In the early internet, only academics and researchers had access.
And every time a company has been hacked to hell because an employee opened some malware personal email, I have pounded the table for a separate internet for business and personal stuff, within an organization.
Overlap? Do you want kids buying stuff on Amazon (or other presumably non age-gated site?) Well, that's above my pay grade to solve.
That's an interesting thought. One thing that comes to mind is that age-gating is often not a cut and dry boolean granting or denying access to an entire application. It's conceivable and even expected that a social media company may want to allow users of any age to access their platform but are legally required to age-gate a subset experience like adult content, gambling etc. I very much like the main street mental model for this, where we default to open access amidst a broad mix of establishments and scope age-gating as minimally as possible vs. having an "adults only" part of town.
Even (redacted) porn, I mean photo sharing, sites have a trivial click-through, or designated area "nudity" not enforced other than perhaps some "this is an adult site" that I ignore.
So, there's an example of division within a site.
No "answer this question" such as "Who is Adlai Stevenson", providing that Claude and others get it wrong and you have to remember (IP-block Google).
This project has been kicking around in my head since I first heard about the webauthn PRF extension in early 2024. I've slowly chipped away at it since, and finally got things to a shareable state over the summer thanks to a very fun parental leave. Headed back to work tomorrow, so I figure there's no time like the present.
Since the blog post covers the why more than the how, here’s a technical tl;dr:
A client-held encryption key derived during passkey authentication encrypts all sensitive user data prior to persistence so that only the user is able to decrypt and reuse that data on their device. This allows short-lived, privacy-preserving age proofs to be issued to requesting applications (18+, no PII shared) without requiring users to re-upload their documents. The SSO user experience is built on top of the OAuth 2.0 Authorization Code Flow.
But the presumption in a liquor store is that pretty much everything in the store is for sale to adults only. That's why liquor stores exist. It's not really a good metaphor for the internet, where the opposite is (or should be) true: the presumption should be open access for all.
Totally fair distinction, and good callout. I agree that open access should be the presumption. The liquor store is not meant here as a metaphor for the internet at large, but rather for how the internet should operate in the specific circumstances age verification is legally required.
Also fair, and there’s certainly an argument to be had there, but it already is law in many cases. Either way, my belief is that it’s not a better outcome to accept the status quo on the implementation side at the expense of privacy while that debate plays out.
Here's an idea, however offbeat. Not a proposal.
In the early internet, only academics and researchers had access.
And every time a company has been hacked to hell because an employee opened some malware personal email, I have pounded the table for a separate internet for business and personal stuff, within an organization.
Overlap? Do you want kids buying stuff on Amazon (or other presumably non age-gated site?) Well, that's above my pay grade to solve.
That's an interesting thought. One thing that comes to mind is that age-gating is often not a cut and dry boolean granting or denying access to an entire application. It's conceivable and even expected that a social media company may want to allow users of any age to access their platform but are legally required to age-gate a subset experience like adult content, gambling etc. I very much like the main street mental model for this, where we default to open access amidst a broad mix of establishments and scope age-gating as minimally as possible vs. having an "adults only" part of town.
Even (redacted) porn, I mean photo sharing, sites have a trivial click-through, or designated area "nudity" not enforced other than perhaps some "this is an adult site" that I ignore.
So, there's an example of division within a site.
No "answer this question" such as "Who is Adlai Stevenson", providing that Claude and others get it wrong and you have to remember (IP-block Google).
Just musing.
Hi! Author here.
This project has been kicking around in my head since I first heard about the webauthn PRF extension in early 2024. I've slowly chipped away at it since, and finally got things to a shareable state over the summer thanks to a very fun parental leave. Headed back to work tomorrow, so I figure there's no time like the present.
Since the blog post covers the why more than the how, here’s a technical tl;dr:
A client-held encryption key derived during passkey authentication encrypts all sensitive user data prior to persistence so that only the user is able to decrypt and reuse that data on their device. This allows short-lived, privacy-preserving age proofs to be issued to requesting applications (18+, no PII shared) without requiring users to re-upload their documents. The SSO user experience is built on top of the OAuth 2.0 Authorization Code Flow.
Demo video, high-level architecture, and FAQ can be found at https://loginwithone.com
Very open to feedback, and happy to answer any questions about the architecture, PRF/passkey encryption, or anything else!
But the presumption in a liquor store is that pretty much everything in the store is for sale to adults only. That's why liquor stores exist. It's not really a good metaphor for the internet, where the opposite is (or should be) true: the presumption should be open access for all.
Totally fair distinction, and good callout. I agree that open access should be the presumption. The liquor store is not meant here as a metaphor for the internet at large, but rather for how the internet should operate in the specific circumstances age verification is legally required.
Or we could resist the notion that age verification should be legally required. Because it won't just be for 'adult' things.
Also fair, and there’s certainly an argument to be had there, but it already is law in many cases. Either way, my belief is that it’s not a better outcome to accept the status quo on the implementation side at the expense of privacy while that debate plays out.