Live data from Hacker News

What we call "age verification" is actually mass surveillance

pluralistic.net

321–330 of 520 posts

Re: What we call "age verification" is actually mass surveillance

#321

Earlier quoted context omitted.

Could you be more specific as to what you're imagining? I don't personally see a way to verify someone's age which doesn't involve either credit card verification, photo id verification, or some sort of facial recognition. If you know enough about someone to verify their age—even to a relatively low degree of accuracy—you probably know enough to pinpoint who they are in general. Heck—in most cases, we can't even tell…

> Could you be more specific as to what you're imagining? sure, i'll put my favorite two. though you'll find much more detailed and thought-out versions of these (and others) in the dozens of other giant threads on the same topic. - buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is no…

> buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is non-identifying.

This could be a good system if it's set up right. There's still some risk of being tracked if it isn't though. IDs could be linked to the cards at the time of purchase if retailers scan the drivers license, then scan the card creating a record that card #XXXXX was purchased using driver's license # XXXXX

Even if retailers aren't scanning the drivers licenses and collecting data that way, the cards and codes on those cards can be tracked and traceable to a retailer. That's how things like calling cards have been tracked. Say for example someone uses the code on a card to access a website, the police can match the code that was used to the serial number of the card, look up which retailer that card was sold at, and can then access security camera footage at that retailer to identify who bought the card from that location. This would also let them passively generate lists of IP addresses/device IDs matched to websites and specific retail locations over time.

Re: What we call "age verification" is actually mass surveillance

#322

> "Age verification" means that everyone who does anything online will have to submit to fine-grained tracking and recording of all their online activities. its been said 1000 times here, but: age verification doesn't have to be a nightmare dystopia of 24/7 fine-grained tracking and recording unless you are somehow hoping to achieve 100% success rate (something we have not done with any other law ever). there are sev…

Sweet summer child. This is not about age verification.

>Sweet summer child.

my comment is only 81 words long, yet it seems that multiple people fail to make it to the end for some reason.

("full dystopia" should be a hint that i recognize the ulterior motive)

Re: What we call "age verification" is actually mass surveillance

#323
post #29

Earlier quoted context omitted.

Where are these mythical sweet-spot solutions? Concretely, half the websites I visit from the UK want me to either scan my face or upload ID documents to access their full featureset. Now that users have been conditioned to accept this, nobody seems very interested in figuring out how to collect less PII - only insulating themselves from liability by having the data processed by a third party.

Government builds a website where you can log in using any government issued ID or using one of the many many many available services that hold your details already(at least in the UK nearly everyone will have a DLVA account, HMRC account, HMPO account, NHS account.....all of these are government services which we can only assume hold our data securely already). On that website, you can click "give me a verification…

Why does the government need to know what pages you visit? It could just encode a string representing the date and 'above 18' and sign it with its private key. PH then just needs to verify it using the public key.

Re: What we call "age verification" is actually mass surveillance

#324
post #259

Parents largely control what their kids have access to, whether it requires a device, a data plan, home Wi-Fi, whatever. Where parents don't/can't control their kids' access, no amount of regulation and technology will fix it. This applies not just to social media, but drugs, alcohol, porn, etc. Yes, laws and IDs add friction and that's good, but if a kid really wants those things they are going to find a way. Social…

Glad that absolutely nothing in my life uses social media for communication like this. What a shitty way to reach people too. Your post is going to be served days late whenever its churned by the algorithm to the intended user, if at all. Meanwhile, email always works. There are even services that will mass text people.

Re: What we call "age verification" is actually mass surveillance

#325

Earlier quoted context omitted.

Make unrestricted devices like alcohol: you need ID to buy (but the box containing the device you’re sold is indistinguishable from any other, so the device may have a UUID but it can’t be traced to your ID); kids caught with unrestricted devices in school have them confiscated; maybe fine parents, but I think discouragement and banning in schools is enough. Kids can have restricted devices, distinguished from unrest…

I don't know, treating general-purpose computers like alcohol seems a lot more dystopian to me. Does this extend to PC components? Can I build a machine and put Linux on it?

> I don't know, treating general-purpose computers like alcohol seems a lot more dystopian to me

Isn't this the logical end goal of basically every approach to "age verification", though? If you really want to control access to the internet, then you can't let people have a VPN or Tor, and if you don't want people to VPNs or Tor then you need to lock the device down.

Re: What we call "age verification" is actually mass surveillance

#326

Earlier quoted context omitted.

> Could you be more specific as to what you're imagining? sure, i'll put my favorite two. though you'll find much more detailed and thought-out versions of these (and others) in the dozens of other giant threads on the same topic. - buy a card with a UUID from anywhere that sells alcohol/tobacco that is valid for some period of time. most people are comfortable with flashing their ID at the clerk. the UUID card is no…

And honestly, all these should ultimately just be done client side in the browser. After the browser has verified "User is x or user is over 21" there's no reason to then send that information to the website. Let websites issue a "window.isUserOver(16)" call once and then move forward based on the response to that query.

Don't even bother having the website ask the browser anything at all. Just have the website TELL the browser the content is intended for adults via HTTP header and let the browser decide to display it or not depending on parental controls.

Re: What we call "age verification" is actually mass surveillance

#327

The slippery slope argument is hugely valid, but having kids not have access to alcohol, porn and guns is very normal. We don't even discuss it in the 'physical world' because it's absolutely normative. Even in 'Europe' kids aren't going into the liquor store stocking up obviously - there are always age and responsibility-related conventions. The 'online' nature of this piques our anti-authoritarian triggers and tend…

In europe drinking age is what 16? By the time you want to regularly drink you are already legally allowed to. Meanwhile in the US you get screwed by both the law and your university for drinking in a dorm at 20 years old.

Re: What we call "age verification" is actually mass surveillance

#328

Earlier quoted context omitted.

And honestly, all these should ultimately just be done client side in the browser. After the browser has verified "User is x or user is over 21" there's no reason to then send that information to the website. Let websites issue a "window.isUserOver(16)" call once and then move forward based on the response to that query.

Don't even bother having the website ask the browser anything at all. Just have the website TELL the browser the content is intended for adults via HTTP header and let the browser decide to display it or not depending on parental controls.

Yeah, that's even better.

Re: What we call "age verification" is actually mass surveillance

#329

This reminds me of being refused entry to a nightclub in the US because I’d forgotten my passport, even though I had a European ID card and I’m over 40. Offline, age checks already often become rigid “approved identity document” checks. Online, that problem seems even worse, because the check can become a persistent identity layer across the web.

Maybe it is just a lax west coast thing but they hardly ID here. Bartenders straight up don't ever card at all. Only place you'd get carded is if they put a bouncer out front, which only happens when it is getting really busy, and even then they are mostly there to keep out teenagers and break up fights, only give you a 1 second glance at your card to not chance a liquor license violation.

Certain night clubs (haven't seen these antics in CA but have in NYC and Miami) often do stupid stuff to guys though. If you show up with a group of guys they will probably not let you in. You need an even ratio of men and women. They will let in a group of all women with hardly any check.

Re: What we call "age verification" is actually mass surveillance

#330

> "Age verification" means that everyone who does anything online will have to submit to fine-grained tracking and recording of all their online activities. its been said 1000 times here, but: age verification doesn't have to be a nightmare dystopia of 24/7 fine-grained tracking and recording unless you are somehow hoping to achieve 100% success rate (something we have not done with any other law ever). there are sev…

> age verification doesn't have to be a nightmare dystopia of 24/7 fine-grained tracking Personally I don't care how much age sniffing is mandatory in that I think it is inacceptable on any level. Do you try to insinuate that a little bit of tracking is ok? Because I can not buy into that premise. To me the whole assumption is wrong from the get go.

> Do you try to insinuate that a little bit of tracking is ok?

Everything is going to contribute to tracking, though. It's really hard to ensure that data doesn't leak.

Example proposal: sites attach an X-AGE-RATING header to pages and browsers only render the page if X-AGE-RATING Exploitable Issue: Send multiple requests from one page for various style sheets with different X-AGE-RATING headers. The ones that get loaded give you all you need to find the user's age cohort.

But, the unique combination of things like your screen dimensions, number of threads, charge percentage, default languages, available fonts, etc already makes tracking possible. I don't know if adding one more - carefully chosen feature - would really make the situation that much worse.

Post reply on HN