Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

What we call "age verification" is actually mass surveillance

pluralistic.net

Post reply on HN
Print view View original

481–490 of 520 posts

Re: What we call "age verification" is actually mass surveillance

#481

Post by account42 »

narnarpapadaddy wrote: post #182
therealdrag0 wrote: post #144

Am I the only one who looked at NSFW websites at 10 years old and played games with voice chat with players of all ages too, and I turned out to be well adjusted productive member of society? People need to chill.

Same, I care little about NSFW. We used to all live in caves together where kids saw adults having sex, in conflict, and cleaning game. But I also grew with a different internet than we have now. There’s a level of targeted manipulation that’s novel. I’m not sure the cat goes back in the bag no matter what we do.

But the targeted manipulation is also bad for adults.

Re: What we call "age verification" is actually mass surveillance

#482

Post by account42 »

nitwit005 wrote: post #413
therealdrag0 wrote: post #144

Am I the only one who looked at NSFW websites at 10 years old and played games with voice chat with players of all ages too, and I turned out to be well adjusted productive member of society? People need to chill.

That's the system. You're supposed to freak out about your kids doing the same things you did when you were young.

As long as freaking out means ranting at the dinner table and not making dystopian laws for everyone, sure.

Re: What we call "age verification" is actually mass surveillance

#483

Post by gambiting »

palata wrote: post #470
gambiting wrote: post #444

Earlier quoted context omitted.

On the other hand, you can't implement single use codes this way, right?

You can. Or maybe I don't get what you mean? It's possible for the government (or any entity, but when it comes to ID it feels natural that the government owns it) to verify your age (by verifying your identity) and give you a token that proves that you are above age, in such a way that the government cannot track you with this token and the website cannot identify you from this token. Using zero-knowledge proofs.

With my implementation, the government revokes the code after it's been verified once. If you want to verify elsewhere, you need to request a new code.

How does that work with your implementation? A token given to you can be verified as legit by anyone using a public key, but there is no way to revoke it after a single use(because you have no way of knowing it's been used, by design).

Re: What we call "age verification" is actually mass surveillance

#484

Post by gambiting »

Epa095 wrote: post #478
gambiting wrote: post #445

Earlier quoted context omitted.

Actually, thinking about it some more - it has one major downside. You can't have a single use key this way.

Well the idea with the date/timestamp was that it would only be valid for X minutes, but if you are afraid that in the 10 minutes window it can be used multiple places you can add some salt to the process. PH pops up a page showing "Your secret word is: hamburgers. Provide access code below:". Age-verifier webpage asks for the secret word, and will create a json with "secret: hamburgers, claims: over_a18, date:2026..…

Right, yeah I like that idea. I think that would actually work correctly and safely. Disregard my other comment on this :-)

Re: What we call "age verification" is actually mass surveillance

#485

Post by Sankozi »

oceansky wrote: post #125
Sankozi wrote: post #100

Earlier quoted context omitted.

This is a manipulation tactic not an argument. Almost nobody wants to prevent spying on kids. Main goal is to prevent harmful content like porn, gore and gambling.

Those digital surveillance rules passed in Brazil under the Digital Statute for Children and Adolescents law. Protection of kids is definitely the most common arguments for them.

Protecting kids does not equal protecting kids from spying, which is what the article is arguing against.

Re: What we call "age verification" is actually mass surveillance

#486

Post by Sankozi »

rootusrootus wrote: post #251
CPLX wrote: post #221

Earlier quoted context omitted.

No let's not. Let's actually create and maintain a society. There are still places in the world where you and your family can literally fend for yourself against nature and rival gangs and so on if you're just super attached to the concept though, it's not like this option has been foreclosed.

This discussion is about the Internet. I.e. that we already have police and regulate in-person things like selling alcohol to minors, etc, is not a great argument in support of policing information .

You were arguing against such restrictions (nor selling alcohol to minors) in the top post.

So which way it is - parents protect kids on their own or society/state helps somewhat?

Re: What we call "age verification" is actually mass surveillance

#487

Post by me-vs-cat »

raxxorraxor wrote: post #460
Aaargh20318 wrote: post #93

Earlier quoted context omitted.

The way identity wallets work: The government issues an eID to your wallet. The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID. The government signs individual attributes combined…

I don't want an eID established on the net. It isn't sensible design. It would only work for the legal offerings and those just can send a header and devices need to block any communication if device is in kidmode. Easy, efficient, better engineering. Illegal offerings won't do either of course. That can only be achieved by whitelisting a kid-net. Resource intensive, but only choice if you want unsupervised kid safet…

What do you mean by "active parenting", and why is it unrealistic?

(Do you mean something specific like HHS' Active Parenting™? https://preventionservices.acf.hhs.gov/programs/744/show )

Re: What we call "age verification" is actually mass surveillance

#488

Post by tremon »

pseudalopex wrote: post #387
Aaargh20318 wrote: post #206

Earlier quoted context omitted.

> Not true. The device's public key is also sent, which functions as a stable device identifier. This is covered by allowing for single-use credentials. IIRC the EU personal IDs will use this. Basically, the wallet requests a batch of single-use eIDs that all use different device key-pairs. Each credential is only used for one request and then deleted. The wallet will automatically request new credentials in batches…

> This is covered by allowing for single-use credentials. They said There are proposed mitigations like issuing multiple sets of credentials or rotating them, but we're not going to get an infinite number of keypairs for every website or session in the secure enclave in practice. > Basically, the wallet requests a batch of single-use eIDs that all use different device key-pairs. The comments you replied to omitted ma…

> The government would know what wallet requested each single use identifier

Which only means that the government knows how many tokens each citizen consumes on average. They don't know where each identifier was used nor the exact timestamp unless each website communicates this to the government, and such a backchannel does not exist in the spec.

Re: What we call "age verification" is actually mass surveillance

#489

Post by subscribed »

ninalanyon wrote: post #103
Aaargh20318 wrote: post #93

Earlier quoted context omitted.

The way identity wallets work: The government issues an eID to your wallet. The ID is signed by the government and linked to the device to prevent transferring the credential. A public/private key-pair is generated by the secure enclave in your phone, the public key along with proof of possession of the private key is included in the request for the government eID. The government signs individual attributes combined…

So now I have to have a mobile phone?

What do you think is the trade off?

You need mobile phone anyway.

Re: What we call "age verification" is actually mass surveillance

#490

Post by gampleman »

johnc1 wrote: post #333

We're already been protecting children from printed porn, alcohol, drugs (legal or illegal), guns, etc. Children don't even have to buy those items, sometimes they can get them from friends or even find at home. It's always been parents responsibility to protect from that, and the Internet doesn't change that. What the Internet does change is granularity of controls. With physical goods, parents can choose to give ch…

As I pointed out elsewhere, the problem is that these parental controls don't work. It's a matter of incentive: at the moment, it's in the interest of providers to help subvert the filters. Device makers also don't have the strongest incentives to make the filters great, since that would presumably lead to less engagement from large market segments.

One of the explicit goals of age verification laws is to throw the legal responsibility of preventing access from minors onto the providers, thereby inverting the incentives.

Post reply on HN