[marcus_holmes]

How does the OS know that you moved from the "13-15" bracket to the "16-17" bracket without knowing your DoB?

And this is the thin edge. Because in a few years there'll be a bill saying something like "too many children are lying about their age online. We need to verify their age" and then we're capturing IDs and storing them somewhere.

[ThatPlayer]

> How does the OS know that you moved from the "13-15" bracket to the "16-17" bracket without knowing your DoB?

No one says it has to be automatic. The OS could require the parent to manually update it.

[godelski]

  > The OS could require the parent to manually update it.

How is their age verified?

At some point one of two things is required:

  1) A promise that the user is a certain age
    - Which puts us exactly where we are
  2) Official identification is used to verify age
    - Which creates a PII nightmare

That's it. There's only those two options. You may not believe #2 is going to be a privacy nightmare but we're already seeing it happen with Discord/OpenAI/LinkedIn and everyone else that uses Persona[1]. They aren't doing the minimal security things and already aren't doing what they claimed (processed on device, then deleted). This "hack" couldn't happen if that was true

[0] https://cybernews.com/privacy/persona-leak-exposes-global-su...

[1] https://withpersona.com/customers

[ThatPlayer]

> Which puts us exactly where we are

The difference here is it can be set by the parent on the OS and locked. Requiring sudo equivalent to change.

The way it is now, there's nothing stopping a (18-) user from logging out of a 'parental control enabled' account and making a new account without those controls on any service from Facebook to Steam. So the only effective option at that point is to entirely block that app or service.

This gives more power to parental control software. And yeah moves the responsibility from the service to the parents, which is what the services want cuz COPPA and other similar laws.

[godelski]

That doesn't change anything I said.

But you do bring up another issue people aren't discussing. That the default setting is under 18.

So we protect the children from adults by... having no way to actually verify someone is a child?

The problem is less kids getting access to porn and more pedos getting accounts to spaces designed for children. Places like Club Penguin or very famously Roblox.

Here's the problem, you can't verify children. They don't have identification in the same way adults do. And worse, if we gave them that then it only makes them more vulnerable!

Then we have the whole problem of a global internet. VPN usage is already skyrocketing to circumvent these policies.

So the only real "solution" to this is global identification systems where essentially everyone is carrying around some dystopian FIDO key (definitely your phone) that has all your personal information on it and you sign every device you touch. Because everything from your fridge to your car is connected to the Internet.

But that's a cure worse than the poison. I mean what the fuck happens to IOT devices? Do we just not allow them on the internet? That they're assumed 18+? So all kids need to do is get a raspberry pi? All they need to do is install a VM on their phone? On their computer? You might think that kids won't do this but when I was in high school 20 years ago we all knew how to set up proxies. That information spread like wildfire and you bet it got easier as the smarter kids put in the legwork.

This is a losing battle. It's not a cat and mouse game it's While E Coyote vs Road Runner.

We're on HN FFS. If there's anywhere on the Internet that the average user is going to understand how impossible this is it should be here. We haven't even talked about hacking! And yes, teenage script kiddies do exist.

These policies don't protect kids, they endanger them. On top of that they endanger the rest of us. Seriously, just try to work it out. Try to create a solution and then actually try to defeat your solution. Don't be fucking Don Quixote.

[Dylan16807]

> But you do bring up another issue people aren't discussing. That the default setting is under 18.

Some things do that. This law doesn't have a default. If the admin sets all the user accounts to 18+, then the users are stuck with the setting being 18+.

> I mean what the fuck happens to IOT devices? Do we just not allow them on the internet?

Sounds pretty good to me.

But yeah they need a different handling of some manner. Maybe a "give no access to anything age-gated" category, though is that really different from under-13 in practice?

> So all kids need to do is get a raspberry pi? All they need to do is install a VM on their phone? On their computer? You might think that kids won't do this but when I was in high school 20 years ago we all knew how to set up proxies.

Just delaying unrestricted access to high school would already solve most of the problem.

> These policies don't protect kids, they endanger them. On top of that they endanger the rest of us.

They do not. Some totally different system could endanger people, but this one doesn't.

[godelski]

  > Some things do that.

I think you're missing the point...

  > Sounds pretty good to me

Really? Be a bit more serious now. There are a lot of things that connect to the internet, and not just for stupid data harvesting reasons. I gave other examples. I think you can understand that this gets pretty hairy pretty quickly. If you don't, then dig in deeper to how the networking is done. You're an older account so I'm assuming you actually understand computers.

  > They do not.

They definitely do. I explicitly stated how that happens too. If you want me to take you seriously you have to respond with something better than "trust me bro".

There is no evidence that these companies are actually handling that data properly. There is a lot of evidence that they are handling it improperly. That data being leaked does in fact, endanger kids.

I'm also unconvinced these things even achieve the goals they claim to be after. Which is keeping pedos away from kids. i.e. the reason I said you're missing the point. So either it is not achieving that goal, or lulling people into a false sense of security. Imagine if Roblox was saying "we don't allow adults on the platform" and so now all the tech illiterate parents and kids think their kids are exclusively talking to other kids. That's just a worse situation than now.

So what do these laws even solve?! I'm serious

[mittensc]

So the kid boots up linux off a USB stick and makes it all pointless

[watwut]

Overwhelming majority of kids wont. The idea that the average teenager even knows what those words mean is not realistic.

[marcus_holmes]

Heard exactly the same thing about VPN use (kids won't know how to set up a VPN). Then Australia age verification kicked in, and VPN use went through the roof [0]

And, of course, the response so far has included similar thoughts as the UK about banning VPNs [1]

[0] https://www.rmit.edu.au/news/media-releases-and-expert-comme...

[1] https://www.techradar.com/vpn/vpn-privacy-security/no-approa...

[ChoGGi]

They may not, but the friend selling porn sticks at school does.

[mittensc]

kids would have time and motivation... they will learn pretty fast

[Dylan16807]

> How does the OS know that you moved from the "13-15" bracket to the "16-17" bracket without knowing your DoB?

The OS has the birth date. Of probably 1-5 people.

> And this is the thin edge. Because in a few years there'll be a bill saying something like "too many children are lying about their age online. We need to verify their age" and then we're capturing IDs and storing them somewhere.

Those things are already happening. I see this kind of mechanism as significantly more of an alternative to privacy invasion than an enabler of privacy invasion.

[marcus_holmes]

Requiring the central database is the scary part.

The political establishment used to be able to control what you read, through control of the media. Then 1995 happened and everyone got access to anything they wanted. The establishment have wanted to put that genie back in the bottle ever since. This is part of that effort.

[Dylan16807]

> Requiring the central database is the scary part.

Yes, agreed.

And this type of proposal has no central database, so it removes the scary part.

(Unless you're talking about the local accounts on each computer storing dates of birth for a single household as a "central database" in which case you're being ridiculous and please stop doing that.)