4 ms·

Understand the trick, but think we all know people are clever, especially when they’re motivated, and bypassing systems like that would likely be trivial and ev

Understand the trick, but think we all know people are clever, especially when they’re motivated, and bypassing systems like that would likely be trivial and even potentially result in the endpoints requiring age verification helping bypass them covertly.

sandworm101 4y ago
The goal isnt to actually block children. They goal is to satisfy the corporations legal obligations: whatever scheme requires the least effort, the least information from the applicant, but still meets the minimum standard. Better idea: webcam verification of government ID. Client-side/in-browser AI software matches only name and birthday before passing OK to website. Zero information is actually transmited/stored. Patent please.
- asdfasgasdgasdg 4y ago
  What is to stop someone from modifying chromium to always report "yes" in that case? Or is the idea that we will add another widevine style opaque binary blob to our system that handles this with an encrypted response that can't be examined by the user?
  - O__________O 4y ago
    Nothing would stop someone from hacking the system if everything was client-side.
- O__________O 4y ago
  Not following, how would the system know the document was authentic without transmitting data; understand that client-side it would be easy to cross-reference the ID-face and Live-face and scan the barcode to extract any data attributes, such as age. Also, worth noting that assuming the individual had a smart phone, scanning document would likely provide no additional security and there numerous apps that provide real-time end user verification using biometrics.
  - sandworm101 4y ago
    Perfection is always the enemy of "good enough to meet legal oblugations". Compare the minimal ID checks for buying cigarettes ... or handguns.
    - O__________O 4y ago
      This is not about perfection, as is, unless I missing something, your suggested solution does not solve the problem. There are numerous ways for a system to authenticate a user without the endpoint requesting the authentication knowing who the user is — or the system verifying the user knowing what endpoint system is requesting the authentication; only the user knows both who they are and the endpoint they want access to.

sandworm101 4y ago

The goal isnt to actually block children. They goal is to satisfy the corporations legal obligations: whatever scheme requires the least effort, the least information from the applicant, but still meets the minimum standard. Better idea: webcam verification of government ID. Client-side/in-browser AI software matches only name and birthday before passing OK to website. Zero information is actually transmited/stored. Patent please.

asdfasgasdgasdg 4y ago
What is to stop someone from modifying chromium to always report "yes" in that case? Or is the idea that we will add another widevine style opaque binary blob to our system that handles this with an encrypted response that can't be examined by the user?
- O__________O 4y ago
  Nothing would stop someone from hacking the system if everything was client-side.
O__________O 4y ago
Not following, how would the system know the document was authentic without transmitting data; understand that client-side it would be easy to cross-reference the ID-face and Live-face and scan the barcode to extract any data attributes, such as age. Also, worth noting that assuming the individual had a smart phone, scanning document would likely provide no additional security and there numerous apps that provide real-time end user verification using biometrics.
- sandworm101 4y ago
  Perfection is always the enemy of "good enough to meet legal oblugations". Compare the minimal ID checks for buying cigarettes ... or handguns.
  - O__________O 4y ago
    This is not about perfection, as is, unless I missing something, your suggested solution does not solve the problem. There are numerous ways for a system to authenticate a user without the endpoint requesting the authentication knowing who the user is — or the system verifying the user knowing what endpoint system is requesting the authentication; only the user knows both who they are and the endpoint they want access to.