Lately there has been a lot of controversy about age verification and it’s implementation in places such as UK and US.
The main critic to this mechanism is due being done through facial recognition or a government ID which are privacy invasive.
So here is my question as someone who comes from IT, wouldn’t it be possible to create a device which just gives out true or false depending if the person is of age, given some kind of piece of DNA (hair, blood, nails) ?
I known there is carbon dating, but from what I understand is a bit of complicated process. The human body however shows it’s age visually and I would be interested to know if genetically there are some signs as well that could be somewhat used in a automatic process.
Again I come from IT, just curious about the implications and your takes on the problem.
I don’t think these systems should be implemented, the internet should be a free place and that’s it. Before anyone says “what about the kids oh my god” - this has nothing to do with kids, but the politicians like to use the kids as an excuse to do anything because if you add “kids” and “pornography” or even better “online abuse” and “kidnap” into the same phrase then they can shame you and shut down any argument against whatever they want to implement.
This age verification BS is just a first step into full identity verification online and also the govt knowing exactly you’re doing online, when and where. They also want to be able to instantly remove your ability to login into anything (or everything) they would like.
People say that the US is turning into surveillance / china-like state but in reality the EU is way, way closer than that. Just look at what was done with the EU Digital COVID Certificate (EUDCC) recently:
The EUDCC was a digitally-signed document. It was usually supplied in the form of a QR code, either contained in a PDF file, or as a printout. There are various mobile apps available to store and display the EUDCC (such as the Corona-Warn-App); alternatively, the EUDCC can be presented on paper.
Technically, the QR code contains a JSON document with the information payload. This JSON document is serialized using Concise Binary Object Representation (CBOR), and digitally signed according to CBOR Object Signing and Encryption (COSE). The resulting data is compressed with zlib and encoded into the final QR code
And yes, there were countries blocking you from going into a store to buy basic stuff without showing a valid COVID certificate. No vax or no proof of recovery = starve out. Add the inability to move between cities to that and you’re very, very close to the “democratic” China.
More here: https://github.com/ehn-dcc-development/eu-dcc-hcert-spec
Try to think of how a bad actor might use what you are suggesting to steal someone’s identity. The trouble with any identity verification system is not just how inconvenient it is, but also how criminals will try to abuse the system.
Some kind of entity would have to be in charge of storing and verifying the DNA data. Once that database is created, there will always be the potential for exploitation. Also consider what happens if, or more likely when, that entity changes hands and is run by new people with new agendas? That might not work out so well for the people in that database.
The government has my fingerprints and my drivers license photo. I am not interested in sharing that with any for-profit company. I would be even more resistant to anyone wanting to collect my DNA regardless of the reason.
What I was implying was something local that somehow determined the age of someone, of course such device would have to sign that info with a gov key to limit explotation.
But still everything local, but having to sign the info to make it credible I think like someone suggested a gov issued temp token would be a better solution.
Just geoblock those areas, and put up a page that tells which representatives did this, and maybe point to a petition.
Germany has a government ID that can provide a yes/no answer without revealing anything else about owner
As with all other scientific things someone knows more than me, but I will give my opinion.
The last step is the greatest weakness. The result has to somehow be sent to the website and verified. If you have physical access to the device doing the verification then it will eventually be spoofed. A man in the middle attack would be easy enough given that the device absolutely has to go via a network the user controls.
Beyond the transmission issues, biologically there are not any markers that are a clear and simple age measure. Most biomarkers are more of a range with ages that correlate to some degree. You could say for example testosterone, but that goes up through puberty from a baseline in kids to an adult level, but the adult levels are really varied. Some people are higher than others and some XX people have higher testosterone levels than some XY people, and visa versa for oestrogen. So with the sex hormones out, you would want something that accumulates over time. Unfortunately that is going to vary by where a person lives and what they are exposed to. Honestly it is not at all workable.
That said, a simple solution which would make much more sense than any of this crap is to just have something on the internet account end. If the ISP can offer a check box for “Block adult sites and services” and people can opt in to that then kids will only get access to the full internet when their parents allow it or they are old enough to have their own device on their own internet plan.
If the government want to make a system to protect kids from adult stuff on the internet that is great. If they make it opt in that is all fine with me. But if they make it something you have to verify your age for, using things like state issued ID or facial inspection by an algorithm, then I think it is disastrous. It will be circumvented rapidly by people who are old enough to verify but simply do not want to. That technique will be shared with kids. Kids will be able to bypass it. This nanny state approach is not actually about protecting kids in my opinion. I think the companies involved will use the data, the face images for during verification, as training data for AI models, use the licence data for various profit driven business activities, and in the process make us all less secure. They will eventually have a leak or hack that exposes your data including what site you were on and your licence. The only question is when.
Tbh honest I am against the idea of blocking gov blocking websites.
Parents should be responsible for their kids online presence and exploration using existing tools for such control. For that though people would have to know how to use such tools and unfortunately many do not and there is a lack of programs to teach the parents how to use them.
But I agree with u I am overcomplicating things, was just letting my mind wander and now I am realising that a simple gov generated token or a key with which we could generate such token and pass it to website would be the easier and most logical way like a user pointed out.
This whole ID and face recon honestly could be replaced such system and I would be OK with it.
As someone who comes from IT, what are you talking about?
You rightfully assert that facial recognition and government ID are privacy invasive, but then you offer DNA verification as a less invasive tool? That’s much more privacy invasive.
Also, it’s impossible to determine someone’s age from some DNA with the required accuracy. The law requires that 18+ content is available to someone who just turned 18 today and not available to someone who’s 18th birthday is tomorrow. That’s impossible to do from DNA, same as it’s impossible to do from just facial recognition alone.
Carbon dating only works for dead materials since e.g. your skin or your skin is only ever roughly a month old and even blood cells only live for ~120 days. Also, again, carbon dating is not nearly accurate enough for the day-accuracy required.
The only day-accurate process that exists is verifying your identity against government ID. And here it hardly matters which kind of ID is used for that (facial ID/DNA/Fingerprint/…) since the issue at hand is the ID itself. Facial ID is by far the least privacy sensitive version of biometric DNA.
This process isn’t great, no question about that, but the alternatives are worse if hard age verification is the goal.
That’s why the whole goal is being called into question, since there’s no non-privacy-invasive option to do real age verification.
Or…they don’t fucking do any of it. It’s not their place to police people.
