Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Discord's face scanning age checks 'start of a bigger shift'

bbc.com

Post reply on HN
Print view View original

191–200 of 448 posts

Re: Discord's face scanning age checks 'start of a bigger shift'

#191

Post by arctek »

Edmond wrote: post #140
whall6 wrote: post #138

Earlier quoted context omitted.

How are the certificates issued?

https://certisfy.com/partnership/ Any number of entities can be certificate issuers, as long as they can be deemed sufficiently trustworthy. Schools, places of worship, police, notary, employers...they can all play the role of trust anchor.

This just moves the issue elsewhere though. I do agree that adding an extra step of having to notarize documents will filter many people.

But outside of this if someone is determined they can issue fake documents at this level of provenance.

Drivers licenses for example you can buy the printing machine and blanks (illegally) so you actually need to check the registrar in that location.

Re: Discord's face scanning age checks 'start of a bigger shift'

#192

Post by stego-tech »

john01dav wrote: post #185
stego-tech wrote: post #173

Earlier quoted context omitted.

Oh, make no mistake, I hate both of these. I loathe this forced surveillance of everyone because parents can't be bothered to supervise and teach their children about the most primary of human animal functions (sex), regardless of their reasons for it. I take great pains to keep minors out of my adult spaces, and don't have to resort to anything as invasive as biometric surveillance or card charges. This notion that…

> take great pains to keep minors out of my adult spaces, and don't have to resort to anything as invasive as biometric surveillance or card charges. What sort of spaces are these (online or in person), and how do you enforce this? I have an online space where such non invasive measures could be useful.

Mine are rooted in the 90s/00s internet: I know the people I allow into my spaces, and extend to them a degree of trust to let others in who are also of legal age. I rotate the credentials every so often at random, forcing everyone to request the new password from me. Other spaces I inhabit also operate off this sort of "community trust" system, only letting in folks we already know ourselves. It's how we keep out minors and trolls, as well as just bad/no-longer-trusted actors.

It's inconvenient, sure, and it's not SEO-friendly, but it generally works and doesn't require checking IDs or doing biometric verifications. The thing is, I'm building a community, not a product, and therefore don't have the same concerns as, say, PornHub, for checking IDs. It's also not a scalable solution - I have to build individual rapports with people I can then trust to have the access keys to my space(s), and then monitor that trust at each password change to ensure it's not violated. It's hard work, but it's decently reliable for my needs.

For larger/at-scale providers...I think the better answer is just good-old-fashioned on-device or home-network filtering. The internet was NEVER meant to be child-friendly, and we need to make it abundantly clear to parents that it's never going to be so they take necessary steps to protect their children. I'd personally like to see more sites (in general, not just adult) contribute their domain names and CDNs to independent list maintainers (or published in a help article linked via their main footer) so individuals and organizations can have greater control over their online experience. I think if someone wants to, say, block the entire domain ranges of Amazon for whatever reason, then that information should be readily available without having to watch packet flows and analyzing CDN domain patterns.

It's just good netiquette, I think, but I'm an old-fashioned dinosaur in that regard.

Re: Discord's face scanning age checks 'start of a bigger shift'

#194

Post by zoklet-enjoyer »

chatmasta wrote: post #169
stego-tech wrote: post #164

A long, long time ago (within the past ten years), I had to verify my age with a site. They didn't ask for my ID, or my facial scan, but instead asked for my credit card number. They issued a refund to the card of a few cents, and I had to tell them (within 24hr) how much the refund was for, after which point they'd issue a charge to claw it back. They made it clear that debit and gift cards would not be accepted, it…

Is card verification a lesser form of surveillance? And there’s a good chance your card issuer (or your bank, one hop away from it) has your biometrics anyway. I don’t like either of them… (And why does YouTube ask me to verify my age when I’m logged into a Google account I created in 2004?)

Why/how would my bank have my biometrics?

Re: Discord's face scanning age checks 'start of a bigger shift'

#195

Post by SoftTalker »

stego-tech wrote: post #164

A long, long time ago (within the past ten years), I had to verify my age with a site. They didn't ask for my ID, or my facial scan, but instead asked for my credit card number. They issued a refund to the card of a few cents, and I had to tell them (within 24hr) how much the refund was for, after which point they'd issue a charge to claw it back. They made it clear that debit and gift cards would not be accepted, it…

Paypal used this method as identity (or at least account) verification back in the very early days, IIRC. They made a very small deposit and I think they just let you keep it but I can't recall that for sure.

Re: Discord's face scanning age checks 'start of a bigger shift'

#196

Post by stubish »

1659447091 wrote: post #72
Hizonner wrote: post #66

Earlier quoted context omitted.

You mean without giving them any personal information other than where to find your bank account .

It doesn't have to be your bank if you don't want, have the DMV be an issuer or your car insurance, or health insurance or cell phone service etc. You choose which one you want you want to have assert your claim. They already know you. It's a better option than giving every random website or service all of your info and biometric data so you can 'like' memes or bother random people with DM's or whatever people do on…

For Australia (who will need something like this this year per current legislation), the only sensible location is the government my.gov.au central service portal. None of the other services have an incentive or requirement to do it (Medicare, drivers license issuers, Centrelink). And given the scope of the rollout (all major social media, as nominated by the gov), it would need almost all of the banks or super funds to implement the same API for the project to not fail.

But I don't think anyone has told my.gov.au that needs to happen, so we are either going to get some proprietary solution from social media companies (tricky, since they will need to defend it in court as they are liable, but maybe discord saying 'best we can do sorry' or 'better than our competitors' will let them off). Or just switching off the services for a few days until the politicians panic about the blow back and defer the rollout until some committee can come up with a workable solution (ideally in the next election cycle).

Re: Discord's face scanning age checks 'start of a bigger shift'

#197

Post by hn_throwaway_99 »

malfist wrote: post #189
Edmond wrote: post #151

Earlier quoted context omitted.

This video addresses that: https://youtu.be/92gu4mxHmTY All certificates are cryptographically linked to an identity-anchor certificate, meaning buying a certificate would require the seller reveal the private key tied to the identity-anchor certificate, a tall order I would argue. In the case of stolen identity certificates, they can be revoked thus making their illegitimate utility limited.

So an older brother gives his sibling a key. Why would your design prevent that?

We can still have laws, e.g. that using someone else's certificate (or knowingly giving them your certificate) would constitute fraud.

We have laws against kids buying alcohol, even though kids can (and do) try to get adults to buy them booze, but I don't think that's a good reason to say we shouldn't have laws against kids drinking.

Re: Discord's face scanning age checks 'start of a bigger shift'

#198

Post by SoftTalker »

jkaplowitz wrote: post #112
KaiserPro wrote: post #104

Earlier quoted context omitted.

When a corner shop sells cigarettes to minors, who's breaking the law? When a TV channel broadcast porn, who gets fined? These are accepted laws that protect kids from "harm", which are relatively uncontroversial. Now, the privacy angle is very much the right question. But as Discord are the one that are going to get fined, they totally need to make sure kids aren't being exposed to shit they shouldn't be seeing unti…

At least the ways that a corner shop verifies age don't have the same downsides as typical online age verifiers. They just look at an ID document; verify that it's on the official list of acceptable ID documents, seems to be genuine and valid and unexpired, appears to relate to the person buying the product, and shows an old enough age; and hand the document back. The corner shop has far fewer false negatives, far lo…

> and unexpired

Because certainly one's identity might totally change if one's ID card expires...

Re: Discord's face scanning age checks 'start of a bigger shift'

#199

Post by Dylan16807 »

ndriscoll wrote: post #167
stego-tech wrote: post #164

A long, long time ago (within the past ten years), I had to verify my age with a site. They didn't ask for my ID, or my facial scan, but instead asked for my credit card number. They issued a refund to the card of a few cents, and I had to tell them (within 24hr) how much the refund was for, after which point they'd issue a charge to claw it back. They made it clear that debit and gift cards would not be accepted, it…

That was, in fact, what COPA mandated in the US in 1998, and SCOTUS struck it down as too onerous in Ashcroft v. American Civil Liberties Union, kicking off the last 20 years of essentially completely unregulated Internet porn commercially available to children with nothing more than clicking an "I'm 18" button. At the time, filtering was seen as a better solution. Nowadays filtering is basically impossible thanks to…

Despite TLS, filtering is easier to set up now than it was in 1998. You might have to block some apps in the short term, but if you suggest apps can avoid age verification if they stop pinning certificates then they'll jump at the option.

Consolidation is the only tricky part that's new.

Re: Discord's face scanning age checks 'start of a bigger shift'

#200

Post by gjsman-1000 »

ndriscoll wrote: post #167
stego-tech wrote: post #164

A long, long time ago (within the past ten years), I had to verify my age with a site. They didn't ask for my ID, or my facial scan, but instead asked for my credit card number. They issued a refund to the card of a few cents, and I had to tell them (within 24hr) how much the refund was for, after which point they'd issue a charge to claw it back. They made it clear that debit and gift cards would not be accepted, it…

That was, in fact, what COPA mandated in the US in 1998, and SCOTUS struck it down as too onerous in Ashcroft v. American Civil Liberties Union, kicking off the last 20 years of essentially completely unregulated Internet porn commercially available to children with nothing more than clicking an "I'm 18" button. At the time, filtering was seen as a better solution. Nowadays filtering is basically impossible thanks to…

This has already come up before the Supreme Court, with the argument that filtering was a less invasive technique to fulfill the government’s legitimate interests back in the early 2000s.

That ship has sailed. Even the opposition admits that trying to get everyone to filter is not going to work and is functionally insignificant. The only question is whether age verification is still too onerous.

Post reply on HN