21
Could online age verification be done in a way that protects privacy and autonomy? (lemmy.world)
submitted 5 months ago* (last edited 5 months ago) by to c/ask_experienced_devs@programming.dev
53 comments fedilink hide all child comments
 

Apologies if this isn't the right place to ask this, but I thought actual developers with a deep understanding of how technology actually works would be the people to ask!

If you were tasked with setting up a safe and secure way to do this, how would you do it differently than what the UK government is proposing? How could it be done such that I wouldn't have to worry about my privacy and the threat of government suppression? Is it even theoretically possible to accomplish such a task at such a scale?

Cheers!

EDIT: Just to be clear: I'm not in favour of age verification laws. But they're on their way regardless. My question is purely about the implementation and technology of the thing, rather than the ethics or efficacy of it. Can this seemingly-inevitable privacy hellscape be done in a non-hellscapish way?

you are viewing a single comment's thread
view the rest of the comments
[–] 1 point 5 months ago* (5 children)

Full disclosure, I'm not a full time dev, but am in IT and do some minor software development work.

Here's my proposal:

Reverse the verification. Don't verify adults. Have extra actions to allow children to access the internet, and make it the legal responsibility of those adults that purchase the devices verify that a device given to a child can only access the child-friendly internet. We already have laws constructed like this and they work pretty well. Cigarettes and alcohol are largely out of the hands of young children. No its not perfect, but no system will be.

The default behavior of any device is full adult access. However, devices will have a service menu that you can put the device in child-friendly mode. However, it's a one way change. Once its in child-mode, there's no going back.

Then, sell devices that are able to access the internet only to 18 year olds and older. An adult can put the device in child-friendly mode and give it to a child. An adult can also let the child use their adult mode device when it is under the supervisor of the adult. Any child found unsupervised with an adult mode device will be treated the same way as if they were found with a fifth of whiskey or a carton of cigarettes. Any adult found giving adult-mode devices to children will be charged the same way as if they were giving alcohol and tobacco to children. Perhaps a repeat offender adult will have their ability to buy electronics capable if internet access made illegal for a time as punishment.

  • permalink
  • fedilink
  • source
  • hideshow 5 child comments
    •
  • [–] 5 points 5 months ago* (4 children)

    However, it's a one way change.

    How would you implement this? It would require devices so locked down you could never replace or even update the OS on them.

    The idea seems sound, but to implement this, hardware and software would have to go down a path they really, really shouldn't.

    This idea is essentially incompatible with FOSS.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 0 points 5 months ago* (3 children)

    How would you implement this?

    Hardware and firmware combination. Fusible link in the CPU would be the one-way change. Firmware would have to support the service menu option to burn the link forever setting the device to only access the child-friendly internet. The only change in the firmware be the menu to activate the fusible link burning, and later reading the registers where a binary state of "child friendly=0 or 1" exist.

    It would require devices so locked down you could never replace or even update the OS on them.

    What is child un-friendly about an OS? I can't see any reason why an OS would be labeled not-safe-for-children. I'd be surprised if debian.org or Microsoft.com would be considered child-unfriendly.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 1 point 5 months ago* (last edited 5 months ago) (2 children)

    Ok. So your variable is set in hardware.

    How are you going to prevent the OS or a program from ignoring it?

    How are you going to prevent ROM flashing or storage replacement to modify the OS or other software?

    I'd be surprised if debian.org or Microsoft.com would be considered child-unfriendly.

    The websites?

    The problem here is that the OS and all applications on them would need to change their behaviour based on the mode.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 5 months ago* (1 child)

    Correct me if I am wrong the base problem, but we're not trying to lock down the OS. We're trying to limit the adult internet to children right?

    The problem here is that the OS and all applications on them would need to change their behavior based on the mode.

    So the AuthZ event can occur at the remote web server (or server serving the API). Yes, those would have to change. The AuthN event would supported by the web browser (or other software) making the call to the remote server. So yes, those would have to support the check of the CPU flag.

    How are you going to prevent ROM flashing or storage replacement to modify the OS or other software?

    Legal protections, not technical ones. This is the same method we use to prevent someone from setting up a distillery in their kitchen and making their own whiskey. There's nothing technologically limiting people from doing this, only laws. Also, the only people breaking the law to circumvent the child protections would be children, or adults purposefully trying to assist children in bypassing this check. The children committing the crime would be handled in the existing juvenile justice system the same way an under-aged child that is caught with alcohol. An adult assisting children with circumvention would be prosecuted the same way as an adult that buys booze for under-aged children.

    In this system, no adults would have to age verify. No adult identity would be sent anywhere. All devices are "adult" by default.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 5 months ago*

    No. I'm asking how you'd make the child mode a truly one-way thing.

    And you've essentially just admitted that you aren't actually suggesting that at all.

    Physically blowing a fuse in a CPU to achieve an equivalent result to a text file containing a date, is a little silly.

    If you're gonna fall back on legal assurances anyway, simply make it a software thing. Not being able to just unlock your devices when you're old enough is a recipe for e-waste, anyway.

    In this system, no adults would have to age verify. No adult identity would be sent anywhere. All devices are "adult" by default.

    That makes no sense. A single bit isn't significant unless read and enforced by software. And if you're suggesting "burning" or "purging" some kind of token that is to be authenticated to show a device is in one mode or the other... Then you've just added a new kind of hardware id.

    And are you saying adults escape any kind of tracking.... But kids don't?

  • permalink
  • fedilink
  • source
  • parent