Age Verification isn't a technical problem to solve.
-
Age Verification isn't a technical problem to solve. If you think that, you're missing the point.
It's a social problem used by authoritarian governments as an excuse for population control and censorship.
It's a fundamental attack on free speech and democracy.
It must not be accommodated.
It must be stopped.#MassSurveillance #AgeVerification #Privacy #Democracy #HumanRights
@Em0nM4stodon What i hate about age checks in social media is that they say it's to protect children from the toxicity of social media.
How about governments try to actually regulate social media instead of outright banning children? Social media can be a good source of social integration and information ( being a queer child that lives with queerphobe parents, for instance, may only get queer support from people on the internet
). 1/2 -
@Em0nM4stodon What i hate about age checks in social media is that they say it's to protect children from the toxicity of social media.
How about governments try to actually regulate social media instead of outright banning children? Social media can be a good source of social integration and information ( being a queer child that lives with queerphobe parents, for instance, may only get queer support from people on the internet
). 1/2@Em0nM4stodon Plus... do adults not matter? Regulating social media would make it healthier for everyone, child or adult. 2/2
-
@Azarilh I do not have the time to review and speak about this specific product sadly. But in general, even if the token handed to the application requesting it is fully anonymized, the application collecting the initial data is still a potential attack vector and point of failure.
If it's proprietary, then it entirely relies on blind trust. If it's open source, then it must be fully audited regularly and built and reviewed with independent experts. But even if it was perfectly secure and private, the piece of ID showing the age must be uploaded somehow. Is the whole system secure? Where is this data stored? Does it get fully purged after or is the "deleted" information only flagged as deleted but kept in a database somewhere?
If all identifiable information is fully deleted, then what shows this token is reliably only used by an adult and not shared with a child? Where is this token stored? Can it be sold to others online? People have already done that with the supposedly secure and supposedly private World App. If identifiable information is kept to prevent this, then all the other problems mentioned above remain.
And regardless of all of this, having to upload an official ID, even in the imaginary scenario where we would magically have a perfectly privacy-preserving technology, gatekeeps the use of devices and access to information and communication from many people who, for various reasons, cannot have this official ID. It closes down the internet. We should never agree to that, let alone contribute to facilitating it. More information here: https://www.eff.org/issues/age-verification
@Em0nM4stodon So your point is that "no system is safe"? I would agree with that, but vaccines are not 100% safe either yet we should still take them. The importance is to make it as safe as possible, and it has to be safe enough. Everything is corruptable, with physical ID too ( they could be taking photos for all i know ).
-
@Azarilh I do not have the time to review and speak about this specific product sadly. But in general, even if the token handed to the application requesting it is fully anonymized, the application collecting the initial data is still a potential attack vector and point of failure.
If it's proprietary, then it entirely relies on blind trust. If it's open source, then it must be fully audited regularly and built and reviewed with independent experts. But even if it was perfectly secure and private, the piece of ID showing the age must be uploaded somehow. Is the whole system secure? Where is this data stored? Does it get fully purged after or is the "deleted" information only flagged as deleted but kept in a database somewhere?
If all identifiable information is fully deleted, then what shows this token is reliably only used by an adult and not shared with a child? Where is this token stored? Can it be sold to others online? People have already done that with the supposedly secure and supposedly private World App. If identifiable information is kept to prevent this, then all the other problems mentioned above remain.
And regardless of all of this, having to upload an official ID, even in the imaginary scenario where we would magically have a perfectly privacy-preserving technology, gatekeeps the use of devices and access to information and communication from many people who, for various reasons, cannot have this official ID. It closes down the internet. We should never agree to that, let alone contribute to facilitating it. More information here: https://www.eff.org/issues/age-verification
@Azarilh I would also recommend watching this amazing video by Carissa Véliz. It's short and might help you understand the dangers better: https://infosec.exchange/@Em0nM4stodon/116031435192287968
-
@Em0nM4stodon So your point is that "no system is safe"? I would agree with that, but vaccines are not 100% safe either yet we should still take them. The importance is to make it as safe as possible, and it has to be safe enough. Everything is corruptable, with physical ID too ( they could be taking photos for all i know ).
And i guess this would be a good reason to not over-implement it for things we don't need it. It should not be used for social media, it's so unnecessary i think.
-
@Azarilh I would also recommend watching this amazing video by Carissa Véliz. It's short and might help you understand the dangers better: https://infosec.exchange/@Em0nM4stodon/116031435192287968
@Em0nM4stodon I promise i will check it. Thanks.
-
@Em0nM4stodon So your point is that "no system is safe"? I would agree with that, but vaccines are not 100% safe either yet we should still take them. The importance is to make it as safe as possible, and it has to be safe enough. Everything is corruptable, with physical ID too ( they could be taking photos for all i know ).
@Azarilh No, this isn't like vaccines at all. Vaccines do not facilitate mass surveillance.
-
@Azarilh I would also recommend watching this amazing video by Carissa Véliz. It's short and might help you understand the dangers better: https://infosec.exchange/@Em0nM4stodon/116031435192287968
@Em0nM4stodon Oh, i do understand privacy concerns very well. Information is power.
-
@Em0nM4stodon I promise i will check it. Thanks.
-
@Azarilh No, this isn't like vaccines at all. Vaccines do not facilitate mass surveillance.
@Em0nM4stodon True, they don't facilitate surveillence, but someone can get a very bad reaction from it. What i meant is that it's impossible to make anything 100% safe.
-
@Em0nM4stodon What i hate about age checks in social media is that they say it's to protect children from the toxicity of social media.
How about governments try to actually regulate social media instead of outright banning children? Social media can be a good source of social integration and information ( being a queer child that lives with queerphobe parents, for instance, may only get queer support from people on the internet
). 1/2@Azarilh Exactly. Social media should simply be safer and less addictive for everyone. Adults need it to be healthier as well, and teenagers need to socialize.
-
@Em0nM4stodon Plus... do adults not matter? Regulating social media would make it healthier for everyone, child or adult. 2/2
-
Age Verification isn't a technical problem to solve. If you think that, you're missing the point.
It's a social problem used by authoritarian governments as an excuse for population control and censorship.
It's a fundamental attack on free speech and democracy.
It must not be accommodated.
It must be stopped.#MassSurveillance #AgeVerification #Privacy #Democracy #HumanRights
@Em0nM4stodon I disagree.
As a society, we have decided to age -gate some things. I, personally, think it's a good thing to slow down the pervasiveness of social media, as I think it's a good thing to slow down most addictive things.
-
@Em0nM4stodon True, they don't facilitate surveillence, but someone can get a very bad reaction from it. What i meant is that it's impossible to make anything 100% safe.
@Em0nM4stodon I know i keep trying to find a good side, while at the same time i disagree with age checks for most things. I am just trying to provoke thoughts about any side i care about.
I am all for privacy and a free Internet. I don't think age checks are the solution for social media, especially with the current methods. The EU eID would improve it but i would still rather have none at all in this context. Social media should be regulated, not age gated.
-
Age Verification isn't a technical problem to solve. If you think that, you're missing the point.
It's a social problem used by authoritarian governments as an excuse for population control and censorship.
It's a fundamental attack on free speech and democracy.
It must not be accommodated.
It must be stopped.#MassSurveillance #AgeVerification #Privacy #Democracy #HumanRights
@Em0nM4stodon
Correct, it's throwing the onus on the end user, whereas governments should be controlling the extremeties of social media, as in political bias, miss information and child porn -
@divVerent @Em0nM4stodon No there are not. This is a fundamental fact of mathematical logic. Given a proposed age verification system you can prove that it's either trivially bypassed (doesn't actually verify age) or violates key privacy properties.
Em's point is spot-on. If you think of this as a problem to be solved, you are going to be wrong and you are going to be a useful fool for fascists.
@dalias @divVerent @Em0nM4stodon Knowing how old someone is does not limit their speech nor their ability to vote (we verify age for that already, and for many other reasons). Age verification isn’t state censorship. I suppose it could be a way to limit anonymous speech. That isn’t a Right where I am from (nor is ‘free’ speech). I doubt anonymous speech is a Right anywhere.
I have no doubt it’s absolutely technically feasible in a way that infringes on no one’s privacy. Ultimately though, yes, it could be abused by bad actors. Like everything else in civilisation we need some balance of enforcement to deal with those people.
-
@dalias @divVerent @Em0nM4stodon Knowing how old someone is does not limit their speech nor their ability to vote (we verify age for that already, and for many other reasons). Age verification isn’t state censorship. I suppose it could be a way to limit anonymous speech. That isn’t a Right where I am from (nor is ‘free’ speech). I doubt anonymous speech is a Right anywhere.
I have no doubt it’s absolutely technically feasible in a way that infringes on no one’s privacy. Ultimately though, yes, it could be abused by bad actors. Like everything else in civilisation we need some balance of enforcement to deal with those people.
@edwiebe@mstdn.ca @dalias@hachyderm.io @Em0nM4stodon@infosec.exchange From what I understand, active verification does necessarily invade privacy.
But active verification is not necessary.
A mere social media ban under age X, if necessary, could simply be passed as a law, making the parents responsible for ensuring their children follow it. There already are existing laws of this kind for other areas of life. And as parents are responsible for supervising their children, they definitively can also be responsible here.
The opposite is true as well - while the child is supervised by their parents, such restrictions should not apply.
To support the ban, I still think it'd be useful to have an (optional at parents' discretion) software solution. Sure one could go all allowlist using e.g. Google Family Link, but I'd prefer if sites specified their purpose (and also some other properties, e.g. the severity of various kinds of NSFW content, potentially even at multiple levels of which the client can then pick one and specify in a header) for such software to use. That's trivial to do, it's just one file to be placed in the web server's root and it'll work. Could store it in DNS instead, whatever, don't care.
Furthermore, while at it, we could combine this with a technical solution for COPPA and other regulations that ban tracking and surveilling children online. Namely, revive Do-Not-Track, and have aforementioned software automatically set the header for minors.
But, I hear Big Tech say, then what if adults set the header too?
Then you don't effing track them either.
But... what if everyone sets it?
Then the people have spoken. -
Age Verification isn't a technical problem to solve. If you think that, you're missing the point.
It's a social problem used by authoritarian governments as an excuse for population control and censorship.
It's a fundamental attack on free speech and democracy.
It must not be accommodated.
It must be stopped.#MassSurveillance #AgeVerification #Privacy #Democracy #HumanRights
@Em0nM4stodon What happened to "never tell anyone your age on the Internet"?
-
@edwiebe@mstdn.ca @dalias@hachyderm.io @Em0nM4stodon@infosec.exchange From what I understand, active verification does necessarily invade privacy.
But active verification is not necessary.
A mere social media ban under age X, if necessary, could simply be passed as a law, making the parents responsible for ensuring their children follow it. There already are existing laws of this kind for other areas of life. And as parents are responsible for supervising their children, they definitively can also be responsible here.
The opposite is true as well - while the child is supervised by their parents, such restrictions should not apply.
To support the ban, I still think it'd be useful to have an (optional at parents' discretion) software solution. Sure one could go all allowlist using e.g. Google Family Link, but I'd prefer if sites specified their purpose (and also some other properties, e.g. the severity of various kinds of NSFW content, potentially even at multiple levels of which the client can then pick one and specify in a header) for such software to use. That's trivial to do, it's just one file to be placed in the web server's root and it'll work. Could store it in DNS instead, whatever, don't care.
Furthermore, while at it, we could combine this with a technical solution for COPPA and other regulations that ban tracking and surveilling children online. Namely, revive Do-Not-Track, and have aforementioned software automatically set the header for minors.
But, I hear Big Tech say, then what if adults set the header too?
Then you don't effing track them either.
But... what if everyone sets it?
Then the people have spoken.Age verification doesn't take away anyone's Rights.
Maybe we don't need it. Maybe we do. That's a different discussion.
-
@dalias @divVerent @Em0nM4stodon Knowing how old someone is does not limit their speech nor their ability to vote (we verify age for that already, and for many other reasons). Age verification isn’t state censorship. I suppose it could be a way to limit anonymous speech. That isn’t a Right where I am from (nor is ‘free’ speech). I doubt anonymous speech is a Right anywhere.
I have no doubt it’s absolutely technically feasible in a way that infringes on no one’s privacy. Ultimately though, yes, it could be abused by bad actors. Like everything else in civilisation we need some balance of enforcement to deal with those people.
@edwiebe @divVerent @Em0nM4stodon There is no way to know how old someone is without attestation by some authority who knows their identity. This precludes participation by anyone not known to such an authority (undocumented, outside of jurisdiction, etc.) or for whom it is not safe to let that authority know they are participating. And this is only the tip of the iceberg.
You are dangerously wrong, and you should stop advocating about things you're dangerously wrong about.
