7 ms·

> experts told PopSci platforms also oppose the laws because they don’t want to be responsible for collecting and maintaining torrents of sensitive users’ data

> experts told PopSci platforms also oppose the laws because they don’t want to be responsible for collecting and maintaining torrents of sensitive users’ data that could pose a ripe target for cybercriminals. Good thing these laws specifically ban them from storing that information that they don't want to store. The implication here is so strange. Kids generally don't have a way to buy VPN services (I suppose they could mail cash to mullvad), so mission accomplished? > Some of the anti-porn laws, like the one enacted in Utah, already possess language explicitly prohibiting online platforms from letting minors “change or bypass restrictions on access.” That's a social media law, not a porn law, and it's about parental controls that the parent set up on an account that's been marked as a child account (so only the parent account can modify controls on the child account: duh!). Absolutely garbage article. Didn't even link to the actual laws. And people complain that no one will pay for "journalism" like this.

goalieca 3y ago
Well they can learn to use tor but most likely they’ll get sucked into shady free VPN services and suffer worse.
- tennisflyi 3y ago
  No way you’re streaming anything via Tor
  - InvertedRhodium 3y ago
    I used to leave porn downloading overnight over 56k in the mid 90s. They’ll just have to get a little more organised about it.
    - jbigelow76 3y ago
      I used to leave porn downloading overnight over 56k in the mid 90s. Literal, delayed gratification.
  - datadrivenangel 3y ago
    It's not uncommon to be able to get a few MBps via Tor. The latency tends to be crap, but once everything is set up it can go pretty fast.
  - crtasm 3y ago
    Well, try it before making bold claims :)
danShumway 3y ago
> Good thing these laws specifically ban them from storing that information that they don't want to store. Well... companies. They don't ban government agencies from retaining that data if they get access to it. But ignore that and assume for a second that they do. The problem is that the laws kind of contradict themselves: "don't collect information that compromises privacy" and also "do this in a way that basically could only work if you collect information that compromises privacy." Most of the bills I've read ban companies from saving this data, but require them to collect it presumably in some way that's auditable? They also provide no real mechanisms for guaranteeing that data won't be stored or will be transmitted securely between services. In Louisiana's bill (https://legis.la.gov/legis/ViewDocument.aspx?d=1289498 https://legis.la.gov/legis/ViewDocument.aspx?d=1289498) there is no penalty for retaining data other than that users can sue for "damages". But historically, proving damages from retained data tends to be difficult to do. Of course the laws do not clarify how age verification is supposed to work under these restrictions, just that documents will be verified somehow: Texas's "example" of age verification explicitly refers to digital identification as information "stored on a digital network" (https://capitol.texas.gov/tlodocs/88R/billtext/pdf/HB01181F.pdf#navpanes=0 https://capitol.texas.gov/tlodocs/88R/billtext/pdf/HB01181F....). But sure, also make sure you don't store anything! /s Presumably this all means that the information should be stored and transmitted until identification is done and then immediately deleted leaving no record of that identification other than that it happened (which hopefully will be sufficient evidence if the government ever accuses you of using a faulty verification method). But eventual deletion doesn't mean the information isn't still getting temporarily stored or that it's not passing between multiple hands, any of which could have rogue employees or leaks, or which could be storing "anonymized" data that turns out to later-on be identifiable. ---- One might argue that since the majority of these laws are proposed and backed by anti-porn organizations, the contradictions might kind of be advantageous to the goals of the backers -- if the law is functionally impossible to comply with and companies are forced to leave the state, well... that's exactly what these groups want anyway. Texas's AG is up-front about being pleased that porn companies are blocking the state. And despite the regular claim that this isn't about restricting porn generally, the vast majority of these bills have ties to religiously conservative groups that have public positions that porn should be banned for everyone. But that's all besides the point: the point is it's just outright false to say that these laws don't require at least the transmission and collection of this data -- they just tack on "don't store it for too long, delete it afterwards." But that doesn't really mean anything: regular identity transmission over the web carries security and privacy risks even if companies could be trusted to reliably delete this data -- which in many cases, they can't. Advocates of these bills ignore that security researchers have an issue with collection and transmission of sensitive data in addition to storage, and so advocates point to narrow, non-specific language about long-term retention as if that solves all of the issues. It doesn't. And to the extent that these laws include any real teeth like actual fines for data leakage, they don't really explain how companies can safely avoid those fines while still proving that their users aren't minors. It's a no-win situation. Note as well, I'm leaving off the accusation I've seen online that this identification would need to be provided per-login/access, because I don't see any language in the bills that would suggest that to me. But of course if that were true, there would be obvious security risks from users providing that information repeatedly as part of regular access. ---- > That's a social media law, not a porn law The law in question explicitly exempts art sharing sites unless they allow specifically porn (https://le.utah.gov/xcode/Title13/Chapter63/C13-63_2023050320230503.pdf https://le.utah.gov/xcode/Title13/Chapter63/C13-63_202305032...): > (H) a professional creative network for showcasing and discovering artistic content, if the content is required to be non-pornographic; Notably, general content harmful to minors like gore, hate-speech, etc is included in that exemption. So your creative gallery site doesn't count as social media and isn't subject to these child-restrictions if you allow nazi emblems or violent imagery, it's only a problem if you allow porn. I will concede on this that conflating the exact language of "change or bypass restrictions on access" is a straightforward misreading of the bill, bad on the article for that. But I think it's being a little coy to act like there's no overlap between Chapter 63 and SB 287. Chapter 63 clearly views pornographic content differently than it views other content that is similarly harmful to minors. SB 287 includes language that seems (to me) to explicitly protect VPN and network providers from liability, but it is not clear whether that kind of language will continue to appear in future bills: the majority of these bills so far have been largely copy-paste templates of each other, and in other Internet restriction debates states have expressed interest in going after actors that they deem to be "enabling" illegal actions. Notably, the copy-paste template that most states have been using doesn't protect sites that allow VPN access, they just protect the VPNs themselves. It's not clear to me from the text of the bills that states wouldn't view a porn site refusing to block all VPN connections as a violation of the law if they were ever interested in pushing enforcement past state lines (which again, in other Internet speech debates states have expressed interest in pushing enforcement across state lines). The article's example of VPN restrictions is misleading and misrepresents the bills it's talking about -- but the general concern that VPN restrictions might come in the future (most likely through targeting companies that do not block VPNs from accessing their services) is a real concern, just poorly presented in this article.

goalieca 3y ago

Well they can learn to use tor but most likely they’ll get sucked into shady free VPN services and suffer worse.

tennisflyi 3y ago
No way you’re streaming anything via Tor
- InvertedRhodium 3y ago
  I used to leave porn downloading overnight over 56k in the mid 90s. They’ll just have to get a little more organised about it.
  - jbigelow76 3y ago
    I used to leave porn downloading overnight over 56k in the mid 90s. Literal, delayed gratification.
- datadrivenangel 3y ago
  It's not uncommon to be able to get a few MBps via Tor. The latency tends to be crap, but once everything is set up it can go pretty fast.
- crtasm 3y ago
  Well, try it before making bold claims :)

danShumway 3y ago

> Good thing these laws specifically ban them from storing that information that they don't want to store. Well... companies. They don't ban government agencies from retaining that data if they get access to it. But ignore that and assume for a second that they do. The problem is that the laws kind of contradict themselves: "don't collect information that compromises privacy" and also "do this in a way that basically could only work if you collect information that compromises privacy." Most of the bills I've read ban companies from saving this data, but require them to collect it presumably in some way that's auditable? They also provide no real mechanisms for guaranteeing that data won't be stored or will be transmitted securely between services. In Louisiana's bill (https://legis.la.gov/legis/ViewDocument.aspx?d=1289498 https://legis.la.gov/legis/ViewDocument.aspx?d=1289498) there is no penalty for retaining data other than that users can sue for "damages". But historically, proving damages from retained data tends to be difficult to do. Of course the laws do not clarify how age verification is supposed to work under these restrictions, just that documents will be verified somehow: Texas's "example" of age verification explicitly refers to digital identification as information "stored on a digital network" (https://capitol.texas.gov/tlodocs/88R/billtext/pdf/HB01181F.pdf#navpanes=0 https://capitol.texas.gov/tlodocs/88R/billtext/pdf/HB01181F....). But sure, also make sure you don't store anything! /s Presumably this all means that the information should be stored and transmitted until identification is done and then immediately deleted leaving no record of that identification other than that it happened (which hopefully will be sufficient evidence if the government ever accuses you of using a faulty verification method). But eventual deletion doesn't mean the information isn't still getting temporarily stored or that it's not passing between multiple hands, any of which could have rogue employees or leaks, or which could be storing "anonymized" data that turns out to later-on be identifiable. ---- One might argue that since the majority of these laws are proposed and backed by anti-porn organizations, the contradictions might kind of be advantageous to the goals of the backers -- if the law is functionally impossible to comply with and companies are forced to leave the state, well... that's exactly what these groups want anyway. Texas's AG is up-front about being pleased that porn companies are blocking the state. And despite the regular claim that this isn't about restricting porn generally, the vast majority of these bills have ties to religiously conservative groups that have public positions that porn should be banned for everyone. But that's all besides the point: the point is it's just outright false to say that these laws don't require at least the transmission and collection of this data -- they just tack on "don't store it for too long, delete it afterwards." But that doesn't really mean anything: regular identity transmission over the web carries security and privacy risks even if companies could be trusted to reliably delete this data -- which in many cases, they can't. Advocates of these bills ignore that security researchers have an issue with collection and transmission of sensitive data in addition to storage, and so advocates point to narrow, non-specific language about long-term retention as if that solves all of the issues. It doesn't. And to the extent that these laws include any real teeth like actual fines for data leakage, they don't really explain how companies can safely avoid those fines while still proving that their users aren't minors. It's a no-win situation. Note as well, I'm leaving off the accusation I've seen online that this identification would need to be provided per-login/access, because I don't see any language in the bills that would suggest that to me. But of course if that were true, there would be obvious security risks from users providing that information repeatedly as part of regular access. ---- > That's a social media law, not a porn law The law in question explicitly exempts art sharing sites unless they allow specifically porn (https://le.utah.gov/xcode/Title13/Chapter63/C13-63_2023050320230503.pdf https://le.utah.gov/xcode/Title13/Chapter63/C13-63_202305032...): > (H) a professional creative network for showcasing and discovering artistic content, if the content is required to be non-pornographic; Notably, general content harmful to minors like gore, hate-speech, etc is included in that exemption. So your creative gallery site doesn't count as social media and isn't subject to these child-restrictions if you allow nazi emblems or violent imagery, it's only a problem if you allow porn. I will concede on this that conflating the exact language of "change or bypass restrictions on access" is a straightforward misreading of the bill, bad on the article for that. But I think it's being a little coy to act like there's no overlap between Chapter 63 and SB 287. Chapter 63 clearly views pornographic content differently than it views other content that is similarly harmful to minors. SB 287 includes language that seems (to me) to explicitly protect VPN and network providers from liability, but it is not clear whether that kind of language will continue to appear in future bills: the majority of these bills so far have been largely copy-paste templates of each other, and in other Internet restriction debates states have expressed interest in going after actors that they deem to be "enabling" illegal actions. Notably, the copy-paste template that most states have been using doesn't protect sites that allow VPN access, they just protect the VPNs themselves. It's not clear to me from the text of the bills that states wouldn't view a porn site refusing to block all VPN connections as a violation of the law if they were ever interested in pushing enforcement past state lines (which again, in other Internet speech debates states have expressed interest in pushing enforcement across state lines). The article's example of VPN restrictions is misleading and misrepresents the bills it's talking about -- but the general concern that VPN restrictions might come in the future (most likely through targeting companies that do not block VPNs from accessing their services) is a real concern, just poorly presented in this article.