6 ms·

Where are these mythical sweet-spot solutions? Concretely, half the websites I visit from the UK want me to either scan my face or upload ID documents to access

by Retr0id 4mo ago

Where are these mythical sweet-spot solutions? Concretely, half the websites I visit from the UK want me to either scan my face or upload ID documents to access their full featureset. Now that users have been conditioned to accept this, nobody seems very interested in figuring out how to collect less PII - only insulating themselves from liability by having the data processed by a third party.

john_strinlai 4mo ago
>mythical sweet-spot solutions? there are thousands of comments on these threads every time it comes up. there's tons of what i consider reasonable solutions proposed. there's examples below, too, which don't require face scans. >Concretely, half the websites I visit from the UK want me to either scan my face or upload ID documents yeah, i agree that really sucks.
- Retr0id 4mo ago
  I've yet to see one I consider reasonable.
  - john_strinlai 4mo ago
    if you think even the client-side "yes im 18" on OS setup proposals are unreasonable, i dont know what to say.
    - Retr0id 4mo ago
      Privacy-wise I think they're completely acceptable, but in terms of circumvention I don't think the politicians will be satisfied. It's barely a step up from the "I'm over 18" buttons on websites.
      - john_strinlai 4mo ago
        >It's barely a step up from the "I'm over 18" buttons on websites. i think its a pretty decent step up from that, but i know what you mean. >I don't think the politicians will be satisfied. and that circles back to my original point. the politicians aren't satisfied with a "mostly effective" solution (e.g. OS-enforced age attestation) as they are with literally every other law, and instead are taking advantage of the issue to justify mass surveillance.
      - intended 4mo ago
        I believe kids will always find circumvention pathways. There is a signaling function these laws serve: things are the products we consider acceptable in society. We have these rules for cigarettes, booze, and vapes. That said, privacy being sacrificed for signals, is an unacceptable trade, especially when better solutions can be crafted.
        throw93939r 4mo ago
        [flagged]
        angiolillo 4mo ago
        > kids will always find circumvention pathways I'd consider this a feature. I'd be proud if my kids find a way to circumvent the parental controls on the family computer or use their own money to build their own computer like I did growing up. At that point they've earned the right to the full internet. (However, I would not be willing to use any solution that sacrifices my or my kid's privacy.)
  - throwaway75353 4mo ago
    [dead]
cogman10 4mo ago
The UK has draconian laws. But some of the easiest middle ground solutions that solve 90% of the problem are things like simple math problems. Get asked "3+7" and that will pretty quickly filter out almost anyone under the age of 6. If you can accept that there are some smart 4 or 5 year olds who can do simple math, congrats you recognize there's a 10%.
- Retr0id 4mo ago
  They are indeed draconian, and the rest of the world is now eyeing up adopting similar legislation.
gambiting 4mo ago
Government builds a website where you can log in using any government issued ID or using one of the many many many available services that hold your details already(at least in the UK nearly everyone will have a DLVA account, HMRC account, HMPO account, NHS account.....all of these are government services which we can only assume hold our data securely already). On that website, you can click "give me a verification code", it gives you a code that is single use and only valid 24 hours. You type that into whatever 18+ website you need to, they use a public API provided by the government to just check "yes this is a valid code and the user is 18" - bang, done, verified. The website knows nothing about you at all, except for the fact that you're 18. In fact, the UK government ALREADY HAS THIS. For the EU settlement scheme, you can give your employeer(or anyone else who needs it) a special magic code that they type in on the government website, and it just says "yet his person has the right to reside in the UK" without spilling any of your personal information at all. The code is single use and valid a limited amount of time. And you can do the same with your driving licence, where anyone can verify you hold a valid licence without actually seeing it or any details on it. Like, am I being stupid here? It seems like an almost trivial solution to the problem, especially given that it already exists for at least 2 services named above. And yes, I know people will say "oh but that requires the government having this data on you, and that's bad" or "but then the government will know you've authenticated with pornhub!". And yes, both of these are true - but on point 1 - like, I'd love some ideal situation where the government can simultaniously give me a passport or a driving licence AND not have any information about me at the same time, but that ain't happening, and on point 2 - yes, but that's still infinitely preferable to the current implementation, and it can be easily solved with legislation saying that the code authentication service doesn't log who requested verification, it just answers with yes/no and that's it.
- Jabrov 4mo ago
  The codes can trivially be shared in this case
  - gambiting 4mo ago
    ...and? Just like a child can "trivially" ask an adult to buy them a beer. Who are these adults giving children their verification codes for adult websites?
dijksterhuis 4mo ago
> half the websites I visit from the UK want me to either scan my face or upload ID documents to access their full featureset. what kind of websites are you visiting to get age checked on half of the sites you visit? i've only been asked to verify for dating apps and "sexy stuff". and i definitely don't spend 50% of my total browsing time on those sites. maybe this says more about the kind of content/sites you're accessing if it is really as high as 50%? UK age verification mostly only applies to sites which might end up hosting the content quoted below. > pornographic images, and content that encourages, promotes, or provides instructions for eating disorders, self-harm, or suicide. or you're just being hyperbolic? 79% of statistics are made up, after all.
- Retr0id 4mo ago
  reddit.com, discord.app, google.com with safe-search off (This one works sometimes, they are A/B testing force-enabling safe-search for unauth'd sessions)
  - dofm 4mo ago
    Oh, reddit, yes. Good point. I don't use that; it's worse for your brain than any regulated substance. Kick your reddit habit while you can. Google safe search: I've only seen this from my PAYG mobile phone, because I've never bothered to lift the adult content lock on that after more than a decade, and Google is the only place I've seen ask, actually. Even so it rarely happens. Discord: the mere idea of being in an adult-content-related discord group is enough to make my skin crawl. Worth noting that of these three, only one of them is a UK-only decision, as far as I am aware: Google Safe Search respects UK phone companies' default adult content block on PAYG. They are about the only company that does. Reddit and Discord have made this decision globally, have they not? Because there are US state laws too.
    - Terr_ 4mo ago
      I'd also caution that Reddit can and will destroy a 10+ year account (erasing all submissions and comments) for no discernible reason with a quite-literally-broken appeals process.
deleted 4mo ago
[deleted]
irusensei 4mo ago
They don't exist because the organizations who lobbied governments were YOTI, Persona, K-ID and others who have a vested interest in collecting data and rent seek by latching through regulations like diseased ticks.

by Retr0id 4mo ago

john_strinlai 4mo ago

>mythical sweet-spot solutions? there are thousands of comments on these threads every time it comes up. there's tons of what i consider reasonable solutions proposed. there's examples below, too, which don't require face scans. >Concretely, half the websites I visit from the UK want me to either scan my face or upload ID documents yeah, i agree that really sucks.

Retr0id 4mo ago
I've yet to see one I consider reasonable.
- john_strinlai 4mo ago
  if you think even the client-side "yes im 18" on OS setup proposals are unreasonable, i dont know what to say.
  - Retr0id 4mo ago
    Privacy-wise I think they're completely acceptable, but in terms of circumvention I don't think the politicians will be satisfied. It's barely a step up from the "I'm over 18" buttons on websites.
    - john_strinlai 4mo ago
      >It's barely a step up from the "I'm over 18" buttons on websites. i think its a pretty decent step up from that, but i know what you mean. >I don't think the politicians will be satisfied. and that circles back to my original point. the politicians aren't satisfied with a "mostly effective" solution (e.g. OS-enforced age attestation) as they are with literally every other law, and instead are taking advantage of the issue to justify mass surveillance.
    - intended 4mo ago
      I believe kids will always find circumvention pathways. There is a signaling function these laws serve: things are the products we consider acceptable in society. We have these rules for cigarettes, booze, and vapes. That said, privacy being sacrificed for signals, is an unacceptable trade, especially when better solutions can be crafted.
      - throw93939r 4mo ago
        [flagged]
      - angiolillo 4mo ago
        > kids will always find circumvention pathways I'd consider this a feature. I'd be proud if my kids find a way to circumvent the parental controls on the family computer or use their own money to build their own computer like I did growing up. At that point they've earned the right to the full internet. (However, I would not be willing to use any solution that sacrifices my or my kid's privacy.)
- throwaway75353 4mo ago
  [dead]

cogman10 4mo ago

The UK has draconian laws. But some of the easiest middle ground solutions that solve 90% of the problem are things like simple math problems. Get asked "3+7" and that will pretty quickly filter out almost anyone under the age of 6. If you can accept that there are some smart 4 or 5 year olds who can do simple math, congrats you recognize there's a 10%.

Retr0id 4mo ago
They are indeed draconian, and the rest of the world is now eyeing up adopting similar legislation.

gambiting 4mo ago

Government builds a website where you can log in using any government issued ID or using one of the many many many available services that hold your details already(at least in the UK nearly everyone will have a DLVA account, HMRC account, HMPO account, NHS account.....all of these are government services which we can only assume hold our data securely already). On that website, you can click "give me a verification code", it gives you a code that is single use and only valid 24 hours. You type that into whatever 18+ website you need to, they use a public API provided by the government to just check "yes this is a valid code and the user is 18" - bang, done, verified. The website knows nothing about you at all, except for the fact that you're 18. In fact, the UK government ALREADY HAS THIS. For the EU settlement scheme, you can give your employeer(or anyone else who needs it) a special magic code that they type in on the government website, and it just says "yet his person has the right to reside in the UK" without spilling any of your personal information at all. The code is single use and valid a limited amount of time. And you can do the same with your driving licence, where anyone can verify you hold a valid licence without actually seeing it or any details on it. Like, am I being stupid here? It seems like an almost trivial solution to the problem, especially given that it already exists for at least 2 services named above. And yes, I know people will say "oh but that requires the government having this data on you, and that's bad" or "but then the government will know you've authenticated with pornhub!". And yes, both of these are true - but on point 1 - like, I'd love some ideal situation where the government can simultaniously give me a passport or a driving licence AND not have any information about me at the same time, but that ain't happening, and on point 2 - yes, but that's still infinitely preferable to the current implementation, and it can be easily solved with legislation saying that the code authentication service doesn't log who requested verification, it just answers with yes/no and that's it.

Jabrov 4mo ago
The codes can trivially be shared in this case
- gambiting 4mo ago
  ...and? Just like a child can "trivially" ask an adult to buy them a beer. Who are these adults giving children their verification codes for adult websites?

dijksterhuis 4mo ago

> half the websites I visit from the UK want me to either scan my face or upload ID documents to access their full featureset. what kind of websites are you visiting to get age checked on half of the sites you visit? i've only been asked to verify for dating apps and "sexy stuff". and i definitely don't spend 50% of my total browsing time on those sites. maybe this says more about the kind of content/sites you're accessing if it is really as high as 50%? UK age verification mostly only applies to sites which might end up hosting the content quoted below. > pornographic images, and content that encourages, promotes, or provides instructions for eating disorders, self-harm, or suicide. or you're just being hyperbolic? 79% of statistics are made up, after all.

Retr0id 4mo ago
reddit.com, discord.app, google.com with safe-search off (This one works sometimes, they are A/B testing force-enabling safe-search for unauth'd sessions)
- dofm 4mo ago
  Oh, reddit, yes. Good point. I don't use that; it's worse for your brain than any regulated substance. Kick your reddit habit while you can. Google safe search: I've only seen this from my PAYG mobile phone, because I've never bothered to lift the adult content lock on that after more than a decade, and Google is the only place I've seen ask, actually. Even so it rarely happens. Discord: the mere idea of being in an adult-content-related discord group is enough to make my skin crawl. Worth noting that of these three, only one of them is a UK-only decision, as far as I am aware: Google Safe Search respects UK phone companies' default adult content block on PAYG. They are about the only company that does. Reddit and Discord have made this decision globally, have they not? Because there are US state laws too.
  - Terr_ 4mo ago
    I'd also caution that Reddit can and will destroy a 10+ year account (erasing all submissions and comments) for no discernible reason with a quite-literally-broken appeals process.

deleted 4mo ago

[deleted]

irusensei 4mo ago

They don't exist because the organizations who lobbied governments were YOTI, Persona, K-ID and others who have a vested interest in collecting data and rent seek by latching through regulations like diseased ticks.