HN Debrief

Think of the children: How to force real ID for all internet traffic (2023)

  • Privacy
  • Regulation
  • Infrastructure
  • Security
  • Social Media

The post is a long warning about how child-safety and age-verification laws can be used to force identity checks across the broader internet. Its concrete alternative is old-school and narrow: sites mark adult content with labels like RTA metadata, browsers and devices honor those labels, and parents handle filtering locally instead of sending government IDs or selfies to third-party verification vendors.

If your product touches age checks, identity, or user-generated content, assume the compliance surface will expand from "protect kids" to broader traffic control. Design for data minimization now, and treat this as a governance and market-structure issue, not just a feature or security problem.

Discussion mood

Strongly negative toward mandatory online ID and age-verification vendors. The mood mixed civil-liberties alarm with cynicism that child-safety language is being used to expand control, plus a sober view that purely technical resistance will not beat coordinated political and commercial pressure.

Key insights

  1. 01

    Legitimacy decides who actually rules

    The useful correction here is that states do not win because they hold all violence. They win because they hold the accepted right to decide which uses of force are legitimate. That framing cuts through a lot of hacker fantasy. You cannot code your way into legitimacy, and any technical system that hopes to replace governance still has to answer who can enforce, override, or recognize it in the real world.

    When evaluating identity or platform-control schemes, ask who gets to declare compliance and punish noncompliance. If your answer depends on social acceptance, courts, app stores, telecoms, or police power, you are in politics whether you like it or not.

  2. 02

    Selective proof systems exist but lack adoption

    There are already attempts to prove narrow facts like personhood or age without disclosing full identity. Comments pointed to Solid-style personal data containers, Apple attestation used with Cloudflare, and zero-knowledge passport projects like zkPassport. That matters because the choice is not only between full anonymity and uploading your driver's license to a random vendor. The real gap is deployment, standards, and incentives.

    If you work on trust or compliance products, look for attribute-based verification before defaulting to document collection. The blocker is less cryptography than ecosystem buy-in from browsers, platforms, and regulators.

      Attribution:
    • vegetablepotpie #1
    • doctorpangloss #1
    • ricochet11 #1
  3. 03

    Third-party ID vendors are obvious breach magnets

    A concrete example sharpened the abstract privacy concern. One comment said Discord used a third-party verifier that was supposed to delete IDs and did not, leading to a leak. That is exactly the operational failure critics expect. Once age checks rely on outsourced identity processors, the whole market fills with fragile repositories of documents that users never needed to hand over in the first place.

    Treat outsourced identity verification as concentrated breach risk, not as risk transfer. If you cannot avoid it, contract for deletion, auditability, and strict retention limits, then assume those controls will still fail.

      Attribution:
    • downrightmike #1
    • Bender #1
  4. 04

    Parents want law because the problem is collective

    The strongest case for regulation was not moral panic. It was a coordination problem. A parent who bans social media at home still loses when every school friendship, party invite, and status game runs through the same platforms. That argument explains why simple advice like "just parent better" does not clear the market. Many families are asking law to change the default because unilateral restraint imposes a social penalty on their own kids.

    If you build products for teens or schools, assume parental controls alone will not settle the debate. Network effects create pressure for policy responses, so product and policy strategy need to address social defaults, not just individual settings.

      Attribution:
    • paytonjjones #1 #2
    • Gigachad #1
    • Bender #1
  5. 05

    Identity checks can harden into a panopticon fast

    One sharp warning was that parents angry at Meta or TikTok may support broad ID rules as a weapon against social media, then discover they built infrastructure for tracking everyone. The point is not that all regulation is impossible. It is that identity rails are general-purpose infrastructure. Once deployed for one category of sites, they are easy to extend to many others.

    Watch proposals that solve one platform problem with universal identity plumbing. Scope creep is a product property here, not just a political risk, so push for mechanisms that cannot be trivially reused across the wider web.

      Attribution:
    • nodrog3000 #1
    • Gigachad #1
    • kyledrake #1
    • inigyou #1

Against the grain

  1. 01

    Anonymity may no longer protect democracy

    This view rejects the libertarian default outright. In a world of cheap bots, routine state lies, and foreign propaganda, anonymity is presented as a weakness rather than a safeguard because it lowers the cost of manipulation at population scale. That framing shifts the goal from privacy toward resilience against coordinated influence operations.

    If your work depends on open participation, invest in abuse resistance that does not assume anonymity is always net positive. Pressure for stronger identity and provenance will keep growing as synthetic media improves.

      Attribution:
    • Svoka #1
  2. 02

    The idea is older than current culture wars

    Pointing to "The Digital Imprimatur" matters because it shows this is not just a reaction to TikTok, AI, or current child-safety politics. The urge to bind speech and publishing to identity has deep roots in digital policy debates. That makes the present push look less like a one-off panic and more like another cycle in a long-running effort to make the network legible to authorities.

    Do not treat age-verification or real-ID proposals as temporary news-cycle artifacts. Plan for repeated attempts under new branding, because the institutional appetite predates the current triggers.

      Attribution:
    • teddyh #1

In plain english

AML
Anti-Money Laundering, regulations aimed at preventing financial crimes that often require identity checks and monitoring.
Cloudflare
A web infrastructure provider that offers hosting, networking, and security services.
DMCA
Digital Millennium Copyright Act, a United States law that includes a process for asking online services to remove allegedly infringing material.
IPsec
Internet Protocol Security, a set of standards for encrypting network traffic between computers.
KYC
Know Your Customer, a process where companies verify a user’s identity, often using official documents, to meet compliance or fraud rules.
Reticulum
An open networking system designed to provide encrypted communication over many kinds of links, including low-bandwidth radio.
RTA
Restricted to Adults, a labeling standard websites can use to mark adult content so software can filter it.
Tinc
An open source mesh virtual private network tool for connecting computers into a private network over the internet.
VPN
Virtual private network, a service that routes internet traffic through a separate encrypted connection to hide or change network identity.
zkPassport
A project using zero-knowledge cryptography to let someone prove facts from a passport without revealing the whole document.

Reference links

Historical and policy references

Privacy-preserving identity and attestation

  • Solid for Developers talk
    Example of selective data sharing and user-controlled identity architecture
  • zkPassport
    Example of zero-knowledge age or identity proof without disclosing full documents

Networking and circumvention tools

Political theory and governance

Law and standards examples