We are experimenting with bootstraping a PKI certificate trust chain for facilitating trust projection and information verification online. Think of it as the ability to do things like age verification at scale via a peer-2-peer ish mechanism instead of sending your government id to a service provider.
One experiment is with PGP key holders (for now Keybase key holders) as CAs:
https://news.ycombinator.com/item?id=46576590
And also .gov email holders:
https://blog.certisfy.com/2025/12/using-gov-email-addresses-...
It's all self-service and requires no sign-up or download of anything, the app (https://certisfy.com/app) is an in-browser app and all the cryptography happens in the browser.
Have the website emit a random nonce (to guide against replay attacks / reuse) plus an information what is requested (name, DOB, address, some like the Croatian ID card even store photographs), the card prepares a response with that data, signs that using its private key (with a 2FA being possible as well by using a PIN/password) and returns it to the website.
The Croatian ID card doesn't even need a middleware because it doesn't do 2FA, you can ask it all of that by pure NFC communication. The German ID card requires a middleware ("AusweisApp", open source) for added protection though.
Here is a concrete example of how trustworthy certificates can be used online, this is my personal profile on bluesky with verification that is independent of the Blue sky service: https://bsky.app/profile/bitlooter.bsky.social
If you click on the profile image you can enter that code into https://certisfy.com/app to verify the identity of the profile. That sticker could be on any online profile to prove high quality authenticity, it could for instance be on an e-commerce site to prove that the site isn't a scam.
But the entire point of age laws is to stifle free speech and ruin privacy. Thus why every age law requires uploading an ID.
If it was just age, just require a credit charge of a $1 through an intermediary. Good for a year or whatever.
Does it? I mean sure, it's a side-effect that some (most?) politicians might find desirable, but there's also people who just want to restrict access to adult material (not taking a position on whether it's a good or bad thing here). Most parents would probably agree with the latter even if they don't with the former.
If your kid is going to get around that by clever vpn use, age gates don't help.
I think politicians and their supporters believe they do help. Of course from their perspective the only way to know for sure is to implement the restrictions (regardless of whether they succeed, at least they fulfill their campaign promises to their electors of "doing something").
Your kid's smartphone can connect to home wifi, mobile data, public wifi, and friends' home wifi - so network filtering alone won't cut it. And 'Encrypted SNI', 'DNS over HTTPS' and Cloudflare makes network filtering much harder than it was 15 years ago.
On top of that, there's loads of porn posted on Reddit, Twitter, Twitch and suchlike. So any effective block is going to have a lot of collateral damage.
Not social media sites. Sites like Reddit are everything. Some also go out of their way to hide certain information from parents.
Reddit (not to be too picky) does some weird things when a logger is in place, essentially making it impossible to know which subreddit is being accessed.
And that's really where the bad stuff lurks - it's peer to peer interactions.
That seems implausible given that most sites requiring age verification outsource it to some third party, which means they're not getting all the juicy biometrics.
> there’s also people who want to restrict access to adult material
First of all - we’ve been down this path so many times. Won’t someone think of the children is a plea to emotion not to reason. Secondly, there are many ways that people can opt in to those controls already, and for the most part _they work_. Anyone who can bypass those will be able to bypass what’s being rolled out around the world. Lastly; they’re trivially bypassable because a grown up can validate and then just hand the device back to a child.
The UK is pretty good at digital services and had a solid opportunity to make an anonymous, privacy first based age verification system. I designed one (not without flaws) in about 15 minutes, so we definitely could have had something decent. Instead our first move was to make something that basically required a liability shift, and we ended up sending face scans and passport photos to US tech giants - meanwhile the kids were just pointing their cameras at YouTube videos of adults and bypassing the filters.
> The U.K. Online Safety Act was (avowedly, as revealed in a recent High Court case) “not primarily aimed at protecting children” but at regulating “services that have a significant influence over public discourse.”
There are a lot of situations in history where in retrospect being able to evade government oversight and restrictions turned out to be a good thing. During the Holocaust a number of Jews and other targeted populations were able to escape hostile territory because they were able to get forged passports and other documents, something that strong cryptography would make impossible (even in a perfectly privacy-preserving way).
I'm not sure how old you are or when you started in tech, but in my case I started as a kid and was able to build the skills that now gave me my career thanks to unrestricted Internet access (and sure, I saw pornography a few years earlier than I should have - didn't seem to have any measurable detrimental effect on me, especially not compared to the cigarettes and alcohol).
This wouldn't have been possible if age verification was properly implemented, since a lot of the resources that might be useful for someone to learn programming/sysadmin could also be used to circumvent age verification and thus would've been blocked, and I would probably be working a minimum wage job and/or engaging in crime to sustain myself as a result. If I had to choose whatever harmful effects from pornography versus having a min-wage job, I'll take the porn side-effects any day, at least I have a roof over my head.
Estonia has a really interesting government issued public key infrastructure where users can validate their identity with their physical ID card and a USB reader (maybe it's NFC by now?) but I don't think I've heard of the above scheme used in practice, just sat through a presentation at the internet identity workshop.
To combat this, you need to have it based off of more and more personal info....which is at odds with the privacy-preservation goal.
Sadly when it comes to age assurance, Zero knowledge proofs are little better than marketing.
The system was that they hired a company to make the cards, and assume civil liability for any privacy violations. They also required to the company to hold insurance in case of a claim.
So it fell to the insurance company to sign off on the standards, and allowed investors to make money by avoiding claims.
I might be half-remembering it but that seemed like a very good system.
Attach minor accounts to the account of the parent, make the parent say yes.
Don't get me wrong - I support your proposal. But it requires massive state intervention.
In the US or elsewhere? I've known a lot of people who attended college at 16, and through friends with teenage children know even more these days. They attended (or are attending) schools in a variety of states.
But which states? I haven't been able to find anything about states barring minors from attending universities.
Did this apply to X (Twitter) at all?
expedition32•2h ago
Meanwhile the silicon valley elite admitted that they don't let their 12 year old daughter on Instagram...
munificent•2h ago
bmitc•1h ago
runako•46m ago
bmitc•38m ago
For your non-technological items in your list, I don't see how public school, rock and roll, and desegregation are or were remotely related to experiments being ran on children by society.
gretch•26m ago
pyuser583•33m ago
conductr•1h ago
I hate this law and those like it, mostly because it shouldn’t be necessary for government to overstep like this. But when I look around… maybe it is
wmf•1h ago
godelski•56m ago
The problem really comes down to complexity and trust. The truth is that there never is a problem if we operate under the assumption that all actors are honest and good natured. But the reality of the world is that this is a naive assumption. All citizens should be concerned about changing objectives from their authorities. A democracy can vote in dictators and a benevolent dictator can quickly change to a malicious one (which has happened frequently historically). We also need to be concerned with non-authority threat actors, from criminals to nation-state actors competing states (and even allies for the same aforementioned reason).
That's the problem. The realistic conditions we need to solve for are far more complex than the ones people operate under and we have a difficult time talking to one another about it. For a privacy conscious person it does not matter if the holder of the data is the most benevolent entity that could exist, it is if there is the opportunity for the data to be held by anyone else. Thus, no one should hold it. No matter how "worthy".
Even on HN there are a large number of users who think they are not the target of hackers, and especially nation-state hackers. Of all places on the internet this should be one of the most informed on the matter and best suited to understand that being "normal" is what makes them a target, to be incorporated into bot-nets or other reasons like being used for lateral movement. It is the exact same problem: the reality is far more complex. The assumption of not being a target is based on the understanding that they are not the end target but the complexity of reality is that this is not the condition for being /a/ target.
I do agree that collective action matters. But it is hard to form collective action when people do not have the motivation for action. And they don't have the motivation because they have a naive approximation of the problems at hand.
MiddleEndian•1h ago