Yes, phones can read it.
For a standard computer, you'll need a USB RFID chip reader.

What’s to stop people from providing that service to buy people alcohol?

It would also reveal to the government that the user was accessing 18+ content

Yes, I did mention that. Although ironically, Australia's social media minimum age law, and other similar laws being considered around the world, would actually increase privacy in this respect. The government could have separate keys for each age of legal significance (16 and 18, in Australia) and sign with the appropriate one (either the highest the user meets, or all the user meets—the latter would give the site less information about the user's and).

I don't believe it is technically possible to get around the example you shared there. Even in the real world, it's not dissimilar to a child asking an adult to buy alcohol for them.

because it's the first step in a multi step attack on our privacy.

for a moment, let's ignore all of the conspiratorial conjecture (not that it isn't warranted).

by exposing an API for web services to identify the users age/birthday, how does that solve the issue of "protecting children online".

what's stopping a bad actor from identifying, tracking, and grooming children directly based on this same mechanism?

right now the majority of kids online are protected through anonymity, but once they are identified they can be targeted directly and the adults responsible for their well being are blissfully unaware because "the government is tracking their age".

also. what comes next is worse than the date. online content ratings. because there's no point in tracking age if you can't apply a ratings system.

Imagine entire swaths of the internet banned because the content rating doesn't meet the government requirements.

this is less about tracking users and more about censoring dissent.

I wasn't replying to a comment about if this is solved or not, or the complexities of getting an outcome that most people are happy with. I replied to a comment that simplified the issue all the way to "it's the parent's choice".

Your comment is opening up new issues, that I agree make enforcement while respecting privacy more difficult (but that I personally don't think are insurmountable)

I agree, although in this thread I'm mostly interested in the technical puzzle.

The difference with the asking an adult to buy alcohol is mostly that, because the whole thing is online, they wouldn't need to ever really interact with an adult.

If the circumvention is as easy as looking up "free age verification" in a search engine, typing a url and clicking a button then it might not be very effective.

If it at least required them to steal dad's id card or get uncle Bob to help or something that's a different story.

The difference is one is physical and requires interaction with a human: "Hey uncle Bob, buy me beer?"
Vs. The other one is technical and just requires them to do a Google search and click a button without interacting with anyone.

The first one has a higher barrier for entry and at least involves some form of adult supervision. The second one makes it not much different to the classic "what is your birthday?" thing.

Ah misread that it was card, not a service.
That mostly works and is the same kind of thing as the other crypto solutions.

Though a bad actor could still set up a service with a legit card that provides government signed anonymous "yes" responses on demand.

I worry that the response will be to require an account and a full ID from it. Social media sites saying "we need to verify your identity to ensure you're an adult human and to combat bots. Scan your id card..."

Still one of the better technical solutions here though.

Actually something just occurred to me. Because my system, unlike the one from the Stack Exchange link or the one described elsewhere in the thread using an ID card, relies on a per-site untraceable request to the government, the government would be able to detect if one user is making a suspicious number of requests. It's reasonable for one person to make tens of requests, maybe even low hundreds over the course of a lifetime. It's not reasonable to be making hundreds or more in a day. They wouldn't know which sites are being accessed with it, or even what accounts on those sites. But they could set rate limits to prevent one person creating too many accounts for others, and potentially threaten legal action against them for doing so.

That threat of legal action is part of the same thing that prevents children from being able to go up to a random adult, handing them a $50 note, and asking for $20 worth of alcohol in exchange. You're not going to be able to prevent it on a smaller scale, but you can definitely prevent a small handful of people being able to age verify on behalf of thousands of children.

An additional protection could be added depending on how the age verification works. If she verification is "upload a scan of your photo ID", then yeah, mass verification becomes possible. But if each verification requires you to hold up your photo ID next to your face, speak a specific phrase aloud (with automated lip reading attempting a rough lip flap match), nod your head, write a specific phrase on a piece of paper, and more, all in randomised orders, it becomes a much bigger burden for someone to provide for others.

I'm certainly not advocating this. The level of burden for legitimate users would be too high to consider it reasonable. But it would be possible. Something like this has been used in the past for things like EV code signing certificates, where a larger burden is relatively more reasonable.

The problem with this question is assuming that violating privacy isn't the entire point of age verification laws.

You can use your phone as the reader, I've had to do so many times to log into govt websites.

I'd do what we're already doing: https://feddit.org/post/26849555/11924777 though this card idea might work too for the sake of data privacy. Not so much for face-to-face privacy, same problem when we got porn on magazines. Let's remember that buying adults goods with the intent to distribute to kids is punishable too. If some 18 year old goes to the store and buys 30 "I'm an adult" cards, there's a good chance the clerk's gonna put a stop to that. After that it becomes effort vs. benefit. Does one really want to go to several different stores to buy multiple cards to sell them for a slight markup? With the threat of getting caught and being charged? There's always the slight embarrassment factor too. Of course adult access could mean a lot of others things than porn too but let's face it: that's what people are going to think, and that's what people are going to think people are going to think.

Again, the magic word is reduction.

There will always be sites that won't comply with any solution, there are p2p sharing methods, TOR and all that. There are always going to be nerdy kids who find their way to forbidden content. But that then becomes easier for parents to keep an eye on. Maybe get the kid off the device more so they simply won't have the opportunity to figure it out. Make sure they only access sites that are in compliance etc. Still not a 100% fool proof solution but again, the point is reduction.

Wrote a comment recently. Age verification? Unnecessary. OS-level parental controls? Possibly meriting.

https://programming.dev/comment/22589550

I am still against where all this age verification crap is coming from, and I'm against what specifically "age verification" entails; but here's the thing: We keep saying, "It should be the parent's responsibility to secure their kids"—and while that's true, you can do all the talking and educating you want, but the fact is that the internet is now nigh-fully integrated with our lives, and unless you are surveilling your kid at every moment they are on the internet (don't recommend), not every parent has the time, resources, or know-how to keep their children safe on the internet without help.

There are some states pushing for "OS-level age verification," and I'm not convinced the proponents for this idea know what this combination of words means—but the idea isn't all bad. An interface for apps to query the device for a simple "can access adult content" value would be helpful for parents to better manage what their kids can access without having to hover 24/7. There is zero need for any sort of identification at any point in the process. The fact that legislation is promoting cumbersome identification collection and not the already existing idea of parental controls is evidence enough that this is designed to surveil.

This may address the privacy concern, but the issue still remains of a centralized power deciding what is and what isn't "safe for kids."

I don't think we're gonna get around the child internet safety conversation, and for good reason; but the conversation should be around how we can do it without jeopardizing individuals' safety and privacy, including children.

That's what the router setting to block adult websites is for... you don't have to monitor 24/7, have some idea that bad sites are blocked, and you can just be doing regular checkups on your child then.

There is and was never a need to involve IDs, other than more control over us as a whole and being able to extract more data.

I have never seen a company do this in a manner that I would trust

Let's not pretend that these laws actually do protect children..

There is always a way around something and if there's any population to figure it out, it's the ones with the most free time.

The difference between going to a bar and using the internet: Showing your ID at a bar doesn't mean it's stored on some server possibly ready to be stolen by hackers. It also doesn't automatically link all of your user data to your id (like it does right now) and make it easier to track your movements everywhere you go.

These laws help no one except the elite. They restrict us, limit access to information and eventually cause our data to be comprimised.

Bad parents exist, but does that mean we lockdown the most expansive knowledge base for everyone? I don't believe this will stop any children of bad parents from being exposed to horrible things online. Age gates don't stop that (because they either get bypassed or another site exposes even worse stuff without the age gate).

I think maybe the barrier could be a little higher than just disconnecting from your home's network.

If we were to accept the premise that there is currently an issue with child internet safety, then clearly this still an issue despite the existence of router controls. But now the question of if this premise is valid. What do you look at to determine whether "internet safety for children" is adequate? I don't really know, and so I guess I have more reading to do.

I was gonna say something about PSAs, but no time.

I can't speak for every government in the world, but as far as the major ones go, USA, Russia, China - I have less than zero percent trust in any of their companies to handle my data in a private and safe way.

It just isn't happening. They will dissect it, sell the data points they can, surveil you with the other data points, train AI with it and all kinds of other shenanigans. And most people know this.

That's why you can't just go right in to doing that, gotta help me adults think they're helping children and society at large first. Start with something small, just a small inconsequential right they lose ("Oh, I have to input my age to access this site") and then raise the stakes a little ("Oh, now I have to input my picture ID, ok")

Until it escalates into full inescapable 24/7 surveillance against you. And far from before that moment in time its already too late.

Once they implement this, its already too late.

I think if you as a parent have router controls and block adult content on their mobile plan if they have one (which I have seen as an option), then you are already doing a lot.

Most routers from ISPs come with "adult" content filtering enabled by default I think, at least the ones I've had have had this on.

VPNs already work and I can't see them not working, so that's always an option I guess, but they are also still an option with ID laws (ie connect to a region where they have no such laws).

Children's safety online can't involve limiting access and tracking everyone who ever goes online with their national ID attatched to every request (basically).

I think it'd be better if we explored the option that involves a parent blocking websites either on your network or on a device they give to you.

Most routers from ISPs come with "adult" content filtering enabled by default I think, at least the ones I've had have had this on.

Not that I'm doubting you, but is this a common thing? I've never even seen it as an option here in Canada, both on ISP supplied devices and on separate routers. Is it just because I'm using cheaper devices, or because on my region?

Hm I know it's common for me. If it isn't in canada or elsewhere, then that's just lazyness and a lack of care by your isp/router manufacturer (which makes sense cuz theres a monopoly on internet over there right? (Rip)).

Anywho, adult filter blocks on routers are a really easy thing to implement. If it isn't then they simply don't care to help explore the simplest of options for parents restricting access to bad sites.

I've heard of apps you can get for child devices that do a similar thing and let parents track their kids, which might be better anyways, assuming they arent a privacy nightmare (if parents dont prefer buying a smarter router).

I mean at the same time if we accept the premise that parents are unable or unwilling to use the mountains of currently available tools, why would we assume that "just one more tool, bro" is actually a solution to the "problem."

They work fine for people who use them correctly

You could accept that premise, and I'd argue that in that case if child internet safety is an issue, then the only solutions are either to force safety protocols or to leave kids in jeopardy.