8 ms·

A long, long time ago (within the past ten years), I had to verify my age with a site. They didn't ask for my ID, or my facial scan, but instead asked for my cr

A long, long time ago (within the past ten years), I had to verify my age with a site. They didn't ask for my ID, or my facial scan, but instead asked for my credit card number. They issued a refund to the card of a few cents, and I had to tell them (within 24hr) how much the refund was for, after which point they'd issue a charge to claw it back. They made it clear that debit and gift cards would not be accepted, it must be a credit card. So I grabbed my Visa card, punched in the numbers, checked my banking app to see the +$0.24 refund, entered the value, got validated, and had another -$0.24 charge to claw it back. Voila, I was verified as an adult, because I could prove I had a credit card. The whole point of mandating facial recognition or ID checks isn't to make sure you're an adult, but to keep records of who is consuming those services and tie their identities back to specific profiles. Providers can swear up and down they don't retain that information, but they often use third-parties who may or may not abide by those same requests, especially if the Gov comes knocking with a secret warrant or subpoena. Biometric validation is surveillance, plain and simple.

jen729w 2y ago
> Biometric validation is surveillance, plain and simple. Eh. It's just easier and cheaper. I'll bet Discord has outsourced this to one of those services that ask you for a face scan when you sign up to [some other service].
ndriscoll 2y ago
That was, in fact, what COPA mandated in the US in 1998, and SCOTUS struck it down as too onerous in Ashcroft v. American Civil Liberties Union, kicking off the last 20 years of essentially completely unregulated Internet porn commercially available to children with nothing more than clicking an "I'm 18" button. At the time, filtering was seen as a better solution. Nowadays filtering is basically impossible thanks to TLS (with things like DoH and ECH being deployed to lock that down even further), apps that ignore user CAs and use attestation to lock out owner control, cloud CDNs, TLS fingerprinting, and extreme consolidation of social media (e.g. discord being for both minecraft discussions and furry porn).
- Dylan16807 2y ago
  Despite TLS, filtering is easier to set up now than it was in 1998. You might have to block some apps in the short term, but if you suggest apps can avoid age verification if they stop pinning certificates then they'll jump at the option. Consolidation is the only tricky part that's new.
  - lupusreal 2y ago
    Filtering has never been easy or practical for the general public. But the situation has become much worse. In 1998 it was easy for a family to have no computer at all, or to put their single computer in the living room where it could be supervised. Internet use was limited because it tied up the phone line. These factors made it easy for parents to supervise their children. Today, computers are everywhere, fit in your pocket, and its very easy to get online. Even if you don't buy any computer for your children (which is hard, because your children will tell you that they're getting bullied and socially ostracized, which probably won't even be a lie!) they will probably be given a computer by their school and any filters on that computer will inevitability be circumvented. And even if that doesn't happen, they can trade or buy one of their peers old phones and use that on free WiFi to access the internet without you knowing it. Are you going to thoroughly search their belongings every week? If you do, they'll know and find ways to hide it anyway. And yes, I know kids used to procure and hide porno mags. What they have access to on the internet is a lot more extreme than a tattered playboy.
    - hsbauauvhabzb 2y ago
      Seems like a reasonable argument to ban encryption rather than actually parent your children. As a conservative voter with nothing to hide, I’m in.
      - ndriscoll 2y ago
        Banning encryption that the device owner can't control actually seems like a great idea. So e.g. for TLS it should be easy to install a CA and MITM filtering proxy as an admin user and all applications must trust that CA.
chatmasta 2y ago
Is card verification a lesser form of surveillance? And there’s a good chance your card issuer (or your bank, one hop away from it) has your biometrics anyway. I don’t like either of them… (And why does YouTube ask me to verify my age when I’m logged into a Google account I created in 2004?)
- stego-tech 2y ago
  Oh, make no mistake, I hate both of these. I loathe this forced surveillance of everyone because parents can't be bothered to supervise and teach their children about the most primary of human animal functions (sex), regardless of their reasons for it. I take great pains to keep minors out of my adult spaces, and don't have to resort to anything as invasive as biometric surveillance or card charges. This notion that the entire world should be safe for children by default, and that anything and everything adult should be vilified and locked up, is toxic as all get-out and builds shame into the human animal over something required for the perpetuation of the species. The adult content isn't the problem, it's the relationship some folks have towards it that's the issue. That's best corrected by healthy intervention early on, not arbitrary age checks everywhere online that mainly serve as an exercise of power by the ruling class against "undesirable" elements of society.
  - john01dav 2y ago
    > take great pains to keep minors out of my adult spaces, and don't have to resort to anything as invasive as biometric surveillance or card charges. What sort of spaces are these (online or in person), and how do you enforce this? I have an online space where such non invasive measures could be useful.
    - stego-tech 2y ago
      Mine are rooted in the 90s/00s internet: I know the people I allow into my spaces, and extend to them a degree of trust to let others in who are also of legal age. I rotate the credentials every so often at random, forcing everyone to request the new password from me. Other spaces I inhabit also operate off this sort of "community trust" system, only letting in folks we already know ourselves. It's how we keep out minors and trolls, as well as just bad/no-longer-trusted actors. It's inconvenient, sure, and it's not SEO-friendly, but it generally works and doesn't require checking IDs or doing biometric verifications. The thing is, I'm building a community, not a product, and therefore don't have the same concerns as, say, PornHub, for checking IDs. It's also not a scalable solution - I have to build individual rapports with people I can then trust to have the access keys to my space(s), and then monitor that trust at each password change to ensure it's not violated. It's hard work, but it's decently reliable for my needs. For larger/at-scale providers...I think the better answer is just good-old-fashioned on-device or home-network filtering. The internet was NEVER meant to be child-friendly, and we need to make it abundantly clear to parents that it's never going to be so they take necessary steps to protect their children. I'd personally like to see more sites (in general, not just adult) contribute their domain names and CDNs to independent list maintainers (or published in a help article linked via their main footer) so individuals and organizations can have greater control over their online experience. I think if someone wants to, say, block the entire domain ranges of Amazon for whatever reason, then that information should be readily available without having to watch packet flows and analyzing CDN domain patterns. It's just good netiquette, I think, but I'm an old-fashioned dinosaur in that regard.
SoftTalker 2y ago
Paypal used this method as identity (or at least account) verification back in the very early days, IIRC. They made a very small deposit and I think they just let you keep it but I can't recall that for sure.
high_priest 2y ago
I had a debit card when I was 13. An absolute godsend during international travel, not having to bother with cash as a forgetful teenager. The card providers share your identity in monetary transactions, but I don't think this data does & should include birthdate.
- Symbiote 2y ago
  These checks accept only a credit card. That's useful as one option, but can't be expected of 18 year olds in most countries, and older adults in many.
  - dharmab 2y ago
    I had a credit card at 15. I had to travel for some school related stuff and it was easier to carry a card than excessive amounts of cash.
oalae5niMiel7qu 2y ago
Credit cards are trivially traceable to your legal identity, since anti-money-laundering and know-your-customer laws require that credit card companies keep this information. The government can subpoena this information just as easily as they could with pictures of your face or ID.
- pests 2y ago
  How do you prove the person typing in the credit card details is the same person who owns the card? I know I've read stories of kids taking cards to purchase games or other things online numerous times over the last 20+ years.
whiplash451 2y ago
What you describe is called QES (Qualified Electronic Signature) and is still widely used to validate identities. Unfortunately it is not enough to prove an identity (you could be using the credit card of your traveling uncle) and regulation requires for it to be combined with another proof. I see a lot of people associating identity verification with evil intent (advertising, tracking). I work in this domain and the reality is a lot less interesting: identity verification companies do this and only this, under strict scrutiny both from their customers and from the regulators. We are not where we want to be from a privacy standpoint but the industry is making progress and the usage of identity data is strictly regulated.
- DrillShopper 2y ago
  As someone looking in from the outside: what regulations govern this type of work?
  - whiplash451 2y ago
    In EU: eIDAS and ETSI. In the US: BIPA started in Illinois and is expanding to other states. BIPA sets a brutal bar in terms of regulation.
    - DrillShopper 2y ago
      Okay, that makes sense. I'm in a different regulated industry (healthcare), so we have a lot of different international standards there, and wondered how that worked in a different space.
that_guy_iain 2y ago
1. Your old credit card solution needs a credit card. So you exclude out the poor, bad credit, etc. 2. Parents will help kids bypass checks like that. 3. It can be bypassed by a half-smart 13-year-old who can access an app on a phone that will give them the card details and be able to see transactions. Any verification that doesn't actually verify you via proper means is easy to fake. Hell, we can fake passport/id photos easy enough so now we have to jump on calls with the passport and move it around. The days of the wild west of the internet are long gone. It's time to realise that it's so important that it deserves the same level of verification we give to in person activities. Someone seeing you and/or your id. It's the only thing that has the best chances of not being bypassed with ease.
aktuel 2y ago
I basically agree with you, but it's not like you could not be tracked using your credit card number.
- iamkonstantin 2y ago
  This is not about tracking, having your biometrics means they can resell the data to other providers (e.g. palantir or some other hellish enterprise). With that, the places and means of following you in real time are practically limitless... There have been so many dystopian movies about this kind of tech, it's a good insight of what comes next.
rozab 2y ago
I don't really get your point, surely a credit card is even more strongly linked to your identify than your face?
piokoch 2y ago
What if you don't have a credit card? This solves nothing, the good way to do this is as system like Polish "MojeID" (my ID) [1]. This works in the following way, a site needs to verify information X, then it redirects users to a bank (that has to provide this service), login over there and then agree to let the bank know whatever it was requested - it could be only one information, birth date. This is a good solution, as banks are obliged to provide free bank account for anyone (there is EU regulation on that), this is very save, gives users full information what data third party requested. [1] https://www.kir.pl/nasza-oferta/klient-indywidualny/identyfikacja-i-e-podpis/mojeid https://www.kir.pl/nasza-oferta/klient-indywidualny/identyfi...
casenmgreen 2y ago
As we've seen, if the information is retained, it will be used. The only safe approach is for that information not to exist in the first place.
reaperducer 2y ago
They issued a refund to the card of a few cents, and I had to tell them (within 24hr) how much the refund was for, after which point they'd issue a charge to claw it back. This was one of the methods that CompuServe used back in the 1980's, though using a checking account. It's sad that so many aspects of technology have completely failed to improve in half a century.

jen729w 2y ago

> Biometric validation is surveillance, plain and simple. Eh. It's just easier and cheaper. I'll bet Discord has outsourced this to one of those services that ask you for a face scan when you sign up to [some other service].

ndriscoll 2y ago

That was, in fact, what COPA mandated in the US in 1998, and SCOTUS struck it down as too onerous in Ashcroft v. American Civil Liberties Union, kicking off the last 20 years of essentially completely unregulated Internet porn commercially available to children with nothing more than clicking an "I'm 18" button. At the time, filtering was seen as a better solution. Nowadays filtering is basically impossible thanks to TLS (with things like DoH and ECH being deployed to lock that down even further), apps that ignore user CAs and use attestation to lock out owner control, cloud CDNs, TLS fingerprinting, and extreme consolidation of social media (e.g. discord being for both minecraft discussions and furry porn).

Dylan16807 2y ago
Despite TLS, filtering is easier to set up now than it was in 1998. You might have to block some apps in the short term, but if you suggest apps can avoid age verification if they stop pinning certificates then they'll jump at the option. Consolidation is the only tricky part that's new.
- lupusreal 2y ago
  Filtering has never been easy or practical for the general public. But the situation has become much worse. In 1998 it was easy for a family to have no computer at all, or to put their single computer in the living room where it could be supervised. Internet use was limited because it tied up the phone line. These factors made it easy for parents to supervise their children. Today, computers are everywhere, fit in your pocket, and its very easy to get online. Even if you don't buy any computer for your children (which is hard, because your children will tell you that they're getting bullied and socially ostracized, which probably won't even be a lie!) they will probably be given a computer by their school and any filters on that computer will inevitability be circumvented. And even if that doesn't happen, they can trade or buy one of their peers old phones and use that on free WiFi to access the internet without you knowing it. Are you going to thoroughly search their belongings every week? If you do, they'll know and find ways to hide it anyway. And yes, I know kids used to procure and hide porno mags. What they have access to on the internet is a lot more extreme than a tattered playboy.
  - hsbauauvhabzb 2y ago
    Seems like a reasonable argument to ban encryption rather than actually parent your children. As a conservative voter with nothing to hide, I’m in.
    - ndriscoll 2y ago
      Banning encryption that the device owner can't control actually seems like a great idea. So e.g. for TLS it should be easy to install a CA and MITM filtering proxy as an admin user and all applications must trust that CA.

chatmasta 2y ago

Is card verification a lesser form of surveillance? And there’s a good chance your card issuer (or your bank, one hop away from it) has your biometrics anyway. I don’t like either of them… (And why does YouTube ask me to verify my age when I’m logged into a Google account I created in 2004?)

stego-tech 2y ago
Oh, make no mistake, I hate both of these. I loathe this forced surveillance of everyone because parents can't be bothered to supervise and teach their children about the most primary of human animal functions (sex), regardless of their reasons for it. I take great pains to keep minors out of my adult spaces, and don't have to resort to anything as invasive as biometric surveillance or card charges. This notion that the entire world should be safe for children by default, and that anything and everything adult should be vilified and locked up, is toxic as all get-out and builds shame into the human animal over something required for the perpetuation of the species. The adult content isn't the problem, it's the relationship some folks have towards it that's the issue. That's best corrected by healthy intervention early on, not arbitrary age checks everywhere online that mainly serve as an exercise of power by the ruling class against "undesirable" elements of society.
- john01dav 2y ago
  > take great pains to keep minors out of my adult spaces, and don't have to resort to anything as invasive as biometric surveillance or card charges. What sort of spaces are these (online or in person), and how do you enforce this? I have an online space where such non invasive measures could be useful.
  - stego-tech 2y ago
    Mine are rooted in the 90s/00s internet: I know the people I allow into my spaces, and extend to them a degree of trust to let others in who are also of legal age. I rotate the credentials every so often at random, forcing everyone to request the new password from me. Other spaces I inhabit also operate off this sort of "community trust" system, only letting in folks we already know ourselves. It's how we keep out minors and trolls, as well as just bad/no-longer-trusted actors. It's inconvenient, sure, and it's not SEO-friendly, but it generally works and doesn't require checking IDs or doing biometric verifications. The thing is, I'm building a community, not a product, and therefore don't have the same concerns as, say, PornHub, for checking IDs. It's also not a scalable solution - I have to build individual rapports with people I can then trust to have the access keys to my space(s), and then monitor that trust at each password change to ensure it's not violated. It's hard work, but it's decently reliable for my needs. For larger/at-scale providers...I think the better answer is just good-old-fashioned on-device or home-network filtering. The internet was NEVER meant to be child-friendly, and we need to make it abundantly clear to parents that it's never going to be so they take necessary steps to protect their children. I'd personally like to see more sites (in general, not just adult) contribute their domain names and CDNs to independent list maintainers (or published in a help article linked via their main footer) so individuals and organizations can have greater control over their online experience. I think if someone wants to, say, block the entire domain ranges of Amazon for whatever reason, then that information should be readily available without having to watch packet flows and analyzing CDN domain patterns. It's just good netiquette, I think, but I'm an old-fashioned dinosaur in that regard.

SoftTalker 2y ago

Paypal used this method as identity (or at least account) verification back in the very early days, IIRC. They made a very small deposit and I think they just let you keep it but I can't recall that for sure.

high_priest 2y ago

I had a debit card when I was 13. An absolute godsend during international travel, not having to bother with cash as a forgetful teenager. The card providers share your identity in monetary transactions, but I don't think this data does & should include birthdate.

Symbiote 2y ago
These checks accept only a credit card. That's useful as one option, but can't be expected of 18 year olds in most countries, and older adults in many.
- dharmab 2y ago
  I had a credit card at 15. I had to travel for some school related stuff and it was easier to carry a card than excessive amounts of cash.

oalae5niMiel7qu 2y ago

Credit cards are trivially traceable to your legal identity, since anti-money-laundering and know-your-customer laws require that credit card companies keep this information. The government can subpoena this information just as easily as they could with pictures of your face or ID.

pests 2y ago
How do you prove the person typing in the credit card details is the same person who owns the card? I know I've read stories of kids taking cards to purchase games or other things online numerous times over the last 20+ years.

whiplash451 2y ago

What you describe is called QES (Qualified Electronic Signature) and is still widely used to validate identities. Unfortunately it is not enough to prove an identity (you could be using the credit card of your traveling uncle) and regulation requires for it to be combined with another proof. I see a lot of people associating identity verification with evil intent (advertising, tracking). I work in this domain and the reality is a lot less interesting: identity verification companies do this and only this, under strict scrutiny both from their customers and from the regulators. We are not where we want to be from a privacy standpoint but the industry is making progress and the usage of identity data is strictly regulated.

DrillShopper 2y ago
As someone looking in from the outside: what regulations govern this type of work?
- whiplash451 2y ago
  In EU: eIDAS and ETSI. In the US: BIPA started in Illinois and is expanding to other states. BIPA sets a brutal bar in terms of regulation.
  - DrillShopper 2y ago
    Okay, that makes sense. I'm in a different regulated industry (healthcare), so we have a lot of different international standards there, and wondered how that worked in a different space.

that_guy_iain 2y ago

1. Your old credit card solution needs a credit card. So you exclude out the poor, bad credit, etc. 2. Parents will help kids bypass checks like that. 3. It can be bypassed by a half-smart 13-year-old who can access an app on a phone that will give them the card details and be able to see transactions. Any verification that doesn't actually verify you via proper means is easy to fake. Hell, we can fake passport/id photos easy enough so now we have to jump on calls with the passport and move it around. The days of the wild west of the internet are long gone. It's time to realise that it's so important that it deserves the same level of verification we give to in person activities. Someone seeing you and/or your id. It's the only thing that has the best chances of not being bypassed with ease.

aktuel 2y ago

I basically agree with you, but it's not like you could not be tracked using your credit card number.

iamkonstantin 2y ago
This is not about tracking, having your biometrics means they can resell the data to other providers (e.g. palantir or some other hellish enterprise). With that, the places and means of following you in real time are practically limitless... There have been so many dystopian movies about this kind of tech, it's a good insight of what comes next.

rozab 2y ago

I don't really get your point, surely a credit card is even more strongly linked to your identify than your face?

piokoch 2y ago

What if you don't have a credit card? This solves nothing, the good way to do this is as system like Polish "MojeID" (my ID) [1]. This works in the following way, a site needs to verify information X, then it redirects users to a bank (that has to provide this service), login over there and then agree to let the bank know whatever it was requested - it could be only one information, birth date. This is a good solution, as banks are obliged to provide free bank account for anyone (there is EU regulation on that), this is very save, gives users full information what data third party requested. [1] https://www.kir.pl/nasza-oferta/klient-indywidualny/identyfikacja-i-e-podpis/mojeid https://www.kir.pl/nasza-oferta/klient-indywidualny/identyfi...

casenmgreen 2y ago

As we've seen, if the information is retained, it will be used. The only safe approach is for that information not to exist in the first place.

reaperducer 2y ago

They issued a refund to the card of a few cents, and I had to tell them (within 24hr) how much the refund was for, after which point they'd issue a charge to claw it back. This was one of the methods that CompuServe used back in the 1980's, though using a checking account. It's sad that so many aspects of technology have completely failed to improve in half a century.