4 ms·

Then check the ID and then throw the PII away. All I’m saying is that there are absolutely ways to do this, and I keep hearing that these companies “can’t” acco

Then check the ID and then throw the PII away. All I’m saying is that there are absolutely ways to do this, and I keep hearing that these companies “can’t” accomplish this, but it just isn’t true. If you want to buy a copy of Playboy from a newsstand, in general, you’re going to get asked for ID at the counter. It’s been like that for a very long time and nobody seems to have a real problem with it. It’s unclear why people think this kind of requirement just goes away if it’s on the Internet.

kelseyfrog 3y ago
So you're saying send PII with every GET request then?
- mbgerring 3y ago
  No, I’m saying verify the user’s ID, don’t save the PII at all, and then authenticate the user for some length of time. Or let users make an anonymous account and have a bit in their profile that says the ID was verified, without saving any of the ID information. There’s no technical reason you couldn’t do this.
  - ceejayoz 3y ago
    Texas: "Prove you identified that user." Pornhub: "Uh... we promise? The database says we did." Now what?
    - ndriscoll 3y ago
      The law specifically says they must not retain ID information, and there is a $10,000 fine per instance if they do: https://legiscan.com/TX/text/HB1181/id/2819916 https://legiscan.com/TX/text/HB1181/id/2819916 > 129B.002(b) A commercial entity that performs the age verification required by Subsection (a) or a third party that performs the age verification required by Subsection (a) may not retain any identifying information of the individual. So I suppose the court would take them at their word unless there were some evidence presented that they did not check ID or accepted an obvious fake (e.g. a sting operation), just like in person. I don't understand why everyone gets so up in arms about this topic without ever reading the laws being written. Absent any information, you might guess that the system ought to work exactly the way it does in person too, which seems to be the case. This was true of the (Utah?) parental controls law discussed on HN a couple weeks ago too. People start asking all these what-ifs about things the law explicitly thought about, and handled in a reasonable way.
      - ceejayoz 3y ago
        It would hardly be the first time maliciously motivated legislating produced a Catch-22.
        ndriscoll 3y ago
        Generally, "prove you didn't break the law" isn't how the law works. If there's no evidence that they broke the law, then there's no issue. If the government gets a 16-year-old to participate in a sting operation to get evidence that they're not checking id... well then if they provide porn to a 16 year old, they broke the law. Lawyers can hash out where the line is on "reasonable" steps to check an ID/what is a reasonably convincing fake/whether appropriate steps were taken to check that the person presenting the ID is the person on the ID. Businesses checking ID for adult-restricted items is not new ground. Collecting and presenting evidence of people breaking this kind of law is not new either.
        kelseyfrog 3y ago
        This doesn't cover the very real digging for extra charges that occurs when someone is subjected to the legal system. We see people all the time get caught for minor offenses and then upon further examination also are found guilty of loads of other things. The fact that parallel construction exists makes it even more egregious. I even agree with you, violations of this won't be anyone's primary charge, but I might disagree that we should conclude that its existence won't affect people. Besides, like a lot of these laws, the primary consequence is a chilling effect where porn sites aren't accessible and in that light it's an effective law.
        ceejayoz 3y ago
        https://www.texastribune.org/2023/12/21/texas-attorney-general-trans-seattle-childrens/ https://www.texastribune.org/2023/12/21/texas-attorney-gener... > Suspecting the Washington-based hospital of providing gender-affirming care to Texas children, which is now banned in Texas, AG Ken Paxton issued investigative subpoenas demanding medical information. Why wouldn’t they do the same sort of harrassing digging in this case?
  - SketchySeaBeast 3y ago
    How does one verify the user's ID? Can we all just upload the same photo of a valid licence over and over?
    - mbgerring 3y ago
      With any of the ID verification SAAS solutions that already exist?
      - SketchySeaBeast 3y ago
        Perfect! Let's get some third parties involved with tracking people's usage of pornography.
quesera 3y ago
I would not feel that my privacy was any less threatened by a promise to discard my information after use. The difference between the Internet and the guy at the newsstand is that you know the guy at the newsstand doesn't have a photographic memory, a replicated database in multiple availability zones, SLAs with IDV providers which are vague about retention policies, or marketing partners who have special offers just for you.
smegger001 3y ago
At a news stand you open you wallet wave it at them without evan taking the card out of the sleave and they hand you your purchase you hand them a $20. no ID is kept on file, no purchase/veiw history is kept, no record of the payment is made there at no middlemen and no chance of it being stolen by hacker and used for ID theft or blackmail. And most importantly no checking with a government database. Comparing in person purchase to online is unreasonable.

kelseyfrog 3y ago

So you're saying send PII with every GET request then?

mbgerring 3y ago
No, I’m saying verify the user’s ID, don’t save the PII at all, and then authenticate the user for some length of time. Or let users make an anonymous account and have a bit in their profile that says the ID was verified, without saving any of the ID information. There’s no technical reason you couldn’t do this.
- ceejayoz 3y ago
  Texas: "Prove you identified that user." Pornhub: "Uh... we promise? The database says we did." Now what?
  - ndriscoll 3y ago
    The law specifically says they must not retain ID information, and there is a $10,000 fine per instance if they do: https://legiscan.com/TX/text/HB1181/id/2819916 https://legiscan.com/TX/text/HB1181/id/2819916 > 129B.002(b) A commercial entity that performs the age verification required by Subsection (a) or a third party that performs the age verification required by Subsection (a) may not retain any identifying information of the individual. So I suppose the court would take them at their word unless there were some evidence presented that they did not check ID or accepted an obvious fake (e.g. a sting operation), just like in person. I don't understand why everyone gets so up in arms about this topic without ever reading the laws being written. Absent any information, you might guess that the system ought to work exactly the way it does in person too, which seems to be the case. This was true of the (Utah?) parental controls law discussed on HN a couple weeks ago too. People start asking all these what-ifs about things the law explicitly thought about, and handled in a reasonable way.
    - ceejayoz 3y ago
      It would hardly be the first time maliciously motivated legislating produced a Catch-22.
      - ndriscoll 3y ago
        Generally, "prove you didn't break the law" isn't how the law works. If there's no evidence that they broke the law, then there's no issue. If the government gets a 16-year-old to participate in a sting operation to get evidence that they're not checking id... well then if they provide porn to a 16 year old, they broke the law. Lawyers can hash out where the line is on "reasonable" steps to check an ID/what is a reasonably convincing fake/whether appropriate steps were taken to check that the person presenting the ID is the person on the ID. Businesses checking ID for adult-restricted items is not new ground. Collecting and presenting evidence of people breaking this kind of law is not new either.
        kelseyfrog 3y ago
        This doesn't cover the very real digging for extra charges that occurs when someone is subjected to the legal system. We see people all the time get caught for minor offenses and then upon further examination also are found guilty of loads of other things. The fact that parallel construction exists makes it even more egregious. I even agree with you, violations of this won't be anyone's primary charge, but I might disagree that we should conclude that its existence won't affect people. Besides, like a lot of these laws, the primary consequence is a chilling effect where porn sites aren't accessible and in that light it's an effective law.
        ceejayoz 3y ago
        https://www.texastribune.org/2023/12/21/texas-attorney-general-trans-seattle-childrens/ https://www.texastribune.org/2023/12/21/texas-attorney-gener... > Suspecting the Washington-based hospital of providing gender-affirming care to Texas children, which is now banned in Texas, AG Ken Paxton issued investigative subpoenas demanding medical information. Why wouldn’t they do the same sort of harrassing digging in this case?
- SketchySeaBeast 3y ago
  How does one verify the user's ID? Can we all just upload the same photo of a valid licence over and over?
  - mbgerring 3y ago
    With any of the ID verification SAAS solutions that already exist?
    - SketchySeaBeast 3y ago
      Perfect! Let's get some third parties involved with tracking people's usage of pornography.

quesera 3y ago

I would not feel that my privacy was any less threatened by a promise to discard my information after use. The difference between the Internet and the guy at the newsstand is that you know the guy at the newsstand doesn't have a photographic memory, a replicated database in multiple availability zones, SLAs with IDV providers which are vague about retention policies, or marketing partners who have special offers just for you.

smegger001 3y ago

At a news stand you open you wallet wave it at them without evan taking the card out of the sleave and they hand you your purchase you hand them a $20. no ID is kept on file, no purchase/veiw history is kept, no record of the payment is made there at no middlemen and no chance of it being stolen by hacker and used for ID theft or blackmail. And most importantly no checking with a government database. Comparing in person purchase to online is unreasonable.