8 ms·

One aspect of this normalization of photo uploading is that, if a platform allows user-generated content that can splash a modal to kids, a bad actor can do thi

by btown 9mo ago

One aspect of this normalization of photo uploading is that, if a platform allows user-generated content that can splash a modal to kids, a bad actor can do things like say “you need to re-verify or you’ll lose all your in-game currency, go here” and then collect photo identification without even needing to compromise identity verification providers! I truly fear the harm that will be done before legislators realize what they’ve created. One only hopes that this prevents the EU and US from doing something similar.

pfraze 9mo ago
I’m sorry to say that a number of US states have instituted age verification laws over the past year
- pixl97 9mo ago
  Aka, morality laws mostly.
kspacewalk2 9mo ago
The fundamental question that needs answering is: should we actually prevent minors below the age of X from accessing social media site Y? Is the harm done significant enough to warrant providing parents with a technical solution for giving them control over which sites their X-aged child signs up, and a solution that like actually works? Obviously pinky-swear "over 13?" checkboxes don't work, so this currently does not exist. You can work through robustness issues like the one you bring up (photo uploading may not be a good method), we can discuss privacy trade-offs like adults without pretending this is the first time we legitimately need to make a privacy-functionality or privacy-societal need trade-off, etc. Heck, you can come up with various methods where not much privacy needs trading off, something pseudonymous and/or cryptographic and/or legislated OS-level device flags checked on signup and login. But it makes no sense to jump to the minutiae without addressing the fundamental question.
- array_key_first 9mo ago
  The real solution, IMO, is a second internet. Domain names will be whitelisted, not blacklisted, and you must submit an application to some body or something.
  - goopypoop 9mo ago
    sounds like an app store
  - anon84873628 9mo ago
    I agree. There were attempts to do something like this with porn sites via the .xxx TLD I believe, but that inverts the problem. Don't force the public to go to a dark alley for their guilty pleasures. Instead, the sites that want to target kids need to be allowlisted. That is much more practical and palatable.
    - tracker1 9mo ago
      Yeah.. the opposition was just a bad take IMO... "but it will create a virtual red light district" which is EXACTLY what you want online, unlike a physical city, you aren't going to accidentally take a wrong turn, and if you're blocking *.xxx then it's even easier to avoid. Then require all nudity to be on a .edu, .art or .xxx, problem mostly solved.
      - MarsIronPI 9mo ago
        > Then require all nudity to be on a .edu, .art or .xxx, problem mostly solved. Who's doing the requiring here? Sounds like yet another path to censorship dystopia.
        tracker1 9mo ago
        In the case of cc-tlds the respective government... In the case of other TLDs ICANN. edit: .edu provides for educational content, .art for artistic expression, .xxx for explicit content.
jofla_net 9mo ago
i call this slipstreaming, it can even occur during the signup yeah, once the bouncing around to many domains / uploading photos is psychologically normalized havoc can ensue. this is the greater evil.
ryandrake 9mo ago
I'm optimistic actually. I think "Gen Alpha" is gonna be alright and sufficiently wary of Internet sharing and privacy. Unlike the previous few generations, esp. Milleneals and to a somewhat lesser extent Gen Z and Boomers, who have massively over-shared and are now reaping some of the horrible harvest that comes from that oversharing. Today's teens and tweens seem to finally be getting the message. I also actually think AI might be a savior here. The ability to fake realistic 18+ year old selfies might help put the nail in the coffin of these idiotic "share a photo with the Internet" verification methods.
- sublinear 9mo ago
  I otherwise agree with what you're saying, but I think the ratio of conscientious people has fluctuated over time across all generations. It has more to do with what year it is than how old they are.
thewebguyd 9mo ago
> I truly fear the harm that will be done before legislators realize what they’ve created. Not defending the legislation as I overwhelmingly disagree with it, but if I recall, I don't think any of the age verification legislation specifies a specific implementation of how to verify age. Requiring photos, or photo ID, or any other number of methods being employed, were all decided on by the various private companies. All the legislators did is tell everyone "you must verify age." The fault here is on Roblox as much as it is on the legislature and they should equally share blame.
- idopmstuff 9mo ago
  How would you suggest they verify age? I am not aware of a good way to do it from a privacy and security perspective.
  - kreco 9mo ago
    You can take a look at what Switzerland is about to do: https://www.homburger.ch/de/insights/swiss-voters-approve-new-e-id# https://www.homburger.ch/de/insights/swiss-voters-approve-ne...!
    - SoftTalker 9mo ago
      Would be very tough to implement in the US, as proposing any sort of "national ID" is pretty much a nonstarter, at least up to this point. States could do it, and maybe agree on some protocols so that things like privacy-preserving "age verification" could be done. Maybe the feds could push it like they did with speed limits: make federal funding contingent upon adopting e-ID. Would still get a lot of pushback.
      - thewebguyd 9mo ago
        The problem with e-ID is its focused on identity verification, not just age verification and that's where the problem lies. We still need the ability to be psuedoanonymous online. We should be able to verify age without divulging any identifying information to the service requesting age verification. An e-ID registry could work on a sort of public/private key system so long as the services requesting informatino from the registry only receives a yes or no of "is this person old enough" and no further information.
dlcarrier 9mo ago
Every once in a while, eBay emails me out of the blue and asks me to update my personal details, with a link to a web page. I always assumed they were phishing scams, but I looked closer at one, and it is a real link too a real page on their site. It's like they're training people to fall for phishing scams. One of them even displayed the name of a variable, instead of my user name.
- graemep 9mo ago
  I have had two banks (Lloyds and Barclays) phone me and ask for personal details to verify me over the phone. Again, training people to fall for scams. Then there are all the links that go to other sites to track clicks or because they have a separate domain for some reason. Again, training people to fall for phishing.

by btown 9mo ago

pfraze 9mo ago

I’m sorry to say that a number of US states have instituted age verification laws over the past year

pixl97 9mo ago
Aka, morality laws mostly.

kspacewalk2 9mo ago

The fundamental question that needs answering is: should we actually prevent minors below the age of X from accessing social media site Y? Is the harm done significant enough to warrant providing parents with a technical solution for giving them control over which sites their X-aged child signs up, and a solution that like actually works? Obviously pinky-swear "over 13?" checkboxes don't work, so this currently does not exist. You can work through robustness issues like the one you bring up (photo uploading may not be a good method), we can discuss privacy trade-offs like adults without pretending this is the first time we legitimately need to make a privacy-functionality or privacy-societal need trade-off, etc. Heck, you can come up with various methods where not much privacy needs trading off, something pseudonymous and/or cryptographic and/or legislated OS-level device flags checked on signup and login. But it makes no sense to jump to the minutiae without addressing the fundamental question.

array_key_first 9mo ago
The real solution, IMO, is a second internet. Domain names will be whitelisted, not blacklisted, and you must submit an application to some body or something.
- goopypoop 9mo ago
  sounds like an app store
- anon84873628 9mo ago
  I agree. There were attempts to do something like this with porn sites via the .xxx TLD I believe, but that inverts the problem. Don't force the public to go to a dark alley for their guilty pleasures. Instead, the sites that want to target kids need to be allowlisted. That is much more practical and palatable.
  - tracker1 9mo ago
    Yeah.. the opposition was just a bad take IMO... "but it will create a virtual red light district" which is EXACTLY what you want online, unlike a physical city, you aren't going to accidentally take a wrong turn, and if you're blocking *.xxx then it's even easier to avoid. Then require all nudity to be on a .edu, .art or .xxx, problem mostly solved.
    - MarsIronPI 9mo ago
      > Then require all nudity to be on a .edu, .art or .xxx, problem mostly solved. Who's doing the requiring here? Sounds like yet another path to censorship dystopia.
      - tracker1 9mo ago
        In the case of cc-tlds the respective government... In the case of other TLDs ICANN. edit: .edu provides for educational content, .art for artistic expression, .xxx for explicit content.

jofla_net 9mo ago

i call this slipstreaming, it can even occur during the signup yeah, once the bouncing around to many domains / uploading photos is psychologically normalized havoc can ensue. this is the greater evil.

ryandrake 9mo ago

I'm optimistic actually. I think "Gen Alpha" is gonna be alright and sufficiently wary of Internet sharing and privacy. Unlike the previous few generations, esp. Milleneals and to a somewhat lesser extent Gen Z and Boomers, who have massively over-shared and are now reaping some of the horrible harvest that comes from that oversharing. Today's teens and tweens seem to finally be getting the message. I also actually think AI might be a savior here. The ability to fake realistic 18+ year old selfies might help put the nail in the coffin of these idiotic "share a photo with the Internet" verification methods.

sublinear 9mo ago
I otherwise agree with what you're saying, but I think the ratio of conscientious people has fluctuated over time across all generations. It has more to do with what year it is than how old they are.

thewebguyd 9mo ago

> I truly fear the harm that will be done before legislators realize what they’ve created. Not defending the legislation as I overwhelmingly disagree with it, but if I recall, I don't think any of the age verification legislation specifies a specific implementation of how to verify age. Requiring photos, or photo ID, or any other number of methods being employed, were all decided on by the various private companies. All the legislators did is tell everyone "you must verify age." The fault here is on Roblox as much as it is on the legislature and they should equally share blame.

idopmstuff 9mo ago
How would you suggest they verify age? I am not aware of a good way to do it from a privacy and security perspective.
- kreco 9mo ago
  You can take a look at what Switzerland is about to do: https://www.homburger.ch/de/insights/swiss-voters-approve-new-e-id# https://www.homburger.ch/de/insights/swiss-voters-approve-ne...!
  - SoftTalker 9mo ago
    Would be very tough to implement in the US, as proposing any sort of "national ID" is pretty much a nonstarter, at least up to this point. States could do it, and maybe agree on some protocols so that things like privacy-preserving "age verification" could be done. Maybe the feds could push it like they did with speed limits: make federal funding contingent upon adopting e-ID. Would still get a lot of pushback.
    - thewebguyd 9mo ago
      The problem with e-ID is its focused on identity verification, not just age verification and that's where the problem lies. We still need the ability to be psuedoanonymous online. We should be able to verify age without divulging any identifying information to the service requesting age verification. An e-ID registry could work on a sort of public/private key system so long as the services requesting informatino from the registry only receives a yes or no of "is this person old enough" and no further information.

dlcarrier 9mo ago

Every once in a while, eBay emails me out of the blue and asks me to update my personal details, with a link to a web page. I always assumed they were phishing scams, but I looked closer at one, and it is a real link too a real page on their site. It's like they're training people to fall for phishing scams. One of them even displayed the name of a variable, instead of my user name.

graemep 9mo ago
I have had two banks (Lloyds and Barclays) phone me and ask for personal details to verify me over the phone. Again, training people to fall for scams. Then there are all the links that go to other sites to track clicks or because they have a separate domain for some reason. Again, training people to fall for phishing.