They don’t care. They want your face, retina, fingerprints, DNA. All for their LLMs and so they can sell you something else.
Also to blackmail you later if they think they can or just feel like it… because they will put all that shit on an insecure server and some 13 year old hacker in Turkmenistan will leak it and make a killing (literally and figuratively) with it.
Have you actually read the bill itself? Nowhere in it does it mention any of the things that you mentioned. It doesn’t even mention ID cards at all.
What it does say is operating system providers shall “Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device”. What we should look out for is that the law does not forbid OS providers from requiring IDs.
It does however require that OS providers “Send only the minimum amount of information necessary to comply with this title and shall not share the digital signal information with a third party for a purpose not required by this title.” (emphasis mine)
I wonder how much this is news outlets overreacting to a proposed bill that is not actually that bad, or if this is some marketing against the bill by some Corp.
Suppose it’s used to verify your age when visiting Pornhub. How is Pornhub going to trust the user’s computer didn’t lie about the user’s age? A “just trust me bro” sent by the browser isn’t going to suffice; teenagers would find a way around that.
Thr attestation will have to be cryptographically signed by some trusted party—and that’s either going to be the government, or the operating system vendor.
If it’s the government holding the signing keys: the website can now verify that you’re a resident of $state in $country and use that for fingerprinting and targeted advertising. And what if your country doesn’t participate, or if Pornhub doesn’t trust the signing keys used by the government of Estonia? Tough shit, no porn for you! It would be impractical to manage all those keys, though, so why not instead leave it up to the operating system vendor?
If it is left the operating system vendor, it’s going to end up being exactly the same as Google Play Service’s SafetyNet “feature”. If you’re not using an approved operating system (a.k.a. Windows, MacOS, stock Android, iOS) you’re not using a banking app.
This bill is a poison pill for device ownership and FOSS operating systems being handed to corporations on a silver platter.
Just to clarify I am not for this law. I do not think that this should have been passed. But also the law seems to have some good intentions and I don’t want to jump to conclusions after just reading headlines.
It feels like the law makers want to standardize and restrict how this age verification works without actually providing any guidance whatsoever on how to implement such a system.
I’m curious to see what systems companies come up with and what major flaws they will have (intentional or not) that data collectors will exploit.
It does however require that OS providers “Send only the minimum amount of information necessary to comply with this title and shall not share the digital signal information with a third party for a purpose not required by this title.” (emphasis mine)
I wonder how much this is news outlets overreacting to a proposed bill that is not actually that bad
What do you mean, that’s horrible on its own. None of this information should be necessary to run a computer. The computer shouldn’t have to process this locally, let alone be mandated to upload it to someone’s server.
No shit. I don’t understand how anyone falls for this.
Also them using stuff like ‘online safety’ and ‘child safety’ in their legal titles needs to be used against them. Remember: Right-wing people NEVER use the words you want them to use, they always use their own. When copyright laws in the 90s were being reformed, many copyright/entertainment lawyers derided the laws by referring to them as the ‘Mickey Mouse copyright act’ because of Disney’s massive hand in how they were written and how they disproportionately benefited them.
Call it for what it is. Call it the survellience act, call it the child endangerment act, call it the transgender discrimination act. Don’t fucking fall for their ‘oh so you want anyone to groom children online’ talk through them, not to them. That is what they do to us anyway.
I fully agree. None of this should be required to operate a computer. We should focus on the parents that give their children free range of the internet without teaching them anything and the school ciriculum which is lacking in this department as well.
To me it feels like the lawmakers have some good intentions with this law, but it was rushed through so quickly that they forgot to ask themselves how this actually would be applied and who they are actually trying to protect.
This actually speaks to one of the concerning things about this law. There is a section forbidding developers from collecting additional information (unless they have confident information that your age is incorrect). But there is no such clause for OS providers.
Developers shall not “Request more information from an operating system provider or a covered application store than the minimum amount of information necessary to comply with this title.”
Or
“Share the signal with a third party for a purpose not required by this title.”
This means that discord could not collect IDs or face scans without confidence that your age is incorrect. But windows can still require whatever they want.
But I guess silver lining is that neither of them can sell or even share the data with 3rd parties. Pretty minimal silver lining though.
What it does say is operating system providers shall “Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device”.
It saddens me that someone who is willing to stand so strongly against a oppressive law would work to discourage discussion about those laws on free social platforms.
I hope you can consider your words next time and we can enter into a good faith discussion over the merits and demerits of any law.
That’s a really good point. It feels like they intended for that to be up to OS providers to determine. But really that was the lawmakers’ job to define. My assumption is that this law was rushed.
Or just use real CSAM from their own private collection and place it on your machine. Or even make a deepfake using your face pasted on theirs and those of your children or young relatives or random kids pasted onto the children. If you point out that this is a deepfake and you have the technical knowledge to prove it, they will use that as proof that you are actually trying to frame THEM.
ArmchairAce1944@lemmy.ca 2 months ago
They don’t care. They want your face, retina, fingerprints, DNA. All for their LLMs and so they can sell you something else.
Also to blackmail you later if they think they can or just feel like it… because they will put all that shit on an insecure server and some 13 year old hacker in Turkmenistan will leak it and make a killing (literally and figuratively) with it.
Archr@lemmy.world 2 months ago
FYI, I am not a lawyer.
Have you actually read the bill itself? Nowhere in it does it mention any of the things that you mentioned. It doesn’t even mention ID cards at all.
What it does say is operating system providers shall “Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device”. What we should look out for is that the law does not forbid OS providers from requiring IDs.
It does however require that OS providers “Send only the minimum amount of information necessary to comply with this title and shall not share the digital signal information with a third party for a purpose not required by this title.” (emphasis mine)
I wonder how much this is news outlets overreacting to a proposed bill that is not actually that bad, or if this is some marketing against the bill by some Corp.
…legislature.ca.gov/…/billTextClient.xhtml?bill_i…
pivot_root@lemmy.world 2 months ago
No, it is bad.
Suppose it’s used to verify your age when visiting Pornhub. How is Pornhub going to trust the user’s computer didn’t lie about the user’s age? A “just trust me bro” sent by the browser isn’t going to suffice; teenagers would find a way around that.
Thr attestation will have to be cryptographically signed by some trusted party—and that’s either going to be the government, or the operating system vendor.
If it’s the government holding the signing keys: the website can now verify that you’re a resident of $state in $country and use that for fingerprinting and targeted advertising. And what if your country doesn’t participate, or if Pornhub doesn’t trust the signing keys used by the government of Estonia? Tough shit, no porn for you! It would be impractical to manage all those keys, though, so why not instead leave it up to the operating system vendor?
If it is left the operating system vendor, it’s going to end up being exactly the same as Google Play Service’s SafetyNet “feature”. If you’re not using an approved operating system (a.k.a. Windows, MacOS, stock Android, iOS) you’re not using a banking app.
This bill is a poison pill for device ownership and FOSS operating systems being handed to corporations on a silver platter.
Archr@lemmy.world 2 months ago
Totally a valid point.
Just to clarify I am not for this law. I do not think that this should have been passed. But also the law seems to have some good intentions and I don’t want to jump to conclusions after just reading headlines.
It feels like the law makers want to standardize and restrict how this age verification works without actually providing any guidance whatsoever on how to implement such a system.
I’m curious to see what systems companies come up with and what major flaws they will have (intentional or not) that data collectors will exploit.
XLE@piefed.social 2 months ago
What do you mean, that’s horrible on its own. None of this information should be necessary to run a computer. The computer shouldn’t have to process this locally, let alone be mandated to upload it to someone’s server.
ArmchairAce1944@lemmy.ca 2 months ago
No shit. I don’t understand how anyone falls for this.
Also them using stuff like ‘online safety’ and ‘child safety’ in their legal titles needs to be used against them. Remember: Right-wing people NEVER use the words you want them to use, they always use their own. When copyright laws in the 90s were being reformed, many copyright/entertainment lawyers derided the laws by referring to them as the ‘Mickey Mouse copyright act’ because of Disney’s massive hand in how they were written and how they disproportionately benefited them.
Call it for what it is. Call it the survellience act, call it the child endangerment act, call it the transgender discrimination act. Don’t fucking fall for their ‘oh so you want anyone to groom children online’ talk through them, not to them. That is what they do to us anyway.
Archr@lemmy.world 2 months ago
I fully agree. None of this should be required to operate a computer. We should focus on the parents that give their children free range of the internet without teaching them anything and the school ciriculum which is lacking in this department as well.
To me it feels like the lawmakers have some good intentions with this law, but it was rushed through so quickly that they forgot to ask themselves how this actually would be applied and who they are actually trying to protect.
LordCrom@lemmy.world 2 months ago
So everyone’s windows OS will be registered to Mike Hunt born 1/1/1970. Gotcha
Archr@lemmy.world 2 months ago
This actually speaks to one of the concerning things about this law. There is a section forbidding developers from collecting additional information (unless they have confident information that your age is incorrect). But there is no such clause for OS providers.
Developers shall not “Request more information from an operating system provider or a covered application store than the minimum amount of information necessary to comply with this title.”
Or
“Share the signal with a third party for a purpose not required by this title.”
This means that discord could not collect IDs or face scans without confidence that your age is incorrect. But windows can still require whatever they want.
But I guess silver lining is that neither of them can sell or even share the data with 3rd parties. Pretty minimal silver lining though.
PowerCrazy@lemmy.ml 2 months ago
How about “fuck off.”
Archr@lemmy.world 2 months ago
It saddens me that someone who is willing to stand so strongly against a oppressive law would work to discourage discussion about those laws on free social platforms.
I hope you can consider your words next time and we can enter into a good faith discussion over the merits and demerits of any law.
WesternInfidels@feddit.online 2 months ago
I’ve only skimmed but:
They don’t even define “account.” They have a definition of “account holder” that makes no sense.
Are all devices required to have user accounts? There was a time when home computers did not have such things.
Archr@lemmy.world 2 months ago
That’s a really good point. It feels like they intended for that to be up to OS providers to determine. But really that was the lawmakers’ job to define. My assumption is that this law was rushed.
Eryn6844@piefed.blahaj.zone 2 months ago
wrose yet blackmail you with their ai created child pron.
ArmchairAce1944@lemmy.ca 2 months ago
Or just use real CSAM from their own private collection and place it on your machine. Or even make a deepfake using your face pasted on theirs and those of your children or young relatives or random kids pasted onto the children. If you point out that this is a deepfake and you have the technical knowledge to prove it, they will use that as proof that you are actually trying to frame THEM.