The 'papers, please' era of the internet will decimate your privacy

bilsbie 571 points 255 comments June 25, 2026
expression.fire.org · View on Hacker News

Discussion Highlights (20 comments)

gchamonlive

Who'd have guessed hitting the library would become an act of rebellious defiance

DrammBA

Also a very good game, https://store.steampowered.com/app/239030/Papers_Please/

sublinear

I'm not sure "social media" is the best example. You've never had complete freedom of speech on there. It's been true for decades in the USA that if they want to arrest you, they will. The age verification doesn't make this situation better, but at this point it's almost just a formality.

lovich

My privacy is already decimated. For 2 decades we’ve already known about the NSA slurping up everything[1] on top of the Snowden leaks. Then you have the mega corps like Facebook who can figure out every detail about you even from merely _not_ using their system because of the hole you leave in your social network that does use them. The only privacy left is from anonymous troll farms claiming to be an American while talking about how the Texas oblast is valuable for its warm water ports. I am fine for privacy on consumption of content, but you should be forced to identify yourself for posting so the common man at least has a chance to evaluate your statements instead of being misled, all while, as stated above, our governments and corporations don’t have that limitation. [1] https://en.wikipedia.org/wiki/Room_641A

trumpdong

Age verification is identity verification... except when it's in California or Illinois?

miiiiiike

I’m glad this is finally becoming the cause célèbre du jour. This feels like THE FIGHT or at least one of the TOP 3 THE FIGHTS and it hasn’t had even a fraction of the public’s attention until now.

sscaryterry

This just legitimises the existing practices. They already know who you are.

andrewlin247

privacy online is already largely gone

j2kun

There are at least some technological solutions here, such as anonymous credentials. [1] Modern versions of this technique allow one to associate metadata (like a proof of age exceeding a threshold) in such a way that the verifier can't even correlate repeated requests across users. Governments that are serious about age verification and individual privacy (which, doubtful they truly are) should agree on a protocol and set up certificate issuers that are associated with a digital ID. Then age verification will not be an invasive procedure or risk data leaks or insider threats. [1]: https://blog.cryptographyengineering.com/2026/03/02/anonymou...

kulahan

I can’t think of a better solution to the issue of children being so aggressively harmed by the internet. That doesn’t remove any of the problems associated with this.

dools

How is it any different from being required to identify yourself to get a phone or electricity account? Identifying yourself on the internet is long overdue.

madrox

I'm pretty sure this is a "pick your poison" problem. We as a society are damned no matter what we do or do not do. For my part, we need to do something, because things are not fine the way they are, including the half ass Australian solution. We can't keep putting the onus on private enterprise to address social issues. I may sound crazy for saying so, but I think the answer is more government run infrastructure for enabling identity-based operations, like payments and authentication, with rules about standards, open source, contractor selection, and audit that make operation transparent. It can work if technical operations are legislated instead of "left for the engineers to figure out." Then at least the evolution of systems can become real political issues that map to election cycles. My stance is probably a polarizing one, but this is precisely why we need to be able to debate the minutae of these systems through our political discourse instead of just "will we; won't we" legislation. This should be debated in democratic process.

HoldOnAMinute

Assuming no revolutionary changes are coming to the USA, I am planning to opt out of the digital world when I retire. Physical media only. No subscriptions. Spend lots of time in the library. Find like-minded people and meet in person. Will only keep the bare minimum for survival, like banking.

clickety_clack

This was in part caused by the general public’s comfort with federated identity for OAuth. If everyone already has one anyway (the thinking may go), why not mandate it?

g023

Anything to close Pandora's box. "They" liked the eras they could control the communications, and therefore the narrative. Boomers on their last legs, question is, will the future undo the unjustness that was forced upon them? Restore the rungs of the ladders that were removed, so they could have a chance too? Or are they going to stay in the fear narrative, and make this tragedy worse?

motohagiography

The discussion is not about whether it's a good or bad idea, but whether we will yield the power to these people to ratchet in further oppressive laws onto formerly free countries. Tech companies should ignore it and just publicly name whoever attempts to prosecute them and see how the population responds. I think people today are orders of magnitude more informed about their privacy and the consequences of digital ID laws. A few countries are on the edge of revolt at the moment anyway, and this would be a good way to get young people into the streets. 20 years ago, people would have had no defense against it or understanding of what was being imposed on them. Today, normal people use Signal and encrypted messengers, faraday bags, and leave their phones at home. Where we were nerdy security guys back then, non-technologist women and girls use spy tradecraft level electronic opsec for their own safety and security from middle school. People are much more sophisticated about their privacy now. They're ready to take this on. The laws coming into force are on people who are not in favour of them, and I'm so optimistic that I will not interrupt the enemies of privacy and human dignity while they are making a mistake.

AJRF

The path ahead in the next few years (at least for the UK) 1. Age gating + VPN ban under the guise of protecting children from social media 2. Few years pass, Identity Passport gets ushered in under guise of convenience of not having to repeat those pesky age verification checks. 3. Utilities start to require ID Passport. Including signing up with an ISP. 4. Renting starts to require ID Passport. 5. Work requires ID Passport. 6. Well done, you built the torment nexus!

tqi

> You’re not happy about it, but you hand over a photo of your passport and hope it doesn’t come back to haunt you. I think for this argument to carry weight with voters, privacy advocates need to be much more specific about what "coming back to haunt you" looks like. They do a little bit of it later on[1], but I think most people do a rough cost benefit in their head and decide that the small benefit outweighs the small risk (to them). [1] "And that creates a lot of risks for data breaches, overly broad data collection and retention, censorial legal demands for collected data, corporate and governmental malfeasance, pressure to self-censor, and perhaps blatant First Amendment violations. Every new layer and every new mandate brings more potential for risk. As we’ve unfortunately seen many times over the years, people including high-level government officials will maliciously seek to root out the identities of their critics, so the more layers of anonymity we can preserve in online speech, the better."

zaptheimpaler

This seems more like a technical problem that we could actually solve well if we wanted to and had competent people advising the governments. You go to DMV and they generate a keypair and an entry in a DB. App looks up your age with your public key + signed private key authorization from you. Apps can ask for specific checks like is_over_21, is_citizen or whatever without any more data. Something like that, details are probably off ;) The whole infrastructure could be open source. Age verification doesn't need to equal identity verification by a 3rd party company that will leak your IDs.

lokar

Is a 10% reduction that bad?

Semantic search powered by Rivestack pgvector
11,625 stories · 109,460 chunks indexed