9 ms·
The headline seems misleading. "Pornhub blocked in Texas" suggests Texas did the blocking, a better headline would be "Pornhub blocks users with Texas IPs"
by root_axis 3y ago
The headline seems misleading. "Pornhub blocked in Texas" suggests Texas did the blocking, a better headline would be "Pornhub blocks users with Texas IPs"
- segasaturn 3y agoThe Texas legislation is effectively a block - there's no way for PH to verify the age of users entering the site in the way the legislation demands, but they face fines and legal action for not doing so. Catch-22, the only solution is to turn off access.
- greggsy 3y agoCredit card verification?
- segasaturn 3y agoIIRC, the legislation that's being passed in red states defines age verification as the service provider being provided with 2 pieces of valid government photo ID
- lupusreal 3y agoPH could implement that, they just don't want to.
- segasaturn 3y agoTheoretically they could sure, it would just be expensive, labor-intensive and put them at risk of criminal penalties if their process failed or broke down. Also the number of people willing to send their ID to a porn site is very small so whether they complied or not, they will not be getting much traffic from Texas. Its "impossible" from a common business sense perspective, not a theoretical perspective.
- lupusreal 3y agoAs I said, they could but they don't want to. You said there is no way for PH to verify ages the way the legislation demands, but that plainly isn't true.
- johnnyanmac 3y ago>Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith. Few things are truly impossible or 100% correct. There's not much value in arguing such extremes.
- lupusreal 3y agoWhen it comes to legislators demanding changes to technology, many things are impossible. This isn't one of them. It's only cumbersome to their business model; boo hoo..
- jaredklewis 3y ago> Also the number of people willing to send their ID to a porn site is very small Not saying you’re wrong (I certainly don’t have any data to the contrary), but this isn’t intuitive to me. Don’t tons of people send their credit card (which is linked to their SSN) to PornHub? From there seems like a small step to also send ID?
- SketchySeaBeast 3y agoI'm certain those people are a minute fraction of the total userbase. They are intentionally trading privacy for greater access.
- johnnyanmac 3y agoNot usually. Porn sites tend to use a 3rd party payment processor to manage funds (often sites dedicated to working with adult sites). So you don't get Pornhub on your billing statement, but something like Probiller or whatever.
- throwaway5959 3y agoYeah, if they wanted to massively violate their user’s privacy. Fuck that.
- johnnyanmac 3y agoMost people don't even have two forms of photo id in the US. Usual identification for jobs involves deeds/bills (no photo), pay stubs (no photos), social security (no photo, usually), and birth certificate (no photo). The only major form of photo ID is a state/driver's license and passports and I think only 30% of the US has Passorts. It's such a big country that you can reasonably never require it and still travel more than the average EU citizen. You can also fill out a form with your employer to get a photo form of employee authorization, but you're Sol of you're freelance/gig economy.
- ndriscoll 3y agoThis seems to be the specific legislation: https://legiscan.com/TX/text/HB1181/id/2819916 https://legiscan.com/TX/text/HB1181/id/2819916 It requires a system where the user: (1) provide digital identification; or (2) comply with a commercial age verification system that verifies age using: (A) government-issued identification; or (B) a commercially reasonable method that relies on public or private transactional data to verify the age of an individual. Unclear to me what the transactional data means, and if a charging a credit card would suffice, but it does not require 2 forms of photo ID.
- bastawhiz 3y ago16 year olds can get credit cards
- aaomidi 3y agoCredit Card APIs I believe have Age/DoB or something. Edit: No they do not.
- ceejayoz 3y agoNo, they do not.
- aaomidi 3y agoTIL! Thanks!
- SketchySeaBeast 3y agoMan, I hope that by paying for something with my credit card I'm not giving the vendor that much access to my information. I kind of assumed the point of a credit card was to be a third party and put me at less risk, not more.
- mgiampapa 3y agoBeing able to produce a credit card number and transaction has nothing to do with a user's age or the stated goal of the law, protecting minors.
- aaomidi 3y agoYeah but I was like, ISPs have the ability to just start arbitrarily blocking websites that fast? DPI? DNS? etc
- mvkg 3y agoAs of TLS 1.3, the ClientHello (which includes the Server Name Identification (SNI) extension) is still sent in plaintext. There is a current draft for encrypted client hellos[0], but I don't think its adoption is widespread. QUIC appears to encrypt the ClientHello; however, it does not protect from an attacker which can observe the initial connection packets[1]. [0]: https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ https://datatracker.ietf.org/doc/draft-ietf-tls-esni/ [1]: https://www.rfc-editor.org/rfc/rfc9001.html#name-security-of-initial-message https://www.rfc-editor.org/rfc/rfc9001.html#name-security-of...
- aaomidi 3y agoYep! The WG last call is happening now. Even so, I don't think many ISPs have the capability to do the DPI for observing SNI on a moments notice.
- etskinner 3y agoStill, the article could say something like "Pornhub removes access to Texans after law requires stricter age verification"
- observationist 3y agoPornhub complies with authoritarian new Texas law and begins blocking users in that region.
- johnnyanmac 3y agoDon't know if editorialozed or if the website edited the title, but the current page reads: >Pornhub Disables Website in Texas Over Age-Verification Law So, mission accomplished?
- bicarbonato 3y agoSome news websites conduct A/B testing for titles. Maybe it was one of the options.
- fragmede 3y agoIt could also be titled Pornhub to require Texas users to install VPN software to access site.
- tivert 3y ago> there's no way for PH to verify the age of users entering the site in the way the legislation demands What exactly are those requirements, and how is there "no way" for Pornhub to satisfy what "the legislation demands"? I ask because I'm tired of seeing (in general, not just PornHub) deceptive rephrasing of "we don't want to" as "it's impossible for us to." Companies too often take the attitude that they're entitled to their business model or being able to push externalities onto others, but that's obnoxious BS propaganda. Edit: So according to the OP, the law "requires [PornHub] to verify the age of all visitors using a government-issued ID or 'public or private transactional data.'" I'm pretty sure they've already implemented that to verify the identify of performers (https://help.pornhub.com/hc/en-us/articles/19159382668435-Trust-and-Safety-Initiatives https://help.pornhub.com/hc/en-us/articles/19159382668435-Tr...), after much kicking and screaming, in the wake of that Nicholas Kristof article a few years ago. So a pretty straightforward implementation would be to require user accounts to view (at least for Texas), push users through PornHub's existing age verification flow, then give them access.
- javawizard 3y agoA much better way of phrasing my comment, thank you. It's perfectly valid for PH to say "we don't believe the requirements of the law are reasonable so we're choosing to not do business in Texas rather than comply" - but that's a very different conversation than "the requirements the law imposes on us/other adult websites are impossible to satisfy from a technical perspective".
- bee_rider 3y ago> I ask because I'm tired of seeing (in general, not just PornHub) deceptive rephrasing of "we don't want to" as "it's impossible for us to." Companies too often take the attitude that they're entitled to their business model or being able to push externalities onto others, but that's obnoxious BS propaganda. Somebody posted their message to users from Texas. https://news.ycombinator.com/item?id=39708615 https://news.ycombinator.com/item?id=39708615 I know you are just talking in general, but in this specific case, it doesn’t appear that they actually say they can’t do it. The idea that they can’t do it just seems to be a misunderstanding from somebody posting on this site. I agree in general that it is annoying that companies say they “can’t” do something, mixing up “incompatible with my business mode” and “incompatible with reality.” But I don’t see anything like that in their comment. WRT reusing their implementation for the actors, I’m not sure, is that possible? The actors upload videos of themselves so it ought to be easy to verify the fact that the face on the ID matches the face in the video, right? In the case of a user, somebody could easily steal their parent’s ID or use a computer that someone else had left logged in, right? I mean, I don’t know how any of that works, but I could see why the site would rather not risk it. I mean, this is a site full of webdevs, would anyone here want to take a chance at implementing something like this in-house, before best methods have been discovered? I suspect most people would rather wait for a lawsuit-tested turnkey solution. So, “can’t” in this context could mean something like: we aren’t aware of an existing solution that fits inside our legal risk tolerance. That’s still a business objection rather than a laws-of-physics one, but it seems a lot more reasonable.
- javawizard 3y agoThis is interesting. What about the Texas law makes it impossible for PH to comply if they were to otherwise decide that that they wanted to (which of course isn't likely)?
- kthejoker2 3y agoIt's more of a straightforward risk calculation. Set up controls, if anyone bypasses them, you have expensive litigation and potentially existential financial penalties. Or don't and lose the revenue of Texas folks. Interested parties will go out of their way to bypass any rules PornHub does set up, and PornHub bears the brunt of any successful such attempts.
- bcaxis 3y agoYeah, if you make a bad faith effort to comply you deserve to be sued. If you did your honest reasonable best, a suit shouldn't go anywhere. Systems aren't perfect. They aren't really expected to be either. Given the way the porn industry historically operates by addicting the young and the huge levels of abuse towards women. I'm not holding my breath for good faith efforts.
- paulddraper 3y ago> there's no way for PH to verify the age of users entering the site in the way the legislation demands That's not true. It's onerous, inconvenient, whatever.
- Arnt 3y agoSuppose it really can't be done cheaply enough that Pornhub could pay for it and still make a profit. Possible in theory, but not possible within their budget. Would you then call it impossible or onerous? Which term describe that situation, in your opinion? FWIW I've no idea how expensive commercial age verification is. I'm just wondering why none of the commenters seem to consider the aspect of cost, and picked a random commenter to ask.
- paulddraper 3y agoI base my characterization on comparables. In this case, gambling sites, which perform age (and residency) verification.
- Arnt 3y agoThat answer really clarifies the thread for me. Thanks. Now I read it as some people treating Pornhub as obviously similar to the gambling sites and others obviously different, basing their different viewpoints on the different foundations, and not stating those foundations because they're obvious. FWIW I can see how login-required porn sites are similar to gambling sites. I'm open on whether mostly-without-login sites are.
- xjay 3y agoMaybe one hack would be to have a binary "restricted" flag communicated through the ISP's reverse IP lookup (probably very slow). It wouldn't put any personal information at risk, but it would probably open Pandora's box, except that Pandora's box had hope inside of it. 1) IP address from "Restricted Region" connects to website. 2) Server attempts a reverse IP lookup and waits for reply from ISP's DNS. 3) If DNS reply contains "restricted" (on behalf of the subscriber), server has to restrict access, etc.
- deleted 3y ago[deleted]
- anon-sre-srm 3y agoChanging all of the world's infrastructure isn't a "hack", All they have to do is use AnyCast and geoip to block most users from a specific region. If you really need Pornhub in Texas, a VPN cloud VM is your courier.
- deleted 3y ago[deleted]