pull down to refresh

The UK

Beginning last week, the United Kingdom has started requiring purveyors of online porn to check IDs—and it's already reverberating beyond adult websites. For example, Bluesky—a general-interest social media platform and not what most people would call an "adult website" by any means—will begin requiring U.K. users to prove they're adults or otherwise find direct messaging and certain content inaccessible.
In addition to Bluesky, Reddit, X, Discord, and Grinder "have now announced they will deploy age assurance" schemes, Ofcom says.
Per Ofcom's rules, there are various ways that age checks can be done, including checking users' government issued IDs, employing some sort of online ID verification service, or utilizing bank, credit card, or phone information.

It Will Happen Here

If you're in the U.S. and thinking, "What does this have to do with me?" Well, consider the U.K. a glimpse into our inevitable surveillance-mad future. At least 20 states 1 have already passed rules requiring age verification for adult content. And I think we can expect most, if not all, states to follow suit now that the Supreme Court has given it the OK 2.
But sex work is always the canary in the coal mine for free speech and privacy, and age-check requirements aren't stopping with online porn. Already, some states are passing laws that necessitate social media platforms checking IDs or otherwise verifying user ages. A federal appeals court recently 3 gave the green light to Mississippi 4 to start enforcing a social media age verification law.

A Global Attack on Anonymity and Privacy

"Around the world, a new wave of child protection laws are forcing a profound shift that could normalize rigorous age checks broadly across the web," note Matt Burgess and Lily Hay Newman at Wired 5. They point out that "Meanwhile, courts in France ruled last week that porn sites can check users' ages. Ireland implemented age checking laws for video websites this week. The European Commission is testing an age-verification app. And in December, Australia's strict social media ban for children under 16 will take effect, introducing checks for social media and people logged in to search engines."
The age of online anonymity being possible is rapidly vanishing. In its place, we get dubious "protection" measures that can be easily gamed by motivated parties, may send people to less regulated and less responsible platforms, put adults and children alike at risk of identity theft and other security violations, and make it much easier for authorities around the world to keep tabs on their citizens.

Despite that laws like the one in TX (#1037208) technically allows for ZKP verification, we're not seeing this in practice. And in other jurisdictions like the UK and the EU there is much less room for this, if at all.
Can we deploy ZKP today at the scale needed to prevent the massive identity leaks of the years to come? If not yet, what's the bottleneck?

Footnotes

  1. In April, 2025
150 sats \ 7 replies \ @Scoresby 10h
The age-verified internet is a kyc'd internet.
Just as mixers are now considered criminal enterprises only used by evil people, vpns will be considered "identity launderers" and the people who use them will be criminals.
reply
Welp. Guess I'm going to be non-compliant with 2/2 then.
reply
100 sats \ 5 replies \ @Scoresby 9h
Maybe it will actually lead to a much stronger offshore VPN industry like banking. Or something like flag of convenience identities.
reply
The most comprehensive review of Google's longfellow-zk implementation I mentioned on your thread earlier this month would be https://news.dyne.org/longfellow-zero-knowledge-google-zk/ 1
It basically allows you to zero-knowledge prove your age if you are in posession of a digital ID in MDOC format, signed by an authority - like your state government.
I think the main issue here is that all these states that are pushing this, including the European ones, do not yet have the tech deployed to make the ID-side real, not even the standardized digital ID without the ZKP, but are restricting these sites early to score points. (i.e. make the current thing real to get re-elected.)
It's an extreme disservice to the public, but the public won't know until they find out about all the defaulted mortgages in their name and then they gotta pay up.
s Is the hardworking individual too big to fail too? /s

Footnotes

  1. The author is a fellow cypherpunk frequently seen at freedomtech / privacy conferences and the current lead of the W3C Security IG
reply
100 sats \ 3 replies \ @Scoresby 9h
Do you think states like those in the US or in EU are capable of implementing digital ID systems without massive failures (leaks, rampant identity theft, abuses by people who gain access to databases, etc)?
reply
As someone that has actually designed and provisioned massive secure cryptographic systems irl that you're likely to have used many times in your life... Sure!
They just need good help but their RFP process is going to make them get cheap help and that's why they always fuck up.
200 sats \ 3 replies \ @ek 8h
Connected to a Mullvad server in London and visited a nsfw subreddit:
Just entering a fake birthday is not enough, it actually requires verification:
I also can't change my fake birthday anymore ¯\_(ツ)_/¯
reply
Estimate age from selfie
I guess there's a deepfake challenge right there :-)
PS: all my mullvad VPN endpoints get blocked by Reddit normally.. do they stop doing that now? Would be cool :-)
reply
100 sats \ 1 reply \ @ek 7h
I was logged in
reply
Oh! Yeah... I don't do that.
reply
131 sats \ 0 replies \ @ek 7h
lol, apparently you can just submit a fake ID of your MP via use-their-id.com:
Hi HN - I made a site that takes a UK postcode, grabs the local MP's information and generates an AI mockup of what their ID might look like.
It's a small, silly protest at the stupidity of the Online Safety Act that just came into force. The IDs actually work (for Reddit, Discord etc.) which highlights how terrible this implementation is.
reply
The same techniques for surveillance that China has in place, are coming disguised as good intentions to the West.
UK is already a basket case of surveillance against the people.
America must oppose this wholeheartedly, fortunately I do not see it moving forward, but it must be consistently opposed in every nation or the surveillance state and Internet KYC becomes law.
reply
Omg I hate this not that anyone would want to steal my identity but that sounds sketchy af
reply
ZKP solutions have been pitched endlessly to politicians. It falls on deaf ears because this was never about "protecting children", but silencing citizen dissent.
reply