A non-political explanation of implementing age verification systems

This post is designed to look at the technical aspects of how an age verification system could work.

The government is planning to introduce age verification so that under-16s cannot access social media and under-18s cannot access NSFW content.

There appears to be two or three primary complaints with this from those who oppose such measures:

1. It's not the government's responsibility, it's the parents OR a general disagreement with the concept (i.e. that minors should be allowed access to these things)
2. "It's a ban on all users, except those willing to identify themselves"/I don't want to hand over my ID to some random company
3. It can be fairly trivially circumvented with a VPN

This post will not look at point 1. It assumes that this is coming whether you are in support of it or not.

Point 3 is a big one - but at the same time, if there's a barrier to entry then at least some people will be dissuaded. Other than that, this post does not look at how requiring verification could be enforced.

When discussing age verification, there's 2 qualities that we want:

• As little information about a person is exposed to as few people or business (like apps or websites: services) as possible
• A service can be certain about a person's age

Therefore, the first thing to conclude is that any viable system must only reveal to a service that:

• The user is over/under x years of age
• That attestation belongs to the person who is currently the user

The service must not find out any other identifiable information about the person.

Another quality is that it should be easy for the user to verify their age. This means as few long-winded verification processes as possible.

Broadly, there's 3 methods to implement age verification.

• The service does it (maybe using a delegate 3rd party)
• The device does it (i.e. Apple/Google/etc.)
• A "Digital ID"

Many people seem to be rightly concerned with option 1.
It's implemented by requiring users to upload a photo of their document to each website, or a photo of their face which then uses unreliable AI testing. It is difficult to enforce that our initial requirements are met: it's a black box and once the photo is uploaded, who knows what's happened to it. Additionally, a photo of ID or a face can be easily faked. It also fails to meet the second requirement: every site needs the ID again.

The second option is a halfway option. It has similar problems to the first one, except that the user no longer needs to verify with each site individually. At least it reduces the spread of information.

The only way to fulfill these criteria is with a system where:

• You can identify yourself to a trusted system
• The information the system holds is minimal so that if there is a leak then information leaked is minimal
• That system can attest your age to other systems when requested by you

"Attest" means it can provide a trusted guarantee.

The only entity which matches the first part is the government. I'll explain how we can trust them later. It could be another entity, but the government has the advantage that when you reveal your information to them, none of it is new, so they have no incentive to try to collect your information.

The second part can only be met by a concept called decentralisation. This can be thought of as a wallet held by you on your phone. This means that the only failure point is your device. The maximum data that can be leaked in one attack is only your data (not everyone's), and your responsibility is to keep it safe. Additionally, attacks on individual devices (especially modern ones) are much more difficult.

The system works as such:

1. You identify yourself to a government portal. Ideally this would be without needing to upload a photo of ID, and instead some other way they can be sure you are who you say you are - perhaps this requires mailing a letter or using an existing document number and fingerprint, etc. It could be hooked up with the driving license and passport databases to cover most people.
2. The government portal issues a certificate to you which says something about you. In this case, it could say your age (or maybe just whether you meet the boundary for using social media).
3. The certificate is stored on your mobile wallet.
4. A service makes a request for the certificate.
5. You provide a biometric or some other authentication.
6. The service can view the certificate.

This meets all our requirements. The certificate can be made tamper-proof. It can be made encrypted so that only your fingerprint can decrypt it into something usable.

Other services could also start issuing certificates in future. Government services could link in - there might be a certificate replacing your insecure NiNO at some point.

As a technical concept, it might help to know that it's mathematically possible to generate a one-way hash or digest. Multiple pieces of information are all mixed together then out comes a single string of digits which can usually only be formed from the exact original input and cannot be reversed into that input. Also, using biometrics as a cipher key to encrypt information that does need to be reserved is a good idea. All of this is already done and forms the groundwork of modern communication.

It's very similar to passkeys, which is similar to things like "Login with Google" - the service never knows your Google password, but Google tells it information about you, and the service can be confident that that information is indeed relating to you.

​

Let's answer some FAQ's:

* How can you trust the government or wallet?

Software can be made zero-trust. Apps and websites you use everyday already implement this concept - it is possible to guarantee within normal parameters that the software running was built from the given source code. Therefore, making the entire source code open source completes the chain - anyone can inspect the software the government is running on your device.

* How will people without a phone/device use it?

Well, if a person needs it at all, it already suggests that they have a phone. The intention here is not to replace physical ID or even be mandatory to access government service - it's to supplement this and be mandatory when you want to access services which want data about you from the government.

* How can you be sure a person doesn't let someone else use their ID?

A biometric should be required to 'unlock' the certificate. This proves that the user is the person concerned.

* What if the government doesn't follow zero-trust principles?

Then we can start rioting. More importantly, then we know that there's something they might be hiding and not to use the system.

* How does this stop the services collecting information about me?

The only information it's possible to collect is your "fingerprint"/"identifier" (which don't actually need to be related to your real fingerprint/ID other than being generated by an irreversibly generated summary of your key points of your ID) and the select details you wish to share. If implemented well, it should not be possible for multiple services to share/guess across them what certificate belongs to who. It does become possible for a single service to build a picture of you without you following a traditional "sign up" procedure - but that could actually be a user experience advantage.

* Who's already using this system?

The EU is implementing it right now! And this is what the UK government also suggested for digital IDs. Many of the complaints about the system come from not knowing the technical details of it.

---

I'm happy to answer questions about this where I can, but my main point is:

Regardless of political decision, introduction of a digital ID is very important to securing our real IDs as we move forward into a world where proving ourselves matters more and more. We can slow down that progression maybe, but at some point it will be needed for one reason or another - and it's best not to end up on a worse solution because the public were not properly aware of a better solution.