4 ms·

The spec is being implemented by Apple, who is sensitive to privacy issues. The intent of the ISO spec is to allow you to request fine-grained data, like birth

The spec is being implemented by Apple, who is sensitive to privacy issues. The intent of the ISO spec is to allow you to request fine-grained data, like birth year only, but if you read the W3C standard, they explicitly call out privacy as a complex thing that maybe should be regulated. The spec spells out the complexity: some ID verification processes actually need a lot of info! But some, like an alcohol age check, do not. The spec can do both, but it’s hard to differentiate these technically. The spec does lay out what user agents should do to make it clear which information is going where. A bad scenario would be designing an API that is too hobbled to replace the invasive “photo of an ID” companies, which this spec seeks to do. I’d prefer an open web standard that can be abused (with user consent) to a closed App Store-only API or the status quo

AnthonyMouse 1y ago
> The intent of the ISO spec is to allow you to request fine-grained data, like birth year only, but if you read the W3C standard, they explicitly call out privacy as a complex thing that maybe should be regulated. Aren't the regulations the problem here? If not for that nobody would be getting pressured to divulge this personal information to every shady app and website in the first place. Suppose I want to make a service that verifies your age by asking you questions about what life was like before 9/11. Can I do that? And if I can't, is the problem the standards, or the law?
- mlyle 1y ago
  I think most age verification ranges from silly to chilling to speech. But I don’t think we can somehow punt these problems to the quiz from the beginning of Leisure Suit Larry (which never stopped 10 year old me).
  - AnthonyMouse 1y ago
    Requiring someone to have a government ID isn't anywhere near 100% effective because people will just borrow one from dad's wallet while he's not looking or use a device already signed in as someone else or the high school freshmen will get one from the high school seniors etc. If we're admitting solutions that aren't 100% effective, why can't we admit solutions that aren't 100% effective but are much better at preserving privacy?
    - dcow 1y ago
      Well this time around the phone will ask the person presenting an ID for biometrics before allowing them to use Dad’s ID. We are improving. There is no perfect solution; we don’t live in a perfect world. Surely we shouldn’t give up and regulate nothing…
      - AnthonyMouse 1y ago
        > Well this time around the phone will ask the person presenting an ID for biometrics before allowing them to use Dad’s ID. We are improving. How is this improving? It's the most invasive proposal yet, serves to prohibit devices that are controlled by their owners and still doesn't actually work because a) there are still a zillion devices with security vulnerabilities and b) none of this applies to websites hosted in other jurisdictions, so you're not actually limiting the access of minors to anything, you're only inconveniencing anyone who does have servers in the US or interacts with any that are. Which is an extremely large number of people to trouble for a benefit that rounds to zero. > Surely we shouldn’t give up and regulate nothing... When we're in the category of speech, let's go with this option all the way to the wall.
        dcow 1y ago
        I’m not following your argument, sorry. How are device owners being prohibited from anything? Which zillion vulnerabilities in the TPM are you referring to? Because that’s how seriously these standards take security. These are device bound TPM secured identity credentials where the wallet stack is audited and certified by security professionals before credentials are allowed to be stored. There’s no less secure option.
        mlyle 1y ago
        > How are device owners being prohibited from anything? I think a lot of us are wary of a world where we have limited selections of software stacks that we can run and do essential things. At some point, we don't own the devices anymore. I like that Apple is a benevolent overlord, for now. But I like to be able to run software that I control and participate in the world, and that has alternated between being somewhat harder and prohibitively so. Lockdown of devices (chain of trust, mandatory signed binaries, limitations of device drivers, bootloaders that won’t unlock) makes it increasingly difficult to experiment, repair, or even trust the tools we rely on, and is viewed as a prerequisite for many of these solutions. -- (I appreciate the alternatives are really hard, and that there are substantial potential downsides creating pressure towards these types of solutions, above and beyond the desires to lock down marketplaces and capture rents).
- conradev 1y ago
  Yes, they are! but also because the law sets the standard, it can also provide a new one. For example: a) you are still legally required to age verify online alcohol purchases but b) it’s illegal to use information collected for that purpose for other purposes and c) Which information is collected is made legible by the user agents Maybe something around only collecting minimal data, too. Some of the first eager customers are banks with onerous KYC requirements – they want one click account creation! Good luck changing financial disclosure laws, though, my bank knows quite a bit about me.
  - AnthonyMouse 1y ago
    > but also because the law sets the standard, it can also provide a new one. If the people writing the law cared about privacy they wouldn't have passed that one, and anybody who does would be repealing it rather than trying to find the best shade of lipstick for the pig. > Which information is collected is made legible by the user agents This is the part you don't need a law in order to do because the user can choose their user agent. Or if they can't, you should stop talking about any of this and go fix your antitrust problem. > you are still legally required to age verify online alcohol purchases but By conceding this you've already lost, because: > it’s illegal to use information collected for that purpose for other purposes This is the part which is hopeless. If they have the information, you're already screwed, because once they have it it's almost impossible for you or the government to know what they're doing with it, which makes those laws nearly impossible to enforce. And on top of that, a large part of the problem is what criminals or governments do once there is a legally-mandated database of all of that stuff, and those entities aren't constrained by laws. Which is why anybody who really cares about this knows that the only solution is to not have the law requires that data to be collected. > Good luck changing financial disclosure laws, though "Slippery slope is a fallacy", they said. "It's just one inch", they said.
    - conradev 1y ago
      I figured I’d get this response, but: I don’t see my primary care doctor selling my health data, due in part to data privacy laws like HIPAA. Consumer companies take COPPA seriously. You absolutely cannot control what companies do with data, so you want to prevent its collection in the first place – but you can penalize them when they do something wrong, which does influence their beyavior. The jury is still out on the effectiveness of the GDPR, but to say it had no effect would be an odd claim.
- dcow 1y ago
  Are you arguing that we should not regulate porn, alcohol, and cigarettes? Or that we shouldn’t have digital ways to do the regulating we’ve been doing for decades? If the discussion was a question of whether to regulate or not, I’d see more where you’re coming from. But the discussion is about how to effectively respond to the enforcement of existing laws now against websites. Society has grown up and we’re not comfortable giving the internet a pass because digital identity is hard.
  - harvey9 1y ago
    I took their post to mean the law steers implementations down a path which is not privacy- preserving. Showing your driver's license to the store clerk didn't used to mean the store kept a copy.
  - AnthonyMouse 1y ago
    > Are you arguing that we should not regulate porn, alcohol, and cigarettes? Most of the important regulations around these things have nothing to do with the topic at hand. Requiring bourbon not to contain methanol and adult performers to be tested for STDs aren't related to the internet. And once we're talking about the internet, those things are in a different category because alcohol and cigarettes are physical objects. You can't download vodka from Russia. Whereas if you want to stop kids from downloading porn from other parts of the world, the police state that would require is the thing wars have been fought against and righteously so. Not because of the porn but because of what it would take to actually make those laws effective, and what it would be used for as soon as it's in place. But ineffective laws aren't worth having, because they're all costs with no benefits, not least because then people will keep trying to make them effective and the only means to do that is the police state. > Society has grown up and we’re not comfortable giving the internet a pass because digital identity is hard. I feel like this kind of language is designed to make people angry. As if you're not an adult if you can look at a trade off against privacy and free speech and say "that's not worth having" instead of implementing every creeping authoritarian proposal specifically because the last one didn't solve the problem.
    - dcow 1y ago
- Spooky23 1y ago
  The theocracy types are making this terrible, but the technology has alot of potential to enhance privacy. For example, I was involved in a project several years ago on this where this was explored before the big vendors became players. The issue we were studying was abuse of credentials in-person - many bars will capture people’s identity information when validating IDs. The ability to provide only the attribute securely is awesome, but of course the systematic abuse of this technology by the reactionaries among us will drive adoption.
chme 1y ago
> The spec is being implemented by Apple, who is sensitive to privacy issues. I generally agree with your points, but I wouldn't trust Apple, or any publicly traded company, to have any kind of ethics. Just because their incentive to make as much profit as possible, leads to them trying to differentiate themselves from other companies, and thus they choose to temporarily align with privacy concerns doesn't mean they will not compromise on them, if they see better profits elsewhere. I rather have privacy enforcing regulations like the GDPR or policies that go even further, than relying on publicly traded companies to protect their users.

AnthonyMouse 1y ago

> The intent of the ISO spec is to allow you to request fine-grained data, like birth year only, but if you read the W3C standard, they explicitly call out privacy as a complex thing that maybe should be regulated. Aren't the regulations the problem here? If not for that nobody would be getting pressured to divulge this personal information to every shady app and website in the first place. Suppose I want to make a service that verifies your age by asking you questions about what life was like before 9/11. Can I do that? And if I can't, is the problem the standards, or the law?

mlyle 1y ago
I think most age verification ranges from silly to chilling to speech. But I don’t think we can somehow punt these problems to the quiz from the beginning of Leisure Suit Larry (which never stopped 10 year old me).
- AnthonyMouse 1y ago
  Requiring someone to have a government ID isn't anywhere near 100% effective because people will just borrow one from dad's wallet while he's not looking or use a device already signed in as someone else or the high school freshmen will get one from the high school seniors etc. If we're admitting solutions that aren't 100% effective, why can't we admit solutions that aren't 100% effective but are much better at preserving privacy?
  - dcow 1y ago
    Well this time around the phone will ask the person presenting an ID for biometrics before allowing them to use Dad’s ID. We are improving. There is no perfect solution; we don’t live in a perfect world. Surely we shouldn’t give up and regulate nothing…
    - AnthonyMouse 1y ago
      > Well this time around the phone will ask the person presenting an ID for biometrics before allowing them to use Dad’s ID. We are improving. How is this improving? It's the most invasive proposal yet, serves to prohibit devices that are controlled by their owners and still doesn't actually work because a) there are still a zillion devices with security vulnerabilities and b) none of this applies to websites hosted in other jurisdictions, so you're not actually limiting the access of minors to anything, you're only inconveniencing anyone who does have servers in the US or interacts with any that are. Which is an extremely large number of people to trouble for a benefit that rounds to zero. > Surely we shouldn’t give up and regulate nothing... When we're in the category of speech, let's go with this option all the way to the wall.
      - dcow 1y ago
        I’m not following your argument, sorry. How are device owners being prohibited from anything? Which zillion vulnerabilities in the TPM are you referring to? Because that’s how seriously these standards take security. These are device bound TPM secured identity credentials where the wallet stack is audited and certified by security professionals before credentials are allowed to be stored. There’s no less secure option.
        mlyle 1y ago
        > How are device owners being prohibited from anything? I think a lot of us are wary of a world where we have limited selections of software stacks that we can run and do essential things. At some point, we don't own the devices anymore. I like that Apple is a benevolent overlord, for now. But I like to be able to run software that I control and participate in the world, and that has alternated between being somewhat harder and prohibitively so. Lockdown of devices (chain of trust, mandatory signed binaries, limitations of device drivers, bootloaders that won’t unlock) makes it increasingly difficult to experiment, repair, or even trust the tools we rely on, and is viewed as a prerequisite for many of these solutions. -- (I appreciate the alternatives are really hard, and that there are substantial potential downsides creating pressure towards these types of solutions, above and beyond the desires to lock down marketplaces and capture rents).
conradev 1y ago
Yes, they are! but also because the law sets the standard, it can also provide a new one. For example: a) you are still legally required to age verify online alcohol purchases but b) it’s illegal to use information collected for that purpose for other purposes and c) Which information is collected is made legible by the user agents Maybe something around only collecting minimal data, too. Some of the first eager customers are banks with onerous KYC requirements – they want one click account creation! Good luck changing financial disclosure laws, though, my bank knows quite a bit about me.
- AnthonyMouse 1y ago
  > but also because the law sets the standard, it can also provide a new one. If the people writing the law cared about privacy they wouldn't have passed that one, and anybody who does would be repealing it rather than trying to find the best shade of lipstick for the pig. > Which information is collected is made legible by the user agents This is the part you don't need a law in order to do because the user can choose their user agent. Or if they can't, you should stop talking about any of this and go fix your antitrust problem. > you are still legally required to age verify online alcohol purchases but By conceding this you've already lost, because: > it’s illegal to use information collected for that purpose for other purposes This is the part which is hopeless. If they have the information, you're already screwed, because once they have it it's almost impossible for you or the government to know what they're doing with it, which makes those laws nearly impossible to enforce. And on top of that, a large part of the problem is what criminals or governments do once there is a legally-mandated database of all of that stuff, and those entities aren't constrained by laws. Which is why anybody who really cares about this knows that the only solution is to not have the law requires that data to be collected. > Good luck changing financial disclosure laws, though "Slippery slope is a fallacy", they said. "It's just one inch", they said.
  - conradev 1y ago
    I figured I’d get this response, but: I don’t see my primary care doctor selling my health data, due in part to data privacy laws like HIPAA. Consumer companies take COPPA seriously. You absolutely cannot control what companies do with data, so you want to prevent its collection in the first place – but you can penalize them when they do something wrong, which does influence their beyavior. The jury is still out on the effectiveness of the GDPR, but to say it had no effect would be an odd claim.
dcow 1y ago
Are you arguing that we should not regulate porn, alcohol, and cigarettes? Or that we shouldn’t have digital ways to do the regulating we’ve been doing for decades? If the discussion was a question of whether to regulate or not, I’d see more where you’re coming from. But the discussion is about how to effectively respond to the enforcement of existing laws now against websites. Society has grown up and we’re not comfortable giving the internet a pass because digital identity is hard.
- harvey9 1y ago
  I took their post to mean the law steers implementations down a path which is not privacy- preserving. Showing your driver's license to the store clerk didn't used to mean the store kept a copy.
- AnthonyMouse 1y ago
  > Are you arguing that we should not regulate porn, alcohol, and cigarettes? Most of the important regulations around these things have nothing to do with the topic at hand. Requiring bourbon not to contain methanol and adult performers to be tested for STDs aren't related to the internet. And once we're talking about the internet, those things are in a different category because alcohol and cigarettes are physical objects. You can't download vodka from Russia. Whereas if you want to stop kids from downloading porn from other parts of the world, the police state that would require is the thing wars have been fought against and righteously so. Not because of the porn but because of what it would take to actually make those laws effective, and what it would be used for as soon as it's in place. But ineffective laws aren't worth having, because they're all costs with no benefits, not least because then people will keep trying to make them effective and the only means to do that is the police state. > Society has grown up and we’re not comfortable giving the internet a pass because digital identity is hard. I feel like this kind of language is designed to make people angry. As if you're not an adult if you can look at a trade off against privacy and free speech and say "that's not worth having" instead of implementing every creeping authoritarian proposal specifically because the last one didn't solve the problem.
  - dcow 1y ago
Spooky23 1y ago
The theocracy types are making this terrible, but the technology has alot of potential to enhance privacy. For example, I was involved in a project several years ago on this where this was explored before the big vendors became players. The issue we were studying was abuse of credentials in-person - many bars will capture people’s identity information when validating IDs. The ability to provide only the attribute securely is awesome, but of course the systematic abuse of this technology by the reactionaries among us will drive adoption.

chme 1y ago

> The spec is being implemented by Apple, who is sensitive to privacy issues. I generally agree with your points, but I wouldn't trust Apple, or any publicly traded company, to have any kind of ethics. Just because their incentive to make as much profit as possible, leads to them trying to differentiate themselves from other companies, and thus they choose to temporarily align with privacy concerns doesn't mean they will not compromise on them, if they see better profits elsewhere. I rather have privacy enforcing regulations like the GDPR or policies that go even further, than relying on publicly traded companies to protect their users.