Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What we call "age verification" is actually mass surveillance

pluralistic.net

Post reply on HN
Print view View original

61–70 of 520 posts

Re: What we call "age verification" is actually mass surveillance

#61

Post by utopiah »

john_strinlai wrote: post #27
Wowfunhappy wrote: post #16

Earlier quoted context omitted.

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general. Heck—in most cases, we can't even tell…

> Could you be more specific as to what you're imagining? sure, i'll put my favorite two. though you'll find much more detailed and thought-out versions of these (and others) in the dozens of other giant threads on the same topic. - buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is no…

> UUID card is non-identifying.

Kids aren't going to trade Pokemon cards in the playground anymore...

Re: What we call "age verification" is actually mass surveillance

#62

Post by Retr0id »

cogman10 wrote: post #47
Retr0id wrote: post #29

Earlier quoted context omitted.

Where are these mythical sweet-spot solutions? Concretely, half the websites I visit from the UK want me to either scan my face or upload ID documents to access their full featureset. Now that users have been conditioned to accept this, nobody seems very interested in figuring out how to collect less PII - only insulating themselves from liability by having the data processed by a third party.

The UK has draconian laws. But some of the easiest middle ground solutions that solve 90% of the problem are things like simple math problems. Get asked "3+7" and that will pretty quickly filter out almost anyone under the age of 6. If you can accept that there are some smart 4 or 5 year olds who can do simple math, congrats you recognize there's a 10%.

They are indeed draconian, and the rest of the world is now eyeing up adopting similar legislation.

Re: What we call "age verification" is actually mass surveillance

#63

Post by oliwarner »

Wowfunhappy wrote: post #16
john_strinlai wrote: post #2

> "Age verification" means that everyone who does anything online will have to submit to fine-grained tracking and recording of all their online activities. its been said 1000 times here, but: age verification doesn't have to be a nightmare dystopia of 24/7 fine-grained tracking and recording unless you are somehow hoping to achieve 100% success rate (something we have not done with any other law ever). there are sev…

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general. Heck—in most cases, we can't even tell…

That's because you're treating AV as a system that must be 100% correct immediately. This isn't banking or an election.

As soon as you loosen off the requirements to "reasonable effort", you can start looking at account age, facial features, social attestation, and include retrospective tools to revisit someone's verification if they get in and start acting like a child. Heuristically messy but far from impossible to demand a stronger form of verification if their original might have been borderline.

The goal is broad coverage, not complete. Screening doesn't have to get 100% to have an effect.

Re: What we call "age verification" is actually mass surveillance

#64

Post by Jabrov »

gambiting wrote: post #59
Retr0id wrote: post #29

Earlier quoted context omitted.

Where are these mythical sweet-spot solutions? Concretely, half the websites I visit from the UK want me to either scan my face or upload ID documents to access their full featureset. Now that users have been conditioned to accept this, nobody seems very interested in figuring out how to collect less PII - only insulating themselves from liability by having the data processed by a third party.

Government builds a website where you can log in using any government issued ID or using one of the many many many available services that hold your details already(at least in the UK nearly everyone will have a DLVA account, HMRC account, HMPO account, NHS account.....all of these are government services which we can only assume hold our data securely already). On that website, you can click "give me a verification…

The codes can trivially be shared in this case

Re: What we call "age verification" is actually mass surveillance

#65

Post by cogman10 »

john_strinlai wrote: post #27
Wowfunhappy wrote: post #16

Earlier quoted context omitted.

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general. Heck—in most cases, we can't even tell…

> Could you be more specific as to what you're imagining? sure, i'll put my favorite two. though you'll find much more detailed and thought-out versions of these (and others) in the dozens of other giant threads on the same topic. - buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is no…

And honestly, all these should ultimately just be done client side in the browser. After the browser has verified "User is x or user is over 21" there's no reason to then send that information to the website.

Let websites issue a "window.isUserOver(16)" call once and then move forward based on the response to that query.

Re: What we call "age verification" is actually mass surveillance

#66

Post by amanaplanacanal »

ordu wrote: post #56
john_strinlai wrote: post #2

> "Age verification" means that everyone who does anything online will have to submit to fine-grained tracking and recording of all their online activities. its been said 1000 times here, but: age verification doesn't have to be a nightmare dystopia of 24/7 fine-grained tracking and recording unless you are somehow hoping to achieve 100% success rate (something we have not done with any other law ever). there are sev…

> age verification doesn't have to be a nightmare dystopia of 24/7 fine-grained tracking and recording unless you are somehow hoping to achieve 100% success rate I believe you are missing the point. "To protect kids" is just a cover, the nightmare dystopia is the real goal. So age verification have to be a nightmare dystopia or it would be useless for those, who push for it.

Well, some who push it anyway. There is another group whose motive is to get rid of all porn.

Re: What we call "age verification" is actually mass surveillance

#67

Post by john_strinlai »

donmcronald wrote: post #60
john_strinlai wrote: post #27

Earlier quoted context omitted.

> Could you be more specific as to what you're imagining? sure, i'll put my favorite two. though you'll find much more detailed and thought-out versions of these (and others) in the dozens of other giant threads on the same topic. - buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is no…

> buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time Why should I pay continuously to prove I'm an adult? And those cards will be getting sold to kids faster than you can blink. I bet a lot of parents would buy them for their kids.

>And those cards will be getting sold to kids faster than you can blink.

there's a reason i said 90% and not 100% effective. alcohol and tobacco get resold to kids, too.

Re: What we call "age verification" is actually mass surveillance

#68

Post by vaylian »

seethishat wrote: post #31

My main concern is transparency. How do we know that the ruling/governing class is not abusing these monitoring systems and exempting themselves from monitoring? If we are all subject to the same monitoring and there are no exceptions, that would be fair. However, if some people are exempt from monitoring because of their connections, relations, etc. then that would be unfair. And if some people are allowed to harass…

> If we are all subject to the same monitoring and there are no exceptions, that would be fair.

Not everyone is an exhibitionist. Some people thrive when they are very public about their life. Some prefer a much more private life.

Re: What we call "age verification" is actually mass surveillance

#69

Post by shevy-java »

> What we call "age verification" is actually mass surveillance

Thank you.

It has never been about "protecting the children" either. That was always a lie - the red herring. Many pointed that out from the get go too.

The much more fascinating thing is how legislation is still being actively changed to sustain that narrative. This is like a pre-scripted event what we are seeing here. I find it quite fascinating. It shows how real lobbyism actually works.

My prediction is that mandatory age sniffing will come, they will continue to claim it is all for children, and the openness of the world wide web will factually be transformed into a two-class apartheid system. The latter has already happened actually - you have walled gardens e. g. discord rather than oldschool phpBB webforums (aka privately controlled access to information), Google already ruined its search engine, AI slop continues to ruin more here. These are all not isolated. This is a deliberate mega-slop attack, combined with payments to key lobbyists. We see a degradation of services here. That they attack VPNs is very logical - after all VPNs allow people to break out of the global ghetto system they are building here. They want to know who is who.

Interestingly I see this attack also related to them trying to abolish the right to repair movement. Now, there is no direct connection here, but right to repair also attempts to put people at the center - you purchased something, you should be able to freely change it to your own liking, without some random private company being able to proxy-deny any change to that. With mandatory age sniffing coming, it also means that people will lose the ability to change software. Recently a university here in Europe started to demand that students must own a smartphone AND must install an app from a private company (via google store) in order to be able to read email sent to them via a webmail account. I also found this fascinating, because now people need to submit to Google, in order to study in a small european country, if they study at that university (which is paid for by taxpayers by the way). These interdependencies will keep on increasing here. Even Linux will fall victim - systemd already added data fields to track your age. More to come in the future despite Poettering's claim that it is all very, very harmless. Until it is not. And then it is too late.

Re: What we call "age verification" is actually mass surveillance

#70

Post by bbminner »

michael1999 wrote: post #24
Wowfunhappy wrote: post #16

Earlier quoted context omitted.

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general. Heck—in most cases, we can't even tell…

Info-minimized oidc handshakes with certified identity providers could verify age-category of a user with no other information shared. Consider "log in with apple" as it is today. Depending on what you share, a relying website might not even get your name or email.

Yes, that was my thought as well when i was visiting UK and reddit kept asking me to verify my age. It might be even more private and non-trackable than that - if "age.id.gov" central authority effectively "provides a new random user id" (implementation may vary and does not need to have a "literal username") every time you try to use it / log into a website that needs to verify your age - this way websites can not even track you across platforms.

It seems like all the tech stack is there to implement a very simple and privacy-persevering solution.

It does not even smell of state censorship because a website does not have to check your age if it decides to be "non compliant".

Why isn't it implemented like that? Based on the comments it seems more like a "free-for-all implement-your-own-PPI-handling-thon".

This will ofc make life harder for a some groups of people - like people without / limited access to IDs etc. And i do not even argue that the whole thing is necessary.

But there seem to be vastly superior technical means to implement that, aren't there?

Post reply on HN