Elon Musk being against the social media ban on under 16-year-olds is him basically reaching a good conclusion from the wrong equation, because he’s not doing it out of privacy concerns about how everyone would probably have to verify themselves to prove that they’re older than 16 years old. He’s doing it because it would not be good for his business.
I’m not sure how they could implement this without requiring ID verification on every single internet user. I guess I’m not familiar with the topic enough to say if there is another way that they could pursue, but even if there is, at the same time, I’m not too confident in the governments opting for the other options. I’m from neither Spain nor Greece, so I guess I can’t speak on this, but I’m just referring to governments as a general group. And because a lot of different countries are trying to do this at the same time, I’m also not too confident about my own country not doing this at some point, sooner or later.
But the problem is not doing it right. If the page asks only “is this cert from a person older than 16 y.o.?” with an answer that can only be yes, no or bad cert, problem solved. The page doesn’t say which user has that cert and the authority doesn’t give any personal data except “older than 16”.
Certificates that can’t be tied to a specific person can and will be shared, making them essentially worthless.
We‘ve had that in Germany about 20 years ago. Some websites asked you to verify your age by entering a part of the encoded data on the back of your ID card. It took maybe a few days until lists with valid IDs were all over the internet.
Sure, certificates are marginally more reliable because they can be revoked but at that point, websites need to update their revocation lists close to real time which isn’t practical and still can’t catch every shared cert.
Reliably verifying your identity without revealing too many personal details is an extremely hard problem that has troubled computer scientists for decades.
And as a follow up to my previous point, now that I’m at my PC and don’t have to type on my phone:
Even if we made certificates in a way that can’t be shared, for example by locking the private key inside a physical device (like a digital passport), we have solved nothing.
Your certificate would immediately become your digital fingerprint that will be stored with your account (to find duplicates) and can be tracked across websites as soon as a database gets leaked or the sites’ owners sell your data to advertisers (when would that ever happen?). While that fingerprint alone doesn’t say anything about you except your age, it makes it trivial to aggregate your activity across the whole internet. Ever bought something on a site that requires age verification? Congratulations, your certificate is now tied to an address. Shared a selfie somewhere? Your certificate has a face. Even without personal data directly in the certificate, it would be a privacy nightmare and exactly what the EU GDPR tried (and failed) to prevent.
The next step would be to find a mechanism that creates single use certificates every time you need one. But you can’t do that locally, because the certificates still need to be signed (and revocable) by a trusted authority. So maybe you need to send a certificate signing request to a government server every time you sign up for something. That could work for some use cases but requires expensive infrastructure that is never allowed to fail even for a few minutes or it would cause chaos.
… and now I’ve noticed your exact wording, implying that sites would forward the users’ certificates to the authority to be verified. That’s a big no-no. A site may never ever acknowledge to an authority that it has seen a specific certificate. The authority necessarily knows who the owner of that certificate is and even if they don’t tell the website, the authority itself can keep track of every citizen. “On date X, PornHub asked us to verify the age for certificate ABCDEF which we know belongs to John Doe from Somesmalltown” is not something I would want to be stored on a government server.
And this is all still assuming that the infrastructure for this would be implemented according to modern standards without security-critical shortcuts. If you have any hope that will ever happen, I recommend you click through https://media.ccc.de/ and watch some talks about government IT fails. Many are available in English.
About the part of sending the certificate, how do you say they should check the age? By smoke signs?
The whole point about certificates is that they are signed with an asymmetric cryptographic key so you can verify them on your own. You have a list of root certificates from trusted certificate authorities and when a user sends you a certificate that claims to be issued by the Spanish government, you check the signature with the Spanish root certificate. No need to contact the Spanish government’s server about that specific certificate.
This is exactly how any certificate validation process works today. Otherwise, your web browser would have to talk to a bunch of certificate authorities every time you open an HTTPS connection to a website.
You would need to include the birth date in the certificate. But of course that would have its own privacy implications.
And that’s what I’m trying to say: your “just do X” falls short. It is incredibly hard, maybe impossible, to build a reliable age verification system where neither the websites nor the government can violate your privacy. Even the tiniest mistake can mean that the whole thing comes crashing down. And no, “just trust your government” is not a solution. Even if I trust my current government, the next election could put raging Nazis in power who use every available database to identify and terrorize people they don’t like.
If someone designs a system that satisfies all these requirements and is reviewed by multiple independent security researchers, I’m all for implementing it. But from what I know about government IT projects, it currently looks like every country will implement its own system, each with obvious problems that can be exploited by the average computer science student.
Elon Musk being against the social media ban on under 16-year-olds is him basically reaching a good conclusion from the wrong equation, because he’s not doing it out of privacy concerns about how everyone would probably have to verify themselves to prove that they’re older than 16 years old. He’s doing it because it would not be good for his business.
I’m not sure how they could implement this without requiring ID verification on every single internet user. I guess I’m not familiar with the topic enough to say if there is another way that they could pursue, but even if there is, at the same time, I’m not too confident in the governments opting for the other options. I’m from neither Spain nor Greece, so I guess I can’t speak on this, but I’m just referring to governments as a general group. And because a lot of different countries are trying to do this at the same time, I’m also not too confident about my own country not doing this at some point, sooner or later.
But the problem is not doing it right. If the page asks only “is this cert from a person older than 16 y.o.?” with an answer that can only be yes, no or bad cert, problem solved. The page doesn’t say which user has that cert and the authority doesn’t give any personal data except “older than 16”.
Certificates that can’t be tied to a specific person can and will be shared, making them essentially worthless.
We‘ve had that in Germany about 20 years ago. Some websites asked you to verify your age by entering a part of the encoded data on the back of your ID card. It took maybe a few days until lists with valid IDs were all over the internet.
Sure, certificates are marginally more reliable because they can be revoked but at that point, websites need to update their revocation lists close to real time which isn’t practical and still can’t catch every shared cert.
Reliably verifying your identity without revealing too many personal details is an extremely hard problem that has troubled computer scientists for decades.
And as a follow up to my previous point, now that I’m at my PC and don’t have to type on my phone:
Even if we made certificates in a way that can’t be shared, for example by locking the private key inside a physical device (like a digital passport), we have solved nothing.
Your certificate would immediately become your digital fingerprint that will be stored with your account (to find duplicates) and can be tracked across websites as soon as a database gets leaked or the sites’ owners sell your data to advertisers (when would that ever happen?). While that fingerprint alone doesn’t say anything about you except your age, it makes it trivial to aggregate your activity across the whole internet. Ever bought something on a site that requires age verification? Congratulations, your certificate is now tied to an address. Shared a selfie somewhere? Your certificate has a face. Even without personal data directly in the certificate, it would be a privacy nightmare and exactly what the EU GDPR tried (and failed) to prevent.
The next step would be to find a mechanism that creates single use certificates every time you need one. But you can’t do that locally, because the certificates still need to be signed (and revocable) by a trusted authority. So maybe you need to send a certificate signing request to a government server every time you sign up for something. That could work for some use cases but requires expensive infrastructure that is never allowed to fail even for a few minutes or it would cause chaos.
… and now I’ve noticed your exact wording, implying that sites would forward the users’ certificates to the authority to be verified. That’s a big no-no. A site may never ever acknowledge to an authority that it has seen a specific certificate. The authority necessarily knows who the owner of that certificate is and even if they don’t tell the website, the authority itself can keep track of every citizen. “On date X, PornHub asked us to verify the age for certificate ABCDEF which we know belongs to John Doe from Somesmalltown” is not something I would want to be stored on a government server.
And this is all still assuming that the infrastructure for this would be implemented according to modern standards without security-critical shortcuts. If you have any hope that will ever happen, I recommend you click through https://media.ccc.de/ and watch some talks about government IT fails. Many are available in English.
Cl@ve gives you a one-use code of 3 letters that you have to validate on your phone and tells you who asks for validation.
About the part of sending the certificate, how do you say they should check the age? By smoke signs?
The whole point about certificates is that they are signed with an asymmetric cryptographic key so you can verify them on your own. You have a list of root certificates from trusted certificate authorities and when a user sends you a certificate that claims to be issued by the Spanish government, you check the signature with the Spanish root certificate. No need to contact the Spanish government’s server about that specific certificate.
This is exactly how any certificate validation process works today. Otherwise, your web browser would have to talk to a bunch of certificate authorities every time you open an HTTPS connection to a website.
But that doesn’t give the validation of age. Just the validation of the cert. Are you saying they have to add an “older than 16” database?
You would need to include the birth date in the certificate. But of course that would have its own privacy implications.
And that’s what I’m trying to say: your “just do X” falls short. It is incredibly hard, maybe impossible, to build a reliable age verification system where neither the websites nor the government can violate your privacy. Even the tiniest mistake can mean that the whole thing comes crashing down. And no, “just trust your government” is not a solution. Even if I trust my current government, the next election could put raging Nazis in power who use every available database to identify and terrorize people they don’t like.
If someone designs a system that satisfies all these requirements and is reviewed by multiple independent security researchers, I’m all for implementing it. But from what I know about government IT projects, it currently looks like every country will implement its own system, each with obvious problems that can be exploited by the average computer science student.