Hacker News Reader

Comment by john_strinlai | Hacker News Reader

>An FTC spokesperson told CNBC that companies must limit how collected information is used. [...] The agency pointed to existing rules requiring firms to retain personal information only as long as reasonably necessary and to safeguard its confidentiality and integrity.

the very same rules that have allowed literally every single piece of my data to be leaked several separate times, and now i have free credit monitoring instead of privacy? and all of those companies still operate normally, as if nothing ever happened? very neat.

>Discord said it is using the additional time this year to add more verification options, including credit cards, more transparency on vendors and technical detail of how age verification will work

and why didnt we start with credit cards? instead of facial recognition with peter thiel? (this is a rhetorical question)

View on HN

I have gotten several notices of medical data being leaked over the last two years. I thought HIPPA law had very harsh fines for this, but I guess they just look the other way.

Seems like if you just disclose and make assurances that "you take security seriously" then it's fine.

I once worked with both PCI and HIPAA at a consulting firm. Neither had very high bars. PCI compliance was just a yes/no questionnaire that said something like "I do not store unencrypted CC numbers in my DB." No one validates the questionnaire. I just submit it and I got a shiny badge to put on my clients site.

HIPAA compliance was just a half hour webinar.

To be fair, I think HIPAA works in offline contexts (employers can't ask your doctor about your health) but as far as how easy it was for me to get access to customer CCs and medical information... Let's just say the barrier was basically nonexistent.

unfortunately, even if the fine seems harsh, if it is less than the profits generated the fine is an operating expense and not a deterrent.

HIPAA doesn't have a private cause of action so if a violation happens, it's a wealth transfer to the government, it doesn't mean anything to you or any individual.

And most companies can simply price it in as cost of doing business at this point.

> I thought HIPPA law had very harsh fines for this

Not at all. The maximum fine a company has to pay is capped at $2 million per calendar year for a violation, and that's assuming it's even eligible for the highest tier of penalty.

Some companies may have paid fines, some people may have lost their jobs over incidents like these, but the repercussions aren't severe enough to be a deterrent.

I prefer facial recognition. Probably good that there isn't a popular face-spoofer app, since it would put attention to the efficiency of these verifications.

Credit card info is a bad solution. In many countries they still are rare and it would very likely exclude as much adults as children.

The real answer is that while we should expect children to be online, it is the responsibility of the parents to moderate their usage. Add a standard header to every http request to support filter solutions. That is the only viable solution that is of a technical nature.

The whole ZKP idea is futile, no model works if you also have connection information, which states tend to save too.

Anonymous internet usage is pretty awesome. For adults and kids for that matter. And that doesn't change because there are also bad advertisers that practically can identify and track you. If you want to protect kids, have those be imprisoned first. Strong opinion, I know, but also the correct one.

I definitely agree that we need to pass strict laws around “advertising,“ which at this point is a misnomer for the assault we experience every day just by engaging with the Internet or simply walking into a store now. It’s data fracking, not “targeted advertising” anymore.

The semi-anonymous Internet is so important especially for people in repressive households/societies.

> now i have free credit monitoring

Might not even matter ...

"TransUnion and Experian, two of the three major credit bureaus, have started dismissing a larger share of consumer complaints without help since the Trump administration began dismantling the CFPB."

https://www.propublica.org/article/credit-report-mistakes-cf...

How much money did the CFPB actually give back to wronged consumers?

Pre-trump's attempts to eliminate the department, almost $20 billion.

https://www.consumerfinance.gov/enforcement/enforcement-by-t...

And one would hope that the purpose of the CFPB would be to dissuade lenders from wronging consumers in the first place, meaning the net benefit to consumers was likely much higher.

Thanks for the numbers!

Their mere presence was effective. I know people who had trouble with banks refusing to fix their own screwups and demanding evidence that couldn’t exist.

They changed their tune the second there was an open case on the matter.

Also of note is they were responsible for medical debt cases, which are particularly difficult for people to resolve because of the shared responsibility between the patient and the insurer, which allows the insurer to deflect responsibility until the bill ends up in collections.

It's not like they were really doing a very good job anyway. My data has been leaking for two decades now.

Some of the accounts being blocked from certain access are themselves 18! You would think Reddit would consider that, but nope it doesn't.

Probably because the transfer of accounts (typically for reasons of better spamming, but in this case for adult access) is possible.

However, that makes me wonder what mechanism might "unverify" an account holder's age upon transfer. I suppose it's simply a need to re-verify (take a new photo) upon every login, but then folks could transfer the session cookie to avoid needing the new owner to perform a login (unless a new device ID/fingerprint makes the old cookie useless).

10 years was enough for Tom Fulp.

https://www.newgrounds.com/bbs/topic/1549829/1

https://www.newgrounds.com/bbs/topic/1555753/1

Since you don't have to verify every time you use the account, transfer of verified accounts will still be a "problem" though. It's just a CYA to be able to say "we verified this account owner."

But… You could transfer the account after age verification too. The only way to be sure is to ask for ID every time people use the website / application, then children will be truly finally safe from the horrors of the Internet.

The website will only function when webcam is turned on with passport next to your face. Session is immeditely revoked on failure.

> You could transfer the account after age verification too.

Isn't that what I said?

Yes, but you also said it's a CYA, when indeed it's not sufficient CYA if only a former account owner, but not "this account owner," had been verified.

It's definitely CYA. Because not transferring accounts is almost definitely in the TOS. So "we didn't know it was someone else using the account, thats against our TOS" will be the response.

SOTA is age inference: The platform studies your behavior to estimate your age.

> … I suppose it's simply a need to re-verify (take a new photo) upon every login …

Clearly the only foolproof solution is a 3rd-party camera pointed at your face at all times whenever you use a computer.

And a *plug to measure the heart rate at all times in the convenient and unobtrusive way, to ensure the face is of the mammal, and not the mannequin.

A sort of "telescreen" if you will.

Age of account was sufficient for Google and third-party services for verification until recently. My gmail account is almost 22 years old, in continuous use. I have a credit card on file with Google Pay. Why would I need to submit a photo to engage with a private service, outside of volunteering to help train a surveillance apparatus?

Is there any forum short of a senate subcommittee that the public can ask companies these questions? The silence is deafening.

...That would be a cost center, sir. If you don't like our product, you are free to not use us and make your own while foregoing doing any business in anywhere with either of one of the two major political parties.

There is a reason why I don't accept private enterprise as something separate from Government. The nature of the incorporation legal fiction makes them proxies of Government power and influence, hence why I believe private enterprise should in some ways be as heavily restricted by Constitutional guardrails as the Government itself (allegedly) is.

Contact your senator and ask them. Call your senator's offices and ask to meet with them or a representative in person, they can schedule an appointment, and most maintain offices in major population centers in their states.

There's even precedent for credit cards! I remember my dad needing to make a small transaction to get me a nintendo online account back in the 3DS and Wii U era

Reply on news.ycombinator.com