201–210 of 1001 posts
For a project attempting to track these and coordinate technical resistance, see: https://github.com/AntiSurv/oss-anti-surveillance These bills also need to be opposed on a legal/political level. Something I realized last night is that people who lie about their age to send false signals may inadvertently open themselves up to CFAA liability (a felony ). So this is a serious matter for users who want to maintain anon…
Earlier quoted context omitted.
> App and website developers shouldn't be burdened with extra costly liability Why not? Physical businesses have liability if they provide age restricted items to children. As far as I know, strip clubs are liable for who enters. Selling alcohol to a child carries personal criminal liability for store clerks. Assuming society decides to restrict something from children, why should online businesses be exempt? On who…
> Physical businesses have liability if they provide age restricted items to children. These are often clear cut. They're physical controlled items. Tobacco, alcohol, guns, physical porn, and sometimes things like spray paint. The internet is not. There are people who believe discussions about human sexuality (ie "how do I know if I'm gay?") should be age restricted. There are people who believe any discussion about…
Plenty of people would prefer that children not learn about scientology from pro-scientology cultists too. It's not that they can't know about scientology (they probably should, in fact, because knowledge can have an immunizing effect against cults)...
And it's not that they can't know about communism (they probably should, in fact, because knowledge can have an immunizing effect against cults)...
Earlier quoted context omitted.
That is the most serious thing you can do, and the most effective. Do you know how democracy works? There are these people called representatives. They are hired by you . They pass laws. They only get to continue having a job if people like you vote for them. When you tell them "I don't like the law you are passing", they are hearing "the people who hire me are angry with me". The more people that are angry at what t…
It’s not the most effective though. I’ve been writing all my reps at various levels and yet the things I don’t want keep happening.
Earlier quoted context omitted.
The same argument could be said for other age verification methods. Nothing stops a kid from getting their older cousin to verify their identity for something and it will never be possible to prevent this.
The one where the root user can enable parental controls requires the kid to know their parent's password or save up to buy their own device.
(Note, this is why they won’t stop at the CA bill.)
Earlier quoted context omitted.
Even with ZKP this is still highly problematic, it create difficulty for undocumented people to access the web, create ton of phishing opportunity, reinforce censorship on most site (as they will now all need to be minor compliant or need age verification), reinforce the chilling effect and make the web even less crawlable/archivable (or you need to give a valid citizen ID to your crawler/archiver). With no proof it…
>it create difficulty for undocumented people to access the web Why is this such a sticking point in US politics? If the "undocumented" people aren't supposed to be in the country in the first place, why should rest of society cater to them? Even if you're against age verification for other reasons, dragging in the immigration angle is just going to alienate the other half of the population who don't share your view…
Age verification is merely the background task to set up infrastructure for OS to provide many many other signals about who's using the device. Age signals from the OS? Need to provide a channel of information available to applications. Applications already talk to servers with unchecked commonality. Biometric data? Today it unlocks your private key. Tomorrow it's used to verify you are the same person that was used…
>Age signals from the OS? Need to provide a channel of information available to applications. Applications already talk to servers with unchecked commonality. This is a non-issue because it's almost certainly going to be gated behind a permission prompt. There are more invasive things sites/apps can ask for, and we seem to be doing fine, eg. location. Moreover is it really that much of a privacy loss if you go on ste…
Watch as apps refuse to work when you deny them permission. Also the OS (and “privileged apps”) don’t ask for permission, they have full unfettered access to everything already.
For a project attempting to track these and coordinate technical resistance, see: https://github.com/AntiSurv/oss-anti-surveillance These bills also need to be opposed on a legal/political level. Something I realized last night is that people who lie about their age to send false signals may inadvertently open themselves up to CFAA liability (a felony ). So this is a serious matter for users who want to maintain anon…
Did that link just get taken down?
Not surprisingly, Meta is possibly the worst "offender" behind funding of these campaigns.
I am now waiting for Gruber (daringfireball.net) to post another rant about how terrible EU regulation is. Zero-knowledge proofs are the way to go for this type of thing, I find it mind-boggling that the US lets itself be bamboozled into complete lack of privacy.
The benefit of zero-knowledge proofs is that the hide information about the ID and who it belongs to.
That’s also a limitation for how useful they are as an ID check mechanism. At the extreme, it reduces to “this user has access to an ID of someone 18+”. If there is truly a zero-knowledge construction using cryptographic primitives then the obvious next step is for someone to create an ad-supported web site where you click a button and they generate a zero-knowledge token from their ID for you to use. Zero knowledge means it can’t be traced back to them. The entire system is defeated.
This always attracts the rebuttal of “there will always be abuse, so what?” but when abuse becomes 1-click and accessible to every child who can Google, it’s not a little bit of abuse. It’s just security theater.
So the real cryptographic ID implementations make compromises to try to prevent this abuse. You might be limited to 3 tokens at a time and you have to request them from a central government mechanism which can log requests for rate limiting purposes. That’s better but the zero-knowledge part is starting to be weakened and now your interactions with private services require an interaction with a government server.
It’s just not a simple problem that can be solved with cryptographic primitives while also achieving the actual ID goals of these laws.
Every single Linux kernel currently operating within the borders of any of these states should turn itself off and refuse to boot until an update is installed after these bills are rolled back. We should also update all FOSS license terms to explicitly exclude Meta or any affilites from using any software licensed under them.