UK Age Verification Trivially Defeated With Video Game Characters

There’s a second way to defeat UK age verification gates. All it takes is a video game character and you are in.

One of the things I have long argued is the fact that you can’t legislate magical thinking technology into existence. In this case, you can’t necessarily make a law that says you must have an age verification system that is both highly secure, highly effective, and respects privacy all at the same time and expect it to magically poof into existence. What’s more, you can’t necessarily bury your head in the sand and pretend that existing technology is also good enough for the job on top of it all and expect nothing bad to happen afterwards.

Despite what delusional politician’s would have you believe, age verification technology is prone to leaking personal information, is vulnerable to getting hacked, and is ineffective at doing their jobs. What’s more, the push to implement such technology is backed by junk science and opens the door to more censorial abuse by the government. In short, it is all pitfalls and no upsides.

Of course, people such as myself have long warned about all of this. In response, politician’s refer to people like us as sicko’s who don’t want to protect children and say other stupid things like people are too stupid to understand VPNs, therefore, the argument is moot. For everything else, we are either generally ignored or told that the opposite of what we say is true because some lobbyist said so in a press release. Therefor, their personal beliefs overrides what we have to say.

The problem is that reality doesn’t care what your personal beliefs say. It just does what it does and the people on the “personal belief” side of things, along with all the victims along the way, get to deal with the consequences afterwards.

Well, just as we predicted, reality is happening. As we noted yesterday, people are turning to VPN technology in droves and defeating the various age verification systems being implemented to appease UK politicians. As a result, more people are learning about how VPN technology is work, making the UK governments life more difficult down the road. In the last paragraph of the article I wrote yesterday, I wrote this:

I sincerely doubt this is going to be the last problem that crops up. The UK is going to find out that their age verification boat has more holes than Swiss cheese. You’re not going to plug all the holes and the law is going to do little more than continue to take on water before it sinks entirely. In the interim, it will be a never ending fight to deal with the obvious messes that will inevitably be created.

Well, I didn’t have to wait long for that prediction to come true. If you are a UK resident who can’t afford a VPN, well, there’s another exploit being discovered to circumvent the age verification systems. All you need is a video game and you can simply use a characters face to circumvent the age verification system being employed. From the Verge:

Enforcement of the UK’s new online safety rules started on Friday, forcing a variety of platforms to roll out mandatory age verification tools for Brits. We already know that the age-gating checks are easy to bypass with a VPN, but what we didn’t know is that the face scanning tools used by platforms like Reddit and Discord can also be easily bypassed with Death Stranding’s photo mode.

Dany Sterkhov alerted the world to the Death Stranding bypass on Friday morning, and gamers have been using the photo mode and Sam Bridges to trick face scanning tools into accepting them as an adult all weekend. All you have to do is point your phone at your monitor with Death Stranding open, activate the in-game photo mode, and then get Sam to look at the camera.

I used this technique on Discord and the face scanning verification (k-ID) asked me to open and close Sam’s mouth, so I obliged using the facial expressions in the photo mode. I did the same thing on Reddit, but this time the face scanning tool (Persona) asked me to move Sam’s face around, so I panned the camera around until it was accepted. Both were completed within seconds, and it was unbelievably easy to bypass these age checks.

Discord uses the k-ID face verification service, while Reddit uses the Persona service. Both services were fooled by the virtual Sam Bridges. I tried to bypass Bluesky’s age verification, which uses the Yoti service, and it failed with the virtual Sam Bridges. Yoti says Instagram will also use its facial age estimation technology as an option “for people who need to prove they are over 18.”

So, that’s two exploits discovered within two days. It’s actually kind of amusing to see how quickly these exploits are being found, really. With all the bluster of “international standards” and “latest technology”, it turns out it was all just that: bluster.

Moving forward, I can only expect more exploits to be discovered and used. After all, if two can be found this quickly, I would be surprised if more exploits aren’t discovered. For instance, I wouldn’t be surprised if people start using other people’s faces to circumvent the technology. Alternatively, what about using fake IDs altogether? When it comes to humiliating the people who pushed this technology in the first place, it seems the sky is the limit to carry out such a task.

Drew Wilson on Mastodon, Twitter and Facebook.