Hacker News Reader

Comment by mdp2021 | Hacker News Reader

mdp2021

One of the first (among many dramatically) critical issues is:

> Companies, from Big Tech down to smaller platforms and messaging apps, will need to comply with a long list of new requirements, starting with age verification for their users. (Wikipedia, the eighth-most-visited website in the UK, has said it won’t be able to comply with the rule because it violates the Wikimedia Foundation’s principles on collecting data about its users.)

How would one verify age without checking personal identity.

(And who would use a service which involves identification.)

View on HN

They plan to have 3rd party companies that do verification. Of course this will be a privacy disaster and likely intentionally so.

The Tories are obsessed with weakening privacy and data protection laws. It's part pro-business/anti-consumer ideology, part dislike of the EU and its goals and a large dash of corruption. See for example giving away NHS data to Palantir, a company literally funded by the CIA.

> The Tories are obsessed with weakening privacy and data protection laws

True, but from the quoted article:

> I'm not sure I've seen anything by way of potential legislation that's had as broadly based a political consensus behind it.

I'm afraid I don't expect anything to change if Labour win the next general election.

I'm not saying you're wrong and Labour will change anything, but those quotes refer to different versions of the bill. Your second quote is for the initial draft, from 2019, while the first refers to the revised, recently passed, bill (among other things).

That makes me think about the app that starting to get publicly available in France. France Identité, that allows you to use NFC to communicate with your ID and generate a single use, verifiable proof of identity, as well as having a valid digital ID on your phone you can present to the authorities.

I assume it will also be possible to provide a single use proof of age without revealing identity with this kind of system.

I do not get at all why 3rd party companies would be allowed to do something like this. If I need a way to give a digital proof of something like this, I'd much rather have my government handle it.

> I do not get at all why 3rd party companies would be allowed to do something like this

Governments increasingly use services from private companies: they have specific capabilities and they get access to specific personal information.

> If I need a way to give a digital proof of something like this, I'd much rather have my government handle it

Your government, and your view of your government, and your guesses about your future governments, may vary.

I don't think EU goals are very much different - there is European legislation underway to make all messenger app providers scan all messages for signs if child abuse indiscriminately, effectively prohibiting end-to-end encryption

The EU one is on hold.

Sounds a bit like a conspiracy theory. I maybe not that good in British politics, but googling reveals that the bill's text was prepared by a committee involving members of Conservative, Labour, LibDem, and Scottish National Party. The UK parliament's website is an ugly mess, so I couldn't find voting stats, but there are claims in media that it garnered cross-party support. Also it's hard to buy "pro-business ideology" in this particular case when Facebook is against the bill. Bureacracy is by nature always tries to extend its power, I guess that's what happening here.

Every bill is drafted in committee, but the ruling party(majority in the House of Commons) also gets to fill most of the roles in the committee- which makes sense because it would be wasted effort if the committee made a change that the ruling party would not support.

It's pretty trivial, and really doesn't require much explanation. It doesn't contradict to what I wrote: there's no sign for the bill to be one party push over others opposing it (as stated by the comment I replied).

> The Tories are obsessed with weakening privacy and data protection laws.

Labour pledged to "toughen" the "weakened and gutted" online safety bill (now the act) [1].

[1] https://www.theguardian.com/technology/2023/jan/01/labour-pl...

Edit: clarification.

> They plan to have 3rd party companies that do verification.

I'm sure this will be run by unqualified buddies of politicians with nice juicy contracts

And what kind of verification would a site like Wikipedia even need? Does it need to classify all articles with respect to a minimum reader age? Or generally allow all contents only for visitors that are over 18? Or what?

As I recall, Wikipedia insisted on HTTPS for all access well before it was fashionable precisely so that governments couldn't decide which knowledge was OK and which was forbidden (and hence the whole site used to get regularly blocked by China because of e.g. the Tiananmen Square article).

It doesn't take much effort to find things the British establishment won't want kids seeing even though kids talk about them in school playgrounds (or at least we did when I was last in a school a bit over 23 years ago).

For example, I was given a summary of The Texas Chainsaw Massacre by some girl in the same class as me when I was 8 or 9.

And even as an adult, you really don't want to see a real photograph of a newborn with anencephaly, which Wikipedia did have when I was first looking up the condition.

The point of Wikipedia — that it can be edited at any time — absolutely makes it impossible to survive any age rating system other than "adults only".

I mean this is a very good argument, so what I'm about to say is not much of a counterargument and more of a feeling.

But fuck that shit. Sure some information is unpleasant (and frankly an image-free wikipedia would be very convenient for some queries), but trying to prevent this with age restrictions is just not the way to go. Trying to prevent this from reaching the school playground is like restricting kids to keep them from scraping their knee, it's futile and likely more harmful than beneficial.

I kinda agree with your vibes, though only kinda.

Our world is a big complex mess and people have uglier souls than I'd like; the transition from innocent childhood to the adult realisation of this should be… kind and sympathetic, not just the equivalent of throwing someone in the deep end of a pool to teach them to swim.

>like restricting kids to keep them from scraping their knee

Extremely on-brand for the UK.

> The point of Wikipedia — that it can be edited at any time — absolutely makes it impossible to survive any age rating system other than "adults only".

Oh but when it's news at dinner time showing dead children and weapons firing on and on it's all fine, I guess?

1) When that comes up in UK news, it does get prefixed with "this report has some scenes that viewers may find disturbing".

2) I don't know what the rules are for broadcasts at different times of day, but I do know they exist

3) I have always been perplexed as to why violence is considered so much more acceptable than, for example, sexuality. Outright murder? Apparently a suitable topic for children's shows. Nipples, which are the defining characteristic of the class Mammalia to which we belong? Hide them all! Unless it's a famous statue (then it's Classical Art), or a man's vestigial ones (then it's so unremarkable nobody even says anything).

Re 3) FYI this is a relatively US/UK centric approach. In most of the countries I lived in, besides the UK, the bias was against violence, in this context.

Edit: there was an IG account posting solely picture of nipples, male and female, cropped so it was hard to ascertain the sex of the photographed person.

It existed purely to mess with the IG censorship rules. I don’t recall the name of the account but I think it was a genius idea.

It's not of course. But 'screening' news casts for 'inappropriate' content is easy and it is easy to point fingers when it doesn't meet 'standards'.

Whereas with wikipedia, unless a dedicated team of editors who are contracted or liable to vet _every_ change. Possibly only for the UK, who get a special 'only with vetted edits' version or some such, I don't think wikipedia would be interested in making such a thing.

Separate from that, wikipedia has various pages on (conditions related to) our sexual organs, as well as lots of articles about politically contentious things. I don't think they are particularly interested in filtering that either.

In contrast to news channels, most of which would have no particular complaints about a bunch of rules about content. As a rule your 9'o clock news isn't going to just casually show frontal nudity (except e.g. Germany because they're fine with it).

One obvious problem is all those words in single quotes: Who gets to decide? Evidently you aren't happy with whomever decided how far you can go with the content shown on the news, and I concur that it goes quite far. But the point isn't about the current standards being applied. The point is whether _any_ standard can be applied at all.

To news: Yes. To wikipedia: Not in a way wiki foundation would accept.

> Whereas with wikipedia, unless a dedicated team of editors who are contracted or liable to vet _every_ change.

A few other Wikipedias including the Turkish one work in that exact manner.

I've not heard of this before, do you have a reference for that? I can't find it easily, but… well… Google's not so great at this kind of thing any more.

See https://en.wikipedia.org/wiki/Wikipedia:Flagged_revisions

Shouldn’t we also make encyclopedias usage prohibited for children? Perhaps technically easier to just forbid both encyclopedias and children within libraries.

Sometimes people un-ironically say such things about dictionaries.

I would note that there are such things as "children's encyclopaedias"; I might have had an earlier edition of this one myself as a kid: https://www.amazon.com/Childrens-Illustrated-Encyclopedia-DK...

(I wonder if they still put in the cartoon of the Aztec Blood Sacrifice?)

Careful with that irony Eugene,

there have been displays on the news even recently of people who find the Arts unacceptable because they may depict genitals (Greek Urns, Renaissance Statues etc.),

so easily you will find around voices that could respond recommending that children be protected from exposure to the Arts.

(And - ironically - not from the obscenity of those very voices.)

There was a Simpsons episode about that, wasn't there?

It should be possible to have a third party IdP provide the site with a trustworthy claim that the user is an adult without any more information, shouldn't it? I think people are a little too quick to claim victory because something is "technically impossible" when it actually isn't (efficacy of public sector IT projects notwithstanding)

But if Wikimedia is taking broad approach to enforcing their principles, they would refuse to interface with such a privacy destroying service anyway.

Wikipedia don't refuse to interface with privacy destroying payment systems required to collect donations. They will be fine

Donations are voluntary.

So is your use of Wikipedia. Your point?

The contextual critical matter in accessing information is that you do it in privacy.

When you finance the source you relatively openly promote the source.

The two activities are dissimilar.

> The contextual critical matter in accessing information is that you do it in privacy.

Since when, in human history, was this an implicit critical assumption in anyone's mind?

> The two activities are dissimilar.

Yes they are different activities. The point is still: Wikipedia doesn't worry about integrating with systems that require you to be identified. (Actually, internet is another such system, you can't use it without providing some form of ID in probably most countries.)

> Since when, in human history, was this an implicit critical assumption in anyone's mind?

Since we discovered Dignity, that has been a fundamental tenet.

(Yes there are also many occasions «in human history» when the principle got instantiated for protection against the ignorant and the malevolent.)

> The point is still: Wikipedia doesn't worry about integrating with systems that require you to be identified

The point is not with the occasional use of those systems in special cases (e.g. donations), but with systematic use in fruition.

> Since we discovered Dignity, that has been a fundamental tenet.

So unless you are trolling you would be able to give a rough year or decade when it became an implicit assumption and why exactly, right? ;)

> The point is not with the occasional use of those systems in special cases (e.g. donations), but with systematic use in fruition.

No, the point is "But if Wikimedia is taking broad approach to enforcing their principles, they would refuse to interface with such a privacy destroying service anyway" and frankly your new goalposts are not of much interest to anyone

The poster went

«But if Wikimedia is taking broad approach to enforcing their principles, they would refuse to interface with such a privacy destroying service anyway»

You replied

«Wikipedia don't refuse to interface with privacy destroying payment systems required to collect donations. They will be fine»

You were replied with observations that attempt to explain to you why your comment is out of context, and try to show you the point:

-- normal people, i.e. dignified people, and prudent people, refuse to be tracked in their consumption of information.

-- Wikipedia seems to be aware of the above.

-- Wikipedia seems to be unavailable to enforce «privacy destroying service[s]», there where relevant: consumption of information.

-- Wikipedia also accepts donations, and the process may involve tracking that somebody promotes Wikipedia financially. This is completely different from tracking individuals in their consumption of information, so it is irrelevant in that context. That an entity accepts non-anonymous donations does not imply anything about the approach such entity holds about the treatment of privacy of its users, of the fruition of its specific services.

You seemed to advance that «Wikipedia don't refuse to interface with privacy destroying payment systems required to collect donations» as in «They will be fine [in employing other «privacy destroying service[s]»]»: no, they may not, that is not good reasoning, because one thing is accepting donations, another is revealing which specific services your customers used - for example, whether they read a page about Kennedy or about Oswald.

Spend the required effort when reading posts.

> revealing which specific services your customers used - for example, whether they read a page about Kennedy or about Oswald

If you authenticate with OAuth, the OAuth server doesn't get to know what particular subresources you visit. It only gets to know which URL initiated the authentication (and whether it tracks even that is an open implementation question).

In other words sure Wikipedia can tell government what pages you visit, but to say that this law does enable that or require that even as a side effect is pure FUD.

This isn't a technical problem. A technical solution will not fix it.

> a third party IdP provide the site with a trustworthy claim that the user is an adult

Then the Identity Provider would have information about personal identity (to verify age) and information about who is requesting it. This is still www access without privacy.

> too quick to claim victory

What are you talking about. There are good reasons to guess that readers may be generally reading these as ghastly news, far from any sense of "victory".

The identity provider could be one the user already has given their info to... For example, the government.

Said users have certainly not allowed any government to peek into their privacy.

But now the government will know all the service providers that the user is accessing, including Wikipedia, but also porn sites.

There could be another intermediary who hides the site name from the government, but who doesn't see the users ID.

Do trust the intermediary does not collude with the government?

I don’t think that it is technically impossible and I don’t think that’s what most people have a problem with. It might be possible, just very high effort, for in most cases (e.g. Wikipedia) very little gain.

I think the problem is exactly that one possible solution is a third party that everyone has to trust with their personal data.

The way thinks work in this country that might mean that a friend of an influential MP sets up a new company as we speak that then will be chosen as the one and only service provider for this verification. For a considerable fee of course. This friend will then find an acquaintance who has worked for a consultancy at some point who will then hire a (maybe British) company to implement the service, they will outsource it to a much cheaper (probably not British) company to implement it. Provided that no one except for the outsourcing company has any idea what they are doing and the money is siphoned off to the Virgin Islands already it might take a while to get the service started and then it does not work.

At this time the government will notice that not only their money is gone, they have to pay more to even get it started and from then on the long chain of contractors need a lot of money on a yearly basis to keep it running.

This is the moment where they turn and explain to the public that from now on they have to pay to use the internet.

Remind you this is a country that only since one year requires identification to vote in elections. But everyone is now supposed to register with a third party probably non government institution to access the internet. ¯\_(ツ)_/¯

They only consolation is that they probably won’t get it off the ground in the foreseeable future.

> But everyone is now supposed to register with a third party probably non government institution to access the internet. ¯\_(ツ)_/¯

Wait, you could have internet connection (land line or mobile) without IDing yourself in the UK before? But how would you pay for it?

Without going to much into this, e.g. I am sure you have used free Wifi in a Café before ?

Know of many cafes these days offering wi-fi that doesn't require registration via SMS or something?

But just use same logic, surely you can ask someone else to validate age for you when you register just like you could use someone else's connection. Maybe even there will be grey market for this

This entire principle is very believable and makes me uncomfortable

Unclear to me is whether this would apply to peer to peer apps like Nostr or non-profit federated systems like Mastodon or Matrix.

None of these have coherent entities behind them.

Also looks like the UK is about as bad a place to host something as mainland China.

All the responses you are getting are very US centric. Just to give an example how you could do this in the EU, today. Every country is now issuing (or planning to issue soon) electronic ID cards with digital signatures that can be scanned with your smartphone. The plan is to allow users to attest they are over or under 18 without revealing any other personal information. They will release an official EU app (like they did for Covid) or Google/Apple will add the appropriate secure API.

I don't necessarily agree we need this, but to claim it's impossible to do this in a secure way is ridiculous.

Practically, I am not sure about the feasibility.

You request a one-time-certificate with a smartphone, then copy it on a laptop (already this is not automatic): once per website or page? That is a lot of certification requests. And that would be to access the content in the www? It creates a dependency stronger than DNS. And there should be full warranty that the issuer and the receiver cannot cross information (of the issued and the received - that would identify the user).

Plus, not everybody has a smartphone. Not everyone accepts Android or iOS at their current implementations. Do those people remain without access to the www?

> Practically, I am not sure about the feasibility.

Last week I logged into my e-gov website by confirming a push notification on my authenticator app that's tied to my e-ID card to download my birth certificate. No copy pasting needed. Random websites now even support logging in without passwords by using your smartphone passkeys.

I am sure they can make it work for a simple yes/no (over 18) challenge-request scenario.

> Plus, not everybody has a smartphone. Not everyone accepts Android or iOS at their current implementations. Do those people remain without access to the www?

We are talking about adult content. The alternative is having that content banned. Many democratic countries have already done that, like South Korea. I don't prefer this scenario.

The bigger alternative is the status quo: A big button saying "I am at least 18 years old" and some web-filtering technologies that parent could use but probably don't. Nobody's dying over this, so I'd be wary of arguments along the lines of "we have do do something anyway".

the alternative is to force parents to do their jobs. We don't need the government protecting us from everything. What do they want to protect us from next? Car accidents (stop allowing private car ownership). Being fat (monthly weigh ins with fines if you don't get down to your target weight?). Where does it stop?

I don't think it's -technically- impossible, I just think it's intellectually impossible for governments to allow such valuable information to actually be anonymous and would provide backdoors to aggregate the data and associate it with citizenry.

You think the government doesn't know the stuff that's already on your ID? Or are you implying governments want to add backdoors for other companies to harvest data?

just block all visitors from the UK. See how long their stupid law lasts.

A lot longer than you think. However, yes, blocking is a good idea. It trains users to bypass the block using VPNs etc.

In your block message, make it very clear (a) exactly why the site is blocked, (b) what legal routes people can take (petition their MP etc), and (c) how to get around the block by technical means.

This will just lead to VPNs being outlawed

Yes, but the problem is with this practice spreading to more legislations.

So how would an American company who doesn't want to comply with this handle it? Simply block all incoming UK IP addresses?

I wonder if there is any chance that British courts would say this goes against basic human rights. I have no idea if there is a "set" of basic rights like the Amendments in the US Constitution.

“age verification” modalities does not seems to be expressed, so a simple “confirm your age” à la porn websites may suffice?

Here's hoping that the resulting dumpster fire will at least serve as a deterrent to others.

> How would one verify age without checking personal identity.

Just like one can auth without checking password. Ever heard of OAuth?

Unless you use zero-knowlege proofs, there is always a 3rd party that needs to guarantee they checked your identity.

App requests that you are of age. You are redirected to gov site, you log in to gov site, gov site tells app true or false. No one knows your age, no one checks your ID, besides the gov site which anyway knows your age because they issued your ID. This is basic OAuth. What's the problem again?

Now gov site has a list of every website you've looked at.

So now the government gets to gatekeep every website deemed controversial? That's quite the slippery slope.

True, but gov site doesn't have to be informed which site is asking whether you are of age or not.

The problem as I see it is not about government gatekeeping stuff (they already can do it if they want and we can already bypass it if we want, like literally nothing will change) but that third-party sites that profile users can now also add "of age" to fingerprints.

Reply on news.ycombinator.com