Stop Killing the Internet: No Digital ID and No Age Verification

I don't see any proposals yet that will actually work for what they say they'll do.

By all means, if you have an adversarial relationship with the state, fight every expansion of its power tooth and nail. But conversely, if you think that everything is going basically fine and the police are reasonable folks overall, then giving them more power doesn't look like a slippery slope straight to dystopia.

The control bit is the dangerous one, sure.

Kids CAN absolutely bypass a lot still. Jump on Nostr and nobody can stop anyone -- a server can be run on any device (mine is on my phone), and it'll even run on non-TCP/IP networks (FIPS is in early days and still largely runs on existing infrastructure but absolutely doesn't rely on it staying there). Give it another few months with some LoRA build out (and enough motivation for the kids) and even the ISP gateway stops being a filter point. Not that ISP level controls have ever really been the most effective anyway, given the existence of VPN's and other tunneling methods (to say nothing of public wifi networks).

We see this happening in real time as India tries to stamp out Bitchat. The codebase has appeared on more and more repositories, and the most recent version of Bitchat is capable of transmitting itself for install to other devies without relying on any server or Internet at all.

So should we push back? Of course. At some point we would need to worry that they'll say enough is enough and make the hardware itself inaccessible. We're a long way off from that, and it'd be a surefire way to get a LOT more pushback.

But in the meantime, we shouldn't despair too much. The cypherpunks that gave us private and secure access on the Internet used by everyone today despite being once illegal to export didn't go anywhere. They're still here, kicking down every wall that gets put up, or at least pointing out that there are multiple ways around (or through) it.

https://news.ycombinator.com/item?id=49080929

There is discussion about LLMs, models, CSAM, undressing people with AI, and posting those images to places.

No handy wavy stuff, makes this problem go away due to filtering at creation. That's because, open models are a thing. So you either ban all open models, or maybe make it a crime to publish uncensored models, or you punish what individuals do on the internet.

Slander and libel and defamation are a thing, and have been a thing forever, millennia. Suddenly, on the open and free internet, for barely an eyeblink, anyone could say anything with zero liability and responsibility.

Then, 2010s came. Then, doxing of people we didn't like, or didn't agree with, became OK. So suddenly, it was OK to "out" a person, but not to just force everyone to be de-anonymoized. In other words, unpopular opinions? Yeah, that's OK to remove the cloak.

And with AI, everyone and their dog will be able to render images of anyone they want naked. CSAM. Political lies, made up videos, slander, libel, literal wors in people's mouths, on and on.

What's my point?

Well, just as 2000 brought a new world to people, 2025 is doing the same.

This is only going to get worse. And I fully agree, the dangers for "control" are going to exist. But the dangers of people posting all of this stuff, has hit the point where a lot of people are uncomfortable with it. And if you think Grok creating CSAM is bad, then you must think anyone creating CSAM is bad. Or anything. So how to you prevent the harm?

Well really, you either heavily restrict software. Open LLMs, or?

You make people posting this stuff liable.

The world is at a fork. Everything will change. Because banning software requires immense control over hosting software, but so does deanonymizing the internet. And really, this is inline with how the political and societal landscape changes.

It's only been 20 years since a lot of people were on the Internet, and only 10 years since I'd label it 'mainstream'. As in, even grandma uses it. And so, now the laws are coming, as legislation and law and change takes time for politicians, and political bodies.

We're here. Right now. This is the moment.

So I 100% guarantee that absolutely nothing will stop the path to liability for slander, libel, and more that is coming. Nothing. Whatever it takes, you can be sure it will happen.

So how will it happen?

Well, by knowing who to sue.

Like it or not, that's the truth. And no, I don't like it myself.

It is trivial to demonstrate that this is incorrect (despite sounding plausible). There's plenty of incredibly toxic behavior to be found all over facebook.

Among other considerations it's worth noting that most of the usual social feedback mechanisms are missing from typical online interactions.

> The cost of running LLM botnets is going down.

Agreed that this is an existential threat to anonymous discourse as it is typically implemented.

And yes, anonymity should be the default because otherwise the alternative is that you need to identify. If not, most users would stay anonymous because it is simply the smarter decision with the exception that you seek exposure.

You can do that already, Facebook is pretty close to exactly what you're talking about. They do a lot of work to identify real people and de-prioritize spam/bots. You can configure your account to only be able to interact with real people if you want. Many people like anonymity though, it's important for speaking truth to power and discussing topics which are outside the Overton window.

There's a good reason that many of the United States' founding fathers used pseudonyms when writing. Anonymity and real freedom of speech are foundational to democracy. If you can put someone in jail for saying something that the government doesn't like, then the government will be able to steer discourse towards outcomes it deems acceptable, even if those outcomes subvert the will of the people.

There's no real need to have the government force all websites to always authenticate all humans. The only real argument for such a system is to move us toward dystopian authoritarianism.

Kids these days have it too easy, we need stronger protections or the next generation will make pathetic hackers.

How will teens overcome the Android SafetyNet?

And these authoritarian politicians will destroy the internet with these actions. Maybe they will even change society as we know it, and not for the better.

The problem is thinking such initiatives will achieve anything in a bureaucratic system devoid of honest debate and actual democracy.

These citizen's initiatives must at least be tried but simultaneously we must create a new internet forever out of politician reach.

I think it's time that "please let 1800 analytics firms monitor your every browsing habit in exchange for this content" was seen in the same light as "please let 1800 private foreign espionage and propaganda agencies spy on you".

Like, yeah, it was an accurate statement, but total shit if your goal is to get people up off the couch and into voting booth. Way too abstract and high-minded

Not without either being able to trivially let others use your proofs OR ending open computing. There is no zero knowledge proof about the slab of meat sitting in front of the screen.

[1] https://philosophercigars.com

(Cue the twitter profile origin country flag thing).

What, you don't think that's how things work already except "the people" whose will is being followed is an even smaller group. Is political activist having a bigger influence over politics than people who slouch on their couch supposed to be surprising or even bad?

Say I go to a bar, I show my ID to the bouncer. My identity isn't recorded (unless they scan it with a device that records the scan data). Maybe they have cameras, my image isn't immediately associated with my identity, somebody would have to do a bit of work to connect the two. Maybe I pay with a credit card, now my name is stored in the point-of-sale system.

But I can still go to a bar with no scanner, no cameras, and pay in cash, and it's not a problem. Not suspicious at all. None of the above record-keeping is required, nor should it be.

Now, if a web site says I need to be provably 18+ to view their content, that's fine. I can take it or leave it. I have a choice.

When the law tries to mandate the software that can or must be run on my device, or tries to limit how I can communicate with my friends and family, now I have a problem. I consider my rights to personal computation and personal communication to be sacred. And I also believe in my right to privacy in these matters. I never needed an ID to send a personal letter, and my right to privacy regarding such communication is protected by law.

Finally, I see gathering of access data by a central authority (which I assume would eventually happen if social media sites started requiring validated ID) to be a concentration of power, and a dangerous one.

Would you really enter a bar, casino or strip club when it would look like this?

We don't talk about children, we talk about everyone here.

When you're age-checked on the internet, a scan of your ID goes on the website, then is likely forwarded to a helpful third party business. It extracts every bit of data, analyzes your picture, then carefully saves and catalogues everything, and returns True to the website, which may have also stored their own copy of this data, depending on how the process is implemented. This data is now in their hands forever. If, at any point in the future, you access another age-gated website that uses the same third party business, now there's nothing stopping them from correlating that private browsing data. How juicy. Adtech will love that. As you keep handing out your ID left and right, every single bit you divulge is recorded somewhere, forever. And at the end of the day, this is just moving data around, so there's nothing preventing your government, or the host's government, or all governments from passing a law that asks for that data to be shared with them - just in case, you know. Now there's many copies of your exact identity floating around, just one data leak or legal request away from revealing everything you've ever done tied in a neat little package. Real life ID is limited by constraints of practicality and our physical world, digital ID is limited by nothing.

And this is the best-case scenario I'm describing here. Imagine if they ask us to show our identities publicly, not just to the corporate all-seeing-eyes. Everyone would become doxxable by default, their whole life exposed and searchable, the mere idea of having secrets would be wiped away, communities made for marginalized or at-risk people would all fall silent.

Yes, there are ideas about zero-knowledge proofs and legislation about data privacy and whatever else. But these don't benefit either corporations or governments, and the average Joe doesn't care about putting his real name on everything, so we can pretty safely assume that this won't happen.

But if we have to talk about age, if I want to buy alcohol in my country at least, I don’t need to show my id because I don’t look under 18. If I did look under 18 the shop keeper would just quickly do what amounts to a boolean check, old enough or not?

Regardless of the intensions of the people who are pushing this (which we can’t know for sure and likely varies), the fact is that there’s so much surface area for abuse here.

You’re asking everyone to submit their id in what could be a permanent way, there’s no way for me to know what you’re doing with my id, or how long you’re keeping it for. Unlike the in person example, I cannot just take the physical copy back.

Now you might be tempted to mention that at some venues they scan your physical ID and your face. Yeah, I don’t like that either. Just because there’s precedence doesn’t make it right.

A different design logic, and the logic of the blogosphere that preceded it, much more tightly prioritized following a blogger or poster and interpreting everything you see in light of who was posting it. The trust is placed in the account you follow.

Right now the most important thing to inhibiting a dystopia is to break the lock Apple and Google have on approval of mobile code, because it gets used as a fulcrum by authoritarians. Want to ban VPNs? Make the app stores do it. Censor social media? Have them ban every social media app that doesn't censor. Want to track everyone everywhere? Make the phone provide sites and apps with a persistent cross-service tracking ID.

Whereas if ordinary people had devices that worked like PCs traditionally have, banning a VPN from the Microsoft store doesn't prevent you from installing one directly from the developer etc.

And getting this to be possible could be done by any sufficiently large market. If a sufficiently large market e.g. bans attestation and enforces antitrust, it allows an open platform to develop in that country by starting with compatibility with the apps of existing platforms, and then that platform can expand into other markets. Or you can get an iPhone there that you can install a VPN on and Apple can't prevent it, and then those iPhones can be exported into authoritarian countries.

And if you want a financial incentive for this, how about every country outside the US not wanting their local businesses paying the 30% tax to a foreign monopolist?

You are incorrect. The NIMBY movement has been extraordinarily successful despite severe opposition from moneyed interests. Bloomberg lost embarrassingly despite setting records for campaign spending. There are countless similar examples.

Not possible. Why do advocates of age verification bring this argument up again and again? It is not possible.

They're children. They have the internet access you give them. This isn't some unsolveable problem that needs government intervention, my parents were setting up filters so long ago that they're grandparents now.

> We call on the European Commission to propose legislation ensuring that digital identity and age-assurance systems used to access online services in the Union remain voluntary, privacy-preserving and non-discriminatory. Citizens must not be forced to identify themselves to access lawful online content or services unless strictly necessary, proportionate and provided by law. The legislation should require anonymous or pseudonymous proof-of-age, data minimisation, selective disclosure, open-source implementation, independent security audits, prohibition of cross-service tracking by relying parties, and equivalent alternatives for citizens who do not use a digital wallet.