This is not true for the proposed age verification schemes for the internet and that is a big problem. Unless this is solved, these schemes deserve every level of resistance we can muster.

You can get an anonymous, cryptographically signed, certified legal bearer token confirming your age only, or identity or whatever by a centralized service, be it government or high trust private organizations who need to verify your identity anyway like banks. With some smarts you can probably make such a token yourself so the root bearer token issuer doesn’t have the one you use to browse pornhub.

Perhaps a system like Privacy Pass would be ideal. Where a verifier generates a verified client a number of redeemable signed tokens for a session, but when presented by a client, the site doesn't know who that token was issued to, but they know they authenticated this person and can verify they made the token. Therefore they get access.

Key and verification passed to verifier

Verified list is published

Site pulls list and checks its number has been verified

Site doesn’t know who it is, and verifier doesn’t know which site was verified against

If the verified list is tied against identity, there is only a simple law change required to de-anonymize everything.

Otherwise, why wouldn’t I just try the last entries from that list?

Now sure if the identity provider and the site work together they could negate the anonymity, but given that for the identity provider anonymisation would be the key selling feature they wouldn’t want to risk that. Mullvad I’m sure would be trustworthy enough.

How can you guarantee that the credential you're getting belongs to the actual person on the other side of the screen?

ID.me for one is doing full identity verification by looking at your face and your ID card (and I assume having a human check up on it if the algorithm doesn't work). If Apple can do their fancy cloud-AI server thing with provable attestations that they aren't saving your information, someone could build a version of this which has those kind of safeguards and which passes back an emum (UNDER_18, 18_TO_20, ADULT) rather than a name or ID number to the caller.

Whether people would trust it is again, shrug. Most people barely understand how any kind of cryptography works so at the end of the day you do your best and people make their choices on whether to trust you. But the fact is that if the system actually IS designed properly, there isn't any risk of "oh no, 2029 fascism, now Supreme Commander Trump knows what porn sites I use" because that data was never saved.

Not well-designed ones. I think you overestimate how much retailers want to even possess sensitive information like that.

What's going to be stored is the fact that an of-age ID was scanned, and possibly the DOB. This is to protect honest cashiers and to have a way to punish ones who might sell to the underage. If an underage sale is reported, they check the audit log and it says the transaction had an ID scanned the cashier can be cleared of wrongdoing. Unless it's the same DOB always being scanned, which seems like some kind of dishonesty.

I do not buy that the supermarket chain wants to use your ID card data for any purpose. First of all, they don't need to, they have (most people's) loyalty cards that do a much better job as they're swiped or entered even without buying any beer. Second, again, only downsides come from saving it. If they were to sell the data and be caught, terrible. If they were to get hacked, terrible.

It's a several hundred billion dollar industry, in the US alone. Retail is definitely a source: https://market.us/report/data-broker-market/

Someone was on here a couple of years ago stating that even "line item" level data on your receipt is now being transmitted in a lot of cases, and growing.

The bottom line today—never expect a company to default to respect of your privacy. Simply too lucrative.

The store isn't tying your drivers license number and specific DOB to your purchases because you show an ID to buy beer -- that's a different kind of data and carries with it way too much potential for identity theft. Thinking that they want that is tinfoil-hat thinking. You can ask every single supermarket company if they do that and every one will tell you no. You can ask the companies which make the POS software if the scan ID functionality ties into data brokers and they'll say no. But go ahead and think that there are like 15 Fortune 500 companies all secretly doing this, even though not a single whistleblower has ever come forward. Of every engineer at those companies, I am not aware of anyone who has alleged this from a position of actual knowledge.

Pot industry needs to anonymize their customer records or stop using SaaS packaged solutions.

Now if China hacks Meadows or something, they have customer and purchase lists which may include security cleared personnel who can now be blackmailed.

If you run a pot shop, or an SaaS solution for them like Meadows, you really have to figure out how to divorce customer PII from purchases.

I am back to the black market in Oregon for this reason!

And second, underaged kids can not checkout non kid material without adult in the loop. That part is simply not true, the librarian will say no to the child or ask for parents permission.

If your goal is "prevent children from accessing adult material", it really isn't that limited.

> underaged kids can not checkout non kid material without adult in the loop

They don't need to. They can read it in the library; that's what libraries are for.

And obviously "adult material" is not referencing cookbooks for housewifes nor antic philosophy nor fantasy books meant for adults.

It does in fact means porn and such.

Or is it the pearl clutching where a novel with a same-sex kiss is smut? What about all of the graphic acts that happen in the Bible?

And yes, there was considerable pearl clutching over same sex kiss. To the point the supposed old school bastions of freedom would not print it, would not put it in the library and would do everything possible for kid not to read it.

The physical world of back then was considerably more restrictive in terms of what kids could access. Whether in the libraries or outside of them.

What is adult content? A cartoon butt? A book on breastfeeding? "I can't define porn, but I know it when I see it" has led to Calvin and Hobbs being banned.

As far as I'm aware, online sites generally don't let children wander in either. One of the reasons being they will make a mess of the cabling.

That's obviously in jest, but the point is that physical presence is the entire crux here. When entering a physical space, you do so with a physical body that society has demanded be able to be identified. And age can often be determined without even fully verifying identification, which is why our society has been so accepting of age checks.

The Internet has flourished precisely because of the foundation where one does not need to be identified. In fact one does not even need to be human, nor accessing a digital service the way the publisher intends. Separation of concerns. This has worked for what, 30 years at this point? An entire generation? If parents are still buying their kids hardcore pornography terminals these days, they've got no one to blame but themselves. And no, I do not care that "everybody else is doing it".

Ultimately, the "logistics" cannot be separated from the "morality" - it is a different type of space, and the moral thing to do is engage with it as it is, instead of demanding centralizing authoritarian changes.

These demands are from a narrow contingent of people that could straightforwardly build their own desired environment (the content blocking you've referenced as a straw man, or more accurately kid-friendly content curation), but yet have not done so. Because ultimately these types of calls are never actually about "the kids" but rather a general desire to insert themselves as morality police into everyone's business.

An age verification requirement might stop your 12-year-old from accessing a porn site headquartered or hosted in the US, but it will do nothing to keep your kid from finding porn on any of the thousands (tens of thousands? more?) of websites hosted in various other countries who don't care about this sort of thing.

These sites are (or will be, if US-based sites become inaccessible) just as easy to find, and just as hard to block with normal parental-controls style content blocking.

Requiring age verification in the US doesn't solve the problem. It just stifles free speech and turns us even more into a Christian nanny-state. The people pushing these laws don't care about children, in reality. They care about banning pornography in the US, and this is one step on that road.

> If you believe it's hard to do it without satisfying privacy concerns, totally true!

That's not the issue. The issue is that it's impossible to achieve the stated goal (making it impossible or even hard for children to access adult content), period. Whether or not the age-verification is done in a privacy-preserving manner is irrelevant.

There are two ways to "solve" this problem. One is better parental controls, but this will always be a cat-and-mouse game, and will never be perfect. The other is to accept that your kids will sometimes see things that you don't want them to see. That's how the world has always worked, and will continue to always work. Be there for them to provide context and support when they run across these things by accident and are confused or upset, and punish when they seek it out against the rules and boundaries you've set for them. You know... be a parent, and parent them.

Similarly the only expected VPN traffic in my network would be inbound to my wire guard server/router. Everything else can be banned by default.

My kids aren't old enough for computers yet, but I'm mostly of the mindset that a whitelist or curated offline cache (at least for anything on the web) is the sanest approach for younger kids. Outside of .gov, .edu, a handful of discussion forums, and stuff not relevant to them like shopping/banking, there's honestly not a lot of utility to the web. If they end up interested in programming, reference material can be kept offline, libraries downloaded through a proxy repository, etc.

He’ll realistically the US doesn’t make the cut either.

Are US organizations hosting in Canada for some reason? They probably wouldn't go further than that for latency reasons.

There's the separate problem of foreign companies having US points of presence, but assuming these laws expand, I'd imagine that would eventually lead to liability for services like cloudflare providing the endpoint/hosting on US soil.

Gigabyte.com for example makes a great deal of computer parts like graphics cards and it’s hosted at 103.130.100.144 which geolocates to Taiwan, Province of China.

bmw.com 160.46.226.165 Germany

Now some of them will route US users to US servers to lower their ping, but that’s an added expense that not everyone pays for.

Firmware updates can fix compatibility long after a purchase, it’s not just a question of whether something works on day 1 but day 540. IE why isn’t this EV charger taking to the solar inverter so it preferentially charges the car over sending energy to the grid? Firmware fix and suddenly it all works.

Because they're interested in it. I was installing Linux when I was 9 because I thought it was cool.

If my parents had walled me off into a foam internet safe-room, it would have stifled one of my lifelong interests that led to my career, and bred trust issues and resentment against my parents.

However this is just a cost vs benefit tradeoff. If looking at porn instantly killed a kid or caused significant harm then going to extremes would be worth it, but the benefit of such an approach is minimal. There’s a bunch of metrics that tracked kids as internet porn became a thing and the net impact is effectively zero on metrics like suicide, self worth, promiscuity, age of first sex, etc. Instead the correlation goes in the other direction.

Blocking social media on the other hand is much easier and backed up by a lot of research.

I used to think this was a valid point, but I read something that changed my opinion completely. Pornhub, plus other large sites, have a lot of attention on them. They're a long way from perfect but they do self police, probably far more than anyone here knows, because they don't want to get banned. If you get rid of them, you're boosting smaller and far nastier sites that don't self regulate anywhere near the same amount.

To state it simply, if you block Pornhub, curious children will still find porn, but it'll be far worse.

It's not the same as banning sale of physical items like cigarettes. It's more like if you banned cigarettes but then all the children went and got black market cigarettes that are 50% asbestos.

I don't really see much of an issue with the content of the porn if that's what you mean by nastier sites. To me it's more like if you ban cigarettes and now kids are all buying black market cigarettes without nicotine.

Mindgeek (company owning Pornhub and many other porn websites) are by no mean a company respecting sex workers as good as they should but they are putting an effort to stop nasty shit from their websites if only not to be banned.

So I would agree that Mindgeek websites are better than others. Not good enough but better.

Would you say the same about drugs?

Or we move everything not meant for the sanitised internet to TOR hidden services.

Still need a solution to age-verify without tracking though, or else people would think of it as something to be turned off immediately since Reddit and X would obviously not be on the registry since they host tremendous amounts of porn.

I don't think that's an intractable problem at all, and I think as technologists we should be putting our efforts into building the most trustworthy system for that instead of just campaigning for nothing to change because it's "the parents' problem." Easy for us to say: We're all either not parents, or we're the type who are equipped to properly filter access to the Internet for our young kids. In reality, the single mom of 3 working 12 hours a day is not equipped to "just" set up a proxy server or figure out how to install internet filtering software on the Amazon Fire tablet she got her 8-year-old to watch Spider-Man.

Separately from that, if switching DNS servers is an easy workaround to keep access to porn, kids interested in it will quickly learn how to do so, trading recipes and even downloaded content directly. Ditto with Tor etc.

The fundamental problem here is that it is an attempt to censor something for which there is huge demand among the very group that's being excluded. The only way you can do so that would actually work is full-fledged panopticon, where all communication channels are pervasively monitored.

RE Point 2. They could just use a whitelist instead of a blacklist/filter. They exist already, after all. Fill it up with sites showing the wholesome version of the world you want your child exposed to and they can only visit those places.

You would have to lock down any electronics device that can be used to bypass the restrictions. In reality the best way to do this is to build a screen based nudity filter into the device, which is not only more effective, it exposes this whole nonsense as an attempt to grow the police state.

I like this point. I feel like the tech community just figured politicians would forget about the issue. Instead of working together to develop a solution.

However we're seeing what happens next. Politicians write laws anyway forcing the tech community to do what they want.

I am just saying that in hindsight a bit of cooperation may have resulted in a less privacy invasive solution. I guess with the supreme court ruling it's too late now. The politicians have already won.

Not only that, but once you do so, you effectively concede that such censorship is valid to begin with, which can and will be used against you to pass further laws along those lines in the future. And if those laws cannot be implemented without ditching all that privacy you worked so carefully to respect in your compromise, well, too bad about that.

From a different angle: many people went into the web in disagreement with how the physical world is managed.

Those who were good at politics also tried to improve the offline rules, but not everyone can.

From that POV, opposing the application of irl biggotery into the online world isn't some illogical or whimsical move. They tried to make a better world for the likes of them, and in a way you're using the success of the platform to explain why they're not welcome anymore.

I'd be sympathetic to your logic if it was for the betterment of the online world, but IMHO it surely isn't and we're looking at bullies expanding irl power to crush other platforms as well.

1. In the offline world, the child and media provider are in the same physical location, subject to the same laws. On the internet, they're in different places. This is central, as the argument by SCOTUS seems to be that the most restrictive law anywhere applies everywhere.

2. I don't think "just" is a silly instruction. Your child can do any number of things and we expect parents to have a certain amount of oversight and/or involvement to help children navigate it. I don't see how the internet is any different from anything else.

3. There's an important difference between a child entering a store or library and finding a page on the internet. Entering a store, library, or physical home, or whatever, presupposes a certain amount of effort involved in entering the premises, and that the owner of the store or whatever is present and can in fact monitor each visitor easily; on the internet it's a matter of linking from one text to another. Sometimes I don't think you can draw analogies easily, and this is one of those cases. To me it's less like requiring an ID for purchase of a media item within a store, and more like having ID requirements to view something in a public square, or having ID requirements to publish the media item in the first place. It's a bit like SCOTUS saying "if you publish a book in state X where it's legal, but state Y requires a publisher to be responsible for monitoring every purchaser of their book everywhere, then you have to comply with state Y."

For what it's worth, I think its absurd to have legal age requirements for speech, offline or online.

That's also an argument against an id verification mechanism then, the list of sites to block who don't implement one will be infinite.