6 ms·

The technical implementation is messy too. Most age verification systems either don't work well or create massive privacy risks by requiring government ID uploa

The technical implementation is messy too. Most age verification systems either don't work well or create massive privacy risks by requiring government ID uploads.

shostack 9mo ago
That feels like a feature and not a bug given the way some of this stuff is heading.
- DANmode 9mo ago
  Don’t let it.
Forgeties79 9mo ago
LinkedIn’s verification is maddening
- lostlogin 9mo ago
  LinkedIn is maddening. If you make the mistake of signing up, it takes years to escape their spam and bs.
  - toast0 9mo ago
    I got years of their spam without signing up. Only after several years did they add a way to opt out an email address without making an account.
    - fc417fc802 9mo ago
      If they don't provide an easy opt-out link then why not just block the sender and move on? Unlike the less legal operations I wouldn't expect a legitimate business to rotate domains or otherwise attempt to evade blocks.
      - immibis 9mo ago
        Why block when you can report to Spamhaus?
        fc417fc802 9mo ago
        I prefer to only report genuinely malicious behavior. As long as there's no active attempt at block evasion I figure reporting it is just increasing noise and generally making things worse for everyone. It's the active block evasion crowd that make any and every network communication protocol a pain in the ass to use at scale. It wasn't simpletons using a single static IP address that triggered such widespread adoption of Anubis overnight.
        marcosdumay 9mo ago
        How is that not genuinely malicious behavior?
        fc417fc802 9mo ago
        Look I'm just trying to distinguish "active circumvention of blocks" from pretty much everything else. Because the former is what destroys the usefulness of protocols while the vast majority of other things can be trivially resolved by blocking the offending party. Including { corporate service } that I don't use sending me { unwanted thing }. If a bot that sends a fixed set of headers and is behind a single static IP is behaving poorly and slowing down your server you can block it and move on. Whereas when an abhorrently selfish operator with a client that actively hinders fingerprinting rapidly rotates through hundreds of thousands of IPs you end up with mass adoption of solutions like Anubis.
        immibis 9mo ago
        99.9% of spam is not active circumvention of blocks. It comes from so many sources you can't block them, but they are true different sources and not a block circumvention technique. That's why we decided to come down with the biggest hammer on every single source.
triceratops 9mo ago
https://news.ycombinator.com/item?id=46223051 https://news.ycombinator.com/item?id=46223051 This one works well. Or at least, as well as age verification for tobacco and alcohol. And equally privacy-preserving.
- chrisweekly 9mo ago
  Agreed! Great idea. I'll save others the click: "The insistence on perfect age verification requires ending anonymity. Age verification to the level of buying cigarettes or booze does not. Flash a driver's license at a liquor store to buy a single-use token, good for one year, and access your favorite social media trash. Anonymity is maintained, and most kids are locked out. In the same way that kids occasionally obtain cigs or beer despite safeguards, sometimes they may get their hands on a code. Prosecute anyone who knowingly sells or gives one to a minor."
  - CrossVR 9mo ago
    This does nothing to protect anonymity as you are still assigned a unique code that has been tied to your ID at the liquor store.
    - fc417fc802 9mo ago
      Historically liquor store checks were purely visual. These days they are often digital, meaning claims about privacy might (or might not) be outdated. The general principle still applies though. The physical infrastructure already exists, the ID checks do not necessarily need to be digitized or recorded, and even if they are the issued tokens don't need to be tied to the check. Grocery stores already sell age restricted items as well as gift cards that require activation. The state could issue "age check cards" that you could purchase for some nominal fee. That would require approximately zero additional infrastructure in most of the industrialized world. The efficacy would presumably be equivalent to that for alcohol and tobacco.
      - CrossVR 9mo ago

The technical implementation is messy too. Most age verification systems either don't work well or create massive privacy risks by requiring government ID uploads.

shostack 9mo ago

That feels like a feature and not a bug given the way some of this stuff is heading.

DANmode 9mo ago
Don’t let it.

Forgeties79 9mo ago

LinkedIn’s verification is maddening

lostlogin 9mo ago
LinkedIn is maddening. If you make the mistake of signing up, it takes years to escape their spam and bs.
- toast0 9mo ago
  I got years of their spam without signing up. Only after several years did they add a way to opt out an email address without making an account.
  - fc417fc802 9mo ago
    If they don't provide an easy opt-out link then why not just block the sender and move on? Unlike the less legal operations I wouldn't expect a legitimate business to rotate domains or otherwise attempt to evade blocks.
    - immibis 9mo ago
      Why block when you can report to Spamhaus?
      - fc417fc802 9mo ago
        I prefer to only report genuinely malicious behavior. As long as there's no active attempt at block evasion I figure reporting it is just increasing noise and generally making things worse for everyone. It's the active block evasion crowd that make any and every network communication protocol a pain in the ass to use at scale. It wasn't simpletons using a single static IP address that triggered such widespread adoption of Anubis overnight.
        marcosdumay 9mo ago
        How is that not genuinely malicious behavior?
        fc417fc802 9mo ago
        Look I'm just trying to distinguish "active circumvention of blocks" from pretty much everything else. Because the former is what destroys the usefulness of protocols while the vast majority of other things can be trivially resolved by blocking the offending party. Including { corporate service } that I don't use sending me { unwanted thing }. If a bot that sends a fixed set of headers and is behind a single static IP is behaving poorly and slowing down your server you can block it and move on. Whereas when an abhorrently selfish operator with a client that actively hinders fingerprinting rapidly rotates through hundreds of thousands of IPs you end up with mass adoption of solutions like Anubis.
        immibis 9mo ago
        99.9% of spam is not active circumvention of blocks. It comes from so many sources you can't block them, but they are true different sources and not a block circumvention technique. That's why we decided to come down with the biggest hammer on every single source.

triceratops 9mo ago

https://news.ycombinator.com/item?id=46223051 https://news.ycombinator.com/item?id=46223051 This one works well. Or at least, as well as age verification for tobacco and alcohol. And equally privacy-preserving.

chrisweekly 9mo ago
Agreed! Great idea. I'll save others the click: "The insistence on perfect age verification requires ending anonymity. Age verification to the level of buying cigarettes or booze does not. Flash a driver's license at a liquor store to buy a single-use token, good for one year, and access your favorite social media trash. Anonymity is maintained, and most kids are locked out. In the same way that kids occasionally obtain cigs or beer despite safeguards, sometimes they may get their hands on a code. Prosecute anyone who knowingly sells or gives one to a minor."
- CrossVR 9mo ago
  This does nothing to protect anonymity as you are still assigned a unique code that has been tied to your ID at the liquor store.
  - fc417fc802 9mo ago
    Historically liquor store checks were purely visual. These days they are often digital, meaning claims about privacy might (or might not) be outdated. The general principle still applies though. The physical infrastructure already exists, the ID checks do not necessarily need to be digitized or recorded, and even if they are the issued tokens don't need to be tied to the check. Grocery stores already sell age restricted items as well as gift cards that require activation. The state could issue "age check cards" that you could purchase for some nominal fee. That would require approximately zero additional infrastructure in most of the industrialized world. The efficacy would presumably be equivalent to that for alcohol and tobacco.
    - CrossVR 9mo ago