Elon Musk being against the social media ban on under 16-year-olds is him basically reaching a good conclusion from the wrong equation, because he’s not doing it out of privacy concerns about how everyone would probably have to verify themselves to prove that they’re older than 16 years old. He’s doing it because it would not be good for his business.
I’m not sure how they could implement this without requiring ID verification on every single internet user. I guess I’m not familiar with the topic enough to say if there is another way that they could pursue, but even if there is, at the same time, I’m not too confident in the governments opting for the other options. I’m from neither Spain nor Greece, so I guess I can’t speak on this, but I’m just referring to governments as a general group. And because a lot of different countries are trying to do this at the same time, I’m also not too confident about my own country not doing this at some point, sooner or later.
But the problem is not doing it right. If the page asks only “is this cert from a person older than 16 y.o.?” with an answer that can only be yes, no or bad cert, problem solved. The page doesn’t say which user has that cert and the authority doesn’t give any personal data except “older than 16”.
Certificates that can’t be tied to a specific person can and will be shared, making them essentially worthless.
We‘ve had that in Germany about 20 years ago. Some websites asked you to verify your age by entering a part of the encoded data on the back of your ID card. It took maybe a few days until lists with valid IDs were all over the internet.
Sure, certificates are marginally more reliable because they can be revoked but at that point, websites need to update their revocation lists close to real time which isn’t practical and still can’t catch every shared cert.
Reliably verifying your identity without revealing too many personal details is an extremely hard problem that has troubled computer scientists for decades.
And as a follow up to my previous point, now that I’m at my PC and don’t have to type on my phone:
Even if we made certificates in a way that can’t be shared, for example by locking the private key inside a physical device (like a digital passport), we have solved nothing.
Your certificate would immediately become your digital fingerprint that will be stored with your account (to find duplicates) and can be tracked across websites as soon as a database gets leaked or the sites’ owners sell your data to advertisers (when would that ever happen?). While that fingerprint alone doesn’t say anything about you except your age, it makes it trivial to aggregate your activity across the whole internet. Ever bought something on a site that requires age verification? Congratulations, your certificate is now tied to an address. Shared a selfie somewhere? Your certificate has a face. Even without personal data directly in the certificate, it would be a privacy nightmare and exactly what the EU GDPR tried (and failed) to prevent.
The next step would be to find a mechanism that creates single use certificates every time you need one. But you can’t do that locally, because the certificates still need to be signed (and revocable) by a trusted authority. So maybe you need to send a certificate signing request to a government server every time you sign up for something. That could work for some use cases but requires expensive infrastructure that is never allowed to fail even for a few minutes or it would cause chaos.
… and now I’ve noticed your exact wording, implying that sites would forward the users’ certificates to the authority to be verified. That’s a big no-no. A site may never ever acknowledge to an authority that it has seen a specific certificate. The authority necessarily knows who the owner of that certificate is and even if they don’t tell the website, the authority itself can keep track of every citizen. “On date X, PornHub asked us to verify the age for certificate ABCDEF which we know belongs to John Doe from Somesmalltown” is not something I would want to be stored on a government server.
And this is all still assuming that the infrastructure for this would be implemented according to modern standards without security-critical shortcuts. If you have any hope that will ever happen, I recommend you click through https://media.ccc.de/ and watch some talks about government IT fails. Many are available in English.
Elon Musk being against the social media ban on under 16-year-olds is him basically reaching a good conclusion from the wrong equation, because he’s not doing it out of privacy concerns about how everyone would probably have to verify themselves to prove that they’re older than 16 years old. He’s doing it because it would not be good for his business.
I’m not sure how they could implement this without requiring ID verification on every single internet user. I guess I’m not familiar with the topic enough to say if there is another way that they could pursue, but even if there is, at the same time, I’m not too confident in the governments opting for the other options. I’m from neither Spain nor Greece, so I guess I can’t speak on this, but I’m just referring to governments as a general group. And because a lot of different countries are trying to do this at the same time, I’m also not too confident about my own country not doing this at some point, sooner or later.
But the problem is not doing it right. If the page asks only “is this cert from a person older than 16 y.o.?” with an answer that can only be yes, no or bad cert, problem solved. The page doesn’t say which user has that cert and the authority doesn’t give any personal data except “older than 16”.
Certificates that can’t be tied to a specific person can and will be shared, making them essentially worthless.
We‘ve had that in Germany about 20 years ago. Some websites asked you to verify your age by entering a part of the encoded data on the back of your ID card. It took maybe a few days until lists with valid IDs were all over the internet.
Sure, certificates are marginally more reliable because they can be revoked but at that point, websites need to update their revocation lists close to real time which isn’t practical and still can’t catch every shared cert.
Reliably verifying your identity without revealing too many personal details is an extremely hard problem that has troubled computer scientists for decades.
And as a follow up to my previous point, now that I’m at my PC and don’t have to type on my phone:
Even if we made certificates in a way that can’t be shared, for example by locking the private key inside a physical device (like a digital passport), we have solved nothing.
Your certificate would immediately become your digital fingerprint that will be stored with your account (to find duplicates) and can be tracked across websites as soon as a database gets leaked or the sites’ owners sell your data to advertisers (when would that ever happen?). While that fingerprint alone doesn’t say anything about you except your age, it makes it trivial to aggregate your activity across the whole internet. Ever bought something on a site that requires age verification? Congratulations, your certificate is now tied to an address. Shared a selfie somewhere? Your certificate has a face. Even without personal data directly in the certificate, it would be a privacy nightmare and exactly what the EU GDPR tried (and failed) to prevent.
The next step would be to find a mechanism that creates single use certificates every time you need one. But you can’t do that locally, because the certificates still need to be signed (and revocable) by a trusted authority. So maybe you need to send a certificate signing request to a government server every time you sign up for something. That could work for some use cases but requires expensive infrastructure that is never allowed to fail even for a few minutes or it would cause chaos.
… and now I’ve noticed your exact wording, implying that sites would forward the users’ certificates to the authority to be verified. That’s a big no-no. A site may never ever acknowledge to an authority that it has seen a specific certificate. The authority necessarily knows who the owner of that certificate is and even if they don’t tell the website, the authority itself can keep track of every citizen. “On date X, PornHub asked us to verify the age for certificate ABCDEF which we know belongs to John Doe from Somesmalltown” is not something I would want to be stored on a government server.
And this is all still assuming that the infrastructure for this would be implemented according to modern standards without security-critical shortcuts. If you have any hope that will ever happen, I recommend you click through https://media.ccc.de/ and watch some talks about government IT fails. Many are available in English.
Cl@ve gives you a one-use code of 3 letters that you have to validate on your phone and tells you who asks for validation.
About the part of sending the certificate, how do you say they should check the age? By smoke signs?