Utah passed law requiring everyone to show proof of age for social sites | Hacker News Reader

Utah passed law requiring everyone to show proof of age for social sites

apnews.com

38 pointsEGreg19 comments

UK did this already

https://www.theregister.com/AMP/2022/02/08/age_verification_...

No more anonymity online. You would need a passport to access every website on which people post content, or a third party that is “official enough” that the sites can point to them when the government sues them.

"Adults would be forced to enter personal information like passport or credit card details – a gift to scammers – and would be left at greater risk of being caught with their pants down in the event of a data breach," he added – a warning that will resonate with many Reg readers.”

Still better than Australia’s “Hacking” law which lets the government commandeer your accounts and impersonate you on social media!

https://digitalrightswatch.org.au/2021/09/02/australias-new-...

Dear EGreg, et. al.,

"anonymous" means "without a name", which is never the case for Internet usage, except for Tor/onion type anonymization schemes.

Internet use such as Hacker News is pseudonymous; we choose a name or one is assigned to us (it may even be an IP address), and many Internet communities rely on stable pseudonyms for reputation and recognizability.

> "anonymous" means "without a name", which is never the case for Internet usage

There are plenty of online communities (like chans) that are anonymous. I understand your point, which is that the admins have access to your IP address even if you don't have a profile, but that's only one meaning of the word "anonymous", and it's a bit rude to correct someone based on another meaning of the word.

That's not what I meant. Although it is true that admins will always have access to identifying information, and this article indicates that the level of that info will increase, surprising no-one.

The question becomes "anonymous/pseudonymous to whom?" Who is able to identify us and on what level? This is all a matter of degrees. So if the admins to 4chan know who visited the board and who posted an image, they can identify users to the extent that geolocation and browser fingerprinting allow. Law enforcement could pressure 4chan into revealing this stuff and then proceed to the user's ISP which would reveal the rest.

I recall the early 90s as the Internet transitioned to the NSFnet and thence to Sprint's, with all the commercialization and privatization that ensued. There was a space in time where all a guy needed was a modem and a computer and a cooperative modem bank on the other side, such as a BBS. It was sort of like using an open proxy. You didn't need no account, didn't need no identifiers, didn't need no login or password unless you stole them. Then the backbone decreed that everyone who used the Internet had better be associated with a legitimate account. That was a very early regulation, and every development since then has been a decrease in privacy/pseudonymousness.

Then again, gains in privacy are made. Some old sites still identify users by IP address, such as Wikipedia. They're working to eliminate this as a pseudonymous identifier, and replace it with something perhaps even more stable, but that can't be geolocated or otherwise identified as belonging to the person behind the edits. And that's in compliance with EU/US regulations on privacy. Not even regular admins on Wikipedia can see browser fingerprints; CheckUser status and tool usage is closely controlled.

If you replace it with the word pseudonymous, my point still stands.

I meant anonymity in the colloquial sense, but in a technical sense, your correction is apt.

I don't see this, properly implemented, as incompatible with pseudonymity or anonymity.

With modern (even 90s) technology there is no reason why "Be able to prove that you checked their ID" has to mean "Keep their information on file."

The Utah government could generate public/private keypairs, and have the social network upon signup do a live call to check ID. The social network can use the public keys to encrypt photos of the ID picture and the user's face from the video, together with the ID numbers. They'd be required to not keep any unencrypted copies. Then the government could, if investigating violations, ask for the encrypted info, decrypt it and see what ID the user provided and whether it (A) looked real enough and (B) matched the person who appeared.

> With modern (even 90s) technology there is no reason why "Be able to prove that you checked their ID" has to mean "Keep their information on file."

But then...

> Then the government could, if investigating violations, ask for the encrypted info, decrypt it and see what ID the user provided and whether it (A) looked real enough and (B) matched the person who appeared.

Which would only be possible if the ID was kept on file.

So, that's not even close to being anonymous. I'm so glad I still live in an area where I don't have to register with the government in order to use the internet.

Ah, so it's compatible with pseudo/anonymity - until the government comes calling.

That's not really compatible.

To be clear here, the government's only business in my example scheme is investigating the crime of say, Facebook, of allowing an 8-year-old to register.

I wouldn't suggest empowering the government to compel Facebook to hand over the ID of said person so that they can be prosecuted for saying mean things about the President or whatever.

As it stands today if the government is mad about something a user posts they already have the power to demand that person's IP so they can pursue them in meatspace.

> I wouldn't suggest empowering the government to compel Facebook to hand over the ID of said person so that they can be prosecuted for saying mean things about the President or whatever.

But the government _already_ has this power. They can issue a warrant. How is requesting their identification - which your example specifically cited - significantly different from demanding the person's IP address?

I sure as hell would not trust a tech company to neither retain nor leak unencrypted copies of my information regardless of what laws are in place.

Companies won't create a bunch of technical complexity so they can forget personal information, because surveillance companies want this information. The main thing that holds them back from demanding it right now is that it would weird people out. Once government directs companies to move in lockstep and normalizes the practice, it will become standard. Think how Google continually harasses you to tell them your birthday to "comply with the law".

Utah isn't even the first US state to do this. California, Texas, and Louisiana led the way

California (I’m not bothering to fact check Texas and Louisiana) did not pass a law requiring proof of age. California passed a law requiring certain sites to estimate the age distribution of their users, which some outside observers opined might lead to the sites imposing some kind of proof-of-age requirement. [0][1]

Utah adopted an age verification requirement.

These are not the same thing.

[0] https://www.axios.com/2022/09/16/california-law-websites-chi...

[1] https://www.techtarget.com/searchcio/news/252529455/Californ...

Isn't there a fine if they show personalized ads to underage user? How do they avoid that without checking ID?

I don't see anything in the bill about penalties for fake IDs presented as verification, and likewise no indemnity for the social site for getting punked with a fake ID. Is the state going to provide a Social Security lookup service for social sites to confirm the credentials presented by the user are valid?

And this is why VPNs exist. I ain't giving anyone id for anything like this.

Does anyone have insight into how they define ‘social’, intend to enforce this, or collisions with CCPA?

So..., does hacker news have to comply with this?

Reply on news.ycombinator.com