Comment

Comment on EU citizens on here, Ross Scott is warning about a draconian law in the European Unio.

Online ID should only be legally mandated in cases where KYC (know your customer) laws exist, like financial services.

If you want to protect children, make them use devices that are locked down and block adult content. Online service providers should at most be required to mark such content with metadata.

source

Sort:hotnew top

Carl@anarchist.nexus ⁨3⁩ ⁨hours⁩ ago
I’d be fully in favor of hardware-level age verification. And by that, I mean we already have the technology to securely and privately verify your age directly with the government, (not using a third-party), and so no single organization has a chance to collect more than a salted hash of your info. Then your user account (or the entire device, if you’re using a phone) would be considered verified. It would require governments to actually cooperate and be technologically literate, (which… Yeah… I know that makes it a pipe dream) but it is technologically feasible to implement.

The short version is as follows:

Governments have citizens create a password. Ideally this would happen when they’re applying for their ID, which they would need to have to verify their age anyways. This password and salt is used for their hashed info.

The government sets up a database of salted hashed info, along with a simple pass/fail for whether or not the individual is an adult. Again, this is only using salted hashes, (the same method we use to send passwords to a website) so no recognizable data even if it gets intercepted in transit.

The government publishes a service that intakes a hash, and returns a true/false for whether that hash is an adult. Again, no actual PII is stored in this database, only salted hashes.

The user who wants to verify their age inputs their info into their device using standardized inputs, along with the password they created when they applied for their ID. This is hashed directly on the device, just like a password is hashed before it is sent to a website. This hash is the only info that leaves the device.

Whatever service that is trying to verify your age takes this hash, passes it to that government database, and receives a pass/fail result. If you pass, your age is now verified.

Note that the company never received your PII, they only received the salted hash, and only received a basic Boolean 1/0 response from the government server. And the government never received any info about your device, so they can’t use it to track you at a hardware level.

Now that account is verified, and can be used to confirm your age on any devices it is used on. For example, if your Microsoft account is verified, any computer you log into with it will also be verified. If your Apple/Google account is verified, your phone is verified when you’re logged into it.

This could even cut out the middleman and verify the device directly using that same government service, but that would need to come with some extra security precautions to be sure the government isn’t able to collect verification attempts and tie individuals to the specific hardware devices that made those requests.

And then the verified device can directly pass a “yes this user is over 18” flag directly to any service that needs it. This could be done securely during the TLS handshake, before the site even begins to load. Ideally, it would be a fairly wide age range. So for instance, maybe we group it into child, teen, and adult. So sites that need to verify age for regulatory purposes can do so without actually collecting your personal data.

This would allow websites to verify ages on the backend, without actually needing to use third-party services. It would also allow for a much smoother user experience, with verified adult users being able to bypass any kind of age gates. And unverified users would automatically get redirected to a “your device isn’t verified, here is why, here is how to verify it” page. No concerns about kids lying and clicking the “yes I’m over 18” button, because they never even see a button to click. They just immediately get redirected as soon as the site sees that they’re not verified as an adult.

It’s really the best of all worlds. It allows for secure verification, where the only info leaving your device is scrambled. It appeases the “think of the children” crowd. It allows us to ditch the stupid fucking “click here if you’re over 18” pages. And most importantly, it would actually protect kids, because now preventing them from accessing mature content is as simple as protecting your passwords. Because they can’t just steal your ID to verify their device without also having your password.
source
- LordDaveTheKind@piefed.social ⁨34⁩ ⁨minutes⁩ ago
  Some countries (such as mine, Italy) already release a NFC-enabled ID. We would just need an encrypted authenticator on a mobile phone for scanning the ID and providing a validation code.
  
  source
- Ftumch@lemmy.today ⁨2⁩ ⁨hours⁩ ago
  Ok, so let’s say you’re a minor and I get a hold of your hash. Now I’m going to run it through the service every day, whether you log in or not. The day you turn 18 I’m going to know your date of birth.
  
  source
  - Carl@anarchist.nexus ⁨2⁩ ⁨hours⁩ ago
    I actually just updated my post to clarify how child/teen accounts would be handled without needing direct verification. No hash needed for minors, meaning there is no risk of this.
    
    source
ggtdbz@lemmy.dbzer0.com ⁨3⁩ ⁨hours⁩ ago
KYC laws should be mandatory for any service that allows you to type the terrorist codeword characters “Palestine” into a text box especially where someone under the age of 500,000$ stock portfolio can see it

source
bigmamoth@lemmy.world ⁨2⁩ ⁨hours⁩ ago
Parental countrol are already mandatory in the UE. Im not liable for your children. If u can’t educate them to technology dont buy them technology. In no way shape or form I’m liable for your children. If u cant educate them dont make them. If u think the whole world should be police cause u can’t take care of your progeniture you are a parasyte.

source