Suppose it’s used to verify your age when visiting Pornhub. How is Pornhub going to trust the user’s computer didn’t lie about the user’s age? A “just trust me bro” sent by the browser isn’t going to suffice; teenagers would find a way around that.
Thr attestation will have to be cryptographically signed by some trusted party—and that’s either going to be the government, or the operating system vendor.
If it’s the government holding the signing keys: the website can now verify that you’re a resident of $state in $country and use that for fingerprinting and targeted advertising. And what if your country doesn’t participate, or if Pornhub doesn’t trust the signing keys used by the government of Estonia? Tough shit, no porn for you! It would be impractical to manage all those keys, though, so why not instead leave it up to the operating system vendor?
If it is left the operating system vendor, it’s going to end up being exactly the same as Google Play Service’s SafetyNet “feature”. If you’re not using an approved operating system (a.k.a. Windows, MacOS, stock Android, iOS) you’re not visiting Pornhub. Or a banking app. Or applying for jobs. Etc.
This bill is a poison pill for device ownership and FOSS operating systems being handed to corporations on a silver platter.
Just to clarify I am not for this law. I do not think that this should have been passed. But also the law seems to have some good intentions and I don’t want to jump to conclusions after just reading headlines.
It feels like the law makers want to standardize and restrict how this age verification works without actually providing any guidance whatsoever on how to implement such a system.
I’m curious to see what systems companies come up with and what major flaws they will have (intentional or not) that data collectors will exploit.
No, it is bad.
Suppose it’s used to verify your age when visiting Pornhub. How is Pornhub going to trust the user’s computer didn’t lie about the user’s age? A “just trust me bro” sent by the browser isn’t going to suffice; teenagers would find a way around that.
Thr attestation will have to be cryptographically signed by some trusted party—and that’s either going to be the government, or the operating system vendor.
If it’s the government holding the signing keys: the website can now verify that you’re a resident of $state in $country and use that for fingerprinting and targeted advertising. And what if your country doesn’t participate, or if Pornhub doesn’t trust the signing keys used by the government of Estonia? Tough shit, no porn for you! It would be impractical to manage all those keys, though, so why not instead leave it up to the operating system vendor?
If it is left the operating system vendor, it’s going to end up being exactly the same as Google Play Service’s SafetyNet “feature”. If you’re not using an approved operating system (a.k.a. Windows, MacOS, stock Android, iOS) you’re not visiting Pornhub. Or a banking app. Or applying for jobs. Etc.
This bill is a poison pill for device ownership and FOSS operating systems being handed to corporations on a silver platter.
Totally a valid point.
Just to clarify I am not for this law. I do not think that this should have been passed. But also the law seems to have some good intentions and I don’t want to jump to conclusions after just reading headlines.
It feels like the law makers want to standardize and restrict how this age verification works without actually providing any guidance whatsoever on how to implement such a system.
I’m curious to see what systems companies come up with and what major flaws they will have (intentional or not) that data collectors will exploit.