Federal Bill Would Bring OS-Level Age Verification to the Entire U.S.


in reply to 0_o7

You access the Internet through a network owned by a corporation under the jurisdiction of a government, your ISP knows who you are and so your government knows who you are.

Both of our Lemmy instances are hosted by Hetzner, in Finland and Germany. Both instance's connections are proxied through Cloudflare, an American tech company.

Any one of these entities has the ability to track you to at least an ISP and potentially down to the nearest street intersection if you're using fiber/cable. And that ISP will have records linking your IP lease information to your identity, or at least the credit card/billing information that you provided.

The kind of people who would be putting you on a watchlist are not the kind of people who will be thrown off by simply changing usernames on social media.

This entry was edited (6 days ago)
in reply to Lost_My_Mind

..because it's not him doing it. He's mainly a figurehead, a useful idiot. It's the smart fascists around him and behind him. Peter Thiel, Roger Stone, Russ Vought, Stephen Miller, Mitch McConnell, etc. etc. and basically all the Christian Nationalists and White Supremacists who've been working for over 30-40 years to chip away at and infiltrate every US institution. It took a long time, but they worked patiently to reach the point where this was possible.
This entry was edited (1 week ago)
in reply to Sahwa

"Key questions remain unanswered, such as the definition of “operating system provider,” the type of verification required, the focus on major commercial platforms, and the potential scope beyond them."

I guarantee this bill is unenforceable. Cars, phones, traffic lights all have have computers with operating systems. All modern tech has an operating system of some sort. Also how do you even verify age? If my laptop is offline can I just not use it because it can't confirm my id? What about tech that never goes online but has an OS, like a calculator? I can't believe microsoft and apple are not lobbying against this. Who becomes liable if an "underage" person is accidentally given access or if access is denied to an "of age" person. I can just imagine an emt frantically looking for their driver's license so they can use the computerized defibrillator.

in reply to AdamEatsAss

It feels like a Mr. Smith Goes to Washington display would solve this.

Just bring everything that has an operating system in it into the room. Cars, boats, planes, construction equipment, tractors, factories, knock off game consoles, literally every server on the internet.

Show them the ridiculousness of this and maybe we’ll get dragged out by police and charged with contempt of congress

in reply to 「黃家駒 Wong Ka Kui」(he/him)

Without the document text, who knows. But I would not consider it a stretch for a court challenge to interpret "operating system" as "any software that allows a person to interact with computing or electronic hardware". Which would blanket cover all embedded devices.
in reply to Telorand

Maybe we could get some open-source routers and kernel patches going to implement this instead: bill.herrin.us/network/ipxl.ht…

It's what should've been done instead of IPv6 -- well, maybe it's a bit of a non-sequitur for the current problem, but it would create a different internet that maybe could be routed around the age-verified one if that comes to pass.

This entry was edited (1 week ago)
in reply to Sahwa

Would this bill ban the use of all operating systems released before it became law? That seems unlikely.

So then how about OSs released before it became law, with patches released afterwards? That also seems unlikely.

So then how about my computer's current OS, which is a heavily patched version of a little hobby OS called Linux, originally released in 1991?

This entry was edited (6 days ago)
in reply to flandish

"But that's unenforceable", some will claim.

And to that, let me remind us all of a little-known concept called cryptographic attestation. If that doesn't ring any bells, then the term "secure boot" should.

Once this shit passes into law, that's the next step. Operating system vendors have their private keys to sign attestation tokens saying "John Johnson is an adult" and you're only getting one if you verify your government ID. When you go to a website, your browser sends your signed token to the website and then the website checks if it's a valid token signed by Microsoft, Apple, or Google.

But Linux?, you may be wondering. No. No Linux. Kiss it good-bye. Your bank will "require" identity attestation for "extra security", and your bank doesn't give a fuck about Linux. Your bank will check against whatever list of public keys they want to trust, and it ain't going to include anything not backed by a global megacorporation.

This entry was edited (1 week ago)
in reply to chunes

About that last sentence; the same crap is creeping in Europe at the very least. There was another press release about the eu commission iirc welcoming a similar decision in spirit. Just not implemented at OS level but web-side.

Not sure or Asia and Africa are feeling about this but unfortunately USA is not alone. which in my opinion gives credits to the various theories that it’s being pushed by gafam.

in reply to mrmaplebar

Well they could do it the right way where, for example, you go to your city hall to get a certificate of age where they check your ID.
Then some cryptography happens so you only enter a public key from that certificate on a website or OS to verify your age.

The website or OS doesn’t check your ID. City hall doesn’t know your browsing history.

But I’m not fooling myself, that’s not the point of such a law.

This entry was edited (1 week ago)
in reply to BonkTheAnnoyed

That's not true. It's simple if all you actually want is age verification.

You go in to the government building and show your ID. Seeing you are 18 or older you get to go to another room where they don't check your ID, just give you a token saying the one holding it is over 18. Make the token like a FIDO key where you have a pin you set yourself.

There is an air gap between the validation and the token creation so there is no way to go from token to ID. You make the key use a pin so we consider it to be once usable by one person.

The issue is not about the technology. The issue is that we all know this has nothing to do with kids getting on porn sites.

in reply to harmbugler

You are changing the goal. The point of this is to provide THE USER with a solution where they don't have to give away their personal information to the Government or the 3rd Party site. We do not care about situations where users commit crimes as that means our focus is on the Government's needs which they would already have met by just implementing a "Show us your ID" solution.

Now you could make the pin be a biometric so it's physically connected to the user. But part of the solution needs to be that the token is not identifiable with the user. If I pull of my wrist band no one will know it was mine. If you throw out your token someone could go around testing everyone's fingers and find out it was yours.

in reply to harmbugler

no, the point of the key is to access infomatĂŽon without giving away personal information.

Even a photo ID doesn't prove age. It just shows a record of what age the gov thinks someone is. They are still prone to forgery, misuse, etc. There isn't any actual method of showing someone's age so we can skip that part and focus on what the actual need of the user is, accessing a website while not handing over more personal information than is necessary.

in reply to harmbugler

in reply to Devolution

This is about protecting the entrenched players in the OS games; Microsoft, Google and Apple.
The likely end play for all this is the erosion of personal computing so they can rent (and therefore control) all the compute available to you, so you don’t get uppity and think of running your own AI, which they believe will be as integral to everyday life as the internet is today.
in reply to ripcord

Well now you have to provide ID to use any of those.

This is just another form of control and a potential verified data stream for governments/corporations/marketers.

How can you prove that internet traffic is a human and not a bot? ID verification.

How can you generate more user data? Force them to provide ID for every device that is connected.

Want to control piracy? Easy with OS level ID requirements.

in reply to deathbird

in reply to green_goglin

how to stay young and probably prey on them, probably learned from another rich AH bryan johnson who is trying to stay young buy sucking the blood of his son, and doing "pseudoscience" on himself with questionable scientists about longevity.

one of thiel's partner while married is a young male model, i get its a thing for older gay guys who are rich.

in reply to HiTekRedNek

in reply to Soup

Be kind to others, the game is rigged against them. Propaganda has never been stronger and its everywhere.

Just yesterday I saw a video discussing how private equities buy up YouTube channels to seemingly both squeeze them for their worth and/or use their trust to push an agenda. E.g. fern & veritasium stood out to me the most.

This entry was edited (6 days ago)
in reply to Janx

This is gonna kill the internet, and then free speech in general is going to fall alongside it.

It's also gonna kill device ownership as you will no longer own your device under this law.

The end game is everyone accessing info through a state intranet like NK has, through government-issued thin clients, where only the state decides what you can and can't say and what data you can have access to.

in reply to Sahwa

This entry was edited (6 days ago)
in reply to Sahwa

in reply to Havoc8154

in reply to ImitationLimitation

Well that's just nonsensical. The only obligation it removes for software developers is the need to obtain (and justification for storing) personally identifying information on its users. Websites and apps would still be responsible for moderating their content and only serving appropriate content to underage users. It wouldn't do anything whatsoever to remove accountability for Meta.
in reply to Havoc8154

Let’s just say meta delivers some problematic content that traumatizes a kid and really upsets parents. This content was on the 12-year-olds Chromebook. The kid, then setting up the laptop with his parents had his age in there appropriately, and Met used theAPI to obtain it to prevent adult content delivery.
However, kid is tech savvy, creates a secondary accounts, says they are 45. Maybe uses parents ID or something to do it. They then get the adult content. Parents file suit.
Meta lawyers: Our API works as designed, and we can be held liable when the OS API says the person is 45 and not 12.
Case dismissed. Profit.

But okay, definitely nonsensical.

in reply to ImitationLimitation

How is that any different from what happens today? Kid makes fake account - gets adult content - Meta shrugs and says they did what they could. Of course there would be ways it can be circumvented, this would change nothing about that situation except shift the responsibility of correctly inputting the users age onto the user, which is where it should be. I'd much rather have that scenario than one where meta is forcing all users to upload government IDs; Using that excuse to harvest and store even more data than necessary.
in reply to Havoc8154

I did… and everything you say is nonsensical. So I responded in the only way this system would make any sense.

Your way, the OS just takes in an age on trust, then the apps have to verify anyway. How do they do that? They need ID, when it would’ve raise to get that validation from the OS that already had the ID verified.
Your way means nothing. It does nothing. It adds an age to a system for no reason and is completely unusable.

in reply to ImitationLimitation

What I'm describing is exactly how it's been implemented into several Linux distros in response to the California law. Apps shouldn't need any more verification than pinging the OS to find out the age of the user. It makes a single, easy to understand method of controlling a device intended for a child (which is the only actual benefit to any of this). It puts the responsibility on the parent or guardian setting up the device, which is exactly where it belongs.
in reply to Havoc8154

Should you have to verify your age to your car before you can turn it in, to drive to the DMV before you can obtain your license and registration? Who should have the burden?

Should your front door verify your age before you leave to go buy alcohol from the local liquor store?

Should your bed verify your age and the age of your lover before you have sex?

Also, this isn’t even the biggest problem, the problem is this is just more surveillance. Don’t comply in advance. Default to protect and keep your freedom by protecting your privacy.

in reply to Havoc8154

That’s also just a minorities to the data intrusion and surveillance this is really building. Data is king, and adding age and other demographics obtained at the OS level to more sell more targeted adds to manipulate people.
The same data bend used to target political opponents by governments.
But it’s cool. It’s for the safety of the kids!!!
in reply to ImitationLimitation

Companies are already required to ask if their users are kids because, among other reasons, there are laws against creating ad profiles for kids, and companies have been sued for doing this even accidentally. The California law just changes how they're required to check if they're a kid from asking them at account creation to asking the OS at account creation, where the parents have set the age for them when the OS account was created. It gives the company checking if they're a kid no more information than they had before. I agree with Havoc8154@mander.xyz that this is totally reasonable.

This particular federal bill, on the other hand seems closer to the Florida bill in that it requires some form of age verification instead of just accepting what the parents enter when creating the OS account. That is unreasonable. Complain to your representative, and we'll see how it gets amended.

This entry was edited (5 days ago)
in reply to pfried

If the companies already have to do this, then what is the point of the OS asking for more personal notifying information than it needs just to operate? Thank beyond the seemingly “simplicity” of this and think how it can be used against you. Then decide if it’s rational.
People thought the patriot act was a great idea after 911… They were wrong.
in reply to ImitationLimitation

what is the point of the OS asking


Because for the purpose of securing kids accounts, it doesn't make sense for the kids to enter their ages themselves each time they create an account at a new website.

Tell me how it can be used against me. It doesn't give out any information beyond what I let it give out about me, and that information is information I get to make up. Remember, the California law doesn't require any verification of the age data that is given to the OS.

This entry was edited (5 days ago)
in reply to pfried

It’s about kid safety! Take off your tin hat! Right?

… well
lemmy.ml/post/46083470


Hackers Expose The Massive Surveillance Stack Hiding Inside Your “Age Verification” Check


in reply to ImitationLimitation

Legislate mandating firewalls and routers have easy to use parental controls for internet settings.


Sorry but no. That would drive up the cost of all firewalls and routers, for no real reason, except that the manufacturers can because the government says they have to. And most firewalls that offer content filtering need some sort of a subscription to keep the filters up-to-date.

Never mind the fact that a router's job isn't content filtering (it's routing).

Todays parents grew up exposed to the internet. If we don't know how to protect our own kids and teach them how to safely use the internet, then we are hopeless as a generation.

Btw, Cloudflare WARP is free for a small number of users and has a pretty decent web filter built in. It's far from easy to use, but it's free and effective. I use it on my 9yo's Fedora laptop, and as long as he can't sudo, he can't turn it off. And if he even tries to sudo, he will be reminded that he's not in the sudoers file, and this incident WILL be reported.

in reply to ImitationLimitation

I mean, it very easily could be. A service like WARP, they can decrypt the traffic, if you allow them to (it is off by default). The warp client will add the certificate to the trust-store, and the traffic will get decrypted on Cloudflare's end.

For my kid, I kept deep-inspection off. If he figures out how to get past DNS and SNI inspections, he deserves to see a boob or two.

in reply to Holytimes

The death threats were shitty, I agree. But they were at least partially fueled by the fact that we have lawmakers trying to make it illegal to use an operating system that doesn't ask for your age. If that systemd change was introduced in a different time, I doubt people would have even noticed or cared.

Not trying to excuse the death threats, because again, that's shitty, there's no reason to do that. I think it's important to understand the context and nuance around all that though.

in reply to Havoc8154

I'll appreciate that it's hard to be a devil's advocate on an argument and provide a nuanced take. But I will say the points made on the Ageless Linux website demonstrate why that's an issue, primarily around how you're teaching kids from their first time on the internet to lie. It really doesn't matter whether this happens through a drivers' license pic or a DOB selector.
in reply to Katana314

Their argument is entirely based on the assumption that the child can change their DOB on the device at any time. That's trivially easy to avoid with a simple admin password requirement. If this was implemented in any competent way (granted, that is a lot to expect of legislators) the DOB would not be able to be changed once the device/user account is setup, or would require an administrator password which obviously shouldn't be given to the child.

But they turn around and say this is good and how things should work:

This app lets you chat with people on the internet.
If you're a kid: ask an adult before chatting online.


Yeah, the kid that's willing to change their device settings is definitely going to go check in with Mom before they access something they know they shouldn't be on. That's just an unbelievably bad argument.

in reply to Havoc8154

in reply to Katana314

So scenario one has a parent who is paying no attention to their child's questions, but in scenario 2 they're suddenly attentive and totally in tune with what their child is doing?

Look, you can't fix everything for everyone, but a simple explanation for first time setup of a device is not difficult, especially if it was implemented as a national movement (law or otherwise). Absentee parents are still gonna absentee, but it would be a tool that parents who give a shit could really benefit from.

in reply to Havoc8154

in reply to Sahwa

The ONLY way I could remotely support age verification is if it was anonymized from the individual, similar to how companies like Mullvad do their VPN or with prepaid gift cards etc

You get a card that has a PIN behind a scratch-off section. You can buy the card for cash or order online, but there's nothing tying the buyer to the card.

Age verification can be similar where you go to a registered location, provide valid ID and like $5 to get a scratch off card. The code on the card just validates "user is 18+" but otherwise has no ties back to their actual identity.

If a site wants to do an age check, it can validate the card PIN or on phone potentially scan a 3d barcode behind the scratch-off. Maybe some hash check could be involved to avoid the need for a centralized provider.

This entry was edited (5 days ago)
in reply to phx

I would support a simple toggle, a content safe mode and an unrestricted mode, selectable at the OS level through a parental controls option. Then have sites flag all "objectionable" or not safe for work material. The restricted mode would not even download such content.

Done, more power to parents, and smart kids, while not destroying the internet to block content that conservatives don't like. Which is what all of these laws are based on.

in reply to lightnsfw

I mean, for the most part yes. I'm not even so much concerned about my kids viewing porn, more so than somebody else will make nasty deepfakes of them and post online etc, so age verification won't fix that.

I could see it help with discriminating between people at their "own damn computers" and bots or misinformation/psyops campaigns run out of certain foreign countries though (assuming any ID also ties back to parent country).

in reply to lightnsfw

in reply to Sahwa

For all those that truly believe this is no big deal, and honestly believe it’s about kids, and think all the commenters in here are silly or tin hat wearers… go read this:

lemmy.ml/post/46083470

Short version: US based company providing age verification has US Govt. surveillance within their stack that adds you to all kinds of potential lists, among other concerns. It also serves as a huge honeypot of data just waiting to be breached, and it will be breached.

For those in the back not paying attention: THIS IS NOT ABOUT KID SAFETY, IT’S ABOUT TRACKING YOU AND YOUR KIDS!


Hackers Expose The Massive Surveillance Stack Hiding Inside Your “Age Verification” Check


⇧