lobsters score: 1 · tags: culture, law, privacy
Under 13: children will not be able to access social media services. They can still use child-friendly video-sharing services through an account managed by a parent or guardian.
So they are no longer allowed to read the political discourse which our representatives love to have on sites like Twittr? Does this mean they will start publishing these in a public location or will we raise a whole generation completely separated from public discourse?
score 1 · canonical
Considering that you can’t really browse X without an account these days, and that you have to be at least 13 to have an account, it doesn’t seem like it will affect much.
score 1 · canonical
As a child for whom social media when I was 12 and 13 in 2020 was a major part of discovering my identity as a queer person, this sort of legislation always rubs me the wrong way.
score 2 · canonical
Someone I know works with digital safety for children. When interviewing teenagers in vulnerable groups what they think of a social media ban for kids, some said outright that they would’ve attempted suicide had it not been for the support of online communities, and that online communities had been hugely important to them.
Personally for me I used to lurk around in forums when I was ~10 y.o. That’s how I learned to code.
score 1 · canonical
https://www.youtube.com/watch?v=mQRcK9nYg9g Pretty good video about the disastrous impact this act would have on video games in the EU (especially on solo developers and indie studios).
score 1 · canonical
As I have written in another comment the age verification is supposed to be done anonymously, but also gauging from the comments here noone (including me) seems to understand how.
score 1 · canonical
There are multiple schemes that can be implemented correctly, and are pretty classical.
This doesn’t change that (a) there is a bunch of deeper issues with the regulation, (b) the solutions can be implemented correctly but won’t be.
Like, aiming for actual open-source (not the attestation thing which inevitable ends up with impossibiltiy to change even the UI), an application could hold credentials that also allow something sufficiently annoying (it’s a digital wallet after all) like submitting an address change notification or something. There is a certificate that those credentials are real from a well-known public authority. The server sends a timestamped challenge, the application signs it with its moderately powerful key but doesn’t reveal the signature; instead it verifies the signature chain (authority → certificate/local-key → challenge), observes success and constructs a zero-knowledge argument of having seen this succesful computation.
Basically you don’t want to leave this unattended and talking to open internet (the credentials are real), and you cannot pre-sign tokens and share them, but what server receives has the same probability distribution for all users (assuming not too broken local random generators…), and forging the zero-knowledge argument is a real cryptoanalysis advance.
Instead of all that, of course they will do duopoly-friendly integrity attestation, of course it will be forgeable on any device that can pass integrity check but has a local root vulnerability, and of course it will leak data in a way that Google and Apple will collect.
Which is eclipsed by the entire thing serving to isolate vulnerable kids, of course.
score 1 · canonical
Online services and app stores will have to use tools to check users’ ages, while protecting their privacy. They can for example use the EU age verification app, which does not retain identity documents or biometric data.
These checks are either trivial to bypass or they don’t actually preserve privacy.
score 1 · canonical
How do you know? I am not an expert on this, but I think the app works with the chip on the ID card to just verify that you are older than a specific age via some cryptographic proof without actually providing the name or age to the requester. Meanwhile also the ID card provider doesn‘t know for what you used it for. This of course assumes no backdoors. From what I‘ve heard it is pretty genius, but that‘s not what the big social media companies would like to have, because they want your real age and name.
Edit:
The new age verification app is user-friendly and can be set up using a passport or ID card, enabling users to prove their age when accessing online services. The app is completely anonymous, works on any device, and is fully open source, meaning partner countries around the world can also adopt it.
score 2 · canonical
If it doesn’t reveal my identity in any way, what stops me from distributing my keys on the internet for free?
score 1 · canonical
One way to prevent sharing is to cryptographically sign the app’s state with a hardware id, using an external service so the private signing key is not leaked, and a locked down OS so you can’t fake the id or install a hacked app.
Whether that’s how this particular scheme works or not, strong ones always come with pretty serious freedom or privacy issues. You have to choose somewhere between a dystopia and an easily bypassable system. You can get most of the usefulness (preventing access to problematic things) with very simple systems (starting with the “are you overs 18 ?” click-through), and then each loophole you close comes at an increasingly authoritarian cost.
score 1 · canonical
Locking socializing down to only government approved hardware and OSes does seems pretty bad.
score 1 · canonical
Have they still not cleaned up their act that you can use the tracker collar, sorry, smartphone app to at least verify your age for a website open on an actual computer?
score 1 · canonical
If its just a card, it may be privacy-preserving, but what’s stopping a kid from snatching their parents ID for a moment?
Biometrics might migitate that, but then it seems hard to DK so anonymous without a trusted 3rd-party imvolved, no?
score 1 · canonical
I’m assuming this is the (various) source code(s) for the EU age verification app’s open source publishings? Or is there a different source for that?
score 1 · canonical