Hacker News Reader

Comment by swiley | Hacker News Reader

You work so hard explaining to your friends good infosec practice like not just typing their credit card in because some site wants to "verify their age" and then Google and Apple just go and fuck around with stuff like this.

At this point the best advice you can give your friends is "stay the fuck away from computers unless you're willing to sit down and read a bunch of FOSSS manuals."

View on HN

Related anecdote: A few years ago, my father bought a android tablet to my grand parents (both 85+). After watching them use it for a few minutes, I realized how user hostile the technical world has become: tons of ads popping up and asking for your attention (“click me”, “download x”, “make your device run faster”, etc).

This and apps “redesigned” every few month, breaking the workflow they've struggled to learn (they usually needed to follow the hand-written note, they had taken when I showed them how to do).

They've used it a bit more than a year, with occasional breakage, and they now have stopped completely.

Root it, install a dns level adblocker (either for their network or just the tablet), install appropriate apps for them (preferring FOSS when possible via fdroid) and relock the tablet before giving it to them. Oh, and run a backup of the whole device first.

I can't believe it has to come to this to get a usable device for a growing segment of the population. Old people practically need their own IT department fighting for their best interests with how predatory tech companies have been towards them. They are SOL if their kid isn't a techie.

You should try using android trackphones. The instant it connects to a network it will download gigabytes of crap and launch it in the background. It doesn't matter what you're trying to do, whatever it is will get killed because all the malware needs more memory. Apps you want to install will be added to the end of the long queue. The (expensive!) cellular data will be instantly burned through by Facebook and friends.

It's incredible. Personal computing is well and truly dead for the "consumer."

The things that you complain about are the reasons why Apple has become the most valuable company in the world.

Apple has become the most valuable company in the world because they own everyone's computers so anyone that wants to publish commercial software has to bend over for them.

They're not valuable because of any service they provide.

By "computers" I assume you mean "phones and tablets", because Apple is still a small minority of the world's desktops and laptops.

Even then, ask yourself: Why do so many people pay $800 for an iPhone instead of $200 for some Android?

They didn't become #1 by selling $99 developer accounts.

> Even then, ask yourself: Why do so many people pay $800 for an iPhone instead of $200 for some Android?

Because Apple has managed to make their mass produced commodity products be a status symbol.

Why do so many people pay $800 for an Android instead of $200 for some iPhone?

I don't understand the comparison you're making, because both kinds of phone are available in a wide price range.

I think you misrepresent the human App Store reviewers as not being a service they provide to their users.

Or buy an ipad.

iOS ecosystem also has a problem with gratuitous UX changes. E.g. that physical Home button on early models was a godsend for non-tech users - if they found themselves somewhere unfamiliar, it was always there as an escape hatch, without doing anything non-obvious like swiping from the edge. And then Apple killed it.

Another frustrating thing on the notch devices is that they put the control center on top instead of the bottom. Years of muscle memory down the drain.

In fact I did exactly this to solve the ad issue, but they ended up stopping anyway because they couldn't cope with the constant UI change of their apps (Skype & TV replay apps). And there's nothing I could do about it.

> This and apps “redesigned” every few month

This is why my 90++ old completely non-technical mother has been using Linux since the 90s. I set up a very customized fvwm environment with mutt (also customized) and emacs (same) and helped her learn it. The beauty is that nothing has changed at all in over 25 years!

It's why Apple is the best at what they do. Their apps are consistent for years.

Interesting, when does Apple ask for a cc for age verification? I don't think I've come across that UI.

Edit: Looks like it might be an EU thing?

I set my age to about 3 months old in Skype and got locked out. They need my CC to verify my age because of COPA (child online protection act in the US) or something.

But other websites don't do this, so I don't think it's a COPPA thing.

That would be COPPA.

> In 2019, the Government of the State of New York sued YouTube for violating COPPA by illegally retaining information related to children under 13 years of age. YouTube responded by dividing its content strictly into "for kids" and "not for kids". This has met with extremely harsh criticism from the YouTube community, especially from gamers, with many alleging that the FTC of the United States intends to fine content creators $42,530 for "each mislabeled video", possibly putting all users at risk.[58][59][60] However, some have expressed skepticism over this, feeling that the fines may actually be in reference to civil penalties, possibly intended for the site's operators and/or warranted by more serious of COPPA violations or specific cases of "mislabeling videos."[61][62][63] As of July 2020, nobody has got the $42k fine.[64]

https://en.m.wikipedia.org/wiki/Children's_Online_Privacy_Pr...

I had this happen on a gaming forum, they upgraded to new forum software and pushed users through a 'update your account' flow. I accidentally set my year to the wrong number and ended up locked out of what had been a long-term username.

It was bad, actually, because they had developed a system where your username on the system was tied to your in-game nickname as well so I ended up locked out of both and had to create a new username/nick.

The admin of the website literally said "there's nothing I can do". I'm sure this isn't to do with the law specifically but just some limitation of their tools.

> The admin of the website literally said "there's nothing I can do". I'm sure this isn't to do with the law specifically but just some limitation of their tools.

At the gaming forum I helped to run around 10 years ago we consulted a lawyer and this [asking for birthdate but not allowing birthdate changes] was the only way to keep out of serious trouble and to not need ID verification.

Hah, that probably explains all the age-disclaimers on dating sites. I had assumed it was just "login with Facebook" people not being allowed to change their birthdate by Facebook, but as it turns out that may have been unjust (though FB itself might also prevent bday changes for the same reason).

It is definitely that at least with Tinder.

Skype is not Apple though

Anything on an iphone is Apple. They dictate content, UI design, architecture and moderation policy for all the apps on the device.

No, Apple doesn't dictate credit card verification requirements. Actually they are quite opposed.

>No, Apple doesn't dictate credit card verification requirements.

that's the point parent was making; Apple made a decision about such things when allowing an app within their ecosystem that makes such choices (Skype, in this case).

Allowing something to happen isn’t dictating IMO.

It is when you're very strict about what you allow to happen. (which is the case with iOS apps.)

Apparently they have specifically allowed it in this case. Otherwise there would be no iOS Skype app.

tv.apple.com did for me when trying to play a video

What videos are free to watch on there?

I don't know, I have a free year of it. It plays in the app without asking, but not on the website.

Did you sign in on the website?

No, I already had an account but it doesn't have a credit card on file.

Must be.

On major mobile networks in the UK, SIM cards/data plans by default have an adult content internet filter enabled. Blocks stuff like pornography (obviously) and even some other various adult age-focused content like gaming websites. (I've seen the EA Battlefield/Call Of Duty websites blocked before)

Usually if you try to access, say, pornhub.com, it'll redirect (ala. WiFi captive portal style) to an internal network page and you have to enter a credit card to disable it on your account. A debit/bank card won't work. I'm over 18 now but at the time I came across this (also over 18) I didn't have a credit card but I ended up bypassing this with a Curve (Fintech 1->many card thing) card which seems to identify as a credit card on the network's system.

Alternatively, if you don't mind never seeing the assistant again (jk.), you can go into one of the network's shops and ask the assistant to turn it off by providing some ID like a passport/driving licence.

This only reinforces my image of the UK as a long since resigned totalitarian police state — that, along with the huge 1984-esque CCTV posters with giant eyes hanging watchfully over a dreary autumn midday in London.

It's hilarious. If this technology existed 50 years ago you can be sure they'd be filtering out any homosexual content. "We must protect the children from filth" after all. Good old nanny state.

The posters I referenced were from 2002 [0]... I can only imagine how much worse it's gotten since then.

> Attention Londoners: Big Bobby is watching. That's the message of posters plastered along London's bus routes earlier this week to assuage riders' crime fears.

> But the posters are having the opposite effect on privacy advocates, who say the artwork is creepily reminiscent of the all-seeing authority described in George Orwell's 1984.

> The posters show a red double-decker bus crossing a bridge as four floating eyes stare down from the sky. The eyes' pupils are the symbol of Transport For London, the city's mass-transit provider.

> "Secure beneath the watchful eyes," the poster says. "CCTV and Metropolitan Police on buses are just two ways we're making your journey more secure."

[0]: https://www.wired.com/2002/11/londons-privacy-falling-down/

YouTube does just this[1][2].

[1] https://www.rollingstone.com/culture/culture-features/lgbtq-...

[2] https://www.theverge.com/2018/6/4/17424472/youtube-lgbt-demo...

The whole "asbo" thing that they had for a long time was also in a similar vein. And the ability of even fairly low ranking police commissioners to declare some area as having "high chance of violence" temporarily, which allows them to stop and search people without warrants or anything like that - basically like stop & frisk in NYC, but without the pushback.

On the upside, following UK police twitter accounts can be sorta hilarious in a sad way, because they regularly post stuff like this: https://twitter.com/MPSRegentsPark/status/974645778558980096...

All that said, it's not really totalitarian. A police state for sure, and an authoritarian uber nanny state, but totalitarianism is a whole different ballgame.

I see much of the hardline Islamic substrate in the UK as deeply totalitarian. See this BBC Panorama documentary on Sharia courts functioning as a separate legal system for an example of what I’m talking about: https://youtu.be/4gZCFdHkd4A.

If the all-powerful, authoritarian UK police and the (currently underground) Sharia courts ever collide or end up working together, that’s going to be one hell of a totalitarian trip. Not good at all.

Though France has similar religious demographics, I think France might at least stand a better chance of holding back the influence of Islam, given the country’s strong and storied secular tradition.

In all Western countries that I know of - including UK - those courts are effectively arbitration courts, so they're very limited wrt the kinds of rulings they can make, and even then both parties have to agree to abide. So they're not really a separate legal system.

Unfortunately, many of them hand down rulings which conflict with UK and other local laws. At the very least they are conflicting systems — to what degree is a point of contention among legal scholars in the UK, as outlined in the linked BBC documentary.

There's no real conflict there, because the proper courts always have priority, same as in any other arbitration arrangement when the parties don't agree to participate.

Not an EU thing.

On the more humorous side they could have implemented an age check similar to the one from Leisure Suit Larry.

Although the questions were a lot harder back in 1991 when the Internet was not at your disposal.

http://www.classicgaming.cc/pc/leisure-suit-larry/age-quiz

Tbh I think this sort of thinng would be harder today, if you took away the internet "for a night", because pop culture is now much more fragmented than it was back then.

I had to solve these questions back in 95-96 (when I was 15) after buying these games used from a pawn shop. I used various sources from multiple BBS's and teachers at my high school.

On one hand, people have given up their credit card for worse pre-Internet or outside of the Internet (like "free" or nearly free trials that turn into a subscription service).

On another, Google already has a lot of peoples' credit card numbers by way of Google Pay. Does this expose those people to any more risk?

Aren't there some credit cards that can create virtual numbers?

Just give them a virtual number and then disable it right after registering. Then have your free trial, and only if you decide to actually subscribe, change it to a credit card number that is active.

Businesses should not be unscrupulously trying to make money off people who forgot about the product during their free trial.

I use Privacy.com to make virtual cards for this purpose.

Does privacy.com still require a debit card? That was what put me off the last time I investigated their service.

It did the last time I looked into it.

I went to set up a privacy.com virtual card for a semi-sketchy site, only to have privacy deny the charge as it was for a "high risk" site.

Yeah, I KNOW, that's why I wanted to use a virtual card. That ended my brief foray into privacy.com

Yes, their business model is charging merchants at credit card rates (~3%), and billing you at debit card rates (~0.1%).

only work for US, alas

And for those who haven't given their credit card number, as a protection against abuse or "accidental" purchases (in-app, in-game, premium content, etc.), this looks like a suspiciously-convenient-to-Google mechanism for acquiring CC data.

We were previously told that it was advisable to use YouTube under an alias, and that other personal information such as phone numbers would be used only for account verification.

Those policies were rescinded or proved to be lies.

Google have no credibility here.

> this looks like a suspiciously-convenient-to-Google mechanism for acquiring CC data.

Actually wouldn't be surprised if the newly acquired CC number appeared right away as a new means of payment in Google Play.

The problem isn't that Google is going to do something bad with your credit card, it's that because it's Google, they are training people to be okay with it everywhere else. Like when my bank sends me an email with a link to an external domain because I have a "secure" message.

Actually Google is going to do something very bad with your credit card - link your online nym to your meatspace identity so they can better surveil you. That's much worse than having to deal with a few fraudulent charges, which at most requires mailing in an affidavit.

I don't know why this is down voted. Maybe because at this point creating a Google account now requires such a link?

It might not be that dangerous right now, but it sets a bad precedent. It gets users accustomed to that, and gives bad actors a cover for their activities: Look, Google does it!

My favourite is how many sites want you to click on a link in a "verification email" to log in, especially if you take basic precautions like blocking scripts and trackers and deleting cookies periodically. All that work training people not to click links in unexpected emails, and these companies get a bright idea to require that to log in.

Blame Government not Google and Apple.

I hate both, but this is purely a function of terrible regulations

It's really bad but seems to be some EU law, this isn't something Google ever wanted.

An alternative would be entering your passport or something which would be even crazier

In 2010, Google required your ID card if you enter a false birth date, and you are locked out of your account in the meantime. Happened to a colleague of mine because we were using Google Apps for Business. Because he didn’t want to give his real info to Google at work, he couldn’t work for 2 days and had to give Google his ID.

> In 2010, Google required your ID card if you enter a false birth date

How do they know it's false? And if they know it's false why do they ask for it, they already have the right one.

> if they know it's false why do they ask for it, they already have the right one

Great question. It seems like it's being used as authentication, rather than authorization, in that it's meant to prove that you are who you say you are.

It's not required by the EU. If not all the sites that have content not appropriate for children, such as porn sites, or Reddit, would need to implement this. And of course you wouldn't give your ID or credit card to a porn site.

Google is the only company that started to implement this. To me it's not required by law but they decided to do so to get more user data. Also because having a credit card doesn't confirm nothing about your age. I use a credit card to buy things online since I'm 13, you can have a credit card even if you are not 18, simply your parents need to sign for it, but then it can have your name on it.

Reply on news.ycombinator.com