4 ms·

>An FTC spokesperson told CNBC that companies must limit how collected information is used. [...] The agency pointed to existing rules requiring firms to retain

>An FTC spokesperson told CNBC that companies must limit how collected information is used. [...] The agency pointed to existing rules requiring firms to retain personal information only as long as reasonably necessary and to safeguard its confidentiality and integrity. the very same rules that have allowed literally every single piece of my data to be leaked several separate times, and now i have free credit monitoring instead of privacy? and all of those companies still operate normally, as if nothing ever happened? very neat. >Discord said it is using the additional time this year to add more verification options, including credit cards, more transparency on vendors and technical detail of how age verification will work and why didnt we start with credit cards? instead of facial recognition with peter thiel? (this is a rhetorical question)

clumsysmurf 8mo ago
> now i have free credit monitoring Might not even matter ... "TransUnion and Experian, two of the three major credit bureaus, have started dismissing a larger share of consumer complaints without help since the Trump administration began dismantling the CFPB." https://www.propublica.org/article/credit-report-mistakes-cfpb-experian-transunion https://www.propublica.org/article/credit-report-mistakes-cf...
- ArchieScrivener 8mo ago
  How much money did the CFPB actually give back to wronged consumers?
  - m4ck_ 8mo ago
    Pre-trump's attempts to eliminate the department, almost $20 billion. https://www.consumerfinance.gov/enforcement/enforcement-by-the-numbers/ https://www.consumerfinance.gov/enforcement/enforcement-by-t...
    - gibspaulding 8mo ago
      And one would hope that the purpose of the CFPB would be to dissuade lenders from wronging consumers in the first place, meaning the net benefit to consumers was likely much higher.
    - ArchieScrivener 8mo ago
      Thanks for the numbers!
  - coffeefirst 8mo ago
    Their mere presence was effective. I know people who had trouble with banks refusing to fix their own screwups and demanding evidence that couldn’t exist. They changed their tune the second there was an open case on the matter.
  - throwway120385 8mo ago
    Also of note is they were responsible for medical debt cases, which are particularly difficult for people to resolve because of the shared responsibility between the patient and the insurer, which allows the insurer to deflect responsibility until the bill ends up in collections.
- SoftTalker 8mo ago
  It's not like they were really doing a very good job anyway. My data has been leaking for two decades now.
PaulKeeble 8mo ago
Some of the accounts being blocked from certain access are themselves 18! You would think Reddit would consider that, but nope it doesn't.
- hunter2_ 8mo ago
  Probably because the transfer of accounts (typically for reasons of better spamming, but in this case for adult access) is possible. However, that makes me wonder what mechanism might "unverify" an account holder's age upon transfer. I suppose it's simply a need to re-verify (take a new photo) upon every login, but then folks could transfer the session cookie to avoid needing the new owner to perform a login (unless a new device ID/fingerprint makes the old cookie useless).
  - soulofmischief 8mo ago
    10 years was enough for Tom Fulp. https://www.newgrounds.com/bbs/topic/1549829/1 https://www.newgrounds.com/bbs/topic/1549829/1 https://www.newgrounds.com/bbs/topic/1555753/1 https://www.newgrounds.com/bbs/topic/1555753/1
  - Jeremy1026 8mo ago
    Since you don't have to verify every time you use the account, transfer of verified accounts will still be a "problem" though. It's just a CYA to be able to say "we verified this account owner."
    - DrJokepu 8mo ago
      But… You could transfer the account after age verification too. The only way to be sure is to ask for ID every time people use the website / application, then children will be truly finally safe from the horrors of the Internet.
      - jvuygbbkuurx 8mo ago
        The website will only function when webcam is turned on with passport next to your face. Session is immeditely revoked on failure.
tmaly 8mo ago
I have gotten several notices of medical data being leaked over the last two years. I thought HIPPA law had very harsh fines for this, but I guess they just look the other way.
- john_strinlai 8mo ago
  unfortunately, even if the fine seems harsh, if it is less than the profits generated the fine is an operating expense and not a deterrent.
  - deleted 8mo ago
    [deleted]
- SoftTalker 8mo ago
  Seems like if you just disclose and make assurances that "you take security seriously" then it's fine.
  - abustamam 8mo ago
    I once worked with both PCI and HIPAA at a consulting firm. Neither had very high bars. PCI compliance was just a yes/no questionnaire that said something like "I do not store unencrypted CC numbers in my DB." No one validates the questionnaire. I just submit it and I got a shiny badge to put on my clients site. HIPAA compliance was just a half hour webinar. To be fair, I think HIPAA works in offline contexts (employers can't ask your doctor about your health) but as far as how easy it was for me to get access to customer CCs and medical information... Let's just say the barrier was basically nonexistent.
- jimz 8mo ago
  HIPAA doesn't have a private cause of action so if a violation happens, it's a wealth transfer to the government, it doesn't mean anything to you or any individual. And most companies can simply price it in as cost of doing business at this point.
- chimeracoder 8mo ago
ErigmolCt 8mo ago
On the credit card point though, cards don't work perfectly as age verification either. Plenty of minors can access prepaid cards or family cards
- eikenberry 8mo ago
  Prepaid cards can't masquerade as credit cards as there are easy ways to differentiate them (the numbers have meaning) and a minor getting access to the family credit card is the parents giving them permission. I'm not convinced credit card for age verification is a good solution for all cases but for cases where you've already used a credit card to access the service it would be perfect.
  - array_key_first 8mo ago
    I agree, we shouldn't be optimizing for the case where a child steals a credit card. That's just not in the threat model. I mean, they could steal IDs too, and children can already steal credit cards and buy, like, vbucks or whatever. Which probably causes more tangible real-world harm than seeing a pair of boobies or whatever we're trying to protect against. However, I still think credit cards are overkill. They reveal way too much information, including addresses. I wouldn't trust most companies with my credit card either, at least not online. In person it's different, the scanners are secure especially if you use tap to pay. But online, you just have a pinky promise that your info isn't being stored. Frankly, I'm getting sick and tired of being put in the situation where I have no choice but to just blindly trust people to do the right thing. Obviously, it's not working, and we need real solutions.
    - eikenberry 8mo ago
      I agree that CCs are overkill for every case except those where you have already given them a CC. There is no risk of revealing to much information for age verification when you already are giving them all that information.
- john_strinlai 8mo ago
  >cards don't work perfectly as age verification either. there are 0 "perfect" age verification systems. plenty of minors can have their brother/sister/parents supply their id, or do the verification video. the on-device verification discord rolled out was, within hours, broken. i remember news reports of kids submitting photos of their dogs and being verified as of-age. credit card solves most of the problem with much less downside than submitting my face (i am already okay putting my card info into most sites)
raxxorraxor 8mo ago
I prefer facial recognition. Probably good that there isn't a popular face-spoofer app, since it would put attention to the efficiency of these verifications. Credit card info is a bad solution. In many countries they still are rare and it would very likely exclude as much adults as children. The real answer is that while we should expect children to be online, it is the responsibility of the parents to moderate their usage. Add a standard header to every http request to support filter solutions. That is the only viable solution that is of a technical nature. The whole ZKP idea is futile, no model works if you also have connection information, which states tend to save too. Anonymous internet usage is pretty awesome. For adults and kids for that matter. And that doesn't change because there are also bad advertisers that practically can identify and track you. If you want to protect kids, have those be imprisoned first. Strong opinion, I know, but also the correct one.
- Forgeties79 8mo ago
  I definitely agree that we need to pass strict laws around “advertising,“ which at this point is a misnomer for the assault we experience every day just by engaging with the Internet or simply walking into a store now. It’s data fracking, not “targeted advertising” anymore. The semi-anonymous Internet is so important especially for people in repressive households/societies.
mghackerlady 8mo ago
There's even precedent for credit cards! I remember my dad needing to make a small transaction to get me a nintendo online account back in the 3DS and Wii U era

clumsysmurf 8mo ago

> now i have free credit monitoring Might not even matter ... "TransUnion and Experian, two of the three major credit bureaus, have started dismissing a larger share of consumer complaints without help since the Trump administration began dismantling the CFPB." https://www.propublica.org/article/credit-report-mistakes-cfpb-experian-transunion https://www.propublica.org/article/credit-report-mistakes-cf...

ArchieScrivener 8mo ago
How much money did the CFPB actually give back to wronged consumers?
- m4ck_ 8mo ago
  Pre-trump's attempts to eliminate the department, almost $20 billion. https://www.consumerfinance.gov/enforcement/enforcement-by-the-numbers/ https://www.consumerfinance.gov/enforcement/enforcement-by-t...
  - gibspaulding 8mo ago
    And one would hope that the purpose of the CFPB would be to dissuade lenders from wronging consumers in the first place, meaning the net benefit to consumers was likely much higher.
  - ArchieScrivener 8mo ago
    Thanks for the numbers!
- coffeefirst 8mo ago
  Their mere presence was effective. I know people who had trouble with banks refusing to fix their own screwups and demanding evidence that couldn’t exist. They changed their tune the second there was an open case on the matter.
- throwway120385 8mo ago
  Also of note is they were responsible for medical debt cases, which are particularly difficult for people to resolve because of the shared responsibility between the patient and the insurer, which allows the insurer to deflect responsibility until the bill ends up in collections.
SoftTalker 8mo ago
It's not like they were really doing a very good job anyway. My data has been leaking for two decades now.

PaulKeeble 8mo ago

Some of the accounts being blocked from certain access are themselves 18! You would think Reddit would consider that, but nope it doesn't.

hunter2_ 8mo ago
Probably because the transfer of accounts (typically for reasons of better spamming, but in this case for adult access) is possible. However, that makes me wonder what mechanism might "unverify" an account holder's age upon transfer. I suppose it's simply a need to re-verify (take a new photo) upon every login, but then folks could transfer the session cookie to avoid needing the new owner to perform a login (unless a new device ID/fingerprint makes the old cookie useless).
- soulofmischief 8mo ago
  10 years was enough for Tom Fulp. https://www.newgrounds.com/bbs/topic/1549829/1 https://www.newgrounds.com/bbs/topic/1549829/1 https://www.newgrounds.com/bbs/topic/1555753/1 https://www.newgrounds.com/bbs/topic/1555753/1
- Jeremy1026 8mo ago
  Since you don't have to verify every time you use the account, transfer of verified accounts will still be a "problem" though. It's just a CYA to be able to say "we verified this account owner."
  - DrJokepu 8mo ago
    But… You could transfer the account after age verification too. The only way to be sure is to ask for ID every time people use the website / application, then children will be truly finally safe from the horrors of the Internet.
    - jvuygbbkuurx 8mo ago
      The website will only function when webcam is turned on with passport next to your face. Session is immeditely revoked on failure.

tmaly 8mo ago

I have gotten several notices of medical data being leaked over the last two years. I thought HIPPA law had very harsh fines for this, but I guess they just look the other way.

john_strinlai 8mo ago
unfortunately, even if the fine seems harsh, if it is less than the profits generated the fine is an operating expense and not a deterrent.
- deleted 8mo ago
  [deleted]
SoftTalker 8mo ago
Seems like if you just disclose and make assurances that "you take security seriously" then it's fine.
- abustamam 8mo ago
  I once worked with both PCI and HIPAA at a consulting firm. Neither had very high bars. PCI compliance was just a yes/no questionnaire that said something like "I do not store unencrypted CC numbers in my DB." No one validates the questionnaire. I just submit it and I got a shiny badge to put on my clients site. HIPAA compliance was just a half hour webinar. To be fair, I think HIPAA works in offline contexts (employers can't ask your doctor about your health) but as far as how easy it was for me to get access to customer CCs and medical information... Let's just say the barrier was basically nonexistent.
jimz 8mo ago
HIPAA doesn't have a private cause of action so if a violation happens, it's a wealth transfer to the government, it doesn't mean anything to you or any individual. And most companies can simply price it in as cost of doing business at this point.
chimeracoder 8mo ago

ErigmolCt 8mo ago

On the credit card point though, cards don't work perfectly as age verification either. Plenty of minors can access prepaid cards or family cards

eikenberry 8mo ago
Prepaid cards can't masquerade as credit cards as there are easy ways to differentiate them (the numbers have meaning) and a minor getting access to the family credit card is the parents giving them permission. I'm not convinced credit card for age verification is a good solution for all cases but for cases where you've already used a credit card to access the service it would be perfect.
- array_key_first 8mo ago
  I agree, we shouldn't be optimizing for the case where a child steals a credit card. That's just not in the threat model. I mean, they could steal IDs too, and children can already steal credit cards and buy, like, vbucks or whatever. Which probably causes more tangible real-world harm than seeing a pair of boobies or whatever we're trying to protect against. However, I still think credit cards are overkill. They reveal way too much information, including addresses. I wouldn't trust most companies with my credit card either, at least not online. In person it's different, the scanners are secure especially if you use tap to pay. But online, you just have a pinky promise that your info isn't being stored. Frankly, I'm getting sick and tired of being put in the situation where I have no choice but to just blindly trust people to do the right thing. Obviously, it's not working, and we need real solutions.
  - eikenberry 8mo ago
    I agree that CCs are overkill for every case except those where you have already given them a CC. There is no risk of revealing to much information for age verification when you already are giving them all that information.
john_strinlai 8mo ago
>cards don't work perfectly as age verification either. there are 0 "perfect" age verification systems. plenty of minors can have their brother/sister/parents supply their id, or do the verification video. the on-device verification discord rolled out was, within hours, broken. i remember news reports of kids submitting photos of their dogs and being verified as of-age. credit card solves most of the problem with much less downside than submitting my face (i am already okay putting my card info into most sites)

raxxorraxor 8mo ago

I prefer facial recognition. Probably good that there isn't a popular face-spoofer app, since it would put attention to the efficiency of these verifications. Credit card info is a bad solution. In many countries they still are rare and it would very likely exclude as much adults as children. The real answer is that while we should expect children to be online, it is the responsibility of the parents to moderate their usage. Add a standard header to every http request to support filter solutions. That is the only viable solution that is of a technical nature. The whole ZKP idea is futile, no model works if you also have connection information, which states tend to save too. Anonymous internet usage is pretty awesome. For adults and kids for that matter. And that doesn't change because there are also bad advertisers that practically can identify and track you. If you want to protect kids, have those be imprisoned first. Strong opinion, I know, but also the correct one.

Forgeties79 8mo ago
I definitely agree that we need to pass strict laws around “advertising,“ which at this point is a misnomer for the assault we experience every day just by engaging with the Internet or simply walking into a store now. It’s data fracking, not “targeted advertising” anymore. The semi-anonymous Internet is so important especially for people in repressive households/societies.

mghackerlady 8mo ago

There's even precedent for credit cards! I remember my dad needing to make a small transaction to get me a nintendo online account back in the 3DS and Wii U era