Hacker News Reader

Comment by AnimalMuppet | Hacker News Reader

Well, no, I won't. If that's the rules, and sites implement them, then I won't visit websites based in California. If there are enough people who won't on principle, or won't because they're fed up with the hassle, then it will be a competitive advantage to not be based in California.

View on HN

You say that, but what if Apple helpfully adds this feature to iPhones, like they added support for digital driver's licenses, Covid passes, and (almost) client side scanning for illegal material?

For iPhone users who use Face ID, it could cache the result, and send it to sites (signed by a per-device certificate, issued by Apple's CA) in the background, so that most users wouldn't even know this law existed.

That might explain the "on-device" claims. Does Apple have partnerships with age-verification companies, or would it become an age-verification company? Is there a connection between Passkeys (FIDO) and age-verification?

These are the right questions to ask. I suspect that if one were to follow the money behind who is pushing for this law, those questions could be answered.

Since Apple recently added the ability to store state-level identity documents in Apple Wallet (IF a state/country is on board), it's not a big leap to combine this with Face ID.

If Apple can perform a digital attestation of a derived attribute, e.g. "older than 18", rather that disclosing name, DoB, address to the visited website, it would likely be well received.

But at that point, we're a hair's breadth away from state-corporate fusion.

> If Apple can perform a digital attestation of a derived attribute, e.g. "older than 18", rather that disclosing name, DoB, address to the visited website […]

I don’t know about websites, but one of Apple’s examples is almost exactly that – “older than 21” – for purchasing alcohol (in the US, yes, yes) without giving over all of the rest of the information on your ID.

Just wait until they figure out that Apple's LIDAR causes cancer if you scan yourself with it 15 times a day.

Hmm? Details?

Front-facing FaceID is periodically beaming IR light at the user, even when not doing an authentication.

Lidar is only on the iPhone Pro rear cameras.

clutches mmWave-less FaceID-less LIDAR-less iPhone SE3

“This website is known to the state of California to cause cancer”

Before y'all downvote as speculation: apple is literally working with cloudflare and a bunch of other companies on using attestation to replace captchas. Seems like it could roll easily into that.

No, I don't think it could cache the result. That would defeat the whole purpose. People sometimes use other peoples' devices. The web site needs to know who's visiting this site, not who visited the last one. So it's going to have to scan the user's face each time.

Surely this would in practice affect all businesses that do business in California, not just those based there (at least those with a legal presence in the US that they care about)?

Not sure why you're getting downvoted - this is the legal standard which many state entities have successfully applied for years, often to the glee of HN users (e.g. US companies getting GDPR fines because they have users in the EU).

It's 2022. The world is on fire. I'm getting older and less patient.

If a state or other entity passes an internet bill I think is unconstitutional or otherwise infringes upon my rights as both a web user and web developer, I'm simply going to ignore the "law" and continue on, business as usual. Sue me. The curtain is falling. I can't be assed to care. California is beyond arrogant if they think they can pull this off.

Before I get roasted, GDPR is mostly a good thing, even if its implementation has made browsing the internet worse and more annoying, at least I have legal avenues for deleting my data that didn't exist before. But this is case by case. Supporting GDPR doesn't mean I should support SESTA and ilk.

Reply on news.ycombinator.com