Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So, you’ve hit an age gate. What now?

eff.org

Post reply on HN
Print view View original

161–170 of 306 posts

Re: So, you’ve hit an age gate. What now?

#161

Post by Aurornis »

kspacewalk2 wrote: post #98
btown wrote: post #61

Earlier quoted context omitted.

One aspect of this normalization of photo uploading is that, if a platform allows user-generated content that can splash a modal to kids, a bad actor can do things like say “you need to re-verify or you’ll lose all your in-game currency, go here” and then collect photo identification without even needing to compromise identity verification providers! I truly fear the harm that will be done before legislators realize…

The fundamental question that needs answering is: should we actually prevent minors below the age of X from accessing social media site Y? Is the harm done significant enough to warrant providing parents with a technical solution for giving them control over which sites their X-aged child signs up, and a solution that like actually works? Obviously pinky-swear "over 13?" checkboxes don't work, so this currently does…

> The fundamental question that needs answering is: should we actually prevent minors below the age of X from accessing social media site Y?

I suspect if you ask Hacker News commenters if we should put up any obstacles to accessing social media sites for anyone, a lot of people will tell you yes. The details don't matter. Bashing "social media" is popular here and anything that makes it harder for other people to use is viewed as a good thing.

What I've found to be more enlightening is to ask people if they'd be willing to accept the same limitations on Hacker News: Would they submit to ID review to prove they aren't a minor just to comment here? Or upvote? Or even access the algorithmic feed of user-generated content and comments? There's a lot of insistence that Hacker News would get an exception or doesn't count as social media under their ideal law, but in practice a site this large with user-generated content would likely need to adhere to the same laws.

So a better question might be: Would you be willing to submit to ID verification for the sites you participate in, as a fundamentally good thing for protecting minors from bad content on the internet?

Re: So, you’ve hit an age gate. What now?

#162

Post by jvanderbot »

array_key_first wrote: post #117
kspacewalk2 wrote: post #98

Earlier quoted context omitted.

The fundamental question that needs answering is: should we actually prevent minors below the age of X from accessing social media site Y? Is the harm done significant enough to warrant providing parents with a technical solution for giving them control over which sites their X-aged child signs up, and a solution that like actually works? Obviously pinky-swear "over 13?" checkboxes don't work, so this currently does…

The real solution, IMO, is a second internet. Domain names will be whitelisted, not blacklisted, and you must submit an application to some body or something.

I dont see why phones can't come with a browser that does this. Parents could curate a whitelist like people curate playlists, and share it, and the browser would honor that.

Combined with some blacklisted apps (e.g., all other browsers), this would be a passable opt-in solution. I'm sure there's either a subscription or a small incentive for someone to build this that hopefully isn't "Scam children".

It's not like kids are using PCs, and if they use someone else's phone, that's at least a severely limiting factor.

Re: So, you’ve hit an age gate. What now?

#163

Post by tracker1 »

MarsIronPI wrote: post #150
tracker1 wrote: post #138

Earlier quoted context omitted.

Yeah.. the opposition was just a bad take IMO... "but it will create a virtual red light district" which is EXACTLY what you want online, unlike a physical city, you aren't going to accidentally take a wrong turn, and if you're blocking *.xxx then it's even easier to avoid. Then require all nudity to be on a .edu, .art or .xxx, problem mostly solved.

> Then require all nudity to be on a .edu, .art or .xxx, problem mostly solved. Who's doing the requiring here? Sounds like yet another path to censorship dystopia.

In the case of cc-tlds the respective government... In the case of other TLDs ICANN.

edit: .edu provides for educational content, .art for artistic expression, .xxx for explicit content.

Re: So, you’ve hit an age gate. What now?

#164

Post by qweiopqweiop »

cons0le wrote: post #6

>If Google can guess your age, you may never even see an age verification screen. Your Google account is typically connected to your YouTube account, so if (like mine) your YouTube account is old enough to vote, you may not need to verify your Google account at all. This has been proven false a bunch of times, at least if the 1000s of people complaining online about it are to be believed. My google account is definit…

This comes across as incredibly paranoid. Most places use 3rd party age verification anyway. They're following the law/playing safe with the law in certain countries, and it's just easier to apply it everywhere.

Re: So, you’ve hit an age gate. What now?

#165

Post by thewebguyd »

btown wrote: post #61
ryandrake wrote: post #27

My kid has recently just quit playing Roblox because of the sketchy facial age check process. She said that her and all her friends know not to ever upload a picture of themselves to the Internet (good job, fellow Other Parents!!) so they're either moving on to other games or just downloading stock photos of people from the internet and uploading those (which apparently works). What a total joke. These companies need…

One aspect of this normalization of photo uploading is that, if a platform allows user-generated content that can splash a modal to kids, a bad actor can do things like say “you need to re-verify or you’ll lose all your in-game currency, go here” and then collect photo identification without even needing to compromise identity verification providers! I truly fear the harm that will be done before legislators realize…

> I truly fear the harm that will be done before legislators realize what they’ve created.

Not defending the legislation as I overwhelmingly disagree with it, but if I recall, I don't think any of the age verification legislation specifies a specific implementation of how to verify age.

Requiring photos, or photo ID, or any other number of methods being employed, were all decided on by the various private companies. All the legislators did is tell everyone "you must verify age." The fault here is on Roblox as much as it is on the legislature and they should equally share blame.

Re: So, you’ve hit an age gate. What now?

#166

Post by tzs »

cloudfudge wrote: post #60

This makes me wonder if there's a business case for a privacy-preserving identity service which does age verification. Say you have a strong identity provider that you have proven your age to. Just as the 3rd party site could use SSO login from your identity provider, perhaps the identity provider could provide signed evidence to the 3rd party site that asserts "I have verified that this person is age X" but not divu…

You've almost got it right. You just need to modify this part:

> Just as the 3rd party site could use SSO login from your identity provider, perhaps the identity provider could provide signed evidence to the 3rd party site that asserts "I have verified that this person is age X" but not divulge their identity

The way you compared it so SSO login makes it sounds like there would be interaction between the 3rd party site and the identity provider. That's bad because if someone got a hold of the records from both the site and the identity provider they might be able to match access time logs and figure out who you are.

A fix is to make it so you get your signed document from the identity provider ahead of time, and that document is not tied to doing age verification with any particular site(s). You get it once and then use it with as many sites as you want.

When you use it with a site to demonstrate age we need to do that in such a way that neither of you have to communicate with the identity provider. If the site needs to verify a signature of the identity provider on something you present they use the provider's previously published public key.

We need to make it so that when you use the signed document from the identity provider to show your age to a site they don't see enough from the document to identify you, even if they have been compromised and are collaborating with the identity provider to try to identify you.

Finally, the signed document should be bound to you in some way so that you can't just make copies and give them to others or sell them on the black market to people who want to evade age checks.

BTW, since under this approach the identity provide isn't actively involved after their issue your signed document what probably makes the most sense is to have your government be the identity provider. In particular, the same agency that issues your driver's license or passport or nation ID (if your country has those).

Such a system can in fact be built. The EU is including one in their EU Digital Identity Wallet project, which has been in development for several years and is not undergoing large scale field testing in several countries. It is supposed to be deployed to the public this year or next.

The first version handles the binding of the document to you by tying it to your smart phone's hardware security element. They plan to later support other types of hardware security elements. 90+% of adults in the EU have smart phones (95-98% for adults under 54), and it is going up, so the first version will already cover most cases.

Google has published some libraries for implementing a similar system. Both the Google libraries and the EU system are open source.

Re: So, you’ve hit an age gate. What now?

#167

Post by pcthrowaway »

Aurornis wrote: post #161
kspacewalk2 wrote: post #98

Earlier quoted context omitted.

The fundamental question that needs answering is: should we actually prevent minors below the age of X from accessing social media site Y? Is the harm done significant enough to warrant providing parents with a technical solution for giving them control over which sites their X-aged child signs up, and a solution that like actually works? Obviously pinky-swear "over 13?" checkboxes don't work, so this currently does…

> The fundamental question that needs answering is: should we actually prevent minors below the age of X from accessing social media site Y? I suspect if you ask Hacker News commenters if we should put up any obstacles to accessing social media sites for anyone, a lot of people will tell you yes. The details don't matter. Bashing "social media" is popular here and anything that makes it harder for other people to use…

This is a good opportunity to link to the recent archive of Hacker News, for when this happens: https://news.ycombinator.com/item?id=46435308

Re: So, you’ve hit an age gate. What now?

#168

Post by bigfatkitten »

ryandrake wrote: post #27

My kid has recently just quit playing Roblox because of the sketchy facial age check process. She said that her and all her friends know not to ever upload a picture of themselves to the Internet (good job, fellow Other Parents!!) so they're either moving on to other games or just downloading stock photos of people from the internet and uploading those (which apparently works). What a total joke. These companies need…

My kids also know that as far as the internet is concerned, their date of birth is 1 January 1970.

Re: So, you’ve hit an age gate. What now?

#169

Post by rhplus »

kevmo wrote: post #46
ryandrake wrote: post #27

My kid has recently just quit playing Roblox because of the sketchy facial age check process. She said that her and all her friends know not to ever upload a picture of themselves to the Internet (good job, fellow Other Parents!!) so they're either moving on to other games or just downloading stock photos of people from the internet and uploading those (which apparently works). What a total joke. These companies need…

I was getting a haircut last week and chatting about our kids with the stylist, who said (basically): "I just started letting my 7 year old on Roblox. I know its full of pedophiles. I told him to come to me or his older brother if anyone tries to talk to him." If the million reports of Mark Zuckerberg enabling pedophiles and scam artists haven't made it clear, the executives of these tech companies just don't care. T…

The drip-feed of mindless brain-rot, micro-payments, and cyber-bullying should be much higher up the list of reasons for not letting a 7 year old use Roblox (and YouTube and FaceBook and…)

Re: So, you’ve hit an age gate. What now?

#170

Post by idopmstuff »

thewebguyd wrote: post #165
btown wrote: post #61

Earlier quoted context omitted.

One aspect of this normalization of photo uploading is that, if a platform allows user-generated content that can splash a modal to kids, a bad actor can do things like say “you need to re-verify or you’ll lose all your in-game currency, go here” and then collect photo identification without even needing to compromise identity verification providers! I truly fear the harm that will be done before legislators realize…

> I truly fear the harm that will be done before legislators realize what they’ve created. Not defending the legislation as I overwhelmingly disagree with it, but if I recall, I don't think any of the age verification legislation specifies a specific implementation of how to verify age. Requiring photos, or photo ID, or any other number of methods being employed, were all decided on by the various private companies.…

How would you suggest they verify age? I am not aware of a good way to do it from a privacy and security perspective.
Post reply on HN