Skip to content(if available)orjump to list(if available)

Discord's face scanning age checks 'start of a bigger shift'

stego-tech

A long, long time ago (within the past ten years), I had to verify my age with a site. They didn't ask for my ID, or my facial scan, but instead asked for my credit card number. They issued a refund to the card of a few cents, and I had to tell them (within 24hr) how much the refund was for, after which point they'd issue a charge to claw it back. They made it clear that debit and gift cards would not be accepted, it must be a credit card. So I grabbed my Visa card, punched in the numbers, checked my banking app to see the +$0.24 refund, entered the value, got validated, and had another -$0.24 charge to claw it back.

Voila, I was verified as an adult, because I could prove I had a credit card.

The whole point of mandating facial recognition or ID checks isn't to make sure you're an adult, but to keep records of who is consuming those services and tie their identities back to specific profiles. Providers can swear up and down they don't retain that information, but they often use third-parties who may or may not abide by those same requests, especially if the Gov comes knocking with a secret warrant or subpoena.

Biometric validation is surveillance, plain and simple.

ndriscoll

That was, in fact, what COPA mandated in the US in 1998, and SCOTUS struck it down as too onerous in Ashcroft v. American Civil Liberties Union, kicking off the last 20 years of essentially completely unregulated Internet porn commercially available to children with nothing more than clicking an "I'm 18" button. At the time, filtering was seen as a better solution. Nowadays filtering is basically impossible thanks to TLS (with things like DoH and ECH being deployed to lock that down even further), apps that ignore user CAs and use attestation to lock out owner control, cloud CDNs, TLS fingerprinting, and extreme consolidation of social media (e.g. discord being for both minecraft discussions and furry porn).

Dylan16807

Despite TLS, filtering is easier to set up now than it was in 1998. You might have to block some apps in the short term, but if you suggest apps can avoid age verification if they stop pinning certificates then they'll jump at the option.

Consolidation is the only tricky part that's new.

lupusreal

Filtering has never been easy or practical for the general public. But the situation has become much worse.

In 1998 it was easy for a family to have no computer at all, or to put their single computer in the living room where it could be supervised. Internet use was limited because it tied up the phone line. These factors made it easy for parents to supervise their children.

Today, computers are everywhere, fit in your pocket, and its very easy to get online. Even if you don't buy any computer for your children (which is hard, because your children will tell you that they're getting bullied and socially ostracized, which probably won't even be a lie!) they will probably be given a computer by their school and any filters on that computer will inevitability be circumvented. And even if that doesn't happen, they can trade or buy one of their peers old phones and use that on free WiFi to access the internet without you knowing it. Are you going to thoroughly search their belongings every week? If you do, they'll know and find ways to hide it anyway.

And yes, I know kids used to procure and hide porno mags. What they have access to on the internet is a lot more extreme than a tattered playboy.

null

[deleted]

gjsman-1000

This has already come up before the Supreme Court, with the argument that filtering was a less invasive technique to fulfill the government’s legitimate interests back in the early 2000s.

That ship has sailed. Even the opposition admits that trying to get everyone to filter is not going to work and is functionally insignificant. The only question is whether age verification is still too onerous.

Terr_

> trying to get everyone to filter

We never needed everyone to filter, just parents busy lobbying the government to impose crap onto every possible service and website across the entire world.

Instead, they should purchase devices for their kids that have a child-lock and client-side filters. All sites have to do is add an HTTP header loosely characterizing it's content.

1. Most of the dollar costs of making it all happen will be paid by the people who actually need/use the feature.

2. No toxic Orwellian panopticon.

3. Key enforcement falls into a realm non-technical parents can actually observe and act upon: What device is little Timmy holding?

4. Every site in the world will not need a monthly update to handle Elbonia's rite of manhood on the 17th lunar year to make it permitted to see bare ankles. Instead, parents of that region/religion can download their own damn plugin.

fc417fc802

> The only question is whether age verification is still too onerous.

You've skipped right past the "does it work" question. It doesn't. Porn is available on file sharing networks in far greater quantity than it is on reputable websites.

The only realistic methods I'm aware of are whitelist filtering, sufficient supervision, or sufficient interaction and education.

null

[deleted]

uconnectlol

lets just skip straight to the logical conclusion, buddy. no amount of "web" or "discord" regulation stops porn consumption. the statistic of "minors viewing porn" wouldn't be affected even slightly, even if all of the regulation in question here were passed to the fullest extent. this is because people can just download and run whatever software they want, and communicate with any party they want. what you want is for people to not have control over their computers/communications made from them. people talk about a middle ground, but there is none, because you will always just notice that the "minors viewing porn" statistic is not affected by your latest law, until you have absolute control over civilian communications. this is completely against what anyone in the open source community let alone democracy, stand for.

ndriscoll

My complaint was exactly that with modern devices, the owner does not have absolute control over communication on the device, and that's a problem. I think anyone in the open source community or people that believe in democracy would agree that e.g. the owner of a phone or computer should absolutely have the ability to intercept, record, manipulate, and filter all communication that device is doing.

pavel_lishin

Right. My friends in middle school would trade floppies with porn on them, which older students and siblings would be happy to provide.

droopyEyelids

Do you believe the ease with which a service can be used influences the amount of people who use that service?

Like with marginal users?

bbohyeha

[dead]

stavros

Jesus, how does your society still function when underage people can see videos of people having sex?! It's one thing for minors to be having sex, but to watch others doing it? Reprehensible.

Loic

I suppose you do not have children. I am open-minded, mid 40's. The level of violence in porn you can get access to with just one click, has no comparison with what I could get access to as a kid (basically nothing).

With the net, you get access in one click to the worse and the best. It is a lot of work as a parent to educate the kids about that.

As kids, teenager and even as 20 something, if we wanted to do some experience, we had to physically access the media or be physically present. This was not on-demand over a screen.

So, I filter the access at home while also trying my best to educate. This is not easy and I can understand that non tech savvy people request more laws, even so I am personally against.

The article is pretty well balanced, we have no silver bullet here.

pdntspa

My girl discovered self-pleasure at the age of 5, ironically during an exam from her doctor (she doesn't think it was intentional). I had an ex discover masturbation around the same age. I personally discovered it around 11 or 12. All of the above discovered porn accidentally as kids. I don't know about them but after that I intentionally sought it out.

Guess what! Both of us are perfectly fine!! (Well the ex is a bit psychotic but that's unrelated...)

This obsession with protecting kids from the realities of life is just fucking stupid. We as a species have the stupidest, most ridiculous views about something that is required to keep us alive!

Sohcahtoa82

The problem is that most porn depicts sex as somewhat violent and sets unreasonable expectations of what sex is like.

Not every woman is capable of deep-throating or going straight from vaginal to anal without adding some extra lube. Most women don't want their man to put his hands around her throat during sex. Almost none of them are okay with going from ass to mouth.

Porn also sets an unrealistic standard for penis size. When the average is 5.2 inches with a standard deviation of about an inch, it becomes clear that the 7+ inch penises used in porn are like the top 5%.

I don't think parents are having these conversations with their kids about this.

Aeglaecia

it is recommended not to employ sarcasm when counterpoints are easily available

Andrex

> Jesus, how does your society still function when underage people can see videos of people having sex?!

It kind of isn't anymore. But not just because of porn, obviously.

Early porn exposure goes hand in hand with the problems we see typified in the recent Netflix movie Adolescence. Seen women constantly railed and treated like meat when that young probably does do something.

"Videos of people having sex" is deliberately misleading, modern porn is not dry educational science videos. It's clear you'd rather be snide than correct.

chatmasta

Is card verification a lesser form of surveillance? And there’s a good chance your card issuer (or your bank, one hop away from it) has your biometrics anyway.

I don’t like either of them… (And why does YouTube ask me to verify my age when I’m logged into a Google account I created in 2004?)

stego-tech

Oh, make no mistake, I hate both of these. I loathe this forced surveillance of everyone because parents can't be bothered to supervise and teach their children about the most primary of human animal functions (sex), regardless of their reasons for it.

I take great pains to keep minors out of my adult spaces, and don't have to resort to anything as invasive as biometric surveillance or card charges. This notion that the entire world should be safe for children by default, and that anything and everything adult should be vilified and locked up, is toxic as all get-out and builds shame into the human animal over something required for the perpetuation of the species.

The adult content isn't the problem, it's the relationship some folks have towards it that's the issue. That's best corrected by healthy intervention early on, not arbitrary age checks everywhere online that mainly serve as an exercise of power by the ruling class against "undesirable" elements of society.

john01dav

> take great pains to keep minors out of my adult spaces, and don't have to resort to anything as invasive as biometric surveillance or card charges.

What sort of spaces are these (online or in person), and how do you enforce this? I have an online space where such non invasive measures could be useful.

jjmarr

> This notion that the entire world should be safe for children by default, and that anything and everything adult should be vilified and locked up, is toxic as all get-out and builds shame into the human animal over something required for the perpetuation of the species.

The world should be safe for kids because kids are the future of our society. When the world isn't safe, families won't have kids and society will start to decline. Maybe that means giving up some of the privileges you have. That's the cost of our future.

Dylan16807

> And why does YouTube ask me to verify my age when I’m logged into a Google account I created in 2004?

Yeah those checks are super annoying. The internet has been around long enough, mechanisms for this should exist.

And even in the smaller term, if I had to be 13 to make this account, and it has been more than 5 years, maybe relax?

lucb1e

> Is card verification a lesser form of surveillance?

It's not just about which is worse surveillance, it's also simply that everyone has a face but not everyone has a credit card. I'm not deemed creditworthy in this country I moved to (never had a debt in my life but they don't know that) so the card application got rejected. Do we want to upload biometrics or exclude poor and unknown people from "being 18"? I really don't know which is the lesser poison

> (And why does YouTube ask me to verify my age when I’m logged into a Google account I created in 2004?)

I'd guess they didn't want to bother with that edge case. Probably <0.01% of active Youtube accounts are >18 years old

SkyBelow

>everyone has a face

Does everyone who is 18+ have a face that passes for 18+ (and the inverse as well)?

Overall it seems like a bad idea, but one demanded by what sounds like a good idea with not reasonable way to fully implement it, leading to a tangled network of bad ideas patching other bad ideas patching other bad ideas all the way down.

zoklet-enjoyer

Why/how would my bank have my biometrics?

sph

I logged into my Starling Bank account on a new phone, and I had to film my face reading a 6 digit number.

chatmasta

They almost certainly have a photo of your passport or other identification.

Joker_vD

Don't know about the US, but over here the last couple of years it has been a big wave of "enable biometrics sign-in! Totes safe, your face is the best ID, just click this checkbox, please, we would really like you to use it, pretty please" in the bank apps. No idea why they pushed it so hard, and it seems to have largely subsided now.

whiplash451

What you describe is called QES (Qualified Electronic Signature) and is still widely used to validate identities.

Unfortunately it is not enough to prove an identity (you could be using the credit card of your traveling uncle) and regulation requires for it to be combined with another proof.

I see a lot of people associating identity verification with evil intent (advertising, tracking).

I work in this domain and the reality is a lot less interesting: identity verification companies do this and only this, under strict scrutiny both from their customers and from the regulators.

We are not where we want to be from a privacy standpoint but the industry is making progress and the usage of identity data is strictly regulated.

DrillShopper

As someone looking in from the outside: what regulations govern this type of work?

whiplash451

In EU: eIDAS and ETSI.

In the US: BIPA started in Illinois and is expanding to other states.

BIPA sets a brutal bar in terms of regulation.

casenmgreen

As we've seen, if the information is retained, it will be used.

The only safe approach is for that information not to exist in the first place.

SoftTalker

Paypal used this method as identity (or at least account) verification back in the very early days, IIRC. They made a very small deposit and I think they just let you keep it but I can't recall that for sure.

high_priest

I had a debit card when I was 13. An absolute godsend during international travel, not having to bother with cash as a forgetful teenager.

The card providers share your identity in monetary transactions, but I don't think this data does & should include birthdate.

Symbiote

These checks accept only a credit card.

That's useful as one option, but can't be expected of 18 year olds in most countries, and older adults in many.

dharmab

I had a credit card at 15. I had to travel for some school related stuff and it was easier to carry a card than excessive amounts of cash.

rozab

I don't really get your point, surely a credit card is even more strongly linked to your identify than your face?

aktuel

I basically agree with you, but it's not like you could not be tracked using your credit card number.

iamkonstantin

This is not about tracking, having your biometrics means they can resell the data to other providers (e.g. palantir or some other hellish enterprise). With that, the places and means of following you in real time are practically limitless...

There have been so many dystopian movies about this kind of tech, it's a good insight of what comes next.

jgaa

This is never about protecting the children.

This is always about government overreach.

People are less likely to criticize the government, or even participate in political debate, if their online identities are know by the government. Governments like obedient, scared citizens.

The only ethical response to laws like this, is for websites and apps to terminate operations completely in countries that create them. Citizens who elect politicians without respect for human rights and privacy don't really deserve anything nice anyway.

washadjeffmad

Providing identity and access services at scale is certainly a few people's next big plan, and it appears they've managed to sell the representatives of their own states on it first.

This sort of thing can't happen except through the largest tech companies in the world, who are coincidentally already poised to be the world's official providers of digital identity, and private internet enclaves.

Look at what Microsoft has done with Windows - mandatory minimum TPM to install and a Microsoft account registration for a local user. Try using an Apple iPad or iPhone without an iCloud account or adding a payment method. Google wants you to sign in with them, everywhere, aggressively. Cloudflare has been the web's own private gatekeeper for the last decade. Facebook's whole product is identity. IBM has sold surveillance, IAM, and facial recognition services for decades.

Instead of a clunky IP-based Great Firewall, imagine being able to render VPNs ineffective and unnecessary everywhere on the planet by a person's (verified national) identity. Click. Block and deactivate all members of group "Islamic State" on your platform. Click. Allow IDs registered to this ZIP Code to vote in this election. Click. CortanaSupreme, please dashboard viewer metrics by usage patterns that indicate loneliness, filtering for height, last assessed property values, and marriage status, and show their locations.

Currently, laws don't require age verification, just that ineligible parties are excluded. There's no legal requirement to card someone before selling them alcohol, and there's no reason anyone would need a depth map of someone's face when we could safely assume that the holder of a >5 year old email account is likely to be 18 if 13 is the minimum age to register with the provider.

Shifting the onus to parents to control what their kids do on the internet hasn't worked. However, that's a bare sliver of what's at stake here.

tencentshill

The anonymous, unchecked Internet got us where we are today. It was a great experiment in worldwide communication, but has now been converted into a weapon for the same type of authoritarians that previously used traditional media and propaganda channels. AI is only accelerating the possibilities for abuse. Critical thinking skills taught from a young age is the only defense.

9dev

That’s a very strange take on governments, treating them as a singular entity. A government that deserves that name is first and foremost and elected set of representatives of the constituents, and thus like citizens that vote for them again, act in their interests.

If the government is not working like that, you have an administrative problem, not a societal one. A state is its population.

gherard5555

> A state is its population.

Very dangerous thinking. Unless each and every citizens has approved the elected "representative" and every decision they made (which will never happen), you cannot assimilate the state and the population. The state has to be considered a separate entity, one which operate beyond the common man's thinking.

9dev

> Unless each and every citizens has approved the elected "representative" and every decision they made

But they have, by electing the representatives that ought to represent them, and thereby yield the power to make decisions on behalf of their constituents. If they do no not act accordingly, they will not be elected again in subsequent terms; if they act against the law, they will be fairly tried; and if the laws don't sufficiently capture the reality anymore, they will be adapted. That is how a representative democracy should work. If it doesn't, you have an implementation problem, not a systemic one (admittedly, this is almost a true Scotsman, but still.)

> The state has to be considered a separate entity, one which operate beyond the common man's thinking.

This isn't mutually exclusive. Of course the state has to make higher-level considerations and people in power will invariably be corrupted to some degree, but concluding that the state is your enemy and cannot be trusted is the wrong one, in my opinion. With that attitude, you're just waiting for it to become truly evil so you can say "See? I told you all along." Better to try and shape the state you have into something better while you still can.

bccdee

> A state is its population.

Oh that's not true at all. A state is an institution which is influenced by its population, but if anything, the attitudes of the population are more a product of the state, its constituent political parties, and the associated media apparatuses than of a freestanding "will of the people."

To give a trivial counterexample, if the American state "is" its population, then why does your presidential vote only matter if you live in a swing state, and why can you only vote for one of two candidates? Surely your vote should reflect all of your policy preferences and have equal influence no matter where you live.

graemep

I would say it is a realistic take, and yours is idealistic.

9dev

It isn’t realistic, it’s pessimistic. If the government, the system, is your opponent, there is no other outcome than subversion, everything is futile anyway. That leaves no room for democratic participation, for any kind of peaceful change, if you’re being earnest with it. And that seems very cynical and ideologically driven to me. There’s a lot of room for improvement that doesn’t involve tearing everything down because it’s beyond the pale anyway; it isn’t.

marcosdumay

> treating them as a singular entity

The entities that keep pushing for that stuff tends to be quite centralized.

MichaelDickens

> Citizens who elect politicians without respect for human rights and privacy don't really deserve anything nice anyway.

Unfortunately things don't always work out that cleanly:

- Sometimes you vote for the pro-freedom candidate, but your candidate loses. - Sometimes there are only two dominant candidates, and both disrespect human rights. - Sometimes one candidate disrespects human rights in some particular way, but the other candidate has different, bigger problems, so you vote for the lesser of two evils. - Sometimes a candidate says one thing while campaigning, and then when elected does something different.

jjice

Aside from the privacy nightmare, what about someone who is 18 and just doesn't have the traditional adult facial features? Same thing for someone who's 15 and hit puberty early? I can imagine that on the edges, it becomes really hard to discern.

If they get it wrong, are you locked out? Do you have to send an image of your ID? So many questions. Not a huge fan of these recent UK changes (looking at the Apple E2E situation as well). I understand what they're going for, but I'm not sure this is the best course of action. What do I know though :shrug:.

joeyh

Wise (nee Transferwise) requires a passport style photo taken by a webapp for KYC when transferring money. I was recently unable to complete that process over a dozen tries, because the image processing didn't like something about my face. (Photos met all criteria.)

On contacting their support, I learned that they refused to use any other process. Also it became apparent that they had outsourced it to some other company and had no insight into the process and so no way to help. Apparently closing one's account will cause an escalation to a team who determines where to send the money, which would presumably put some human flexability back into the process.

(In the end I was able to get their web app to work by trying several other devices, one had a camera that for whatever reason satisfied their checks that my face was within the required oval etc.)

whitehexagon

Hah, indeed, a similar experience here. The desktop option is worse, trying to get a webcam to focus on an ID card took forever. The next step wanted a 3rd party company to do a live webcam session, no thanks! Closed the account. Or at least tried, after a several step nag process, they still keep the email blocked to that account, in case you change your mind...

There seems no way to push back against these technologies. Next it will be an AI interview for 'why do you transfer the money?'

rlpb

> On contacting their support, I learned that they refused to use any other process.

I suspect this won't help you, but I think it's worth noting that the GDPR gives people the right to contest any automated decision-making that was made on a solely algorithmic basis. So this wouldn't be legal in the EU (or the UK).

roenxi

Also, key point in the framing, when was it decided that Discord supposed to be the one enforcing this? A pop-up saying "you really should be 18+" is one thing, but this sounds like a genuine effort to lock out young people. Neither Discord nor a government ratings agency should be taking final responsibility for how children get bought up, that seems like something parents should be responsible for.

This is over-reach. Both in the UK and Australia.

KaiserPro

When a corner shop sells cigarettes to minors, who's breaking the law?

When a TV channel broadcast porn, who gets fined?

These are accepted laws that protect kids from "harm", which are relatively uncontroversial.

Now, the privacy angle is very much the right question. But as Discord are the one that are going to get fined, they totally need to make sure kids aren't being exposed to shit they shouldn't be seeing until they are old enough. In the same way the corner shop needs to make sure they don't sell booze to 16 year olds.

Now, what is the mechanism that Discord should/could use? that's the bigger question.

Can government provide fool proof, secure, private and scalable proof of age services? How can private industry do it? (Hint: they wont because its a really good source of profile information for advertising.)

jkaplowitz

At least the ways that a corner shop verifies age don't have the same downsides as typical online age verifiers. They just look at an ID document; verify that it's on the official list of acceptable ID documents, seems to be genuine and valid and unexpired, appears to relate to the person buying the product, and shows an old enough age; and hand the document back.

The corner shop has far fewer false negatives, far lower data privacy risk, and clear rules that if applied precisely won't add any prejudice about things like skin color or country of origin to whatever prejudice already exists in the person doing the verification.

EA-3167

Cigarettes are deadly

Broadcasting porn isn't an age ID issue, it's public airwaves and they're regulated.

These aren't primarily "think of the children" arguments, the former is a major public health issue that's taken decades to begin to address, and the latter is about ownership.

I don't think that chat rooms are in the same category as either public airwaves or drugs. Besides what's the realistic outcome here? Under 18's aren't stupid, what would you have done as a kid if Discord was suddenly blocked off? Shrug and not talk to your friends again?

Or would you figure out how to bypass the checks, use a different service, or just use IRC? Telegram chats? Something even less moderated and far more open to abuse, because that's what can slip under the radar.

So no I don't think this is about protecting kids, I think it's about normalizing the loss of anonymity online.

threeseed

> This is over-reach. Both in the UK and Australia

2/3 of Australians support minimum age restrictions for social media [1] and it was in-particular popular amongst parents. Putting the responsibility solely on parents shows ignorance of the complexities of how children are growing up these days.

Many parents have tried to ban social media only for those children to experience ostracisation amongst their peer group leading to poorer educational and social developmental outcomes at a critical time in their live.

That's why you need governments and platform owners to be heavily involved.

[1] https://www.theguardian.com/australia-news/article/2024/jun/...

DrillShopper

> Putting the responsibility solely on parents shows ignorance of the complexities of how children are growing up these days.

Don't have kids if you're unwilling to parent them. "It's hard! :(" is not an argument.

"We've tried nothing and we're all out of ideas!"

exe34

that sounds quite puritan. my god says I can't, is one thing. my god says you can't either, is very different.

now replace god with parent.

pjc50

It almost certainly is overreach, but locking young people out of porn is hardly a new concern. We have variants of this argument continuously for decades. I'm not sure there is a definitive answer.

leotravis10

There's a SCOTUS case in FSC v. Paxton that could very well decide if age verification is enforced in the US as well so sadly this is just the beginning.

zehaeva

It's a good thing to think about. I knew a guy in high school who had male pattern baldness that started at 13 or 14. Full blown by the time he was 16. Dude looked like one of the teachers.

MisterTea

Same in my drivers ed at 16, guy had a mans face, large stocky build, and thick full beard. I once was talking to a tall pretty woman who turned out to be a 12 year old girl. And I have a friend who for most of his 20's could pass for 13-14 and had a hell of a time getting into bars.

This facial thing feel like a loaded attempt to both check a box and get more of that sweet, sweet data to mine. Massive privacy invasion and exploitation of children dressed as security theater.

red-iron-pine

i went to school with a guy who had serious facial hair at like 14. dude was rocking 5 oclock shadows by the end of the school day

pezezin

I had a friend who had a serious beard by the age of 15; he would order whisky and cola at the bar, and nobody ever asked him for any kind of ID xD

I myself have a mighty beard but took a couple more years to develop...

AStonesThrow

Was your school located at 21 Jump Street?

https://en.wikipedia.org/wiki/21_Jump_Street

Was it Steve Buscemi toting a skateboard?

https://knowyourmeme.com/memes/how-do-you-do-fellow-kids

pests

I witnessed the Better Off Ted water fountain skit play out in real life once, it was incredible awkward. I was helping my buddy and his black friend and his wife set up accounts on online casinos in Michigan for the promos/refer-a-friend rewards. Some of the sites require the live video facial verification and we were doing it in a darkly lit space at night. It worked instantly and without issue for my friend and me but oh man, many many attempts later and many additional lights needed to get it to work for his friends.

mezzie2

It's not even edge cases - I was a pretty young looking woman and was mistaken for a minor until I was about 24-25. My mother had her first child (me) at 27 and tells me about how she and my father would get dirty looks because they assumed he was some dirty old man that had impregnated a teenager. (He was 3 years older than her).

I think, ironically, the best way to fight this would be to lean on identity politics: There are probably certain races that ping as older or younger. In addition, trans people who were on puberty blockers are in a situation where they might be 'of age' but not necessarily look like an automated system expects them to, and there might be discrepancies between their face as scanned and the face/information that's show on their ID. Discord has a large trans userbase. Nobody cares about privacy, but people make at least some show of caring about transphobia and racism.

> So many questions.

Do they keep a database of facial scans even though they say they don't? If not, what's to stop one older looking friend (or an older sibling/cousin/parent/etc.) from being the 'face' of everyone in a group of minors? Do they have a reliable way to ensure that a face being scanned isn't AI generated (or filtered) itself? What prevents someone from sending in their parent's/sibling's/a stolen ID?

Seems like security theater more than anything else.

StefanBatory

I had a colleague, that when going out with her boyfriend, police was called on him as someone believed he is a pedophile.

She was 26. She just was that young looking.

:/

null

[deleted]

nemomarx

I don't think they make much of a show of caring about trans rights in the UK right about now, unfortunately. In the US you can make a strong case that a big database of faces and IDs could be really dangerous though I think

mezzie2

It's mostly about the service's audience. Discord is a huge trans/queer/etc. hub. If Discord were X or Instagram etc. it wouldn't matter. Users of Discord are, as a group, more likely to be antagonistic to anything that could be transphobic or racist than the general populace. (Whereas they don't care about disability rights, which is why people with medically delayed puberty aren't a concern.)

A tactical observation more than anything else.

tbrownaw

> In the US you can make a strong case that a big database of faces and IDs could be really dangerous though I think

The government already has this from RealID.

candiddevmike

The right thing to do here is for Discord to ignore the UK laws and see what happens, IMO.

Is there a market for leaked facial scans?

doublerabbit

With the UK currently battling Apple, Discord has no chance of not getting a lawsuit.

Ofcom is a serious contender in ruling their rules especially where Discord is multi-national that even "normies" know and use.

And if they got a slap of "we will let you off this time" they would still have to create some sort of verification service to please the next time.

You might as well piss off your consumers, loose them whatever and still hold the centre stage than fight the case for not. Nothing is stopping Ofcom from launching another lawsuit there after.

> Is there a market for leaked facial scans?

There's a market for everything. Fake driver licenses with fake pictures have been around for decades, that would be no different.

daveoc64

It says in the article - you can send them a scan or photo of your ID if the face check doesn't work (or if you don't want to do the face scan).

Eavolution

What if I don't want them to have any personally identifiable information about me in a database?

brundolf

Devil's advocate: couldn't this be better for privacy than other age checks because it doesn't require actual identification?

paulryanrogers

Considering the ubiquity of facial recognition tech, I imagine it could very quickly be abused to identify people

xphos

I don't think the problem is that young people are finding porn on the internet. There is a problem, though, and it has to deal with psychological warfare on attention

Formats like shorts or news feeds to you algorithmically with zero lag are the problem. It makes for the zombification of decision making. Endless content breaks people down precisely because it's endless. I think if you add age verification but don't root out the endless nature, you will not really help any young person or adult.

When you look at people with unhealthy content addiction, it is always a case of excess and not necessarily type of content. There are pedophiles but honestly, we have had that throughout all time, with and without the internet. But the endless feeding of the next video robs people of the ability to stop by mentally addiciting them to see just one more. And because content is not really infinite, endless feeds invariably will feed people with porn, eating disorders, and other "crap" in quantities that slowly erode people.

anon84873628

There was just another article on HN about how Snapchat is harming children at an industrial scale. Not just giving them access to drugs, violence, pedophiles, and extortionists, but actively connecting them with those accounts. Kids have died from fentanyl or committed suicide from bullying and harassment.

Porn addiction is bad but it seems there are even worse things happening.

Tokumei-no-hito

minor correction, it was about tiktok. and although it's a long read it's worth understanding just how absurd things have gotten.

https://www.afterbabel.com/p/industrial-scale-harm-tiktok

anon84873628

By the time I got there, dang updated the link to the same publication's article on Snapchat, since the TikTok one had been discussed already.

Hyperboreanal

[flagged]

timewizard

> 2 straight generations of porn addicts

Different types of pornography have different dangers and all of it has been broadly available since before the internet.

> And then you have shit like watchpeopledie.tv.

I think there's a broad gulf between these activities and I don't think they impact the brain in the same way as pornography. This type of violence can be found in movies and video games which also clearly predate the internet.

> Children should have been banned from the internet a decade ago

I'd rather pornography be banned.

> I'm completely willing to give up some privacy to make it happen.

Why? It should be incumbent on the people profiting from this activity to police it not on me to give up constitutional rights to protect their margins.

Hyperboreanal

>Different types of pornography have different dangers and all of it has been broadly available since before the internet.

A child couldn't get hardcore porn as easily as they can now, one google search away. Or just on their reddit/X feed.

>This type of violence can be found in movies and video games

Yeah but those aren't real. Videos of real death and violence being available to kids is worse than video games where fake characters die.

>I'd rather pornography be banned.

Adults are free to fuck themselves up, kids are not. We don't say "well I'd rather alcohol be banned" when it comes to kids not being allowed alcohol.

>Why?

Because I'd rather live in a society with less privacy than a degenerate society full of mentally ill shutins that don't have sex.

>to protect their margins.

Fuck margins, I care about the overall wellbeing of society.

karaterobot

> The social media company requires users to take a selfie video on their phone and uses AI to estimate the person's age.

What I did not see in this article was anything about how AI can tell a 13 year old from a 12.9 year old with confidence. This seems unlikely to me.

I agree with the article's implication that websites will now want a scan of everyone's faces forever. Their insistence that they won't store the face scans is like one those cute lies that kids tell, and adults aren't fooled by. Either you're outright lying, or you're using the loophole of not storing the image, but rather storing a set of numbers, drived from the image, which act as a unique fingerprint. Or, you're sending it to a third party for storage. Or something like that. But you're definitely keeping track of everyone's faces, don't try to pull a fast one on me young lady, I've been around the block before.

gertrunde

I would like to think there there is a solution that can be engineered, in which a service is able to verify that a user is above an appropriate age threshold, while maintaining privacy safeguards, including, where relevant, for the age-protected service not to be privy to the identity of the user, and for the age verification service to not be privy to the nature of the age-protected service being accessed.

In this day and age, of crypto, and certificates, and sso, and all that gubbins, it's surely only a matter of deciding that this is a problem that needs solving.

(Unless the problem really isn't the age of the user at all, but harvesting information...)

michaelt

Unfortunately, no amount of blockchains and zero-knowledge proofs can compensate for the fact that 15 year old has a 18 year old friend. Or the fact that other 15 year old looks older than some 20 year olds. Or the fact that other 15 year old's dad often leaves his wallet, with his driving license, unattended.

Over the next five years, you can look forward to a steady trickle of stories in the press about shocked parents finding that somehow their 15 year old passed a one-time over-18 age verification check.

The fact compliance is nigh-impossible to comply with is intentional - the law is designed that way, because the intent is to deliver a porn ban while sidestepping free speech objections.

throwaway290

None of these things are a problem.

> 15 year old has a 18 year old friend

Adults can be prosecuted for helping minors circumvent the checks.

> Or the fact that other 15 year old looks older than some 20 year olds

See Australian approach. Site can verify you and both government and site don't know who you are. No need for photo.

> shocked parents finding

No law is a replacement for bad parenting. But good parenting is easier with the right laws.

> a one-time over-18 age verification check

it can happen more than once non intrusively.

Hyperboreanal

[flagged]

padjo

By any means?

m463

A humorous age verification quiz for the Leisure Suit Larry game.

My boss is a. a jerk. b. a total jerk. c. an absolute total jerk. d. responsible for my paycheck. Correct answer: d.

dated, and very politically incorrect...

https://allowe.com/games/larry/tips-manuals/lsl1-age-quiz.ht...

(scroll down past answers to questions and answers)

stult

I'd say all of the above but my boss is very forgiving of me. It helps that I am self-employed.

Adverblessly

Here is my solution:

Provide easy to use on-device content filtering tools so parents can easily control what their children can access (there are a few ways to do this through law, like requiring it from OS providers or ISPs or just writing these tools directly).

To make it easy, Discord can provide their services under both adults.discord.com and minors.discord.com so parents can more easily block only the 18+ version of Discord.

Require personal responsibility from parents to decide what is appropriate for their child.

Edmond

There is a solution and I am the developer:

https://news.ycombinator.com/item?id=40298552#40298804

Talking about it or explaining it is like pulling teeth; generally just a thorough misunderstanding of the notion....even though cryptographic certificates make the modern internet possible.

whall6

How are the certificates issued?

Edmond

https://certisfy.com/partnership/

Any number of entities can be certificate issuers, as long as they can be deemed sufficiently trustworthy. Schools, places of worship, police, notary, employers...they can all play the role of trust anchor.

csomar

I don’t get it. What is to prevent a 9 year-old from buying a certificate and using it?

Edmond

This video addresses that:

https://youtu.be/92gu4mxHmTY

All certificates are cryptographically linked to an identity-anchor certificate, meaning buying a certificate would require the seller reveal the private key tied to the identity-anchor certificate, a tall order I would argue.

In the case of stolen identity certificates, they can be revoked thus making their illegitimate utility limited.

fvdessen

The problem is who pays to maintain the system. There are systems that allow you to share your age anonymously (among other things) and they’re already widely used in Europe but the system knows what you’re using it for since the second party pays for the information, and some accounting info is needed for the billing. It would be completely illegal for the system to use that info for anything else though.

red_trumpet

> a service is able to verify that a user is above an appropriate age threshold, while maintaining privacy safeguards

AFAIU, the German electronic ID card ("elektronischer Personalausweis") can do this, but it is not widely implemented, and of course geographically limited.

strangecasts

The problem is that it is much easier to implement such a check in a way which lets the verification service link the site to the user, with no discernable difference to the end user

e: I get the same feeling as I do reading about key escrow schemes in the Clipper chip vein, where nobody claimed it was theoretically impossible to have a "spare key" only accessible by warrant, but the resulting complexity and new threat classes [1] just was not worth it

[1] https://academiccommons.columbia.edu/doi/10.7916/D8GM8F2W

paxys

Transferring your age and a way to verify it to any third party is by definition a privacy violation. Doing so in a safe way is literally impossible since I don't want to share that information in the first place.

packetlost

I feel like you could, theoretically, have a service that has an ID (as drivers license ID), perhaps operated by your government, that has an API and a notion of an ephemeral identifier that can be used to provide a digital attestation of some property without exposing that property or the exact identity of the person. It would require that the attestation system is trusted by all parties though, which is I think the core problem.

brian-armstrong

Wouldn't this require the API provider to know that tbe citizen is connecting to the app? Grindr users might be squeamish about letting the current US admin know about that.

red_trumpet

This is not only theoretical, the German ID card ("elektronischer Personalausweis") can do exactly this.

nonchalantsui

Do you feel this way when you enter credit card information when making a purchase online?

rlpb

> Transferring your age and a way to verify it to any third party is by definition a privacy violation.

No it's not. Unless...

> Doing so in a safe way is literally impossible since I don't want to share that information in the first place.

...well then it is.

But it's not constructive to claim that proving your age to someone is by definition a privacy violation. If someone wants to prove their age to someone, then that's a private communication that they're entitled to choose to make.

It is true that if technology to achieve this becomes commonplace, then those not wishing to do so may find it impractical to maintain their privacy in this respect. But that doesn't give others the right to obstruct people who wish to communicate in this way.

Retr0id

I'm in the UK and discord has asked me to complete this check (but I haven't, yet). I can still use discord just fine, it just won't let me view any media it considers "adult".

I am an adult but refuse to let them scan my face as a matter of principle, so I've considered using https://github.com/hacksider/Deep-Live-Cam to "deepfake" myself and perform the verification while wearing a fake face. If it works, I'll write about it.

squigz

Why not leave the platform and actually send a message?

Retr0id

The platform isn't the problem, it's the legislation.

distalx

This feels more like spying on everyone than making the internet safe for kids. Big companies and the government are already tracking what we do online. This just seems like a further reduction of our privacy on the internet.

Parents need to be more involved in what their kids do online, just like in real life. Grounding them isn't enough. We wouldn't let them wander into dangerous places, so we shouldn't let them wander online without adult supervision. Also, parents need to prepare for having tough conversations, like what pornography or gambling is.

Online companies need to really work to make their sites safe for everyone. They should act like they own a mall. If they let bad stuff in (like pornography, scams, gambling), it hurts their reputation, and people will leave.

Instead of banning everything, because some people take pleasure in those activities, maybe there should be separate online spaces for adults who want that kind of content, like how cities have specific areas for adult businesses. This way, it would be easier to restrict children's access to some hardcore stuff.

If we all put some effort into figuring out easy and privacy-friendly solutions to safeguard kids, we can rely on simple principles. For example, if you want to sell toys to kids, you shouldn't sell adult toys under the same roof (same domain) or have posters that can affect young minds.

sph

> This feels more like spying on everyone than making the internet safe for kids.

That’s always been the point. “Protecting children online” is the trojan horse against privacy, and apart from a few of us nerds, everyone is very much in favour of these laws. The fight for privacy is pretty much lost against such a weapon.

distalx

I hear you on the 'Trojan horse,' but I'm still hopeful! We can vote with our money and maybe even crowdfund platforms that truly respect our privacy and time. We already have paid, privacy-friendly options for things like email and messaging, perhaps a Discord altrenative isn't too far fetched!

spacebanana7

I suspect the endgame of this campaign is to have mandatory ID checks for social media. Police would have access to these upon court orders etc and be able to easily prosecute anyone who posts 'harmful' content online.

woodrowbarlow

<tin-foil-hat> ultimately, i think the endgame is to require government ID in order to access internet services in general, a la ender's game. </tin-foil-hat>

like_any_other

Many countries (including in the EU) already required ID to use a SIM card: https://forestvpn.com/blog/news/countries-sim-card-registrat...

Funnily enough, when the Philippines did this, it was decried as a violation of human rights [1]. But usually, media are so silent on such things I'd call them complicit. One already cannot so much as rent a hotel room anywhere in the EU without showing government ID.

[1] https://en.wikipedia.org/wiki/SIM_Registration_Act

sensanaty

I'm in NL and had my wallet fall out of my pocket once at one of the bigger train stations. I realized within ~5 minutes, and basically as soon as I realized got a call from an anonymous number. It was the police, who had found my wallet with my ID in it and were calling me to inform me about it. Luckily I was still at the station and could just meet them and got my wallet back.

I couldn't help but feel extremely creeped out, and my girlfriend still to this day doesn't understand why I felt uneasy about it. "But you got your wallet back!", she says. "Of course the police know your number!". Having 0 privacy has been completely normalized, and I'm afraid we're far too late to do anything about it.

woodrowbarlow

yup, and this gives the ability to look up per-citizen location data.

sidebar: i've been trying to raise awareness about "joint communications and sensing" wherever i can lately; many companies involved in 6G standardization (esp. nokia) want the 6G network to use mmWave radio to create realtime 3d environment mappings, aka a "digital twin" of the physical world, aka a surveillance state's wet dream.

https://www.nokia.com/blog/building-a-network-with-a-sixth-s...

miohtama

Not only rent, but in Spain there is a central database where your details are sucked in real time when you rent a room or a car, and no oversight how this data is used.

null

[deleted]

xvokcarts

You can buy (and top up) a SIM card without an ID in the EU.

raspyberr

Please walk me from scratch how you would access the internet on your own right now without any form of Government ID

zeta0134

Walk into a coffee shop. Look at the wifi password, usually a sign near the register. Log onto the wifi network using the wifi password. Browse in peace.

Is this sort of flow normal elsewhere? It's certainly normal where I live.

toast0

I'm in the US. I do have government ID, but I don't recall showing it to my network providers. Certainly, some telcos want a social security number to run credit; but that's often avoidable. I'm pretty sure could also wander down to an electronics store (maybe a grocery/drug store too) and pick up a prepaid cell phone with internet access, pay for it with cash, and get that going without government id in the US. It's a bit of a hike to get to the electronics store from where I live, but I can get part of the way there with the bus that takes cash too.

squigz

???

I'd walk to a local library and use their wifi. Or walk to a local McDonalds and use their wifi. Or walk to a friend's/family's house and use their wifi. Or...

Symbiote

Prepaid SIM from one of the EU countries that still has them, such as Denmark. Purchase in cash from a kiosk.

whoopdedo

Prepaid 5G phone bought with cash and activated by dialing 611.

like_any_other

That would not be unprecedented: The first major change by the Lee Myung-bak government was to require websites with over 100,000 daily visitors to make their users register their real name and social security numbers. - https://en.wikipedia.org/wiki/Internet_censorship_in_South_K...

nitwit005

I'm afraid the endgame is, all this activity tied to real identities will be repeatedly leaked, get used for blackmail, and by foreign intelligence agencies.

Followed by governments basically shrugging.

KaiserPro

They already have access to this.

If you run a social media site, then you have an API that allows government access to your data.

pjc50

See e.g. "Ohio social media parental notification act"

(mind you, ID/age requirements for access to adult content go way, way back in all countries)

lanfeust6

Which would kill social media. The cherry-picked tech giant iterations anyway.

samlinnfer

They already have this in China and Korea. Hasn't stopped people from using social media.

lanfeust6

The West isn't China and Korea. They can't opt out of authoritarian-state surveillance and great firewall, whereas we have options more amenable to privacy, even if you want to quibble that they aren't perfect.

Also the fact that UK and Australia are kind of backwards on online privacy.

That aside, this is targeted. The fediverse and vbulletin forums of old, even reddit, are all social media but will never require facial recognition. If they do, then far worse things are happening to freedom.

spacebanana7

I don't think it would kill social media, but it'd make it more similar to Chinese social media. Essentially impossible to use for protests or criticism of things the government doesn't critiques on.

charlie90

Why? People make social media accounts with their real name and face already. I doubt it would have any effect.

numpad0

It ties real world ultraviolence with social media. It won't kill social media, just make it materially toxic. IIUC South Korea in 2000s had exactly this, online dispute stories coming from there were much worse than anything I had heard locally.

ChocolateGod

Exactly, targeting children with their parents credit cards is a profitable business.

miohtama

You need to ask what would Trump do. Court order probably skipped, or from a friendly judge.

2OEH8eoCRo0

Good!

Why is the Internet any different than say, a porn or liquor store? Why are we so fuckin allergic to verification? I'll tell ya why- money. Don't pretend it's privacy.

woodrowbarlow

there two false equivalencies in your argument, as presented in response to GP:

1. ID checks are not the same as age verification.

2. a social media website is not the same as a porn website.

if you take the stance that social media sites should require ID verification, then i would furthermore point out that this is likely to impact any website that has a space for users to add public feedback, even forums and blogs.

spacebanana7

It's about power not money. The Chinese social media companies who do this are plenty profitable.

null

[deleted]

throwaway875847

Money? Every big ad tech company would love to be provided with all that juicy verification data.

2OEH8eoCRo0

If they could make more money with verification than without then we would already have it.

squigz

How about we don't pretend there's only 1 single facet to this issue, no matter which you think it is?

hedora

Like many other people here, I'm wondering what we'll end up having to do at work do deal with this. We don't have the resources to put a full time person on this, and the UK's not a huge market.

For unrelated reasons, we already have to implement geoblocking, and we're also intentionally VPN friendly. I suspect most services are that way, so the easy way out is to add "UK" to the same list as North Korea and Iran.

Anyway, if enough services implement this that way, I'd expect the UK to start repealing laws like this (or to start seeing China-level adoption of VPN services). That limits the blast radius to services actually based in the UK. Those are already dropping like flies, sadly.

I hope the rest of the international tech community applies this sort of pressure. Strength in numbers is about all we have left these days.

fkyoureadthedoc

> I suspect most services are that way

I don't know actual numbers, but I gave up using VPN by default because in my experience they definitely are not.

fny

You'll likely end up paying someone else to do it for you.

hedora

I'm reasonably sure we will not. Dealing with an integration like that means not shipping some other feature to the rest of the planet. The marginal gain of accepting UK users is lower than the marginal gain of increasing addressable market everywhere else.

YurgenJurgensen

…as will everyone else. The same company. Who will have all that data in one convenient database just waiting to be leaked.

null

[deleted]

rkagerer

Of all the terrible, dumb-headed ideas. I would not want my kids scanning their face into who-knows-what third party's service.

I already decline this technology when finance companies want to use it for eg. KYC verification ("Sorry, I don't own a smartphone compatible with your tool. If you want my business you'll have to find another way. Happy to provide a notarized declaration if you'd like" has worked in the past).

Hyperboreanal

[flagged]

sReinwald

This response is a textbook example of a manipulative false dichotomy that poisons legitimate discourse about child safety online.

Presenting the only options as either "scan your child's biometric data into opaque systems" or "let your child be groomed and/or get addicted to porn" is intellectually dishonest and deliberately inflammatory. It's a rhetorical trap designed to shame parents with valid privacy concerns into compliance.

Privacy rights and child protection are not mutually exclusive. Numerous approaches exist that don't require harvesting biometric data from minors, from improved content filtering and educational initiatives to parental controls and account verification methods that don't rely on facial scanning. Corporations are simply implementing the most convenient (for them) solution that technically satisfies regulatory requirements while creating new data streams they can potentially monetize.

What's actually happening here is deeply troubling: we're normalizing the idea that children must surrender their biometric data as the price of digital participation. This creates permanent digital identifiers that could follow them throughout their lives, with their data stored in systems with questionable security, unclear retention policies, and potential for future misuse.

Weaponizing the fear of child exploitation to silence legitimate concerns about corporate overreach isn't just manipulative - it's morally reprehensible. Framing opposition to biometric surveillance as being pro-exploitation deliberately poisons the well against anyone who questions these systems.

We can and must develop approaches that protect children without surrendering their fundamental privacy rights. Pretending these are our only two options isn't just wrong - it actively undermines the nuanced conversation we should be having about both child safety and digital rights.

Hyperboreanal

>from improved content filtering and educational initiatives to parental controls

Parents can do all of that now. They are not doing so. Time to actually cut the kids off from porn. Fuck their privacy rights. Not being a porn addicted gooner at 14 is infinitely more important. Simple as.

nyanpasu64

Frankly I'm scared by governments and corporations going "papers, please" for people to be allowed to access the Internet. On top of endangering privacy by tying pseudonymous online interactions to real-life ID and biometrics, attempts to block under-18 people from finding information or interacting online will only amplify how society regards them as not having rights. This will isolate people (especially gay and trans teens) living with abusive parents from finding support networks, and prevent them from learning (by talking to friends in different situations) that being beaten or emotionally put down by parents is abusive and traumatizing.

I know all too well that when you grow up you're psychologically wired to assume that the way the parents treated you is normal, and if they harmed you then you deserve to be hurt. I've made friends with and assisted many teens and young adults in unsafe living situations (and talked to people who grew up in fundamentalist religions and cults), and they're dependent on online support networks to recognize and cope with abuse, get advice, and seek help in dangerous situations.

nicbou

To add to this, some people might be left out because companies are not financially incentivised to verify them.

In Germany, immigrants struggle to open a bank account because the banks require documents that they don't have (and that they can hardly get with a bank account). Russian, Iranian and Syrian citizens have a particularly hard time finding a bank that works for them. The most common video document verification system does not support some Indian passports, among others.

To banks, leaving these people out is a rational business decision. The same thing will happen to those deemed too risky or too much hassle by the internet's gatekeepers, but at a much bigger scale.

extraduder_ire

What is it about some Indian passports? Do they need to have a biometric chip to work? (just checked, and those were introduced in 2024)

Banks worldwide regularly refuse service to people who have US citizenship, so I don't think you're far off on that point.

nicbou

If I remember correctly there are a dozen variants, and most of them lack a basic feature. I think it's either a signature, latin letters or biometric features.

US citizens also had issues due to FATCA requirements although it seems to have improved since they were introduced.

BlueTemplar

Is banking not deemed a right in Germany ? Aren't there "banks of last resort" ? Or does that right somehow not extend to non-EU refugees ?

nicbou

Yes, sort of. You can always force it, but it takes time, resources and knowledge that recent immigrants lack. Usually they get funneled towards more immigrant-friendly banks.

exe34

> prevent them from learning (by talking to friends in different situations) that being beaten or emotionally put down by parents is abusive and traumatizing.

parents didn't know I'm gay, but they did control all flow of information (before social media) by controlling all movements outside school.

it took me until my thirties to realise how deeply abusive my childhood was. the only hints I had, in hindsight, was the first Christmas at uni, everybody was excited to go home and I couldn't fathom why on earth anybody would want to. I dismissed it as an oddity at the time.