5 ms·

To me it seems like Cory Doctorow is demanding perfection, and saying that because we can't achieve perfection in age verification, we can't do age verification

To me it seems like Cory Doctorow is demanding perfection, and saying that because we can't achieve perfection in age verification, we can't do age verification at all. That isn't going to stop people from trying, and we will end up with a worse system overall. IMO this is a common pitfall of techno-idealists. Technologies like the mdl standard [1] can attest to age without revealing the users identity. As Cory points out, its still possible for kids to swipe someones ID and use that. There are probably practical solutions that are good enough. Android, iOS, and parents could work together to deal with the problem of stolen IDs. If mdl is implemented on devices such that they are managed by the device OS, that would lead to auditability. Parents can ask their child to see their phones ID app, which will show full roster of IDs on the child's device. If a parent sees an ID that shouldn't be there, they can have a conversation about it. In this way the law would be about empowering parents to shape their child's online experience. This is just a straw-man example solution, but there may be better ones. The other objections I saw could be worked through in a similarly pragmatic fashion. This is probably going to be good enough for most folks, and its probably a good thing to keep children away from pornography and such. And IMO coming up with a "good enough" solution will flush out all the bad actors who are hiding behind the excuse of "save the children" when really they want to build up an record of everyone's browsing history. But by denying any solution to a real problem, we let the bad actors hide amongst the well-intentioned folks who are trying to do the right thing. [1] https://en.wikipedia.org/wiki/Mobile_driver%27s_license https://en.wikipedia.org/wiki/Mobile_driver%27s_license

2OEH8eoCRo0 1y ago
All the govt needs to do is send fines to offenders and the industry will be forced to implement one or more solutions. The govt doesn't care how you verify age only that you don't sell to minors.
- wmf 1y ago
  Experience with GDPR and DSA shows that the fines lag years behind the abuses.
- crote 1y ago
  And how well has this worked in practice? How would you even identify violations, if you're not requiring websites to store the user's real-world identity? Large websites do not care even the slightest bit about how accurate the verification method is. They have zero incentive to genuinely get rid of underage users. If anything, they want to keep them - they are prime advertising real estate! Websites have every incentive to implement the age check in the cheapest and most half-baked way possible. As long as they are able to prove on paper that they are doing some form of age verification, they have met their requirements. Got a 90% false positive rate? Working as intended! The only people getting fines are the small websites who can't afford to pay a 3rd party verification service. This'll shut down your local hobbyist communities, which only drives more visitors to the large megacorp websites.
gjsman-1000 1y ago
> common pitfall of techno-idealists Common pitfall? It’s why these techno-idealists are loudmouthed on the internet, but don’t get respect anywhere politically. If you want to gain ground politically, you need to at least acknowledge what the problem is, or is perceived to be, and offer a real solution. “Nope we can’t do that because of this 0.1% edge case” doesn’t qualify. “Apple should just dump all schematics online regardless of what China might do” doesn’t qualify. “The internet is great at it is, and your political concerns are invalid” doesn’t qualify.
- Seattle3503 1y ago
  Yeah, it feels like a junior engineer fresh out their undergrad algorithms course. The business isn't going to grind to a halt and wait until you build the perfect solution.
  - gjsman-1000 1y ago
    Let’s take the pornography argument for example. Regardless of whether pornography is, or should be legal, average exposure is now 11 years old. That’s average, many kids are even younger. If this even prevents 95% of kids from accessing pornography until they’re 15 and get a debit card to buy a VPN, that’s a win in the eyes of most parents and legislators. It doesn’t need to be perfect, or even perfectly force you to be 18, to get the primary job done. Pointing to “a 16 year old can get around it with a VPN” is missing the point. It’s not a surprise why that argument falls on deaf ears. Or, another one, “just use parental controls,” have you even tried this? Almost all parental controls are horrifically buggy, full of loopholes, and these kids can just borrow each other’s technology. Apple’s parental controls predate HTML5 (literally, HTML 4.01) and regularly don’t work, sometimes even by their own admission. It also forces the parent to be in the role of a tech expert fluent in Microsoft, Apple, Google, Nintendo, and other products all at once. You might as well get CompTIA certified. That argument also falls on deaf ears.
    - idle_zealot 1y ago
      > Apple’s parental controls predate HTML5 (literally, XHTML 4.01) and regularly don’t work, sometimes even by their own admission. It also forces the parent to be in the role of a tech expert. That argument also falls on deaf ears. The solution, then, ought to be to pass a law requiring some sort of standardized parental controls that allow trivial set-and-forget management. Require device manufacturers/software distributors to sort out a "child mode" switch you can flip upon device initialization, in-your-face and unmissable, and then have apps/webpages be able to see whether the device reports it's in child mode. Does this not solve the "prevents 95% of kids from accessing pornography" threshold of effectiveness while being infinitely less invasive?
wbl 1y ago
The MDL standard does not do what you think it does.
- Seattle3503 1y ago
  My understanding is that it supports selective disclosure of attributes such as "over 18". Is this not true?
  - wbl 1y ago
    It is not. It claims it but the underlying cryptography doesn't support it.
    - glaucon 1y ago
      I was surprised to read this. I don't have access to the standard for the mDL's being discussed, that is ISO/IEC 18103-5 [1] but I have found a number of accessible resources [2][3] which suggest selective disclosure is supported. I would be interested to learn more about the gap you suggest exists between what is claimed and what is, due to the underlying cryptography, possible. Can you provide more details ? [1] https://www.iso.org/standard/69084.html https://www.iso.org/standard/69084.html [2] https://www.youtube.com/watch?v=sR5b7uuMiKk https://www.youtube.com/watch?v=sR5b7uuMiKk [3] https://www.youtube.com/watch?v=AX2TdIlakNs https://www.youtube.com/watch?v=AX2TdIlakNs (at 0:26 mentions selective disclosure as being "key" to the standard)
      - wbl 1y ago
        People are just telling lies. Each mDL has a unique signature that is always revealed even if other information isn't.
thomassmith65 1y ago
Yeah, it seems like Doctorow presents arguments that a good IDP system is complicated, but begins and concludes by saying it's impossible. It kinda seems the internet has real, longstanding problems stemming from the inability to verify anything about anything online. For the most blatant example, a website admin can never permanently ban a troll or criminal (they just sign up under a new name). It makes one wonder how Doctorow reconciles the internet as it is with his stand against adopting some kind of IDP system.
- hellojesus 1y ago
  A lot of the big players have enacted nearly permanent bans. I'd have to look up the specifics, but generally the process is: 1. Require an approved phone number upon signup or instant account "permanent suspension" 2. Require video of face and you holding id card 3. Associate "forever identifiers" in android with past accounts and ban your new, functional account if it shows up on a device that was previously associated with a banned account. I'm not sure if Apple has similar hard-reset-surviving identifies. 4. Ban accounts that somehow got passed your prior checks but you have reason to suspect they aren't conforming to normal behavior. I think all these practices are bad, bad, bad, so I don't use any sites that require them, but that is mostly how Meta and other large social networks operate these days. I assume they do it for surveillance reasons, associating an account with the correct person to get more money out of their data, but since the precedence exists, it makes it that much easier for other sites to follow.
philjohn 1y ago
They also get who actually passed the bill wrong - it was the last Conservative government.
crote 1y ago
> To me it seems like Cory Doctorow is demanding perfection, and saying that because we can't achieve perfection in age verification, we can't do age verification at all. Not we can't, but we shouldn't. All the current solutions are terrible, and are either trivial to fool or mass surveillance machines. We shouldn't be stupid enough to go for either option because it'll either cost a fortune while giving us nothing, or cause immeasurable harm when the National Porn Viewing Database inevitably gets used to blackmail everyone. We're trying to (poorly) use technology to solve a social problem. If we can't figure out a way to do so using technology without significant downsides, then perhaps we shouldn't be using technology to solve the problem at all.
- Seattle3503 1y ago
  > Not we can't, but we shouldn't. All the current solutions are terrible, and are either trivial to fool or mass surveillance machines. We shouldn't be stupid enough to go for either option because it'll either cost a fortune while giving us nothing, or cause immeasurable harm when the National Porn Viewing Database inevitably gets used to blackmail everyone. It seems like we could get "good enough" solutions that would reduce the amount of explicit material we show to kids, as well as push back the age where children are first exposed. I don't think a good technical implementation will require a "National Porn Viewing Database", but that's what we will end up if engineers and technologists dig in their heels and say "no". It is already happening in places like France and Texas. > We're trying to (poorly) use technology to solve a social problem. If we can't figure out a way to do so using technology without significant downsides, then perhaps we shouldn't be using technology to solve the problem at all. Technology created this social problem; its given us unprecedented access to explicit material. These aren't playboy's under the bed. Technology can help remediate.

2OEH8eoCRo0 1y ago

All the govt needs to do is send fines to offenders and the industry will be forced to implement one or more solutions. The govt doesn't care how you verify age only that you don't sell to minors.

wmf 1y ago
Experience with GDPR and DSA shows that the fines lag years behind the abuses.
crote 1y ago
And how well has this worked in practice? How would you even identify violations, if you're not requiring websites to store the user's real-world identity? Large websites do not care even the slightest bit about how accurate the verification method is. They have zero incentive to genuinely get rid of underage users. If anything, they want to keep them - they are prime advertising real estate! Websites have every incentive to implement the age check in the cheapest and most half-baked way possible. As long as they are able to prove on paper that they are doing some form of age verification, they have met their requirements. Got a 90% false positive rate? Working as intended! The only people getting fines are the small websites who can't afford to pay a 3rd party verification service. This'll shut down your local hobbyist communities, which only drives more visitors to the large megacorp websites.

gjsman-1000 1y ago

> common pitfall of techno-idealists Common pitfall? It’s why these techno-idealists are loudmouthed on the internet, but don’t get respect anywhere politically. If you want to gain ground politically, you need to at least acknowledge what the problem is, or is perceived to be, and offer a real solution. “Nope we can’t do that because of this 0.1% edge case” doesn’t qualify. “Apple should just dump all schematics online regardless of what China might do” doesn’t qualify. “The internet is great at it is, and your political concerns are invalid” doesn’t qualify.

Seattle3503 1y ago
Yeah, it feels like a junior engineer fresh out their undergrad algorithms course. The business isn't going to grind to a halt and wait until you build the perfect solution.
- gjsman-1000 1y ago
  Let’s take the pornography argument for example. Regardless of whether pornography is, or should be legal, average exposure is now 11 years old. That’s average, many kids are even younger. If this even prevents 95% of kids from accessing pornography until they’re 15 and get a debit card to buy a VPN, that’s a win in the eyes of most parents and legislators. It doesn’t need to be perfect, or even perfectly force you to be 18, to get the primary job done. Pointing to “a 16 year old can get around it with a VPN” is missing the point. It’s not a surprise why that argument falls on deaf ears. Or, another one, “just use parental controls,” have you even tried this? Almost all parental controls are horrifically buggy, full of loopholes, and these kids can just borrow each other’s technology. Apple’s parental controls predate HTML5 (literally, HTML 4.01) and regularly don’t work, sometimes even by their own admission. It also forces the parent to be in the role of a tech expert fluent in Microsoft, Apple, Google, Nintendo, and other products all at once. You might as well get CompTIA certified. That argument also falls on deaf ears.
  - idle_zealot 1y ago
    > Apple’s parental controls predate HTML5 (literally, XHTML 4.01) and regularly don’t work, sometimes even by their own admission. It also forces the parent to be in the role of a tech expert. That argument also falls on deaf ears. The solution, then, ought to be to pass a law requiring some sort of standardized parental controls that allow trivial set-and-forget management. Require device manufacturers/software distributors to sort out a "child mode" switch you can flip upon device initialization, in-your-face and unmissable, and then have apps/webpages be able to see whether the device reports it's in child mode. Does this not solve the "prevents 95% of kids from accessing pornography" threshold of effectiveness while being infinitely less invasive?

wbl 1y ago

The MDL standard does not do what you think it does.

Seattle3503 1y ago
My understanding is that it supports selective disclosure of attributes such as "over 18". Is this not true?
- wbl 1y ago
  It is not. It claims it but the underlying cryptography doesn't support it.
  - glaucon 1y ago
    I was surprised to read this. I don't have access to the standard for the mDL's being discussed, that is ISO/IEC 18103-5 [1] but I have found a number of accessible resources [2][3] which suggest selective disclosure is supported. I would be interested to learn more about the gap you suggest exists between what is claimed and what is, due to the underlying cryptography, possible. Can you provide more details ? [1] https://www.iso.org/standard/69084.html https://www.iso.org/standard/69084.html [2] https://www.youtube.com/watch?v=sR5b7uuMiKk https://www.youtube.com/watch?v=sR5b7uuMiKk [3] https://www.youtube.com/watch?v=AX2TdIlakNs https://www.youtube.com/watch?v=AX2TdIlakNs (at 0:26 mentions selective disclosure as being "key" to the standard)
    - wbl 1y ago
      People are just telling lies. Each mDL has a unique signature that is always revealed even if other information isn't.

thomassmith65 1y ago

Yeah, it seems like Doctorow presents arguments that a good IDP system is complicated, but begins and concludes by saying it's impossible. It kinda seems the internet has real, longstanding problems stemming from the inability to verify anything about anything online. For the most blatant example, a website admin can never permanently ban a troll or criminal (they just sign up under a new name). It makes one wonder how Doctorow reconciles the internet as it is with his stand against adopting some kind of IDP system.

hellojesus 1y ago
A lot of the big players have enacted nearly permanent bans. I'd have to look up the specifics, but generally the process is: 1. Require an approved phone number upon signup or instant account "permanent suspension" 2. Require video of face and you holding id card 3. Associate "forever identifiers" in android with past accounts and ban your new, functional account if it shows up on a device that was previously associated with a banned account. I'm not sure if Apple has similar hard-reset-surviving identifies. 4. Ban accounts that somehow got passed your prior checks but you have reason to suspect they aren't conforming to normal behavior. I think all these practices are bad, bad, bad, so I don't use any sites that require them, but that is mostly how Meta and other large social networks operate these days. I assume they do it for surveillance reasons, associating an account with the correct person to get more money out of their data, but since the precedence exists, it makes it that much easier for other sites to follow.

philjohn 1y ago

They also get who actually passed the bill wrong - it was the last Conservative government.

crote 1y ago

> To me it seems like Cory Doctorow is demanding perfection, and saying that because we can't achieve perfection in age verification, we can't do age verification at all. Not we can't, but we shouldn't. All the current solutions are terrible, and are either trivial to fool or mass surveillance machines. We shouldn't be stupid enough to go for either option because it'll either cost a fortune while giving us nothing, or cause immeasurable harm when the National Porn Viewing Database inevitably gets used to blackmail everyone. We're trying to (poorly) use technology to solve a social problem. If we can't figure out a way to do so using technology without significant downsides, then perhaps we shouldn't be using technology to solve the problem at all.

Seattle3503 1y ago
> Not we can't, but we shouldn't. All the current solutions are terrible, and are either trivial to fool or mass surveillance machines. We shouldn't be stupid enough to go for either option because it'll either cost a fortune while giving us nothing, or cause immeasurable harm when the National Porn Viewing Database inevitably gets used to blackmail everyone. It seems like we could get "good enough" solutions that would reduce the amount of explicit material we show to kids, as well as push back the age where children are first exposed. I don't think a good technical implementation will require a "National Porn Viewing Database", but that's what we will end up if engineers and technologists dig in their heels and say "no". It is already happening in places like France and Texas. > We're trying to (poorly) use technology to solve a social problem. If we can't figure out a way to do so using technology without significant downsides, then perhaps we shouldn't be using technology to solve the problem at all. Technology created this social problem; its given us unprecedented access to explicit material. These aren't playboy's under the bed. Technology can help remediate.