Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The UK’s new age-gating rules are easy to bypass

theverge.com

Post reply on HN
Print view View original

41–50 of 191 posts

Re: The UK’s new age-gating rules are easy to bypass

#41

Post by Quarrel »

pr337h4m wrote: post #19

The most disturbing thing about this saga is that websites that have no physical/legal/business presence in the UK are proactively geoblocking UK-origin IPs. Censorious governments have always been a thing since the beginning of the internet. Websites (especially non-corporate ones like 4chan or R34) preemptively surrendering to a foreign government that has no jurisdiction over them is what's new.

> surrendering to a foreign government that has no jurisdiction over them is what's new

Many countries, including the US, claim jurisdiction if you are providing services to their citizens. Some claim jurisdiction if someone in that country sees your web page (ie you've now "published" it there).

You've been blissfully unaware, perhaps, but this has been a thing for a long time.

You have probably seen sites having sections of their TOS tailored specifically for Californian users- this is not that different.

I think the UK legislation here is hamfisted and very harmful, but the jurisdiction argument is nothing new.

Re: The UK’s new age-gating rules are easy to bypass

#42

Post by zigzag312 »

Wouldn't age verification without revealing identity be solved with a service that acts as an identity authority?

1) Site that needs to verify age generates a globally unique id, creates requested data array ["is_over_18"], valid_until property and hmac signature of this message.

2) Client forwards just the id and requested data array to identity authority. Identity authority returns the id, map of data {"is_over_18": true}, public key information, and signature of returned message.

3) Client returns original message with message received from identity authority to the site. Site verifies that id's and requested data match in both messages, original message authenticity via HMAC and signature of message from identity authority using public key cryptography.

User hasn't revealed any PII data besides "is_over_18" value to the site and identity authority doesn't know which site user is accessing.

Requirements: User registers and verifies identity at identity authority. Site trusts identity authority.

Limitations: Site could, behind the scenes, send the generated ID to the identity authority, informing it which site was accessed using this ID.

Re: The UK’s new age-gating rules are easy to bypass

#43

Post by ndsipa_pomu »

mytailorisrich wrote: post #21
pr337h4m wrote: post #19

The most disturbing thing about this saga is that websites that have no physical/legal/business presence in the UK are proactively geoblocking UK-origin IPs. Censorious governments have always been a thing since the beginning of the internet. Websites (especially non-corporate ones like 4chan or R34) preemptively surrendering to a foreign government that has no jurisdiction over them is what's new.

This is because nowadays everything has to be zero-risk and "over-lawyered." We have seen the same with the GDPR and now also with the UK Internet Safety Act.

The GDPR is designed to protect citizen's right to privacy and prevent websites from just plundering and selling people's private information. We need more places to implement GDPR style laws to ensure that companies don't think that they own people's data.

Re: The UK’s new age-gating rules are easy to bypass

#44

Post by Xelbair »

zigzag312 wrote: post #42

Wouldn't age verification without revealing identity be solved with a service that acts as an identity authority? 1) Site that needs to verify age generates a globally unique id, creates requested data array ["is_over_18"], valid_until property and hmac signature of this message. 2) Client forwards just the id and requested data array to identity authority. Identity authority returns the id, map of data {"is_over_18"…

That limitation is enough to kill such proposal.

Also authority could also do it. Nothing stops them from that.

Re: The UK’s new age-gating rules are easy to bypass

#46

Post by AnthonyMouse »

zigzag312 wrote: post #42

Wouldn't age verification without revealing identity be solved with a service that acts as an identity authority? 1) Site that needs to verify age generates a globally unique id, creates requested data array ["is_over_18"], valid_until property and hmac signature of this message. 2) Client forwards just the id and requested data array to identity authority. Identity authority returns the id, map of data {"is_over_18"…

You're making this far more complicated than it needs to be. It requires no cryptography more than a random number generator.

Create a service that generates a random token and then gives it to anyone who is over 18. Any service with any employee who is over 18 can get the token and then compare it to the one submitted by the client. Everyone uses the same token across every service and the token is only available to someone over 18.

The security isn't any worse than having user or service-specific tokens and the privacy is significantly better.

Re: The UK’s new age-gating rules are easy to bypass

#47

Post by mytailorisrich »

pr337h4m wrote: post #23
mytailorisrich wrote: post #21

Earlier quoted context omitted.

This is because nowadays everything has to be zero-risk and "over-lawyered." We have seen the same with the GDPR and now also with the UK Internet Safety Act.

There is absolutely zero risk as long as you stay out of the UK. Even if you do travel to the UK, there is no practical risk for the foreseeable future.

And yet we're seeing websites panicking and blocking all UK visitors... which is my point.

Also, thinking that there might be a risk if you travel to the UK because your random website on the other side of the world does not comply with a specific UK law is rather overestimating your importance and the British authorities.

Re: The UK’s new age-gating rules are easy to bypass

#48

Post by JetSetIlly »

According to the article, Ofcom are encouraging "parents to block or control VPN usage by their children to keep them from dodging the age checkers."

This might be stupidest advice I've ever heard. If parents aren't willing to block or control access to porn sites, there's even less chance of them blocking or controlling VPN usage. But if nothing else, it does show up this law for the nonsense that it is.

Re: The UK’s new age-gating rules are easy to bypass

#49

Post by bsenftner »

Are people still thinking a face image can be used to verify age? That's absurd. Former globally leading facial recognition developer here, and the article lightly mentions using a face image and age verification face analysis - that's not age accurate at all. Ask many ethnicities with experience, "age verification" image analysis is so unreliable it is fraud used in this context.

Re: The UK’s new age-gating rules are easy to bypass

#50

Post by ataru »

pr337h4m wrote: post #19

The most disturbing thing about this saga is that websites that have no physical/legal/business presence in the UK are proactively geoblocking UK-origin IPs. Censorious governments have always been a thing since the beginning of the internet. Websites (especially non-corporate ones like 4chan or R34) preemptively surrendering to a foreign government that has no jurisdiction over them is what's new.

The world-wide-web is becoming more and more only-your-country-web.
Post reply on HN