US States enforcing new age verification for adult content—how could this be done properly?

@technology

Seeing the news about Utah and Virginia over in the US, there’s been a lot of discourse about how unsafe it is to submit government ID online. Even the states that have their own age-verification portals are likely to introduce a lot of risk of leaks, phishing, and identity theft.

My interest, however, focused on this as an interesting technical and legislative problem. How _could_ a government impose age-verification control in a better way?

My first thought would be to legislate the inclusion of some sort of ISP-level middleware. Any time a user tried to access a site on the government provided list of adult content, they’d need to simply authenticate with their ISP web credentials.

Parents could give their children access to the internet at home or via cellular networks knowing this would block access to adult content and adults without children could login to their ISP portal and opt-out of this feature.

As much as I think these types of blocks aren’t particularly effective—kids will pretty quickly figure out how to use a VPN—I think a scheme like mine would be at least _as effective_ as the one the governments have mandated without adding any new risk to users.

What do you all think? Are any of you from these states or other regions where some sort of age-restriction is enforced? How does this work where you are from?

Edit:

Using a simple captive portal—just like the ones on public wifi—would probably be the simplest way to accomplish this. It’s relatively low friction to the end-user, most web browsers will deal with the redirect cleanly despite the TLS cert issues, and it requires no collection of any new PII.

Also, I don’t think these types of filters are useful or worth legislating, I’m just looking at ways to implement them without harming security or privacy.

  • BlameThePeacock@lemmy.ca
    link
    fedilink
    arrow-up
    5
    ·
    1 year ago

    There’s no good way to do this without that information being available somewhere we don’t want it for privacy reasons. You shouldn’t trust a company with your information any more(or less) than the government.

    Stop trying to be a nanny state, if people want to view porn, let them. If kids try to view porn, that’s up to the parents to manage.

    • Jeff@social.rights.ninjaOP
      link
      fedilink
      arrow-up
      0
      ·
      edit-2
      1 year ago

      @BlameThePeacock

      It’s the US republicans who want to do this, not me, I’m just approaching this as an interesting problem.

      As for my suggested solution, the only database would be the list of sites with adult content. No new personal data would be stored about individuals.

      I’m not suggesting that ISPs implement photo-ID checks, just a login with your ISP username/password (an account you already have).

      • BlameThePeacock@lemmy.ca
        link
        fedilink
        arrow-up
        2
        ·
        1 year ago

        The ISP suggestion simply doesn’t work. ISPs would then know who is browsing what within a family, far too big of a privacy problem. It’s already bad enough that they can see and track everyone’s browsing.

        On top of that, it doesn’t deal at all with multi-user devices like a family PC. Kid could just jump on and watch porn after dad/mom finishes because it’s not going to ask for a login every single time or then you’ll actually be tracking which adults are using porn specifically.

  • sylver_dragon@lemmy.world
    link
    fedilink
    arrow-up
    5
    ·
    edit-2
    1 year ago

    I’d preface this by saying the idea is bad and the legislators passing such laws should be voted out.
    That said, looking at it from purely a technology point of view, it’s going to be difficult to implement in a secure and privacy preserving fashion. At minimum, there needs to be some sort of third party trust site where an adult site operator can validate age requests. In order to preserve privacy, this will need to operate via hashes and challenges which prevent either the adult website operator or the trust provider from marrying up user and usage data.
    To spitball it:

    1. All internet users are required to register with third party trust site (Trust Site).
      1a. Because any sort of profit motive would make this site untrustworthy, this probably has to be a government run site.
      1b. By law, the site would be forbidden from collecting or retaining logs or metadata of requests.
      1c. By law the site would be exempt from all wiretap requests including by law enforcement and security agencies. Violations would need to be pursued and punished very harshly. Which is one reason this whole thing is a Bad Idea™. Enforcement would never happen.
    2. When a user visits any website (not just adult websites), the site sends a random nonce to the browser.
      2a. The nonce would be tied to the session via a session cookie.
      2b. The nonce is purely random with no site identifying information.
    3. The user’s web browser communicates this nonce to the Trust Site along with the user’s credentials.
      3a. Nothing else is ever transmitted to the Trust Site. Just the nonce and credentials.
    4. The Trust Server validates the credentials, appends a single bit to the nonce (Response).
      4a. A 1 means “is adult” a 0 means “is not adult” (Adult Bit)
    5. The Trust Server digitally signs the Response with its private key.
      5a. The Trust Site’s public key is publicly available and expected to be cached by all websites.
    6. The Trust Server sends the Response back to the user’s browser.
    7. The user’s browser sends the Response back to the website.
    8. The website validates the digital signature on the Response.
    9. The website provides/denies content based on the Adult Bit in the Response.

    As I said, this is just a spitball and probably has holes/problems. But, it is an attempt to look at the issue constructively.

    • bigkahuna1986@lemmy.ml
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      secure and privacy preserving fashion

      If a local government mandates age verification with no implementation, there’s no way we’ll get either security or privacy unfortunately.

      With the huge amount of adult material out there, I doubt a technological solution exists to this problem and ultimately requires parents communicate with their children.

  • drspod@lemmy.ml
    link
    fedilink
    arrow-up
    4
    ·
    1 year ago

    This problem is always approached from the wrong angle (requiring verification of adults to view adult material) instead of the more freedom- and privacy-preserving method of requiring child-friendly sites to advertise to the browser that they are suitable for child web browsers.

    What I mean by this, and the way that I would solve this problem, is to introduce an HTTP header such as X-Child-Friendly: true or X-Content-Rating: E and to put the onus on parents to set the child’s web browser to only allow browsing sites which return this header. Every browser would need to have a “Parental Control” mode that restricts browsing to sites that return this header, but this could easily become a standard. Instead of having every adult site implement your legislative controls, now you just need child-friendly sites to add a header to their responses.

    The whitelist approach is less likely to allow adult sites to slip through the net, compared to the blacklist approach.

    For those who say that children would find a way around this by installing a different browser or unlocking the parental controls: it should be the responsibility of parents to monitor their child’s access to the internet and installation of software. The current approach of trying to enforce age-verification on adult sites just shifts the problem to other adult sites that are not under the jurisdiction of the legislation.

    Forcing age-verification for adults also has a huge bureaucratic cost and potential for abuse and loss of privacy. I think we know why legislators prefer this approach, and it isn’t to protect the children.

    • jasparagus@lemmy.world
      link
      fedilink
      arrow-up
      2
      ·
      1 year ago

      This seems to me like a much smarter solution, and it’s more in line with how (e.g.) YouTube kids and the Play Store work (content with ratings, but a separate ecosystem with non-earnarked content that parents could always approve). Crafty kids will always find a way around stuff, especially if they’re unsupervised.

      This strategy seems like it would be much less obtrusive, with the bonus of probably being a lot safer for kids in practice. Nobody is ever going to successfully blacklist all the adult content the internet can generate… that’s a Sisyphean task.

      • drspod@lemmy.ml
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        Your DNS whitelist will need to be maintained by somebody and regularly updated. The benefit of the approach that I suggested is that sites report their own content suitability. A new site could be created and immediately be made accessible/inaccesible to restricted browsers without anyone having to maintain a database of allowed/disallowed sites.

  • TheCuriousCoder87@lemmy.ml
    link
    fedilink
    arrow-up
    2
    ·
    1 year ago

    I don’t really like all these anti-porn laws. If kids want porn, there are too many leaky buckets they can drink from. Hell, they could just messages pics and videos to each other.

    That said, if we are forced to do strong verification, the best I can think of is some sort of mix of the ideas we use for certificate authorities and oauth.

    Certificate authorities are really just trusted identity providers. In my solution, you would choose from a list of trusted identity providers. You provide them with all the private information necessary for them to validate your identity. From there a third party can validate information about you with your permission.

    The way this workflow would work is similar to oauth workflows people are familiar with for Google, Facebook, and other single sign-on solutions. You go to a adult site, select your provider from a list of trusted identity providers, the adult site redirects you to the provider site, you log in and give the adult site the privilege to verify you are over 18. The browser redirects to the adult site. The adult site would get nothing else about you besides what identify provider you use and if you are over 18.

    Now ultimately, you have to give your private details to someone but at least you don’t have to give it to everyone. Unfortunately, your provider could potentially keep track of what sites you are allowing to verify your information. We would need strict laws on these providers on what records they are allowed to keep.

    • Jeff@social.rights.ninjaOP
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      I definitely agree that these types of blocking are ineffective and generally do more harm than good, but if governments are going to push for this stuff, it would be good to have a solution that doesn’t harm people’s security and privacy.

    • TheCuriousCoder87@lemmy.ml
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      On the plus side, we could repurposed this system to prevent a lot of types of online fraud. You could use a provider to create a online bank account, sign documents, and other things that require identity.

      On the negative side, a lot of sites might start requiring it just because they want to know who you are for advertising purposes.

    • TheCuriousCoder87@lemmy.ml
      link
      fedilink
      arrow-up
      1
      ·
      edit-2
      1 year ago

      Another idea is to actually use mutual TLS. Your browser provides your certificate. That certificate has nothing else in it but your status as an adult. Still have to give a certificate authority your information though.

      • Jeff@social.rights.ninjaOP
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        @TheCuriousCoder87

        You wouldn’t necessarily have to actually give a CA any details about yourself, just integrate this into the existing ISP portals.

        An adult can log into the provider’s website and click to generate any client certs they need.

        I think this method is maybe a bit _too_ technical (compared to a simple captive portal like you get on public wifi) but I think it would work okay as long as end-users didn’t have to go to a 3rd-party or provide any additional information to their ISP to use it.

  • Saik0@lemmy.saik0.com
    link
    fedilink
    English
    arrow-up
    2
    ·
    1 year ago

    There’s already an answer to that. My state (and several others) have digital IDs that exist. I have an app on my phone called mID (<state> Mobile ID). I can present proof of just my age to a bartender using the app. They don’t see my address, birthday, DLnumber… nothing… Just that I’m indeed 21+.

    I can present a qr barcode that will grant someone the ability to see my ID… I can choose what information to send by default… and if someone is requesting more information I can view/approve if I choose to.

    There’s no reason why a simple request to this platform couldn’t do it. I have the other side of the app that let’s me read other people’s qr codes and validate whatever information I “need” to validate. If I can do it as an individual… I don’t see why website’s couldn’t.

    Now… Do I want the state to particularly know that “BustySluts.com” wants to view my id? I can see this being intrusive… but there’s already answers like charging 1 penny to a credit card as well.

    I would wholeheartedly be against my ISP doing anything other than being a carrier for my data. The ISP wouldn’t be able to tell if I’m on my computer or if my child is anyway. Middleware or not.

  • chkno@lemmy.ml
    link
    fedilink
    arrow-up
    1
    ·
    1 year ago
    1. Paper tokens: Produce 100 billion authentication tokens (could be passwords, could be private keys of signed certificates), print them on thick paper, fold them up, publicly stir them in giant vats at their central manufacturing location before distributing them to show that no record is being kept of where each token is being geographically routed to, and the have them freely available in giant buckets at any establishment that already does age-checks for any other reason (bars, grocery stores that sell alcohol or tobacco, etc.). The customer does the usual age-verification ritual, then reaches into the bucket and themselves randomly selects any reasonable number of paper tokens to take with them. It should be obvious to all parties that no record is being kept of which human took which token.

    2. Require these tokens to be used for something besides porn access. Maybe for filing your taxes, opening bank accounts, voting, or online alcohol / tobacco purchases. This way, people requesting these tokens do not divulge that they are pornography viewers.

  • average650@lemmy.world
    link
    fedilink
    arrow-up
    1
    ·
    1 year ago

    This still introduces ways for identities to be stolen, albeit in a different way.

    The better way is to separate the method of checking identity for credit from these identity checks completely.

    • Jeff@social.rights.ninjaOP
      link
      fedilink
      arrow-up
      0
      ·
      1 year ago

      My scheme doesn’t require any identity information to be provided by the user.

      The ISP already has PII, but that’s a risk that already exists today.

      • average650@lemmy.world
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        Then how can we tell the difference between an adult and a child in the house? The entire connection will just be banned.

  • Sens@feddit.uk
    link
    fedilink
    English
    arrow-up
    1
    ·
    edit-2
    1 year ago

    It will probably just kill off porn companies, have you seen how much porn is on telegram? People would just use that instead. ___

    Porn is basically completely free nowadays anyway

    • Jeff@social.rights.ninjaOP
      link
      fedilink
      arrow-up
      2
      ·
      1 year ago

      @Senseibu

      It might hurt their bottom line, but the big companies operate in so many different markets and I don’t think there’s any risk of _all_ of them enacting these types of restrictions.

    • Jeff@social.rights.ninjaOP
      link
      fedilink
      arrow-up
      0
      ·
      1 year ago

      I don’t think there’s any risk of _any_ of these schemes killing off internet porn.

      The current government schemes all rely on porn companies opting in and on the government/ISPs to catalog all porn sites on the internet.

      • Sens@feddit.uk
        link
        fedilink
        English
        arrow-up
        0
        ·
        1 year ago

        Did you literally downvote me because I pointed out that 1. you misread my first answer 2. That age verification will fail as hardly anyone would use it

        What’s the point in having a conversation if you are going to behave like that 🤣

  • werewolf_nr@fig.systems
    link
    fedilink
    arrow-up
    1
    ·
    1 year ago

    The ISP middleware is an interesting idea, basically an SSO (think the “Sign in with Google” you see everywhere). However, this would require some level of integration between every ISP and adult site, which would get seriously tedious as such things roll out all over the country. This doesn’t even get into the fact that each law would vary somewhat in the specific requirements and that it just kicks the job to verifying IDs and ages to the ISP instead of the downstream site.

    • Jeff@social.rights.ninjaOP
      link
      fedilink
      arrow-up
      0
      ·
      1 year ago

      There are lots of ways around doing a full SSO integration, though.

      In the simplest form, the ISP could simply use a captive portal of some sort directing the user to authenticate first.

      While captive portals can’t serve the correct certificate most browsers these days are smart enough to detect a captive portal redirect and give the user a smoother experience.

      • werewolf_nr@fig.systems
        link
        fedilink
        arrow-up
        1
        ·
        edit-2
        1 year ago

        That solution puts the burden on the ISP to do the filtering. While it is the technologically easiest solution, it would require overturning the laws protecting ISPs from the content they serve.

        • Jeff@social.rights.ninjaOP
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          @werewolf_nr

          You’re right, I don’t think it would make sense to put the legal liability on the ISPs.

          I think, like the current system, it would be a registry that adult websites would have to sign up for in order to be in compliance with the law.