alt Hacker NewsThis is almost right, but it shouldn’t be “is a child using the device?” It should be “is this a child-locked device?”
There should be a children’s Internet, just like there are children’s libraries, and child-locked devices should give access to it. Adults should be able to use the children’s Internet to see what’s there and children should be able to use the adult Internet when supervised by parents and teachers.
Technically, the only thing cooperating websites need is an http header indicating that the client is a child-locked device. Websites can disallow creating accounts or logging in from child-locked devices when they’re only appropriate for adults. There can be laws prohibiting advertising on the children’s Internet, etc, and legit websites will have to follow them. At no point does a website need to know a child’s age or anything else about them. Vendors selling devices are responsible for not selling unrestricted devices to children, but that’s easier than making every website do it.
Since the Internet is still a dangerous place, for non-cooperating websites, child-locked devices do still need the usual whitelists and/or blacklists.
Replies
100% agree, and no OS should be forced to implement this "child-locked" signal. the existence of OSs that do implement it should be enough (if you want to lock your child's device, use a lockable OS).
> http header indicating that the client is a child-locked device
what happens when the request goes through a proxy and that proxy is configured to strip this header?
There could be lock levels to this. By default everything is unlocked (level = 0), but if a content provider / host receives a signal/header with lock-level > 0 they should be required to honor it. Something like this would require government which means it will probably never happen. Much more power asymmetry to just track you.
If you want to make a child-safe website that is OK, it can go be in it's walled garden g-rated brand-safe reality. But that is retarded. The rest of the internet still exists, and will not stop existing. Porn/defense distributed/much more insidious things will still exist.
All the age verification is is creeping totalitarianism by governments.
> It should be “is this a child-locked device?”
No, that leaves vulnerable adults unprotected. It should be "Is my thing in one of the categories of things that this device says this user is not permitted to do? If so, I shall not permit this user to do the thing.".
Nothing stops software authors from providing pre-built bundles of categories that they believe fit certain types of vulnerable people [0], but the fine-grained control must be there so that guardians can choose to set things up for those they guard so to adequately protect them while minimizing the amount of stuff that they're blocked from.
[0] Like: "Overly-trusting human who needs protection from scams", "Dementia-damaged adult who cannot be trusted to manage their finances", "Median sixteen year old USian", etc, etc.
There should not be an HTTP header indicating that the client is a child-locked device. That puts the onus on the server to respect the header, and HTTP doesn't require any action on unrecognized headers. Also, it reveals to the server that the client's user is likely vulnerable to manipulation — exactly the opposite of what you want!
Instead, there should be an HTTP header indicating that the server is an adult-only website. Then, child-locked devices can refuse to show the content to their users. Moreover, this can be more granular than just a single adult-only bit.
This standard has existed for 30 years and was supported in Internet Explorer 3; it's called PICS: https://en.wikipedia.org/wiki/Platform_for_Internet_Content_...
If the current age verification controversy was intended to protect children rather than destroy anonymous speech, it would be focused on requiring the implementation of PICS or something similar.