Steve Gibson (125:43)
Wow. Okay, we have one more sponsor to get to, but let's do that in a. In a bit. I'll get into this EU online age verification, and we'll. We'll take a break when there's was a good point to do it. Good, good. Okay, so I'm sure that everyone who's been listening to the podcast for the past few years, and especially the past few months, will be well aware that of my extreme interest in, and perhaps even a preoccupation with, solving the problem of online Internet age verification, as we know, I was interested enough in the somewhat related problem of online Internet identity authentication to have spent seven valuable years of my life developing a solution and solving the problem. While online age verification and identity authentication are somewhat related, the problem of age verification also brings along some trickier bits. In the case of identity authentication, it's not one's actual identity that's being authenticated. What it actually is is the ability to later prove that you have returned that you are the same anonymous identity that you previously established with a remote website. To accomplish that, there's no need to ever rely upon what I would call an identity anchor. If we use the original username and password authentication, we're simply saying somebody is returned who knows the username and password secrets that were previously established. Thus, you should assume that it's the same individual. And when we used either squirrel, the system I designed, or Passkeys, the system that the industry has adopted, we're simply saying, here's a public key for which I have the private key. Now, and at any point in the future, I will sign any unique random challenge you might send me to prove to you that I continue to hold that public keys matching private key. In other words, at no point are we asserting anything beyond the fact that we have returned. So even just the term age verification indicates that it's something more. The user has a property. I'm sorry, has a properly operating age verification system. Sorry, the user of a pro. Too much coffee. The user of a properly operating age verification system need not ever have visited a site before. So it's not about having returned to the site the first time. Such a user visits any site that wishes to verify that they are of at least a certain age, such a system should be able to challenge them to prove they are above a certain age. At or above a certain age, the user should see, you know, some sort of challenge pop up on their client and then elect to permit their Internet client to assert the truth of that minimum age assertion on their behalf, but only if that assertion is actually true for them. And that's the tricky bit. Any age verification system must be very tightly bound to them, to their real world physical identity. This is another way in which it differs from any fully anonymous Internet authentication system. If we choose to, we could give a friend our username and password, our one time password token, or even our passkey. In other words, traditional Internet identity associations are transferable because they are not intrinsically about us. They're only about the the reassertion of the possession of some secret a secret that could be shared with anyone else, as Netflix has found out. So to my mind, the biggest challenge to solving this problem was will not be technology. As I've noted, all the technological pieces for solving this problem already exist and have for quite some time and they can be deployed without much trouble. The challenge will be the establishment of a true identity anchor, the linking between the age verifying technology and the user's true real world age okay, so let's take a look at some news to see what's been going on and where the world stands. Because I found out something I didn't know. So the first thing was a piece of news about Brazil. Under their headline Brazil enacts Sweeping Bill requiring Online Age Verification Safeguards for Children's Data, the Record informs us that Brazil has joined the UK because of course the UK has also just done this, the Record writes. Brazilian President Luis Ignacio Lula da Silva on Wednesday signed a law requiring digital service providers to verify the ages of users and adhere to strict new data protection and privacy requirements for for children and adolescents. Brazil's digital ECA mandates that tech companies take reasonable measures is the term in the legislation to block young users from accessing content which features violence, pornography, sexual exploitation, drugs or gambling, as well as content that encourages self harm. The law requires that reliable age verification mechanisms be used to ensure users of digital services containing inappropriate content are over age 18. Self declaration this is another key term now. Self declaration is no longer adequate as part of the law. It also orders that tech companies set up a parental supervision mechanism to ensure parents can limit and manage the use of the service, the content accessed, and the processing of personal data carried out. Platforms also cannot process children's personal data in a way that violates their privacy or use their data for targeted advertising. The measure, which overhauls a 1990 law, will take effect in March. Okay, so we have six months before this goes into effect. Human Rights Watch Organization wrote in a prepared statement. Brazil has stepped forward as the first country in Latin America to pass a dedicated law to protect children's online privacy and safety. In June of 2024, Human Rights Watch reported that personal photos belonging to Brazilian children were used to create artificial intelligence systems which were to turned into deep fakes of other children being abused. Yuck. Okay, so this news that Brazil had joined the UK in legislating that self declaration of one's age would no longer be sufficient. And you know, one has to wonder what the legislators who passed this new law imagined would happen. Six months from now, websites peddling violence, pornography, sexual exploitation, drugs or gambling will face fines of up to 900. I'm sorry, not US$9.44 million at some crazy number of, of Brazilian currency or up to 10% of their annual Brazilian revenue if they do not present prevent underage children from accessing their adult content. So in other words, what we're seeing now increasingly is that the laws that have long applied only in the physical world, not in cyberspace, are finally starting to be applied to both commercial and free online services within the cyber realm. And when these laws are tested, with appeals to courts having final say jurisdiction, they're being upheld under the theory that the greater good will be served by them. And at least in the U.S. you know, we've also seen that requiring mature citizens to prove their physical age by divulging their real world identity is regarded as not unduly birth burdensome. Brazil's passing of this legislation last week, while bragging that it was the first Latin American country to protect the children, got me wondering what the W3C might be doing to get an acceptable solution into the hands of the world's web browsers and websites. Since we need standards more than anything else. I mean there are lots of random ad hoc solutions. If you go over to the app store or on an iPhone and put in age verification, you get a bunch of apps. But we need a standard, one single standard. We can't have a, a, a, any kind of a fragmented solution. So as it happens, I found a page at the W3C with a headline upcoming IAB W3C workshop on Age Based Restrictions on Content Access. The page which was posted in the middle of July says W3C announced today the IAB W3C Workshop on Age Based Restrictions on Content Access 7 through 9 of October 2025 in London UK which is exactly two weeks from today, there will be a workshop with that title held. The announcement says the following. They wrote the Internet Architecture Board, that's the IAB, and the World Wide Web consortium, the W3C, are convening a workshop to examine the technical and architectural implications of different approaches to implementing age based restrictions on access to online content. The young are often unprepared for the sorts of things they might find online. Maturity, education and the guidance of responsible adults can help children navigate online interactions, but age is often regarded as the best indicator of how able a person is to cope with exposure to content. Increasing interest is being shown, I'll say, in the implementation of regulation that restricts what content young people can access online. A recurring theme in these efforts is that it is no longer considered sufficient to rely on self assertions of age. A number of jurisdictions have enacted or are in the process of enacting laws that take steps to provide stronger guarantees that children are not expressing exposed to certain content. This workshop seeks to perform a thorough examination of the technical and architectural choices that are involved in solutions for age based restrictions on access to content. We do not expect to identify a single candidate solution, even if that might be an ideal outcome. The goal is to build a shared understanding of the properties of various proposed approaches. In other words, bureaucracy. Great, they said. In general, access restrictions are achieved by selectively blocking or filtering. RFC7754 Technical considerations for Internet Service Blocking and Filtering provides a more general framework for how to think about restrictions on on communications. This workshop will build on that work. In particular, it will seek to examine the specific technical considerations that apply when content is legally accessed by some people and restricted for others based primarily on their age. Individuals interested in participating in this activity can indicate their interest in by submitting a short position paper. Position papers do not represent either the ietf or the W3C. In some cases, an expression of interest is sufficient. Topics of interest, as identified by the Program Committee include surveys of the common features of regulation on age restrictions analysis of the technical requirements that might apply identification of other key factors to consider in the design of a technical architecture, including but not limited to privacy equity of access market dynamics such as centralization, vulnerability to circumvention, cost, accuracy, jurisdiction, geolocation, and censorship details of possible architectural architectures, whether in whole or in part, for determining the age of people for identifying content that might need to be restricted for controlling access to identified content comparisons of different technical architectures examination of how technical architectures might interface with or rely upon regulation or other governance structures feasibility of different approaches and exploration of the ramifications of choosing different technical architectures. Okay, now reading through that, on one hand I become somewhat disheartened since this is, you know, a W C, a W3C group that will be the group that needs to produce the standards that we are right now, this very moment in desperate need of having today. Yet they still appear to be quite a long ways away from even having a rough working specification of anything. On the other hand, it looks like there may be a more far sighted approach here. Like maybe a user tells it like proves to their browser that they are of a certain age and then the browser in a secure means has a way of transmitting that at the initial communication with a website stage so that the, the Internet itself is filtered by their browser that now knows how old they are. So that's a horse of a different color as we might say in not a matter of replacing the yes, I'm 18 button with some sort of interaction. It's literally a way of profiling the Internet based on the proven age of a browser's user, which is way more farsighted than the solutions that anyone is talking about today. So on that hand I'm liking this approach. On the other hand we still need something now, so maybe that's round two, I don't know. Anyway, their announcement of the of this meeting ended by adding input on other relevant subjects is welcome. Papers that are submitted will be used in developing a workshop program. Position papers from those not able to attend the workshop are also encouraged. Submissions can be made by emailing papers to age Hyphen Workshop, pcab.org, participants concludes their choose their preferred format, blah blah, blah. So anyway, so position papers are being submitted. They did say that they would be publishing the papers, which is good because this is in person attendance in London, not over the Internet. It will not be broadcast or recorded, so it will only be by looking at the position papers afterwards and presumably some sort of summary of the meeting's results will be published that will get, we'll get some after the fact sense for what happened. So anyway, we're not going to get any code out of this. This is, you know, way like if we had our, you know, the, the wishes of any kind of system we could ever design or dream of, what would it look like? So the better news came from this which is that the EU itself appears to be somewhat ahead in this regard. They don't have this broad, sweeping, wonderful future vision approach that we may get someday from the W3C. They have something that they're deploying like now. Early last month Spain announced that it would be using the W3C's existing system known as verifiable credentials. And Leo, let's take our final break and we're going to talk about what is going on in Spain, in the EU with the W3C's existing verifiable credentials technology.
