Nothing. Who says a solution has to be perfect? If “good enough” is good enough for handling the sale of alcohol, it can certainly be good enough for accessing web sites. No solution to any problem is perfect. You always have to find a balance between preventing the thing you want to stop and the negative effects of your efforts to prevent that thing.
It’s not as good as the solution for alcohol as one bottle of beer making it to a child gets used up after only giving one child one drink. Once a token leaks, it can be shared again and again and used by arbitrarily many children arbitrarily many times until someone notices that it’s leaked and revokes it (which then means that websites need to actively update a list of revoked tokens instead of just relying on public key cryptography to confirm it was signed by one of a few authorities, or all tokens will need to expire automatically after a short time).
That will always be the case for online age verification. There’s nothing preventing an adult from signing up for an account and then just giving the account to a kid. This is true no matter the verification method chosen. Unless you’re going to demand people scan their face every time they log in, and even then there are ways around it.
My goal is not to create a perfect solution. My goal is to create a good-enough solution that is as reliable as face or ID scanning, but without the privacy violations.
Nothing. Who says a solution has to be perfect? If “good enough” is good enough for handling the sale of alcohol, it can certainly be good enough for accessing web sites. No solution to any problem is perfect. You always have to find a balance between preventing the thing you want to stop and the negative effects of your efforts to prevent that thing.
It’s not as good as the solution for alcohol as one bottle of beer making it to a child gets used up after only giving one child one drink. Once a token leaks, it can be shared again and again and used by arbitrarily many children arbitrarily many times until someone notices that it’s leaked and revokes it (which then means that websites need to actively update a list of revoked tokens instead of just relying on public key cryptography to confirm it was signed by one of a few authorities, or all tokens will need to expire automatically after a short time).
That will always be the case for online age verification. There’s nothing preventing an adult from signing up for an account and then just giving the account to a kid. This is true no matter the verification method chosen. Unless you’re going to demand people scan their face every time they log in, and even then there are ways around it.
My goal is not to create a perfect solution. My goal is to create a good-enough solution that is as reliable as face or ID scanning, but without the privacy violations.