Hacker News new | ask | show | jobs
by freedomben 308 days ago
It may not be effective in the long term, but I think it's very much worth doing. The privacy nightmare of uploading government docs is appalling and should be resisted by all who can, so I think you're doing great work. If it provokes regulators to push harder, they might just get enough attention from voters to motivate a change. That would be my hope anyway
3 comments

It's a great idea to get rid of, I'm shocked a company is this brave to do this. It's not in the interest of any adult to upload their ID so the government can track their web browsing. I didn't want to expose my kid to porn when they were 5, somehow it wasn't a problem because the avg browser use was guided by me, but also the browser blocked porn. When they were a bit older, a teenager, I also lightly guided their computer use.
The solution to spam is that everyone replies to the spam and engages up to the point that human labor is required, thus making it financially impractictable

The solution to this problem is not to provide YOUR ID but to provide AN ID, again and again, once per day. Again - cannot scale if a manual check is done by a human somewhere, flipside if it's fully automated now it's game-able

This is the AI we need.

Detect or tag an email as scam -> forward it to an AI agent that will keep the scammer conversing as long as possible.

Basically a tarpit solution but for actual humans.

Interesting idea. If you're of age, then arguably there would be no material deception from using a fake or borrowed ID to prove that you're of age.

I don't believe for a second that this argument would stand up in court, but it would at least be a rational form of protest against having to identify yourself.

> More and more sites (especially adult ones) are now forcing users to upload IDs or selfies to continue.

> they might just get enough attention from voters to motivate a change

Unfortunately, guaranteeing anonymous internet porno is a terrible political beachhead to motivate "voters" to do anything.

You don't have to sell it like that. The bill that needs to be passed is default presumption that all websites on the internet not explicitly marked as such and who voluntarily accept a higher legal burden and standard of moderation may contain content not suitable for children. And that is up to parents to control their child's internet access to limit their usage to only these sites.

Because I don't actually care about pornography, if it magically disappeared I wouldn't really care, it's all the other "not suitable for kids" content I care about that will get caught up in these laws. I don't want to give gross concern troll political groups moralizing about their precious hypothetical children the legal tools to ban what they don't like.

Ive had massive amounts of trouble convincing people that pornography is just the tip of the iceberg. That's why it's such an effective tool for broaching massive-scale surveillance: the architects of these laws have said that they want to be able to police all content with these laws, and anyone who tries to speak out against them can be painted as a pervert who hates the safety of kids.
It's not about porn. It's about setting a legal beachead to force websites to deanonymize users.
You're asking for them to set up a system that won't be effective.

>And that is up to parents to control their child's internet access to limit their usage to only these sites.

This is an entirely unreasonable expectation on parents. I control web access at home, but I can't control it at school, or at their friend's houses. Nor do I have time, nor do I have access, to exert control over all the systems they come in contact with (even without their own device).

>it's all the other "not suitable for kids" content

Like what? Explicit violence?

Even in the age-verification world you were never safe against friends' houses; my parents bought me porn and took me to a sex shop to pick out toys when I was a teenager. I can't begin to tell you how mortifying that experience was in the moment but in hindsight my parents were just recognizing that teenagers are horny and need an outlet for that. If I were a teenager today I know for sure they would have given me their IDs. And schools have web filters right now today so you don't have to worry about your kids getting access there.

> Like what? Explicit violence?

I find this comment puzzling, you present yourself as someone who desires age restriction of adult content but at the same time only want it for pornography and can't even name other content unsuitable for kids?

Profane language, violence, content about alcohol, content about drugs, content about smoking, blood & gore, "disturbing" content like liveleak, horror, sexually suggestive clothing like titty-streamers, sexually suggestive situations, sex education resources, proana eating disorder content, content about guns and weapons, hate speech, content about suicide and self harm, content depicting and glorifying crime.

When it comes to curating a kid's online experience porn tends toward the bottom of my worry list.

> Unfortunately, guaranteeing anonymous internet porno is a terrible political beachhead to motivate "voters" to do anything.

Reworded press release: "We protect children from being forced to upload their photos (on their IDs) to adult web sites"

Another rewording:

"...to upload your photos (on your IDs)..." :D

Oh yeah, that IS a good point, this verification technique is even stupider than CC number validation in the late 90s!

Then again, these laws aren't about censoring children's access, they're about censoring EVERYONE'S access (and it blows my mind that conservative leaders will come right out and say it, but the average layperson doesn't seem to care or comprehend what a massive slippery slope censorship is -- porn is just the start)

Because there are so many explicit Bible verses[1], require ID verification to read scripture (online at least) and get the religious on your side!

[1] For example Ezekiel 23:20

Even if this was a good idea, ID verification technology should not be outsourced to private parties. This is a service governments themselves must provide. I shouldn't need to upload an ID because the government already has it!

If they simply wanted age verification, the dumb and lazy way is to SSO through a government managed portal with OAUTH2 and you only share your age with the third party. You do a one time account setup (you already have to do this in the US for many government services at the federal level) with age verification, that's your gov portal login. This means the government will now which naughty sites you visit of course, but like I said, it is the lazy approach, and if you think about it, if they respect the laws then a law can be passed to prevent them from storing or using that association, if they didn't, they could still sniff your traffic and wiretap you.

A slightly smarter approach would be to directly auth against a government portal and be given a 24h expiring code for age verification, and the government will publish an updated list of codes to trusted businesses. Those codes could be leaked, but making it a felony should deter most cases, because who wants to go to prison to let some kids watch porn?

Smarter people than me can come up with smarter solution, that is really my point. Involving third-parties and requiring you to upload documents is done either out of extreme incompetence or opportunistic malice by elected officials (bribery).

Every possible solution is terrible, many people have thought about this and nobody has found one that isn't.

The "24 hour code" one you suggest is something the EU is prototyping. Since there's nothing stopping an adult from sharing their code with a minor, or even code-sharing (or selling) websites to pop up, they want it to be bound to a particular device. So what they've done is added integrity checks to the app, so you can only run it on a locked down phone.

Want to run GrapheneOS for privacy and security? Or use an unofficial ROM to get updates on a phone the manufacturer stopped supporting? Just want to uninstall the bloatware and spyware the manufacturer installs? Want to use Linux? Have an old computer without a TPM? All of that and more - congrats, no "adult content" for you.

And no, it's not "porn", it's "adult content", which is a much broader and blurrier category. Is discussion of sexual orientation or gender issues adult content? Sex education? Medical information about "private parts"? News articles mentioning scary things like rape?

This is bad technology and it should never be developed. Do Not Create The Torment Nexus.

South Korea has implemented something similar, but through private corporations, not directly by the government.

When you sign up with a South Korean online service that might contain age-restricted content, you provide your name, date of birth, and phone number. The service operator uses a special telecom-provided API to have a 6-digit code sent to your phone. (The code is generated by the telecom, not the service operator.) When you enter the code, the telecom confirms the name and date of birth. No need for random online services to ask for government IDs, because they're allowed to pass the burden of proof to telecoms who have already verified it offline.

You could probably do something similar via banks, schools, the social security system, or any other regulated industry that has KYC rules.

> the dumb and lazy way is to SSO through a government managed portal with OAUTH2

The weird thing is that UKGOV already has this for the NHS - my GP's app uses access.login.nhs.uk to log me in. That could easily verify my age to another system.

(Admittedly it's not sufficient for the wider case because not everyone is registered on nhs.uk but it does show that UKGOV has the capability to do this.)