago | parent | next [-]

*Citation needed

> Nearly 21 million voting-age U.S. citizens do not have a current (non-expired) driver’s license. Just under 9%, or 20.76 million people, who are U.S. citizens aged 18 or older do not have a non-expired driver’s license. Another 12% (28.6 million) have a non- expired license, but it does not have both their current address and current name. For these individuals, a mismatched address is the largest issue. Ninety-six percent of those with some discrepancy have a license that does not have their current address, 1.5% have their current address but not their current name, and just over 2% do not have their current address or current name on their license. Additionally, just over 1% of adult U.S. citizens do not have any form of government-issued photo identification, which amounts to nearly 2.6 million people.

From https://cdce.umd.edu/sites/cdce.umd.edu/files/pubs/Voter%20I...

Aurornis 7 hours ago | parent | next [-]

That seems like a good citation, but it supports the 99% number above

> Additionally, just over 1% of adult U.S. citizens do not have any form of government-issued photo identification, which amounts to nearly 2.6 million people.

The rest of the statistic is about driver's licenses specifically, including technicalities like expiration dates and address changes. The online ID check for age verification don't care about the address part anyway, in my experience.

If someone has an expired drivers' license or they changed their name and haven't updated their IDs, they have bigger problems than age-verifying their Discord accounts.

Brybry 6 hours ago | parent [-]

My driver's license was expired for 8 years until last year. I wasn't driving so the pressure to renew it was very low.

I actually only renewed it to get medical care and because renewing the license was only a little more expensive than getting an ID-only card.

It did prevent me from using some porn sites because my state requires ID verification but many sites just ignore the requirement so I just didn't use the sites that required ID.

gjs278 8 hours ago | parent | prev [-]

[dead]

jtmarl1n 8 hours ago | parent | prev [-]

Somehow they don’t have trouble getting an ID when they want to buy alcohol

novemp 3 hours ago | parent [-]

A lot of people don't drink alcohol.

monocasa 2 hours ago | parent [-]

Also, in a lot of states you don't get IDed for alcohol after about age 35.

alright2565 8 hours ago | parent | prev | next [-]

ID is much easier to forge, it's just a flat 2-d shape. None of the physical security features come through in images.

TheDong 6 hours ago | parent | next [-]

In functioning states, the ID contains a chip with a private key that can be used to sign a message, and ID verification would not be an image of the ID card, but rather holding your phone's NFC reader to the card and signing a message from the site.

In Japan, there are already multiple apps which use something like this to verify user's age via the "my number card" + the smartphone's NFC reader.

It's more or less impossible to forge without stealing the government's private keys, or infiltrating the government and issuing a fraudulent card.

Of course, the US isn't a functioning state, the people don't trust it with their identity and security and would rather simply give all their information to private companies instead.

notpushkin 5 hours ago | parent [-]

> In Japan, there are already multiple apps which use something like this to verify user's age via the "my number card" + the smartphone's NFC reader.

Does this also leak your identity to the app?

charcircuit 5 hours ago | parent [-]

There is not a way to share just your date of birth. After providing your PIN it can read more than just your date of birth.

klausa 2 hours ago | parent [-]

That's... partially true.

If you use the _digital_ MyNa card (e.g. the one in the Wallet.app; not the plastic one); the iOS SDK lets you only request the "is user more than XX years old" flag; without getting the actual identity: https://developer.apple.com/documentation/passkit/requesting...

Now, AFAICT nobody actually does this, but the technical ability is there.

junon 8 hours ago | parent | prev [-]

When I had to prove my passport for my bank over a video call they told me to rotate it around in the sunlight to show that it had the holo-whatever ink. So I wouldn't put it past them.

digiown 8 hours ago | parent [-]

A call requires a human, which is inherently not scalable. And even humans have trouble distinguishing AI content these days.

ziml77 7 hours ago | parent | next [-]

And it's not like Discord actually cares. They just care about appearing like they care. Something to keep the heat off of them from regulators and angry parents.

krisoft 7 hours ago | parent | prev [-]

A “video call” perhaps requires a human, but the type of test described need not be a video call. One can imagine a network trained to distinguish a fake id card from real one from a video recorded where the user is asked to move the card such that the holograph is glinting in the sunlight.

beambot 8 hours ago | parent | prev | next [-]

Personal Identity Verification (PIV) and Common Access Card (CAC) credentials used by US government & military via NFC already work on web browsers. States should just move to digital IDs stored on smartphones, with chain of trust up through the secure element...

drnick1 5 hours ago | parent | next [-]

This is extremely dangerous, and would only work with hardware/software that is nonfree (i.e., not under the user's control, or any attestation could be spoofed).

beambot 34 minutes ago | parent [-]

This is effectively PKI for personhood. The State DMV acts as the Certificate Authority (CA), signing a "leaf certificate" that is bound to the device's hardware Secure Element.

It’s less like a TLS handshake and more like OpenID for Verifiable Presentations (OID4VP). The "non-free" hardware requirement serves as Remote Attestation—it allows a verifier to cryptographically prove that the identity hasn't been cloned or spoofed by a script. The verification happens offline or via a standard web flow using the DMV’s public key to validate the data signature, ensuring the credential is authentic without requiring a phone-home to the issuer.

esseph 8 hours ago | parent | prev [-]

> Personal Identity Verification (PIV) and Common Access Card (CAC) credentials used by US government & military via NFC already work on web browsers. States should just move to digital IDs stored on smartphones, with chain of trust up through the secure element...

I think you're... missing the point of the pushback. People DO NOT WANT to be identified online, for fear for different types of persecution.

airstrike 8 hours ago | parent | prev | next [-]

And lose every user in the process

jasonfarnon 8 hours ago | parent | next [-]

Is there any data on what kind of hits to enrollment were taken by facebook, gmail etc when they added requirements like a phone #? Maybe it's buried in their sec filings. Anyway, this "cat and mouse" game is probably irrelevant. They're not looking for and don't need a perfect system. Bc 99% of the public couldn't care less about handing over their information.

drnick1 5 hours ago | parent [-]

Google does not require a phone number. They may ask for one and tell you it's for your own good, but you can skip the request.

jasonfarnon 8 hours ago | parent | prev | next [-]

Is there any data on what kind of hits to enrollment were taken by facebook, gmail etc when they added requirements like a phone #? Maybe it's buried in their sec filings.

dark-star 8 hours ago | parent | prev [-]

I think you massively overestimate how many people actually care.

My guess is that 95% or more of all Discord users do not care and simply upload their selfie or ID card and be done with it. I know I will (although they did say that they expect 80%+ to not require verification since they can somehow infer their age from other parameters)

airstrike an hour ago | parent | next [-]

Remember digg?

I've already cancelled my Nitro account. I'm quite active on a ~5k member programming server and we're giving Zulip another try. I think it's unlikely we'll stay on Discord.

Obviously anecdotal, but eventually this adds up.

bee_rider 5 hours ago | parent | prev | next [-]

Those 5% are the unusual sorts that separate Discord from Facebook.

esseph 8 hours ago | parent | prev [-]

> I know I will

Are you a minority, LGBTQ+, etc or of a "different" political persuasion that might have any reason to be distrustful of the US government? If so, you probably wouldn't just "be done with it".

Forgeties79 8 hours ago | parent | prev | next [-]

Most people under the driving age don’t have ID’s, at least in the US.

sieabahlpark 6 hours ago | parent | prev [-]

[dead]