The California law is actually the best form of age verification one can imagine. It only requires the OS to let the user to 'signal' their age. In other words, it's more like a checkbox asking if you're older than 18, instead of scanning your face or driving license. It doesn't require a cloud account either. Storing the ages the user inputted in /etc/ages besides /etc/passed and providing an API to read it is compliance.
How is it so bad that we need some civil disobedience movement over it? On the contrary to, UK's Online Safety Act and China asking all online platforms to verify your phone number?
Just because it's easy doesn't mean it's right. Give legislative busybodies the ability to force this little flag into the OS because it's no big deal, and next year they'll say "hey, make sure you only report 18+ if secure boot is enabled" and 5 years later it'll be "hey, you can only report 18+ if one of our Identity Partners has confirmed it."
It's the principle of the matter. The State should not be allowed to compel speech (what code you write) in your open source project. It may sound stubborn but if we don't fight it now it will only grow little by "easy feature" little.
I want to agree with you, but if it's my system and my browser reporting my bracket, wouldn't it be trivially easy to inject an http-header with the age I want to report?
And by "trivially easy" I mean "somebody already posted how-to for windows to stackoverflow"
You're trivializing how difficult tampering with OS internals in locked down secure boot environments can be. Just look at the state of Android custom roms. Devices that are years old can be impossible to modify the OS on.
Look at projects like byeDPI. Essentially, it's just a VPN service that runs on the phone itself.
You phone connection is passed to this VPN that modifies http-headers.
I kinda did forgot about Android, yeah. You can't exactly rewrite OS rules there. But it's no less trivial* on Android, you just have to solve it from different angle.
* assuming someone will just write the app, and share it. But since similar projects exist, it wouldn't be a reach to say that it's doable and some folks would be interested to do it.
The problem is not that it's hard to cheat (it's easy), the problem is it makes you officially a liar and liable for "illegal app use".
It might not be a problem for you, but some underage kid, who lied about their age, gets addicted to a game with in-game purchases and gets into financial trouble now has no recourse against the company who made the addicting game.
There's no liability in the law for a child who uses an over-18-signaled account and accesses over-18 content, nor for a parent who gave that account to the child. It's all the parent's decision if the child should be restricted or not.
I'm not a lawyer, but it's clear that this changes the narrative. If some technical restriction is in place (OS level age statement with apps who enforce it) and the kid circumvents that, it's easy for a company to claim that they did their part and all blame is on the kid. Without that, it's trickier for the company who intentionally created some addictive product to prove that they did enough to protect the kid.
You see a slippery slope and I see a reasonable compromise. It's a wildly popular opinion that we should control which age groups can use social media[0][1][2]. Do you think these polls are astroturfed? If not, it's clear people want some sort of age verification, and I think California's way is the least intrusive.
And I know someone is going to say 'then we should regulate social media sites to force them to verify the users' ages...' no god please no. Normalizing cloud-based age verification is far, far worse than AB 1043. If there is a principle to be set that should be: cloud should trust local, not vice versa.
People, generally, have no grasp of what they really want or what downstream effects of what they think they want look like. They don't know what it would take to effect that ban. In fact, I would speculate that if the same group were asked "should you, personally, have to scan your ID to visit Facebook," you'd see a meaningful shift in responses. (yes, I know that's not the way this particular CA proposal would be implemented, the point is that people are fickle and polls are not a good guide for lawmaking)
I also don't base my principles on the desires of the masses. It's our duty as people who understand the technology to prevent the controversy-de-jour from wagging our dog.
I share your feeling that if everyone did it this way and the world promised to stop making bad, privacy-invading ID laws I could grin and bear it. I don't see that happening, thus I am hostile to it in any flavor.
> They don't know what it would take to effect that ban.
Exactly. This is why if there is no some less evil way to appease these stupid people we'll go all the way straight to the evilest way. Stupid and uninformed people do actually vote.
I'm curious what a poll of public opinion would say about certain demographics in 1930's Germany. Does that seem like a good argument for what the government should and shouldn't do?
A reasonable compromise? With who? Who here is somehow required to "compromise"?
I think the bigger factor there is that it requires apps to use that, which preempts things like Discord sharing info with Peter Thiel in the name of age verification.
Because people don't have real power, it's all indirect through politicians who are manipulated or paid by professionals.
Democracy should be direct and the gating function shouldn't be age but a test of intelligence, logical reasoning, general knowledge and ability to detect manipulation.
1) Do they really? I honestly don't know, are there independent polls about this?
2) What makes them think they have any right to decide for other people's children? I would be OK with them genuinely thinking they need to surveil their own children but if 1) is true then there is this underlying need of people to control others and I am not OK with that. This is how minorities are suppressed and harassed - same mechanism, different target.
How is it so bad that we need some civil disobedience movement over it? On the contrary to, UK's Online Safety Act and China asking all online platforms to verify your phone number?