Emerging Threats from Age Verification and Identity Infrastructure Changes

• •Identity verification is moving from apps to OS/device levels due to new regulations.
• •Centralization of identity providers may create new vulnerabilities and attack surfaces.
• •Discussions emphasize the need for threat modeling in response to these changes.

Recent discussions highlight the shift of identity verification from application layers to OS and device levels due to new age-verification laws. This change affects users across various platforms, particularly targeting children’s access to online content. The introduction of identity assertions at the access layer creates potential attack vectors, including the risk of high-value identity token theft and device compromise. Centralization of identity providers could lead to new trust boundaries and vulnerabilities. The analysis draws on historical identity frameworks and current regulatory trends, raising concerns about enforcement and potential bypass methods like VPNs. The overall impact could redefine how identity is managed on the internet, necessitating new security models. The community is called to engage in threat modeling and discuss the implications of these changes.