Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The UK’s new age-gating rules are easy to bypass

theverge.com

Post reply on HN
Print view View original

181–190 of 191 posts

Re: The UK’s new age-gating rules are easy to bypass

#181

Post by bsenftner »

rcxdude wrote: post #177
bsenftner wrote: post #174

Earlier quoted context omitted.

It allows a class of low quality providers to basically trick people into the industry with products that claim but cannot deliver. Then that customer either abandons, or ponys up the real amount of investment necessary for a real solution, and due to being burned already, they are more diligent in their research. Which the industry wants, because too many knock on tech company doors expecting magic genies to grant w…

That assumes that the customer actually wants the problem solved, as opposed to doing the bare minimum to be able to say 'we tried' to the regulators. And that works doubly well if the regulators also just want to do the bare minimum so they can say 'we tried' to the politicians, press, and segment of the public that thinks this is a good idea.

That's a very good point: just as theater.

Re: The UK’s new age-gating rules are easy to bypass

#182

Post by rpdillon »

pyman wrote: post #155
harvey9 wrote: post #142

Earlier quoted context omitted.

Actually some idiot politician tried to blame Amazon for knife crime in the UK. Never mind that most kids can find kitchen knives (the type used in a recent crime when the politician made the statement) in the kitchen where they live.

US politician?

I decided to do some legwork here.

https://www.bbc.com/news/live/c9q7r4wpep0t

TL;DR: UK politician

Re: The UK’s new age-gating rules are easy to bypass

#183

Post by tomhow »

pyman wrote: post #128
cherryteastain wrote: post #32

Earlier quoted context omitted.

It's just iteration N of a series of power grabs to expand the panopticon of mass surveillance on the internet under the guise of 'but think about the children!!!'.

[flagged]

Please don't post flamebait like this on HN.

https://news.ycombinator.com/newsguidelines.html

Re: The UK’s new age-gating rules are easy to bypass

#184

Post by AnthonyMouse »

OJFord wrote: post #99
AnthonyMouse wrote: post #64

Earlier quoted context omitted.

> But someone could share this token publicly and then everyone could have it. How is this any different than using any other way of doing it? It's always the case that someone can provide their ID and let someone else use it.

In the solution you described as 'far more complicated than it needs to be', this is significantly mitigated by the inclusion of a valid_until timestamp.

If this is actually a necessary component then you can just change the code for everyone once each ID renewal interval and then the old code expires once the last person with an ID with the old code has their ID expire.

Re: The UK’s new age-gating rules are easy to bypass

#185

Post by AnthonyMouse »

rcxdude wrote: post #69
AnthonyMouse wrote: post #65

Earlier quoted context omitted.

> e.g. the service is generally still aware of what services the user is using that require verification How? The token isn't specific to any user or service. The only information the ID provider gets is that you requested the token and the only thing the service verifying your age gets is the same token shared by everyone over 18.

Ahh, I see what you mean. Yeah, that works if you're gonna completely give up on the whole 'making it hard for someone to share the codes' thing

There isn't any good way of making it hard for someone to share the codes unless you're going to set up an Orwellian panopticon that tracks where everybody is using them, and since that is totally unacceptable and half measures are uselessly ineffective, it's reasonable to just accept that codes are going to be shared.

Re: The UK’s new age-gating rules are easy to bypass

#186

Post by AnthonyMouse »

zigzag312 wrote: post #68
AnthonyMouse wrote: post #64

Earlier quoted context omitted.

> But someone could share this token publicly and then everyone could have it. How is this any different than using any other way of doing it? It's always the case that someone can provide their ID and let someone else use it.

If someone shares their ID publicly, that person could be identified and blocked, so this would probably be limited to sharing of ID to the people in person's social circle. If someone uploads shared token publicly, it's hard to identify who did it and anyone can use it until you rotate the token for everybody.

> If someone shares their ID publicly, that person could be identified and blocked, so this would probably be limited to sharing of ID to the people in person's social circle.

This was the thing your proposal was supposed to do:

> User hasn't revealed any PII data besides "is_over_18" value to the site and identity authority doesn't know which site user is accessing.

If you have that, someone sets up a service that uses their ID (or a set of IDs from any data breach) to provide tokens to anyone.

If the tokens can be mapped back to the IDs, the alleged privacy protection is fake. If they can't, you don't know whose ID is being used to generate tokens for third parties.

Your choices are "no real privacy protection" or "you don't know who is sharing tokens" and the first one is unacceptable, at which point you might as well use the simpler system.

Re: The UK’s new age-gating rules are easy to bypass

#187

Post by AnthonyMouse »

OJFord wrote: post #101
AnthonyMouse wrote: post #56

Earlier quoted context omitted.

The first problem is easy: Write the token on the back of your ID when the government issues it to someone over 18. The second problem is universally intractable. If you have the cooperation of someone over 18, the service will let you in and has no way of knowing that the person using it is a different person.

> The first problem is easy: Write the token on the back of your ID when the government issues it to someone over 18. Now realise the UK doesn't have a government issued national ID. Not to mention if it did this would mean everyone re-requesting it on their 18th birthday...

It doesn't have to be a national ID. It doesn't have to be any specific ID at all. Pass a national law requiring local governments to print the token on their local IDs.

If you want the token between when you turn 18 and when you next renew your ID then show your ID to any adult at any government office or anywhere else and have them give it to you, or get it from your parents.

Re: The UK’s new age-gating rules are easy to bypass

#188

Post by pyman »

rpdillon wrote: post #182
pyman wrote: post #155

Earlier quoted context omitted.

US politician?

I decided to do some legwork here. https://www.bbc.com/news/live/c9q7r4wpep0t TL;DR: UK politician

From what I read this politician didn't blame Amazon, she criticised the government's failure to monitor the attacker:

> She says he was referred to counter-terrorism scheme Prevent three times, but his case was not referred onwards

She also said that regulating the sale of large knives could help reduce stabbings, in the same way strict gun laws helped stop school shootings.

Honestly, in South (and North) America, everyone's carrying a gun. I wish we were talking about knife control instead.

IMO, we need to look at what countries like the UK and China are doing, where civilian gun ownership is almost completely banned.

Re: The UK’s new age-gating rules are easy to bypass

#189

Post by pyman »

Quarrel wrote: post #179
pyman wrote: post #170

Earlier quoted context omitted.

I'm a teacher in a private high school which allows students to have smartphones. Kids have unlimited access to porn and they circulate it during school hours, and there's not much we can do about it. AFAIK, the UK forced the big porn tech giants to hide explicit images and videos from the public unless users verify their age. Twitter, Telegram, WhatsApp, Reddit and other companies failed to do that. These US busines…

> AFAIK, the UK forced the big porn tech giants to hide explicit images and videos from the public unless users verify their age. Twitter, Telegram, WhatsApp, Reddit and other companies failed to do that. These US businesses turned a blind eye to porn just to make more money. Until just now, no, they had not forced them. They had repeatedly delayed and denied, just trying to win electoral points. I think you underest…

I agree, VPNs make it way too easy to get around age checks.

Maybe the solution is for governments to set up a simple age verification service, an official site where you pay $1 (refundable) to prove you're over 18. Then they could offer APIs that any website can plug into to verify users. Kind of like how barcodes work.

To avoid privacy issues, the verification site should only store a hash of the email, no images, no credit card info, nothing else. Just enough to confirm the person passed the check. A digital proof-of-age system without tracking or storing sensitive data.

Re: The UK’s new age-gating rules are easy to bypass

#190

Post by zigzag312 »

AnthonyMouse wrote: post #186
zigzag312 wrote: post #68

Earlier quoted context omitted.

If someone shares their ID publicly, that person could be identified and blocked, so this would probably be limited to sharing of ID to the people in person's social circle. If someone uploads shared token publicly, it's hard to identify who did it and anyone can use it until you rotate the token for everybody.

> If someone shares their ID publicly, that person could be identified and blocked, so this would probably be limited to sharing of ID to the people in person's social circle. This was the thing your proposal was supposed to do: > User hasn't revealed any PII data besides "is_over_18" value to the site and identity authority doesn't know which site user is accessing. If you have that, someone sets up a service that u…

For most KYC verifications just a picture of an ID card is not enough. Identity authority KYC process shouldn't allow that IDs from a data breach to pass verification.

Same ID also cannot be registered more than once at the same identity authority.

Identity authority doesn't provide tokens, but signs (nonce + requested age data) requests that user gets from a service he's trying to access. User needs to be logged in to do that.

If user shares identity authority credentials, that would show in suspicious auth pattern (e.g. accessing from multiple locations at the same time) to identity authority and account should be blocked and require the whole KYC process again.

There is an issue of someone with stolen ID registering at identity authority where true owner of ID hasn't registered and passing KYC process. This could me mitigated by, for example, limiting at which identity authorities a citizen of a specific country can register, limiting the number of concurrent registrations at identity authorities concurrently (for example an ID can be registered at max one identity authority globally at a time. You would need to close account at current identity authority to open it at another) and/or stricter KYC verification (like in person).

Again, even if someone succeeds in registering with stolen ID, sharing of the credentials still needs to be limited in order to avoid getting blocked.

In short, it all depends on identity authorities doing a good job at KYC verifications process.

Post reply on HN