3 ms·

> Not as described. There's no location info in that path Ip address and general time of day will tell you a lot about location. Not street level, but country

> Not as described. There's no location info in that path Ip address and general time of day will tell you a lot about location. Not street level, but country or state level. > UUID passing the age check does not need to be re-signed because I've not given any consideration to expiry. So as soon as any one uuid is leaked, it becomes plausible for any child to bypass the gates until the uuid is manually revoked?

ben_w 2mo ago
> So as soon as any one uuid is leaked, it becomes plausible for any child to bypass the gates until the uuid is manually revoked? How? Phones are already locked down pretty hard. Anything like this would need to be in something secured at the OS level just to stop signatures getting leaked between apps. If you're thinking "kid roots device, replaces OS entirely", that's not the problem of the manufacturer of the OS that just got deleted.
- baby_souffle 2mo ago
  > How? Phones are already locked down pretty hard But never well enough, it seems. If you can't revoke the token then I'll just sell mine to whomever needs it. Kids will beg/borrow/steal their parents / older siblings ... etc. The "harden the device, bake in controls that are difficult to circumvent and managed by not-the-primary-device-user" approach is _very_ similar to DRM. All that does is punish the innocent. I have never once had VLC tell me that the mkv file I just opened can't be played because I'm not in the right region or because my screen is too old to support encryption. I have had family learn the hard way that DRM is not in their best interest, though. Now they just ask me for the movie on a pen drive when I visit next :).
  - ben_w 2mo ago
    > But never well enough, it seems. "Never well enough" for stopping teens (and pre-teens) installing access tokens? Has any adolescent in history ever managed to so much as spoof someone else's session cookie *on their phone*? And if so, when? If this is a flaw which comes up once every five iOS versions or whatever, who cares? > Kids will beg/borrow/steal their parents / older siblings ... etc. They occasionally get alcohol, too, despite restrictions. The point is to *mostly* stop them. And it's not like the payment systems have not already solved the same problem. > All that does is punish the innocent. Which is literally something I'm trying to solve with my suggestion up-thread: here's a way to do age attestation that doesn't need to punish anyone.
- fsflover 2mo ago
  > Phones are already locked down pretty hard. Which is not how it should be done at all. Outsourcing your security to a big brother leads to all kinds of problems like planned obsolescence and spying.
  - baby_souffle 2mo ago
    > Outsourcing your security to a big brother leads to all kinds of problems like planned obsolescence and spying. But, won't somebody think of the children! _sigh_.
    - fsflover 2mo ago
      This is thinking of the adults though.

ben_w 2mo ago

> So as soon as any one uuid is leaked, it becomes plausible for any child to bypass the gates until the uuid is manually revoked? How? Phones are already locked down pretty hard. Anything like this would need to be in something secured at the OS level just to stop signatures getting leaked between apps. If you're thinking "kid roots device, replaces OS entirely", that's not the problem of the manufacturer of the OS that just got deleted.

baby_souffle 2mo ago
> How? Phones are already locked down pretty hard But never well enough, it seems. If you can't revoke the token then I'll just sell mine to whomever needs it. Kids will beg/borrow/steal their parents / older siblings ... etc. The "harden the device, bake in controls that are difficult to circumvent and managed by not-the-primary-device-user" approach is _very_ similar to DRM. All that does is punish the innocent. I have never once had VLC tell me that the mkv file I just opened can't be played because I'm not in the right region or because my screen is too old to support encryption. I have had family learn the hard way that DRM is not in their best interest, though. Now they just ask me for the movie on a pen drive when I visit next :).
- ben_w 2mo ago
  > But never well enough, it seems. "Never well enough" for stopping teens (and pre-teens) installing access tokens? Has any adolescent in history ever managed to so much as spoof someone else's session cookie *on their phone*? And if so, when? If this is a flaw which comes up once every five iOS versions or whatever, who cares? > Kids will beg/borrow/steal their parents / older siblings ... etc. They occasionally get alcohol, too, despite restrictions. The point is to *mostly* stop them. And it's not like the payment systems have not already solved the same problem. > All that does is punish the innocent. Which is literally something I'm trying to solve with my suggestion up-thread: here's a way to do age attestation that doesn't need to punish anyone.
fsflover 2mo ago
> Phones are already locked down pretty hard. Which is not how it should be done at all. Outsourcing your security to a big brother leads to all kinds of problems like planned obsolescence and spying.
- baby_souffle 2mo ago
  > Outsourcing your security to a big brother leads to all kinds of problems like planned obsolescence and spying. But, won't somebody think of the children! _sigh_.
  - fsflover 2mo ago
    This is thinking of the adults though.