You would need to include the birth date in the certificate. But of course that would have its own privacy implications.

And that’s what I’m trying to say: your “just do X” falls short. It is incredibly hard, maybe impossible, to build a reliable age verification system where neither the websites nor the government can violate your privacy. Even the tiniest mistake can mean that the whole thing comes crashing down. And no, “just trust your government” is not a solution. Even if I trust my current government, the next election could put raging Nazis in power who use every available database to identify and terrorize people they don’t like.

If someone designs a system that satisfies all these requirements and is reviewed by multiple independent security researchers, I’m all for implementing it. But from what I know about government IT projects, it currently looks like every country will implement its own system, each with obvious problems that can be exploited by the average computer science student.

About the part of sending the certificate, how do you say they should check the age? By smoke signs?

The whole point about certificates is that they are signed with an asymmetric cryptographic key so you can verify them on your own. You have a list of root certificates from trusted certificate authorities and when a user sends you a certificate that claims to be issued by the Spanish government, you check the signature with the Spanish root certificate. No need to contact the Spanish government’s server about that specific certificate.

This is exactly how any certificate validation process works today. Otherwise, your web browser would have to talk to a bunch of certificate authorities every time you open an HTTPS connection to a website.

And as a follow up to my previous point, now that I’m at my PC and don’t have to type on my phone:

Even if we made certificates in a way that can’t be shared, for example by locking the private key inside a physical device (like a digital passport), we have solved nothing.

Your certificate would immediately become your digital fingerprint that will be stored with your account (to find duplicates) and can be tracked across websites as soon as a database gets leaked or the sites’ owners sell your data to advertisers (when would that ever happen?). While that fingerprint alone doesn’t say anything about you except your age, it makes it trivial to aggregate your activity across the whole internet. Ever bought something on a site that requires age verification? Congratulations, your certificate is now tied to an address. Shared a selfie somewhere? Your certificate has a face. Even without personal data directly in the certificate, it would be a privacy nightmare and exactly what the EU GDPR tried (and failed) to prevent.

The next step would be to find a mechanism that creates single use certificates every time you need one. But you can’t do that locally, because the certificates still need to be signed (and revocable) by a trusted authority. So maybe you need to send a certificate signing request to a government server every time you sign up for something. That could work for some use cases but requires expensive infrastructure that is never allowed to fail even for a few minutes or it would cause chaos.

… and now I’ve noticed your exact wording, implying that sites would forward the users’ certificates to the authority to be verified. That’s a big no-no. A site may never ever acknowledge to an authority that it has seen a specific certificate. The authority necessarily knows who the owner of that certificate is and even if they don’t tell the website, the authority itself can keep track of every citizen. “On date X, PornHub asked us to verify the age for certificate ABCDEF which we know belongs to John Doe from Somesmalltown” is not something I would want to be stored on a government server.

And this is all still assuming that the infrastructure for this would be implemented according to modern standards without security-critical shortcuts. If you have any hope that will ever happen, I recommend you click through https://media.ccc.de/ and watch some talks about government IT fails. Many are available in English.

Certificates that can’t be tied to a specific person can and will be shared, making them essentially worthless.

We‘ve had that in Germany about 20 years ago. Some websites asked you to verify your age by entering a part of the encoded data on the back of your ID card. It took maybe a few days until lists with valid IDs were all over the internet.

Sure, certificates are marginally more reliable because they can be revoked but at that point, websites need to update their revocation lists close to real time which isn’t practical and still can’t catch every shared cert.

Reliably verifying your identity without revealing too many personal details is an extremely hard problem that has troubled computer scientists for decades.

I have exactly one reason why I own an Xbox One S: Gamestop went out of business in Germany at the exact moment I made plans to buy a cheap 4k BluRay player for my bedroom TV and they sold me one (used) for 60€.

Sind Störpfosten wieder erlaubt? Falls nicht: gaaaanz gefährlich, was du dich da traust.

How is a 12-year-old movie being picked up by a streaming service newsworthy? Don’t get me wrong, it’s a really good movie and I’ve seen it multiple times but this sounds like polygon got paid for a thinly veiled ad.

Docker 29 hat API-Änderungen, mit denen Portainer und traefik inkompatibel sind. Das ist aber schon zwei Monate her und soweit ich das verstehe auch inzwischen behoben.

Personally, I don’t care if it’s one message or two. The thing that annoys me is people who send a greeting and then wait for a response before telling me what they actually want. If someone sends “hi” and then immediately starts typing their actual question, that’s fine for me, especially on platforms with a typing indicator.

You’re welcome to start with “Hi”, “Hello” or even “Greetings, my lord” but please don’t just leave it at that. Follow up with your actual question immediately so the recipient knows what you need and if it’s urgent.

They are pretty effective at showing how many victims there were. There are three right in front of my door and in some German cities you can’t walk more than a few dozen meters without seeing one. And now remember that only about 100k have been placed. That’s only about 1% of the total victims.

I have two. Both not the worst in terms of total delay but memorable for being horribly annoying.

1. ICE train from Dortmund to Karlsruhe (Germany) in December 2017. We’d had a couple of centimeters of snow the night before but nothing too drastic… until right after Frankfurt am Main. A railroad switch near Frankfurt am Main Stadion was frozen and could not be operated so we had to stop for over an hour at that tiny station. In the meantime, the beer in the onboard restaurant had run out and some already drunk passengers stole the conductor’s phone to blast the anime music over the train’s speakers and argued who would leave the train to buy more booze. Eventually we had to return to the previous station where dozens of additional passengers boarded. We were confused but got told that ours was the only train that would even attempt the rest of the trip. In the end, we arrived about three hours late.
2. A trip by regional train from Kassel to somewhere near Duisburg (Germany) in September 2021. Should have taken about four hours but due to an unexpected storm and a tree that damaged the overhead lines, the train had to stop in the middle of nowhere. It took 90 minutes just to figure out which taxi company would take us to the next station and a total of eight hours to get to our destination because it was so late at night that at some point no connecting trains were available.

Correction: a TV show of which you’ve seen most episodes at least 15 times. There’s always that one season that you skip because you didn’t like it the first time.

Not the point of the video.

I think it’s more of a general sentiment against Merz. He pushes for longer work days, fewer public holidays, later retirement, “incentives” for people to still work part-time during retirement, fewer protections for workers overall and worse social security. The guy is massively unpopular so nobody trusts that these statements come from any sensible reasoning.

Nobody cares what Friedrich “we need to treat workers like slaves” Merz thinks.

I think OP is not a native speaker. The (implicit) question is probably “Do you agree?”

And now you understand what we Germans feel when Americans ask what our ancestors did during the 1930s and 40s.

Glaub mir, wenn wir die Chance hätten, würden wir sofort wieder zurück in die Heimat gehen, aber manche von uns sind leider gezwungen, im badischen Exil zu leben, weil wir uns da, wo Leute tatsächlich leben wollen, die Mieten nicht leisten können.

https://de.wikipedia.org/wiki/Calw#Württembergische_Zeit

1345 kam die Stadt zur Grafschaft Württemberg und wurde bald Sitz eines Amtes.

Aber ja, es ist knapp. Soweit ich das sehe, haben die umliegenden Orte durchaus auch mal zwischendurch den Besitzer zwischen Baden und Württemberg gewechselt und spätestens mit Pforzheim im Norden und dem Landkreis Rastatt im Westen ist man dann wirklich in dauerhaft badischem Gebiet.