7 ms·

Several US states now require age verification for adult content (I don't know how that is defined). A case challenging such laws is being considered by the US

by mmooss 2y ago

Several US states now require age verification for adult content (I don't know how that is defined). A case challenging such laws is being considered by the US Supreme Court, but most experts believe the court will allow the age verification. That may mean users identifying themselves, which seems dangerous. (It should not at all be dangerous, but it is.) All you need is some phobic government official to sue or investigate you, for any reason they can come up with, and demand all your records as part of their lawsuit/investigation. Perhaps there's a way to do age verification while minimizing privacy risks? For example, verify their age, give them their credentials, then delete the PII? I don't know if that would suffice if your age verification practices were challenged. (Talk to an expert.)

hn_throwaway_99 2y ago
All the porn companies have handled this by simply blocking the sites in the states in question, just forcing people to use VPNs. If you ask for ID verification to see NSFW content they know hardly anyone would provide it, and at the same time it opens you up to a lot of liability in handling extremely sensitive PII. The whole thing is just moralistic BS anyway. I'm sure most kids can figure out how to use a VPN better than adults.
- chimeracoder 2y ago
  > If you ask for ID verification to see NSFW content they know hardly anyone would provide it, and at the same time it opens you up to a lot of liability in handling extremely sensitive PII. Yes, and that is exactly why Morality in Media (the right-wing, evangelical group behind these laws) has been proposing them. Their goal is to outlaw pornography (and other "immoral" content) on the internet by making it so difficult to access or provide legally that nobody will bother. > I'm sure most kids can figure out how to use a VPN better than adults. You're making the mistake of assuming their goal is to prevent kids from being able to access pornography. It is not. Their goal is to make it so financially impractical to run any service that publishes (or allows people to publish) pornography, LGBTQ content, or anything that they deem "immoral" that nobody even tries. And it's working: many services which used to allow that content before 2017 no longer do, and it is much, much more expensive (and difficult) for the remaining folks to find platforms or hosting providers to continue to do so.
  - azeirah 2y ago
    VPNs? Or children?
  - Aromasin 2y ago
    This seems a little baffling to me because these evangelical groups are uniquely American. There would still exist a huge pornography industry globally, particularly within the EU, that would serve the US even if these groups achieved every goal. It's deluded to think it could be stopped.
    - chimeracoder 2y ago
      > This seems a little baffling to me because these evangelical groups are uniquely American. I'm referring to one of several groups that is behind a specific campaign in the US. That doesn't mean that there aren't other efforts to curtail this in other countries or globally. As mentioned elsewhere, there's a law that's about to go into effect in the UK which is actually way broader and draconian than any that has been passed anywhere in the US. There are more in other countries too. > There would still exist a huge pornography industry globally, particularly within the EU, that would serve the US even if these groups achieved every goal. And yet, when Tumblr and Imgur and Reddit[0] banned pornography, no EU-based competitor emerged to take their place. [0] Reddit's ban wasn't a total ban, but it was enough to effectively shut down many groups (which was the goal).
    - influx 2y ago
      Does the EU allow sales of pornography to minors?
      - deleted 2y ago
        [deleted]
    - brimwats 2y ago
      No they're not; their roots are in the YMCA and the British society for the suppression of vice and earlier societies dating back to the 1700s. They originated when the church courts were shut down and are a feature of British evangelicalism that Americans turbocharged.
- Dalewyn 2y ago
  Pedantic, but the word you're looking for is proxy, not VPN. A Virtual Private Network is a private network such as a Local Area Network created virtually on a Wide Area Network such as the internet. Tailscale, SoftEther, or Hamachi for the old boys are examples of VPN implementations. A proxy is a server that accepts and forwards traffic from clients through it, lending its IP address to clients as the traffic origin if desired. A proxy can exist in a private network, but it is not a requirement.
  - rUsHeYaFuBu 2y ago
    Curious, does a proxy also tend to encrypt the data streamed between it and the end user like a VPN service would? That is, does the ISP have access to the information that's being accessed via the proxy? It was my understanding that proxies tending to mask where a request came from but does nothing significant with the data between it and the requester.
    - Dalewyn 2y ago
      >does a proxy also tend to encrypt the data streamed between it and the end user like a VPN service would? It could, but it's not a hard requirement. A proxy server is just like any other server, encrypting the data en route is as desired. A VPN encrypts data as a part of securing tunnels, but it's not a hard requirement there either. As long as two computers can communicate over private IP address ranges on a WAN, it's a VPN. The Private in VPN indicates the scope of the network, not whether any data within is immediately accessible. See also: "Private" and "Public" IP address ranges. >does the ISP have access to the information that's being accessed via the proxy? The ISP providing internet to the proxy server will know what the proxy server requests and receives. >It was my understanding that proxies tending to mask where a request came from but does nothing significant with the data between it and the requester. Correct. Again, whether the data a proxy server receives and forwards was encrypted is tangential to the task of forwarding data.
    - mhitza 2y ago
      Depends on the proxy. If you have an SSH server you can open a local socks5 proxy, that when configured in your browser sends all the traffic through your server. Since its a proxy over SSH it's all encrypted till your server, then whatever protocol the website uses. VPNs are better (as in more ergonomic) in practice, since large sites tend to block access from known hosting providers (looking at YouTube not rendering video when accessed from a Hetzner server).
- ETH_start 2y ago
  It's 100% bullshit. The parents themselves are responsible for letting their children browse the internet unsupervised. The culture of over-reaction to danger that has taken over the political domain is creating a nanny state where it's impossible to avoid crosssing red lines and doing something wrong. It's paralyzing society by instilling inaction as the only safe path.
  - itake 2y ago
    > The parents themselves are responsible Parents give their kids access to guns and we all know how that ends. If we can't hold parents accountable for their children's violence, I seriously doubt we can do anything about parents failing to parent their kids on this topic. What are we going to do? throw the single mom with 2 jobs and 5 kids in jail because she didn't pay $20/mo for parental controls on her kids devices?
    - ETH_start 2y ago
      >throw the single mom with 2 jobs and 5 kids in jail because she didn't pay $20/mo for parental controls on her kids devices? If she wants to have children out of wedlock or with a man who are not financially capable of being a provider, then she and her children should bear the consequences of that, not everyone else who know has to have government take over the internet and mandates identity disclosures for perusing adult content.
      - itake 2y ago
        Society pays the consequences either directly from government or the impact the kids have on everyone else that has to live with adults that discovered porn as a kid before they could understand it. Kids that discovered porn at an early age will not understand how to process it properly and this will impact their relationships in the future. It is their future partners that suffer along with the kids and family.
        ETH_start 2y ago
- itake 2y ago
  > just forcing people to use VPNs Does this really even work? The law isn't "if the user's ip address appears to be from this state, then you must require id". Properly enforcing georestrictions like this costs money and destroys businesses, but that is kinda the point.
  - azernik 2y ago
    It provides plausible deniability. "We did our best, judge"
    - moate 2y ago
      It's not even plausible deniability, it's literally "how are we supposed to know what location people are in other than ISP?" That's the de facto determinate of location online. The government hasn't taken the position that a bar checking driver's licenses to confirm someone's age provides "plausible deniability", but rather that they're doing their part to comply with the law, even if some users are going to use fake IDs to cheat the system.
      - itake 2y ago
        1/ block data center connections / require users to connect via a residential IP, not cell phone. 2/ request GPS location from the device. 3/ request WiFi location from the device. 4/ require billing address to be out of state. (States collect sales tax based on billing address, not where the service or product is bought. So I think this is fair.)
  - svnt 2y ago
    I’m sorry but business success aside, how else do you propose to do it? Require them to go outside and take a panoramic video including their face that somehow also captures third-party information about the date and time and then feed it into geoguessr?
    - harimau777 2y ago
      I think the problem is that laws that are trying to force morality on people.
ajb 2y ago
If you don't do age verification then your need to comply with COPPA etc as you have to assume underage users. My previous employer used twohat to monitor for content dangerous to underage users, but I don't know if they were any good as it's not my area. It looks like they got bought by Microsoft as twohat.com redirects to a Microsoft product page now
freehorse 2y ago
I am not an expert either, but I have read that it requires at least 33% of content being "adult". Not sure how much content this page have, and OP should get in contact with an expert (maybe a trans lawyer or sth would be more willing to help such a project?) but i assume that the most important would be to ensure that NSFW content is below 1/3, like twitter (twitter has a huge lot of porn but even more non-porn content)
KronisLV 2y ago
> Perhaps there's a way to do age verification while minimizing privacy risks? For example, verify their age, give them their credentials, then delete the PII? I wonder why trusted third parties haven't sprung up around this very concept to the degree of OIDC (it's almost everywhere), you could have companies that allow uniquely identifying people, without having to manage or even get their PII directly. Service wants to check age or whether user is banned --> they are redirected to some-identity-platform.com where they can deal with any ID documents and other PII --> some-identity-platform.com gives back a token and a UUID, so all the service really needs is a JSON object with the UUID and whether user is of age (if that was in scope). That service can also let the user granularly choose what information to return: just the UUID, whether they're of age, or specific data like where they're located, actual PII if needed (e.g. auth with govt. site) etc., the UUIDs could also be service specific, so they cannot be cross referenced across different sites in case of leaks. Things a bit like that exist, for example here's a few random ones: https://www.jumio.com/ https://aws.amazon.com/rekognition/identity-verification/ https://www.veriff.com/ https://www.yoti.com/ https://ondato.com/ It does feel like the privacy problem could be solved in exactly these services, without passing too much information to the service itself. Because currently there are crazy amounts of hate and content out there that I might not want from a certain person on a site I operate, so I could just ban 914582c9-289a-4f8c-9e1c-f4193066e210 and the same person (at least with the same legal identity) could never get another account on my platform. I wouldn't even know that it's John Doe from country X and region Y that's uploading problematic content. Vice versa, I might just sell stuff to 5b9ee810-605b-40ce-9ead-85102e92df74 without ever risking compromising their identity.
- numpad0 2y ago
  Because verification requirements are merely indirect means to suppress contents. It really doesn't matter if the actor is 14 or 40 and it's never about making sure it's the latter.
- almatabata 2y ago
  > the UUIDs could also be service specific, so they cannot be cross referenced across different sites in case of leaks. Assuming services play nice. What if they start sharing UUIDs amongst each other, for example for advertising purposes? Worse what is stopping companies from creating both service and verifier? Nothing, as Amazon already has both. I do not trust them not to abuse this. And even if in theory all companies do the respect my privacy. I am one government away, from seeing a law passed, that makes it mandatory to report all UUIDs to the government. The potential for tracking is off the charts. Right now it takes forever to trace everything. You can realistically only do it for a select targets. If you implement this UUID system, suddenly it becomes much easier to trace everyone's actions.
master-lincoln 2y ago
Age verification could be possible without giving out PII e.g. via Zero Knowledge proofs. This would of course need a central authority that is trusted to give out per person digital IDs. Usually that would be the government.
matthewdgreen 2y ago
You can use cryptography to perform parts of verification. Specifically, you can use anonymous credentials to prove to a specific website that you have a credential. But that credential must then be issued by some authority that actually examines your physical "proof of age" (driver's license etc.) and issues it to your device. The problem is that, at least at the moment, simply obtaining a credential like this has a huge chilling effect. You need to mail stuff into some crummy company chosen by the government, which then processes it and takes time. That company might be breached, which identifies you as "a person who is specifically interested in accessing adult content." Many of these problems can theoretically be fixed, but fixing them would have to be the goal of the authorities -- and I suspect it is not.
- mmooss 2y ago
  > "a person who is specifically interested in accessing adult content." Or at more risk, a person interested in trans content.
  - matthewdgreen 2y ago
    And in the very near future, perhaps someone who is interested in accessing non-adult content that simply covers topics that are considered "unwholesome."

by mmooss 2y ago

hn_throwaway_99 2y ago

All the porn companies have handled this by simply blocking the sites in the states in question, just forcing people to use VPNs. If you ask for ID verification to see NSFW content they know hardly anyone would provide it, and at the same time it opens you up to a lot of liability in handling extremely sensitive PII. The whole thing is just moralistic BS anyway. I'm sure most kids can figure out how to use a VPN better than adults.

chimeracoder 2y ago
> If you ask for ID verification to see NSFW content they know hardly anyone would provide it, and at the same time it opens you up to a lot of liability in handling extremely sensitive PII. Yes, and that is exactly why Morality in Media (the right-wing, evangelical group behind these laws) has been proposing them. Their goal is to outlaw pornography (and other "immoral" content) on the internet by making it so difficult to access or provide legally that nobody will bother. > I'm sure most kids can figure out how to use a VPN better than adults. You're making the mistake of assuming their goal is to prevent kids from being able to access pornography. It is not. Their goal is to make it so financially impractical to run any service that publishes (or allows people to publish) pornography, LGBTQ content, or anything that they deem "immoral" that nobody even tries. And it's working: many services which used to allow that content before 2017 no longer do, and it is much, much more expensive (and difficult) for the remaining folks to find platforms or hosting providers to continue to do so.
- azeirah 2y ago
  VPNs? Or children?
- Aromasin 2y ago
  This seems a little baffling to me because these evangelical groups are uniquely American. There would still exist a huge pornography industry globally, particularly within the EU, that would serve the US even if these groups achieved every goal. It's deluded to think it could be stopped.
  - chimeracoder 2y ago
    > This seems a little baffling to me because these evangelical groups are uniquely American. I'm referring to one of several groups that is behind a specific campaign in the US. That doesn't mean that there aren't other efforts to curtail this in other countries or globally. As mentioned elsewhere, there's a law that's about to go into effect in the UK which is actually way broader and draconian than any that has been passed anywhere in the US. There are more in other countries too. > There would still exist a huge pornography industry globally, particularly within the EU, that would serve the US even if these groups achieved every goal. And yet, when Tumblr and Imgur and Reddit[0] banned pornography, no EU-based competitor emerged to take their place. [0] Reddit's ban wasn't a total ban, but it was enough to effectively shut down many groups (which was the goal).
  - influx 2y ago
    Does the EU allow sales of pornography to minors?
    - deleted 2y ago
      [deleted]
  - brimwats 2y ago
    No they're not; their roots are in the YMCA and the British society for the suppression of vice and earlier societies dating back to the 1700s. They originated when the church courts were shut down and are a feature of British evangelicalism that Americans turbocharged.
Dalewyn 2y ago
Pedantic, but the word you're looking for is proxy, not VPN. A Virtual Private Network is a private network such as a Local Area Network created virtually on a Wide Area Network such as the internet. Tailscale, SoftEther, or Hamachi for the old boys are examples of VPN implementations. A proxy is a server that accepts and forwards traffic from clients through it, lending its IP address to clients as the traffic origin if desired. A proxy can exist in a private network, but it is not a requirement.
- rUsHeYaFuBu 2y ago
  Curious, does a proxy also tend to encrypt the data streamed between it and the end user like a VPN service would? That is, does the ISP have access to the information that's being accessed via the proxy? It was my understanding that proxies tending to mask where a request came from but does nothing significant with the data between it and the requester.
  - Dalewyn 2y ago
    >does a proxy also tend to encrypt the data streamed between it and the end user like a VPN service would? It could, but it's not a hard requirement. A proxy server is just like any other server, encrypting the data en route is as desired. A VPN encrypts data as a part of securing tunnels, but it's not a hard requirement there either. As long as two computers can communicate over private IP address ranges on a WAN, it's a VPN. The Private in VPN indicates the scope of the network, not whether any data within is immediately accessible. See also: "Private" and "Public" IP address ranges. >does the ISP have access to the information that's being accessed via the proxy? The ISP providing internet to the proxy server will know what the proxy server requests and receives. >It was my understanding that proxies tending to mask where a request came from but does nothing significant with the data between it and the requester. Correct. Again, whether the data a proxy server receives and forwards was encrypted is tangential to the task of forwarding data.
  - mhitza 2y ago
    Depends on the proxy. If you have an SSH server you can open a local socks5 proxy, that when configured in your browser sends all the traffic through your server. Since its a proxy over SSH it's all encrypted till your server, then whatever protocol the website uses. VPNs are better (as in more ergonomic) in practice, since large sites tend to block access from known hosting providers (looking at YouTube not rendering video when accessed from a Hetzner server).
ETH_start 2y ago
It's 100% bullshit. The parents themselves are responsible for letting their children browse the internet unsupervised. The culture of over-reaction to danger that has taken over the political domain is creating a nanny state where it's impossible to avoid crosssing red lines and doing something wrong. It's paralyzing society by instilling inaction as the only safe path.
- itake 2y ago
  > The parents themselves are responsible Parents give their kids access to guns and we all know how that ends. If we can't hold parents accountable for their children's violence, I seriously doubt we can do anything about parents failing to parent their kids on this topic. What are we going to do? throw the single mom with 2 jobs and 5 kids in jail because she didn't pay $20/mo for parental controls on her kids devices?
  - ETH_start 2y ago
    >throw the single mom with 2 jobs and 5 kids in jail because she didn't pay $20/mo for parental controls on her kids devices? If she wants to have children out of wedlock or with a man who are not financially capable of being a provider, then she and her children should bear the consequences of that, not everyone else who know has to have government take over the internet and mandates identity disclosures for perusing adult content.
    - itake 2y ago
      Society pays the consequences either directly from government or the impact the kids have on everyone else that has to live with adults that discovered porn as a kid before they could understand it. Kids that discovered porn at an early age will not understand how to process it properly and this will impact their relationships in the future. It is their future partners that suffer along with the kids and family.
      - ETH_start 2y ago
itake 2y ago
> just forcing people to use VPNs Does this really even work? The law isn't "if the user's ip address appears to be from this state, then you must require id". Properly enforcing georestrictions like this costs money and destroys businesses, but that is kinda the point.
- azernik 2y ago
  It provides plausible deniability. "We did our best, judge"
  - moate 2y ago
    It's not even plausible deniability, it's literally "how are we supposed to know what location people are in other than ISP?" That's the de facto determinate of location online. The government hasn't taken the position that a bar checking driver's licenses to confirm someone's age provides "plausible deniability", but rather that they're doing their part to comply with the law, even if some users are going to use fake IDs to cheat the system.
    - itake 2y ago
      1/ block data center connections / require users to connect via a residential IP, not cell phone. 2/ request GPS location from the device. 3/ request WiFi location from the device. 4/ require billing address to be out of state. (States collect sales tax based on billing address, not where the service or product is bought. So I think this is fair.)
- svnt 2y ago
  I’m sorry but business success aside, how else do you propose to do it? Require them to go outside and take a panoramic video including their face that somehow also captures third-party information about the date and time and then feed it into geoguessr?
  - harimau777 2y ago
    I think the problem is that laws that are trying to force morality on people.

ajb 2y ago

If you don't do age verification then your need to comply with COPPA etc as you have to assume underage users. My previous employer used twohat to monitor for content dangerous to underage users, but I don't know if they were any good as it's not my area. It looks like they got bought by Microsoft as twohat.com redirects to a Microsoft product page now

freehorse 2y ago

I am not an expert either, but I have read that it requires at least 33% of content being "adult". Not sure how much content this page have, and OP should get in contact with an expert (maybe a trans lawyer or sth would be more willing to help such a project?) but i assume that the most important would be to ensure that NSFW content is below 1/3, like twitter (twitter has a huge lot of porn but even more non-porn content)

KronisLV 2y ago

> Perhaps there's a way to do age verification while minimizing privacy risks? For example, verify their age, give them their credentials, then delete the PII? I wonder why trusted third parties haven't sprung up around this very concept to the degree of OIDC (it's almost everywhere), you could have companies that allow uniquely identifying people, without having to manage or even get their PII directly. Service wants to check age or whether user is banned --> they are redirected to some-identity-platform.com where they can deal with any ID documents and other PII --> some-identity-platform.com gives back a token and a UUID, so all the service really needs is a JSON object with the UUID and whether user is of age (if that was in scope). That service can also let the user granularly choose what information to return: just the UUID, whether they're of age, or specific data like where they're located, actual PII if needed (e.g. auth with govt. site) etc., the UUIDs could also be service specific, so they cannot be cross referenced across different sites in case of leaks. Things a bit like that exist, for example here's a few random ones: https://www.jumio.com/ https://aws.amazon.com/rekognition/identity-verification/ https://www.veriff.com/ https://www.yoti.com/ https://ondato.com/ It does feel like the privacy problem could be solved in exactly these services, without passing too much information to the service itself. Because currently there are crazy amounts of hate and content out there that I might not want from a certain person on a site I operate, so I could just ban 914582c9-289a-4f8c-9e1c-f4193066e210 and the same person (at least with the same legal identity) could never get another account on my platform. I wouldn't even know that it's John Doe from country X and region Y that's uploading problematic content. Vice versa, I might just sell stuff to 5b9ee810-605b-40ce-9ead-85102e92df74 without ever risking compromising their identity.

numpad0 2y ago
Because verification requirements are merely indirect means to suppress contents. It really doesn't matter if the actor is 14 or 40 and it's never about making sure it's the latter.
almatabata 2y ago
> the UUIDs could also be service specific, so they cannot be cross referenced across different sites in case of leaks. Assuming services play nice. What if they start sharing UUIDs amongst each other, for example for advertising purposes? Worse what is stopping companies from creating both service and verifier? Nothing, as Amazon already has both. I do not trust them not to abuse this. And even if in theory all companies do the respect my privacy. I am one government away, from seeing a law passed, that makes it mandatory to report all UUIDs to the government. The potential for tracking is off the charts. Right now it takes forever to trace everything. You can realistically only do it for a select targets. If you implement this UUID system, suddenly it becomes much easier to trace everyone's actions.

master-lincoln 2y ago

Age verification could be possible without giving out PII e.g. via Zero Knowledge proofs. This would of course need a central authority that is trusted to give out per person digital IDs. Usually that would be the government.

matthewdgreen 2y ago

You can use cryptography to perform parts of verification. Specifically, you can use anonymous credentials to prove to a specific website that you have a credential. But that credential must then be issued by some authority that actually examines your physical "proof of age" (driver's license etc.) and issues it to your device. The problem is that, at least at the moment, simply obtaining a credential like this has a huge chilling effect. You need to mail stuff into some crummy company chosen by the government, which then processes it and takes time. That company might be breached, which identifies you as "a person who is specifically interested in accessing adult content." Many of these problems can theoretically be fixed, but fixing them would have to be the goal of the authorities -- and I suspect it is not.

mmooss 2y ago
> "a person who is specifically interested in accessing adult content." Or at more risk, a person interested in trans content.
- matthewdgreen 2y ago
  And in the very near future, perhaps someone who is interested in accessing non-adult content that simply covers topics that are considered "unwholesome."