Even with a "privacy-preserving" mechanism, I'd remain worried about censorship risk. Are you a government, and you want to punish one of your citizens without lifting a finger? Then deny them the ability to verify their ID with anything!
In principle, you could probably cook up some mechanism to prevent this. But then the information would also be irrevocable in case of error, which I doubt governments would accept. Not that ID verification is a foolproof proxy for the actual physical user in any case, short of invasive "please drink verification can"-style setups, which I worry might look tempting.
To get to the gist; you shouldn’t need to show pornhub your ID to verify your age. You should be able to verify your age with an identity provider that issues you a signed token for example.
The signed material does not contain any identifiable information about you, and sites like pornhub can verify the token with the identity provider to verify your age.
The pro-age verification folks have been talking about ZKPs for years now. Here’s one of the legal proponents of the Texas law, and now General Counsel at the FCC, referencing ZKPs[1]. More sophisticated folks have been pitching actual implementations for a while.
Setting aside whether age verification is desirable or a net benefit, some of the discourse is colored by folks that want to make it as painful and controversial as possible so they don’t have to do it.
I totally agree with the author's main point: if we must do "age verification," we should do it through third party identity providers and not directly give our information to everyone.
I have a semantic question, though. If I get tokens from an identity provider which I then pass to an adult website, is that really a "zero knowledge" proof? It's been a while, but I don't think that's a zero knowledge proof. Or maybe it is? I'm not sure what the formal definition is.
One of the most ridiculous things about age verification are the assumed ages for using things. For example, recommended Age Ratings for movies way overestimate the age somebody should be to watch things. I was watching NC-17 movies at the age of 7. Powerful experience, but I grew up a normal person. I still remember being 10 and thinking how ridiculous the PG-13 and R classifications were to the level of maturity I already had at that age. Thankfully I had parents who didn't care and I could watch whatever I wanted.
I don't see how a scheme where you allow the generation of multiple tokens will be practical when the token itself has value decoupled from the concerns of the generator - such as when the token doesn't give access to your personal account.
If the token signifies you are 18+ and nothing else and if the generation limits are such as to be reasonable then people will generate some fraction of their total tokens just to sell them, or use their elderly relative's tokens.
The kids will be trading these tokens to each other in no time. Token marketplaces will emerge. The 18+ function of the token will just become a money/value carrier.
If you limit it to one token per person, the privacy implications will be devastating. All online presence where being 18+ is required will be linked.
The problem with de-anonymising the internet is that I don't think the potential risk (my id becoming public if the id provider is hacked) is worth the potential good (preventing kids from adult experiences online). Is that position ok? Do I have an ability to avoid that risk? When was the case that 'we must do agree verification' proven? If it wasn't, what exactly is going on?
So, I don't accept that this is even an acceptable idea. I hate that we are attempting to 'solutionize' on top of bad assumptions, as with this well-meaning article.
The real issue is that there is no proving that this is a 'good thing' to be done -there is no discussion of the loss of privacy rights. It is already decided that de-anonymising is a good thing for corporations and governments, so the rest is just excuses.
This is actually use of manipulation on the part of governments to trick and coerce individuals into an action they do not want to take. Therefore, thoughtful talking about how to 'mitigate the risk' is the equivalent of negotiating with kidnappers over the ransom, when the right answer is: no coercion. The answers to these questions should be that those who want them opt-in, not forcing risk on everyone.
I'm not on board with age verification at all. Even if it can be done in a private way. I'll just VPN or something, as I'm in the EU and they're dumping this crap on us now.
I'm more than old enough for anything and I have never been 'carded' in my life. In fact I rarely carry ID anyway (even though it's mandatory). Not going to start now.
Wild how out-of-bounds it apparently is to say, but even if age verification was empirically proven to protect kids, I’d still be against it.
It's taboo in our culture to say this, but what keeps me up isn't just what people are afraid of; it's how far they’ll go to feel safe. That’s how monsters get made.
We’ll trade away the last scraps of online anonymity and build a legally required censorship machine, all for a promise of safety that's always just out of reach. And that machine sticks around long after anyone remembers why it was built, ready to be turned on whoever’s out of favor next, like a gun hanging above the door in Act One.
But say this out loud and suddenly you're the extremist, the one who "doesn’t care about kids." We’re already past the point where the "solution" is up for debate. Now you just argue over how it'll get done. If you actually question the wisdom of hanging surveillance over the doorway of the internet, you get boxed out, or even labeled dangerous.
It's always like this. The tools of control are always built with the best intentions, then quietly used for whatever comes next. History is clear, but polite society refuses to learn. Maybe the only real out-of-the-box thinking left is not buying the story in the first place.
in around 2013ish I've worked on a ZKP based SAML-like authentication scheme where almost nobody knows anything:
- you could use your corp ID to log in to pornhub, as the provider doesn't know to whom it verifies the request
- pornhub wouldn't know you used your corp ID
we got as far as a demo out of it but never commercialized as far as I know.
this was after there was a trial project with the UK about ZKP based age verification as kinda the next step where you could verify more than your age online.
it is designed to be a privacy footgun. this wave of age verification bullshit is their foot in the door for "login with your government-issued ID". anonymous rabble congregating on the internet, spreading malinformation and expressing illegal opinions are extremely dangerous to our democracy. the ETA is 5-20 years until another wave of "safety" laws that will require your real identity to be linked to every clearnet website you interact with.
The only thing we need and should accept is websites putting a content flag on their website or apps that any child restriction software or addons can read and either allow or block. It is a parent's job to limit what their children access, it is not the governments job to rubber pad the entire world so you can just let your kids run around like feral pigs.
From this week's news, US prosecutors are subpoenaing a list of every person who attended a gay drag show—under a law ostensibly written to effectively enforce age limits for "adult, sexualized" content[0,1].
You cannot separate the social context from the technical problem; or pretend that if you've designed a cryptographic protocol in some Platonic model reality, you've also solved some real problem in the real world. These things are privacy footguns because people want them to be privacy footguns—they're constructed that way, intentionally. The lack of privacy, the deterrent potential of public shaming, is a desired feature for many of the people pushing these things.
The error is in assuming that privacy is a common, shared value people agree on—a starting point for building technical solutions to. It isn't. It's an ideological dividing line.
> "Just like the Kids Online Safety Act (KOSA) and other bills with misleading names, this isn’t about protecting children. It’s about using the power of the state to intimidate people government officials disagree with, and to censor speech that is both lawful and fundamental to American democracy... EFF has long warned about this kind of mission creep: where a law or policy supposedly aimed at public safety is turned into a tool for political retaliation or mass surveillance. Going to a drag show should not mean you forfeit your anonymity. It should not open you up to surveillance. And it absolutely should not land your name in a government database."
This would be great and all, but all parties who are in a position to choose to implement this kind of system or to keep the status quo are already motivated to keep (and expand) the existing systems, for any number of reasons. Everybody (except the end users) loves to keep that juicy metadata and incidental logs of everything.
The corpos and people lobbying for this "age verification" aren't interested in child protection. They are just abusing child protection for their own gain: data collection. There is safe and secure tech to verify age without sending personal data. But the same lying assholes who claim to do it for the children are just vile agents of surveillance capitalism.
17 comments
[ 3.7 ms ] story [ 35.4 ms ] threadIn principle, you could probably cook up some mechanism to prevent this. But then the information would also be irrevocable in case of error, which I doubt governments would accept. Not that ID verification is a foolproof proxy for the actual physical user in any case, short of invasive "please drink verification can"-style setups, which I worry might look tempting.
The signed material does not contain any identifiable information about you, and sites like pornhub can verify the token with the identity provider to verify your age.
Setting aside whether age verification is desirable or a net benefit, some of the discourse is colored by folks that want to make it as painful and controversial as possible so they don’t have to do it.
[1] https://americarenewing.com/issues/identity-on-the-internet-...
I have a semantic question, though. If I get tokens from an identity provider which I then pass to an adult website, is that really a "zero knowledge" proof? It's been a while, but I don't think that's a zero knowledge proof. Or maybe it is? I'm not sure what the formal definition is.
If the token signifies you are 18+ and nothing else and if the generation limits are such as to be reasonable then people will generate some fraction of their total tokens just to sell them, or use their elderly relative's tokens.
The kids will be trading these tokens to each other in no time. Token marketplaces will emerge. The 18+ function of the token will just become a money/value carrier.
If you limit it to one token per person, the privacy implications will be devastating. All online presence where being 18+ is required will be linked.
So, I don't accept that this is even an acceptable idea. I hate that we are attempting to 'solutionize' on top of bad assumptions, as with this well-meaning article.
The real issue is that there is no proving that this is a 'good thing' to be done -there is no discussion of the loss of privacy rights. It is already decided that de-anonymising is a good thing for corporations and governments, so the rest is just excuses.
This is actually use of manipulation on the part of governments to trick and coerce individuals into an action they do not want to take. Therefore, thoughtful talking about how to 'mitigate the risk' is the equivalent of negotiating with kidnappers over the ransom, when the right answer is: no coercion. The answers to these questions should be that those who want them opt-in, not forcing risk on everyone.
I'm more than old enough for anything and I have never been 'carded' in my life. In fact I rarely carry ID anyway (even though it's mandatory). Not going to start now.
It's taboo in our culture to say this, but what keeps me up isn't just what people are afraid of; it's how far they’ll go to feel safe. That’s how monsters get made.
We’ll trade away the last scraps of online anonymity and build a legally required censorship machine, all for a promise of safety that's always just out of reach. And that machine sticks around long after anyone remembers why it was built, ready to be turned on whoever’s out of favor next, like a gun hanging above the door in Act One.
But say this out loud and suddenly you're the extremist, the one who "doesn’t care about kids." We’re already past the point where the "solution" is up for debate. Now you just argue over how it'll get done. If you actually question the wisdom of hanging surveillance over the doorway of the internet, you get boxed out, or even labeled dangerous.
It's always like this. The tools of control are always built with the best intentions, then quietly used for whatever comes next. History is clear, but polite society refuses to learn. Maybe the only real out-of-the-box thinking left is not buying the story in the first place.
- pornhub wouldn't know you used your corp ID
we got as far as a demo out of it but never commercialized as far as I know.
this was after there was a trial project with the UK about ZKP based age verification as kinda the next step where you could verify more than your age online.
The next question is if that will work at all. Those that want to find it - they will. If that is true, then why is this verification in place at all?
You cannot separate the social context from the technical problem; or pretend that if you've designed a cryptographic protocol in some Platonic model reality, you've also solved some real problem in the real world. These things are privacy footguns because people want them to be privacy footguns—they're constructed that way, intentionally. The lack of privacy, the deterrent potential of public shaming, is a desired feature for many of the people pushing these things.
The error is in assuming that privacy is a common, shared value people agree on—a starting point for building technical solutions to. It isn't. It's an ideological dividing line.
[0] https://www.eff.org/deeplinks/2025/07/you-went-drag-show-now... ("You Went to a Drag Show—Now the State of Florida Wants Your Name ")
[1] https://apnews.com/article/florida-drag-show-law-vero-beach-... ("Florida’s attorney general targets a restaurant over an LGBTQ Pride event")
> "Just like the Kids Online Safety Act (KOSA) and other bills with misleading names, this isn’t about protecting children. It’s about using the power of the state to intimidate people government officials disagree with, and to censor speech that is both lawful and fundamental to American democracy... EFF has long warned about this kind of mission creep: where a law or policy supposedly aimed at public safety is turned into a tool for political retaliation or mass surveillance. Going to a drag show should not mean you forfeit your anonymity. It should not open you up to surveillance. And it absolutely should not land your name in a government database."
This "think of children" phenomenon[1] is a 0-day type phenomenon that is going to change the world a bit like early XP malware did.
1: https://twitter.com/AkkadSecretary/status/195031821425851616...
(Quoting myself from 2021: <https://news.ycombinator.com/item?id=26538052#26560821>)