5 ms·

I'm curious. What's in between nothing and checking id?

by aflag 3y ago

xyzzy4747 3y ago
Just my own thoughts: there could theoretically be an identity system that simply replies "Yes/No" if someone is underage or not. But nothing like this exists to my knowledge.
- aflag 3y ago
  That service would need to be run by a third party, which would know your id and the fact that you are trying to access pornhub, wouldn't it?
  - xyzzy4747 3y ago
    Yes, something that has access to your actual ID.
  - CubsFan1060 3y ago
    To be clear, I hate all of these ideas. But, I think Apple already does this. https://developer.apple.com/wallet/get-started-with-verify-with-wallet/ https://developer.apple.com/wallet/get-started-with-verify-w... "Information about past presentments — including where, when, and what personal information you share — is encrypted and stored only on your device. Neither the state issuing authority nor Apple can see your presentment history." https://support.apple.com/en-us/HT213046 https://support.apple.com/en-us/HT213046
    - aflag 3y ago
      I see. My understanding of it is that apple gives you a signed letter saying that you're verified to be over 18. While it's possible to verify that the signed document is legitimate, if it's in any way tied to the person presenting it, you just created an id, no?
  - madeofpalk 3y ago
    Eventually, but part of this could be delegated to someone who probably already knows your identity.
  - tzs 3y ago
    It would be possible to design a protocol that allows you, a website that needs to know your age but not anything else about you, and a third party verification service that knows who you are to verify your age to the website without the verification service knowing who you are verifying your age to, and without a fourth party such as a government with a subpoena that lets them get the records of the web site and the verification service figure out that you have used the latter to prove your age to the former.
  - belorn 3y ago
    No, there are fairly well established technologies to do this without giving the third-party any information about which site is asking for authentication. The most famous that comes first to mind is the Kerberos protocol. An simplified example could be that I ask the third-party to sign a package that include my current IP address, a message that say "I am over 18", and a validity period. They sign it (after I identify myself to the third-party), and give me the requested signature. I then give this to the website and the website can verify the signature of the third-party. The website only know my IP address, the time, and what third-party service I use to verify my age. Third-party only know my ip address, the time, and that I requested a token for "I am over 18". A major drawback occur if this is only used for porn. In that case, the message "I am over 18" will be synonymous with porn use and thus giving the third-party information that they should not have.
  - dragonwriter 3y ago
    You could have a design where encrypted requests and responses were routed so that the relying party (PornHub) new who the responding party (third party verifier) was, but the responding party only knew who the requesting party (user) was, and then only at the level of “the same party making the request to view”, not their actual identity.
- slothtrop 3y ago
  Seems unsafe to telegraph to the web that a device is being handled by an underage user. And redundant, since that would probably require some intervention from the user/client to set up, who could already block adult websites on devices anyway. If they're capturing the edge case of parents who do nothing, but expect their kids to be protected when they hand them a tablet, I don't think there's much to do. Seems way more effective, with no downsides, to just communicate to parents on the govt's part. Adult streaming sites have the "are you 18 years of age?" pop-up. As far as those managing the sites are concerned that should be enough.
- BurnGpuBurn 3y ago
  This exists, it's called IRMA. [0] The problem is, every data provider has to get on board first. For instance, the city you live in can verify if you're over eighteen. If their IT can handle setting the bit 'over eighteen' in the IRMA app, you can securely and verifiably show this bit of information, and only this piece of information, to the party asking to verify this information. They have to support IRMA too though. But even then, if I'm under age and just borrow your phone... [0] https://privacybydesign.foundation/en/ https://privacybydesign.foundation/en/
  - salawat 3y ago
    Say it with me. Technology does not solve people problems. It only makes them worse/creates new ones in the process of (generally poorly) trying to partially solve them. This is a people problem. Sometimes, the only winning move is not to play.
wongarsu 3y ago
You can estimate age from images of the user's face (taken via webcam/front-facing camera). It wouldn't work well right at the threshold: you can't reliably differentiate 17 year olds from 18 year olds, but you can reliably keep the 10 year olds out. Or at least make a reasonable effort to do so, clever teenagers will find workarounds involving pictures or Halloween masks. This method doesn't seem to be allowed by the law in question though.

I'm curious. What's in between nothing and checking id?

by aflag 3y ago

I'm curious. What's in between nothing and checking id?

Just my own thoughts: there could theoretically be an identity system that simply replies "Yes/No" if someone is underage or not. But nothing like this exists to my knowledge.

aflag 3y ago
That service would need to be run by a third party, which would know your id and the fact that you are trying to access pornhub, wouldn't it?
- xyzzy4747 3y ago
  Yes, something that has access to your actual ID.
- CubsFan1060 3y ago
  To be clear, I hate all of these ideas. But, I think Apple already does this. https://developer.apple.com/wallet/get-started-with-verify-with-wallet/ https://developer.apple.com/wallet/get-started-with-verify-w... "Information about past presentments — including where, when, and what personal information you share — is encrypted and stored only on your device. Neither the state issuing authority nor Apple can see your presentment history." https://support.apple.com/en-us/HT213046 https://support.apple.com/en-us/HT213046
  - aflag 3y ago
    I see. My understanding of it is that apple gives you a signed letter saying that you're verified to be over 18. While it's possible to verify that the signed document is legitimate, if it's in any way tied to the person presenting it, you just created an id, no?
- madeofpalk 3y ago
  Eventually, but part of this could be delegated to someone who probably already knows your identity.
- tzs 3y ago
  It would be possible to design a protocol that allows you, a website that needs to know your age but not anything else about you, and a third party verification service that knows who you are to verify your age to the website without the verification service knowing who you are verifying your age to, and without a fourth party such as a government with a subpoena that lets them get the records of the web site and the verification service figure out that you have used the latter to prove your age to the former.
- belorn 3y ago
  No, there are fairly well established technologies to do this without giving the third-party any information about which site is asking for authentication. The most famous that comes first to mind is the Kerberos protocol. An simplified example could be that I ask the third-party to sign a package that include my current IP address, a message that say "I am over 18", and a validity period. They sign it (after I identify myself to the third-party), and give me the requested signature. I then give this to the website and the website can verify the signature of the third-party. The website only know my IP address, the time, and what third-party service I use to verify my age. Third-party only know my ip address, the time, and that I requested a token for "I am over 18". A major drawback occur if this is only used for porn. In that case, the message "I am over 18" will be synonymous with porn use and thus giving the third-party information that they should not have.
- dragonwriter 3y ago
  You could have a design where encrypted requests and responses were routed so that the relying party (PornHub) new who the responding party (third party verifier) was, but the responding party only knew who the requesting party (user) was, and then only at the level of “the same party making the request to view”, not their actual identity.
slothtrop 3y ago
Seems unsafe to telegraph to the web that a device is being handled by an underage user. And redundant, since that would probably require some intervention from the user/client to set up, who could already block adult websites on devices anyway. If they're capturing the edge case of parents who do nothing, but expect their kids to be protected when they hand them a tablet, I don't think there's much to do. Seems way more effective, with no downsides, to just communicate to parents on the govt's part. Adult streaming sites have the "are you 18 years of age?" pop-up. As far as those managing the sites are concerned that should be enough.
BurnGpuBurn 3y ago
This exists, it's called IRMA. [0] The problem is, every data provider has to get on board first. For instance, the city you live in can verify if you're over eighteen. If their IT can handle setting the bit 'over eighteen' in the IRMA app, you can securely and verifiably show this bit of information, and only this piece of information, to the party asking to verify this information. They have to support IRMA too though. But even then, if I'm under age and just borrow your phone... [0] https://privacybydesign.foundation/en/ https://privacybydesign.foundation/en/
- salawat 3y ago
  Say it with me. Technology does not solve people problems. It only makes them worse/creates new ones in the process of (generally poorly) trying to partially solve them. This is a people problem. Sometimes, the only winning move is not to play.

wongarsu 3y ago

You can estimate age from images of the user's face (taken via webcam/front-facing camera). It wouldn't work well right at the threshold: you can't reliably differentiate 17 year olds from 18 year olds, but you can reliably keep the 10 year olds out. Or at least make a reasonable effort to do so, clever teenagers will find workarounds involving pictures or Halloween masks. This method doesn't seem to be allowed by the law in question though.