Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

So, you’ve hit an age gate. What now?

eff.org

Post reply on HN
Print view View original

241–250 of 306 posts

Re: So, you’ve hit an age gate. What now?

#241

Post by dredmorbius »

cloudfudge wrote: post #60

This makes me wonder if there's a business case for a privacy-preserving identity service which does age verification. Say you have a strong identity provider that you have proven your age to. Just as the 3rd party site could use SSO login from your identity provider, perhaps the identity provider could provide signed evidence to the 3rd party site that asserts "I have verified that this person is age X" but not divu…

What's ... boggled me about this issue since forever is that:

1. Most people access online content through either a personal or business broadband service (residential, mobile, or place-of-work).

2. Those services ... bill directly. Which means that it should be possible to specify an age preference for the service account as a whole, and/or subsets of it. The service can specify whether or not age-bounded online services are acceptable or not, as well as specific classes of age-bounded services. E.g., a workplace service would generally allow for >18 access, but might restrict usage of gaming, gambling, pr0n, or related sites. A household might request no age gating at all (all >18 or whatever minimum age is mandated) or several classes of service, say, if adults and children are present.

3. Where it's necessary to specify multiple preferences, multiple network segments could provide this logically (e.g., an IPv6 block with unrestricted and age-gated ranges), with distinct devices being allocated appropriate gateway addresses.

4. Effectively, the connectivity provider then attests for age, without requiring any finer-grained identity disclosure.

Why ...

A. Would this not work?

B. Is it not being generally proposed?

Re: So, you’ve hit an age gate. What now?

#242

Post by dredmorbius »

triceratops wrote: post #122
cloudfudge wrote: post #60

This makes me wonder if there's a business case for a privacy-preserving identity service which does age verification. Say you have a strong identity provider that you have proven your age to. Just as the 3rd party site could use SSO login from your identity provider, perhaps the identity provider could provide signed evidence to the 3rd party site that asserts "I have verified that this person is age X" but not divu…

Yes. In fact the 3rd party doesn't even need to know who you are. https://news.ycombinator.com/item?id=46447282

Or simply the connectivity provider, see: https://news.ycombinator.com/item?id=46627433>.

Re: So, you’ve hit an age gate. What now?

#243

Post by apricot »

bigfatkitten wrote: post #168
ryandrake wrote: post #27

My kid has recently just quit playing Roblox because of the sketchy facial age check process. She said that her and all her friends know not to ever upload a picture of themselves to the Internet (good job, fellow Other Parents!!) so they're either moving on to other games or just downloading stock photos of people from the internet and uploading those (which apparently works). What a total joke. These companies need…

My kids also know that as far as the internet is concerned, their date of birth is 1 January 1970.

By an amazing coincidence, that's also my date of birth, as well as my kids'.

Re: So, you’ve hit an age gate. What now?

#244

Post by cloudfudge »

dredmorbius wrote: post #241
cloudfudge wrote: post #60

This makes me wonder if there's a business case for a privacy-preserving identity service which does age verification. Say you have a strong identity provider that you have proven your age to. Just as the 3rd party site could use SSO login from your identity provider, perhaps the identity provider could provide signed evidence to the 3rd party site that asserts "I have verified that this person is age X" but not divu…

What's ... boggled me about this issue since forever is that: 1. Most people access online content through either a personal or business broadband service (residential, mobile, or place-of-work). 2. Those services ... bill directly. Which means that it should be possible to specify an age preference for the service account as a whole, and/or subsets of it. The service can specify whether or not age-bounded online ser…

To be blunt, because it sounds insane and simultaneously solving the problem at the wrong abstraction level, and based on criteria that have nothing to do with age. Age-based IP ranges? This sounds like a recipe for reinventing the entire internet in a non-backwards-compatible way. Networks are not people. Why would we treat the network as your identity?

Re: So, you’ve hit an age gate. What now?

#245

Post by cloudfudge »

tzs wrote: post #166
cloudfudge wrote: post #60

This makes me wonder if there's a business case for a privacy-preserving identity service which does age verification. Say you have a strong identity provider that you have proven your age to. Just as the 3rd party site could use SSO login from your identity provider, perhaps the identity provider could provide signed evidence to the 3rd party site that asserts "I have verified that this person is age X" but not divu…

You've almost got it right. You just need to modify this part: > Just as the 3rd party site could use SSO login from your identity provider, perhaps the identity provider could provide signed evidence to the 3rd party site that asserts "I have verified that this person is age X" but not divulge their identity The way you compared it so SSO login makes it sounds like there would be interaction between the 3rd party si…

> That's bad because if someone got a hold of the records from both the site and the identity provider they might be able to match access time logs and figure out who you are

I see your point, but this doesn't sound like an actual risk to me. The idp will have security as one of their critical features and should be considered trustworthy in this regard. And having *both* the target site logs *and* the idp logs compromised is even more far-fetched. We aren't sitting around worrying about people correlating ISP logs to pornhub logs, and I don't trust my ISP any farther than I can throw them.

The beauty of using an SSO-style scheme is that one could actually see it easily slotting in as a subset of existing protocols. The site could get a SAML doc and the only claims it has in it are "user is over 18", for example. Use the infrastructure for exactly what it's designed for: identifying some selection of attributes that describe a person. It's very elegant and leverages existing well-understood (and well-integrated) tech plumbing.

This also takes all the sensitive data handling out of the hands of social media mongers and pornographers. Let them do what they're good at and let the competent security folks handle the sensitive bits.

Re: So, you’ve hit an age gate. What now?

#246

Post by notepad0x90 »

I don't know why I find myself to be the lone voice with this opinion, but the pushback here should for the governments themselves to implement age-verification, just like how it's their job to implement issuance of IDs.

They can implement a transparently auditable system, where you scan your id-card (nfc or camera) in the government's portal, and using oauth federation, it will confirm your age, and nothing more than that to sites requesting it.

Site that wish to prevent the fact that you visited them a secret from the government can use various temporary domains, ips, Tor,etc... so long as the government's verification service can reach it.

The government already has your ID information, and they already know at least your home IP (yes, this is actively shared with them in the US). The only privacy concern is them knowing what sites you're visiting.

I get resisting and fighting this, but it's been years now and people are having to endure this mess. It isn't going away either. I was complaining about KYC laws earlier, they started out the same, it was about "terrorists" then.

You can fight two fights in parallel. One to prevent the whole thing, another to require the government to implement a service themselves, do it transparently and preserve privacy while doing so.

Yet another proposal I have is for sites that offer oauth federated login (google,microsoft,github,etc..) to vouch for your id verification, either by them doing it directly or via the government portal i proposed earlier. You'll then just login to sites with the right google account or whatever and that's all the site will ask from you.

I would also be fine with buying a 'card' of some sort at stores that do id verification already, like where you'd buy a cigarette or alcohol. You also buy some scratchable card with a verification code on it. They can't argue it's not good enough, because it's good enough for cigs and alcohol. they can't say "what if a minor gets a hold of the card later" because what if a minor gets a hold of cigs or alcohol later as well?

Re: So, you’ve hit an age gate. What now?

#247

Post by smegger001 »

tracker1 wrote: post #163
MarsIronPI wrote: post #150

Earlier quoted context omitted.

> Then require all nudity to be on a .edu, .art or .xxx, problem mostly solved. Who's doing the requiring here? Sounds like yet another path to censorship dystopia.

In the case of cc-tlds the respective government... In the case of other TLDs ICANN. edit: .edu provides for educational content, .art for artistic expression, .xxx for explicit content.

Who decides where the art erotica boarder is? There is plenty of content that would straddle that border, I have seen art that could legitimately called pornographic and pornography i would describe as art. Who decides? And then you have prudes Florida Texas red states trying to prevent remove any thing from an .edu and would happily ban the .xxx entirely and would find any .art suspect and probably ban it.

Re: So, you’ve hit an age gate. What now?

#248

Post by like_any_other »

kspacewalk2 wrote: post #98
btown wrote: post #61

Earlier quoted context omitted.

One aspect of this normalization of photo uploading is that, if a platform allows user-generated content that can splash a modal to kids, a bad actor can do things like say “you need to re-verify or you’ll lose all your in-game currency, go here” and then collect photo identification without even needing to compromise identity verification providers! I truly fear the harm that will be done before legislators realize…

The fundamental question that needs answering is: should we actually prevent minors below the age of X from accessing social media site Y? Is the harm done significant enough to warrant providing parents with a technical solution for giving them control over which sites their X-aged child signs up, and a solution that like actually works? Obviously pinky-swear "over 13?" checkboxes don't work, so this currently does…

> should we actually prevent minors below the age of X from accessing social media site Y?

Who's 'we'? The parents? The government? Device manufacturers? Answers should differ wildly depending on who is doing the enforcement.

Re: So, you’ve hit an age gate. What now?

#249

Post by dredmorbius »

cloudfudge wrote: post #244
dredmorbius wrote: post #241

Earlier quoted context omitted.

What's ... boggled me about this issue since forever is that: 1. Most people access online content through either a personal or business broadband service (residential, mobile, or place-of-work). 2. Those services ... bill directly. Which means that it should be possible to specify an age preference for the service account as a whole, and/or subsets of it. The service can specify whether or not age-bounded online ser…

To be blunt, because it sounds insane and simultaneously solving the problem at the wrong abstraction level, and based on criteria that have nothing to do with age. Age-based IP ranges? This sounds like a recipe for reinventing the entire internet in a non-backwards-compatible way. Networks are not people. Why would we treat the network as your identity?

What strikes you as unreasonable?

What I'm suggesting for different service levels is simply to map a specified access / age-verification level to a specific network access point. This is better suited to IPv6 which has a much larger address space than IPv4, and often allocates a range of addresses rather than a single IP, though NAT or IP shenanigans might be possible for the latter as well.

The point is to put the heavy lifting of age validation at a level at which who is getting the service has already been vouched through service account provisioning.

Re: So, you’ve hit an age gate. What now?

#250

Post by satiric »

bigfatkitten wrote: post #168
ryandrake wrote: post #27

My kid has recently just quit playing Roblox because of the sketchy facial age check process. She said that her and all her friends know not to ever upload a picture of themselves to the Internet (good job, fellow Other Parents!!) so they're either moving on to other games or just downloading stock photos of people from the internet and uploading those (which apparently works). What a total joke. These companies need…

My kids also know that as far as the internet is concerned, their date of birth is 1 January 1970.

I wondered for a while why I got so many ads targeted towards seniors when I made my facebook account as a kid. Then I remembered my birth year was set to 1905. I guess I should let the Guinness World Records know that their listing for oldest man in the world is inaccurate.
Post reply on HN