7 ms·

I'm surprised how little this issue has come up in the past, given how much many here are focused on privacy. This issue can be seen even today on YouTube. When

I'm surprised how little this issue has come up in the past, given how much many here are focused on privacy. This issue can be seen even today on YouTube. When I browse videos, I usually do so in FF's private browsing mode, primarily to prevent the recommendations from spilling over into my main account. However, videos marked as age-restricted cannot be viewed without logging into a Google account. Even yt-dlp couldn't download age-restricted videos without credentials when I last attempted it! (I hear there has since been a patch to fix this, but I have not tested it to see if it still works.) And apparently, EU users are sometimes required to upload their government ID to YouTube to prove they are over 18. I get that privacy issues can be most sensitive to those under 18, but it's important to recognize that enforcing far stronger privacy restrictions alongside strong age-verification expectations (no more "are you 18+? yes/no" or "what is your birthday?" questions) can only come at the expense of anonymous browsing.

kybernetyk 4y ago
https://github.com/zerodytrash/Simple-YouTube-Age-Restriction-Bypass https://github.com/zerodytrash/Simple-YouTube-Age-Restrictio... https://greasyfork.org/en/scripts/423851-simple-youtube-age-restriction-bypass https://greasyfork.org/en/scripts/423851-simple-youtube-age-... Works fine for me on FireFox + Greasemonkey
- 14 4y ago
  I want to come back to this comment later and try these out. Thanks
- O__________O 4y ago
  Note that you have to trust the proxy injecting age verification on behalf of the user is not logging data, being malicious, etc; if they are running targeted attacks, this would be very hard to detect; for example, say the proxy was run by China and user requests a video that’s clearly anti-China; to be clear, NOT saying this is the case, just that it does require trusting a proxy, which generally speaking are hostile to users.
O__________O 4y ago
>> strong age-verification expectations [...] can only come at the expense of anonymous browsing No, this is not true, there are numerous ways for a system to authenticate a user without the endpoint requesting the authentication knowing who the user is — or the system verifying the user knowing what endpoint system is requesting the authentication; only the user knows both who they are and the endpoint they want access to.
- LegionMammal978 4y ago
  How could the user verify that the endpoint never learns anything about the user's identity, and that the system never learns anything about the requesting endpoint? In situations where privacy is particularly sensitive, either or both could have a motive to learn more about the user.
  - O__________O 4y ago
    I have seen it explained before, believe it was done using a combination of combination of differential privacy and zero knowledge proofs, but might wrong. Currently trying to find a detailed explanation of how to implement such a system using existing technology. In mean time, if anyone else is aware of such a system, please post a link. EDIT: This appears to cover some aspects, still reviewing it and to confirm it covers all the system attributes I described: https://crypto.stackexchange.com/questions/96232/zkp-prove-that-18-while-hiding-age https://crypto.stackexchange.com/questions/96232/zkp-prove-t...
    - LegionMammal978 4y ago
      Hmm, I don't think that protocol as described would be sufficient for the government. What would prevent Alice (age 18) from sharing her signed age statement with her friend Charlie (age 17), who passes it to Bob to falsify his age? The government would not want underage users to collude with 18+ users to gain access to age-gated endpoints.
      - 4y ago
btdmaster 4y ago
You want yt-dlp on the latest version since YouTube breaks/throttles quite often otherwise. Try yt-dlp --update. (You could also try a custom repository for your package manager, though the best solution in this case is a rolling release distribution.)
dheera 4y ago
We should legalize the use of fake IDs with private organizations as long as there is no intention to commit a crime. Only the government should need real IDs. For example, if I am actually over 18 and intend to watch a video intended for over 18, I should be able to use a fake ID for it.
ng12 4y ago
Reddit added this as well within the last week. You can no longer view 18+ subreddits without being logged in.
- arealaccount 4y ago
  old.reddit still allows this with just an “im sure” prompt
neuralRiot 4y ago
I find ridiculous having to login in YT (which i have no account nor will) to view “age restricted material” when you can watch hardcore porn just by clicking “I’m over 18 years old”
1vuio0pswjnm7 4y ago
"... can only come at the expense of anonymous browsing." False dichotomy. (Also known as false dilemma, bogus dilemma, either-or fallacy, black-and-white fallacy.)[FN1] If the website protects the privacy of all persons, not just those under 18, then there is no problem complying this law. It's like the folks who claim the web cannot or would not exist unless advertising is permitted. It is a self-serving statement of an opinion. It has no evidentiary basis. This false prediction, nonsense reasoning is probably accepted by generations that did not experience the internet before advertising was permitted, before online advertising became pervasive, and/or before online advertising was based on data collection and targeted. The fact is the internet and web did exist without advertising. There is no technical limitation that requires a website to collect data and/or serve ads. Common retorts to such historical facts include such gems as "I would never want to go back to 199x", or "All the wonderful content of the web today would disappear." 1. Computers and networks are never going to return to 1990's prices and speeds. Speeds keep increasing and prices keep decreasing. 2. Who would have guessed, but today's commercial web content is actually being generated mostly by website users themselves rather than website operators. "Tech" companies operating high traffic websites have promoted their own "business", online advertising, to lure people into uploading to their websites without expecting payment in return. Like some sort of opaque lottery. This is why the web has become a cesspool of "clickbait" and garbage "content". FN1. https://en.wikipedia.org/wiki/False_dilemma https://en.wikipedia.org/wiki/False_dilemma
- LegionMammal978 4y ago
  Perhaps I worded that somewhat confusingly. I'm in favor of privacy regulations existing in the first place. What I'm against is having privacy regulations suddenly become stricter below age 18. Most website operators want to minimize the time and money spent on compliance, and the lowest-friction way to do that is to implement a privacy-invasive age gate and deny any user who does not pass it. (Either the website receives your identity directly, or the government learns which websites you've been accessing. I've since been informed that less invasive age gates are technically possible, but they would require competent regulations to implement.) The usual ethical difference, as I've understood it from prior discussions, is that a legal adult user can always consent to a company using their data, so long as the data is knowingly given to the company, the user has been honestly informed of what that data is used for, and the user can revoke the company's access to their data at any point. (Some people recognize less-strict conditions as acceptable, I'm just taking these as a baseline.) However, many of these new regulations outright prohibit minor users' data from being used in certain ways, even if those users have freely consented to it, with the justification that minors are unable to evaluate the full consequences of their data being used. Since businesses face major liability for violating these regulations, they have two options: either implement the strictest possible age-related regulation for every user, or implement an age gate that cannot be circumvented short of the user committing fraud. In this particular regulation, some of the wording is vague, requiring a "compelling reason" to collect minor users' data, regardless of those users' consent. Businesses abhor that kind of liability: how do they protect every user as if they might be a vulnerable minor, under every possible interpretation of the regulation? The easier path by far is to require an age gate. Thus, I'd argue that the better path would be to require uniform privacy regulations, recognizing that random websites don't want to be in the business of age verification. Either require the same strong privacy regulations for all users, or don't implement the new regulations for minors at all.

kybernetyk 4y ago

https://github.com/zerodytrash/Simple-YouTube-Age-Restriction-Bypass https://github.com/zerodytrash/Simple-YouTube-Age-Restrictio... https://greasyfork.org/en/scripts/423851-simple-youtube-age-restriction-bypass https://greasyfork.org/en/scripts/423851-simple-youtube-age-... Works fine for me on FireFox + Greasemonkey

14 4y ago
I want to come back to this comment later and try these out. Thanks
O__________O 4y ago
Note that you have to trust the proxy injecting age verification on behalf of the user is not logging data, being malicious, etc; if they are running targeted attacks, this would be very hard to detect; for example, say the proxy was run by China and user requests a video that’s clearly anti-China; to be clear, NOT saying this is the case, just that it does require trusting a proxy, which generally speaking are hostile to users.

O__________O 4y ago

>> strong age-verification expectations [...] can only come at the expense of anonymous browsing No, this is not true, there are numerous ways for a system to authenticate a user without the endpoint requesting the authentication knowing who the user is — or the system verifying the user knowing what endpoint system is requesting the authentication; only the user knows both who they are and the endpoint they want access to.

LegionMammal978 4y ago
How could the user verify that the endpoint never learns anything about the user's identity, and that the system never learns anything about the requesting endpoint? In situations where privacy is particularly sensitive, either or both could have a motive to learn more about the user.
- O__________O 4y ago
  I have seen it explained before, believe it was done using a combination of combination of differential privacy and zero knowledge proofs, but might wrong. Currently trying to find a detailed explanation of how to implement such a system using existing technology. In mean time, if anyone else is aware of such a system, please post a link. EDIT: This appears to cover some aspects, still reviewing it and to confirm it covers all the system attributes I described: https://crypto.stackexchange.com/questions/96232/zkp-prove-that-18-while-hiding-age https://crypto.stackexchange.com/questions/96232/zkp-prove-t...
  - LegionMammal978 4y ago
    Hmm, I don't think that protocol as described would be sufficient for the government. What would prevent Alice (age 18) from sharing her signed age statement with her friend Charlie (age 17), who passes it to Bob to falsify his age? The government would not want underage users to collude with 18+ users to gain access to age-gated endpoints.
    - 4y ago

btdmaster 4y ago

You want yt-dlp on the latest version since YouTube breaks/throttles quite often otherwise. Try yt-dlp --update. (You could also try a custom repository for your package manager, though the best solution in this case is a rolling release distribution.)

dheera 4y ago

We should legalize the use of fake IDs with private organizations as long as there is no intention to commit a crime. Only the government should need real IDs. For example, if I am actually over 18 and intend to watch a video intended for over 18, I should be able to use a fake ID for it.

ng12 4y ago

Reddit added this as well within the last week. You can no longer view 18+ subreddits without being logged in.

arealaccount 4y ago
old.reddit still allows this with just an “im sure” prompt

neuralRiot 4y ago

I find ridiculous having to login in YT (which i have no account nor will) to view “age restricted material” when you can watch hardcore porn just by clicking “I’m over 18 years old”

1vuio0pswjnm7 4y ago

"... can only come at the expense of anonymous browsing." False dichotomy. (Also known as false dilemma, bogus dilemma, either-or fallacy, black-and-white fallacy.)[FN1] If the website protects the privacy of all persons, not just those under 18, then there is no problem complying this law. It's like the folks who claim the web cannot or would not exist unless advertising is permitted. It is a self-serving statement of an opinion. It has no evidentiary basis. This false prediction, nonsense reasoning is probably accepted by generations that did not experience the internet before advertising was permitted, before online advertising became pervasive, and/or before online advertising was based on data collection and targeted. The fact is the internet and web did exist without advertising. There is no technical limitation that requires a website to collect data and/or serve ads. Common retorts to such historical facts include such gems as "I would never want to go back to 199x", or "All the wonderful content of the web today would disappear." 1. Computers and networks are never going to return to 1990's prices and speeds. Speeds keep increasing and prices keep decreasing. 2. Who would have guessed, but today's commercial web content is actually being generated mostly by website users themselves rather than website operators. "Tech" companies operating high traffic websites have promoted their own "business", online advertising, to lure people into uploading to their websites without expecting payment in return. Like some sort of opaque lottery. This is why the web has become a cesspool of "clickbait" and garbage "content". FN1. https://en.wikipedia.org/wiki/False_dilemma https://en.wikipedia.org/wiki/False_dilemma

LegionMammal978 4y ago
Perhaps I worded that somewhat confusingly. I'm in favor of privacy regulations existing in the first place. What I'm against is having privacy regulations suddenly become stricter below age 18. Most website operators want to minimize the time and money spent on compliance, and the lowest-friction way to do that is to implement a privacy-invasive age gate and deny any user who does not pass it. (Either the website receives your identity directly, or the government learns which websites you've been accessing. I've since been informed that less invasive age gates are technically possible, but they would require competent regulations to implement.) The usual ethical difference, as I've understood it from prior discussions, is that a legal adult user can always consent to a company using their data, so long as the data is knowingly given to the company, the user has been honestly informed of what that data is used for, and the user can revoke the company's access to their data at any point. (Some people recognize less-strict conditions as acceptable, I'm just taking these as a baseline.) However, many of these new regulations outright prohibit minor users' data from being used in certain ways, even if those users have freely consented to it, with the justification that minors are unable to evaluate the full consequences of their data being used. Since businesses face major liability for violating these regulations, they have two options: either implement the strictest possible age-related regulation for every user, or implement an age gate that cannot be circumvented short of the user committing fraud. In this particular regulation, some of the wording is vague, requiring a "compelling reason" to collect minor users' data, regardless of those users' consent. Businesses abhor that kind of liability: how do they protect every user as if they might be a vulnerable minor, under every possible interpretation of the regulation? The easier path by far is to require an age gate. Thus, I'd argue that the better path would be to require uniform privacy regulations, recognizing that random websites don't want to be in the business of age verification. Either require the same strong privacy regulations for all users, or don't implement the new regulations for minors at all.