My previous employer used twohat to monitor for content dangerous to underage users, but I don't know if they were any good as it's not my area. It looks like they got bought by Microsoft as twohat.com redirects to a Microsoft product page now
The whole thing is just moralistic BS anyway. I'm sure most kids can figure out how to use a VPN better than adults.
A Virtual Private Network is a private network such as a Local Area Network created virtually on a Wide Area Network such as the internet. Tailscale, SoftEther, or Hamachi for the old boys are examples of VPN implementations.
A proxy is a server that accepts and forwards traffic from clients through it, lending its IP address to clients as the traffic origin if desired.
A proxy can exist in a private network, but it is not a requirement.
I suspect the root of the problem is that over time, "proxy" has become strongly associated with application-layer protocols like HTTP, and after that shift it wasn't obvious what to use for something lower-level that encompassed a wider range of protocols/endpoints/conversations. In principle, "tunnel" would probably have been better (and a legible metaphor to boot), but that's just not how things shook out in practice.
That is, does the ISP have access to the information that's being accessed via the proxy?
It was my understanding that proxies tending to mask where a request came from but does nothing significant with the data between it and the requester.
VPNs are better (as in more ergonomic) in practice, since large sites tend to block access from known hosting providers (looking at YouTube not rendering video when accessed from a Hetzner server).
It could, but it's not a hard requirement. A proxy server is just like any other server, encrypting the data en route is as desired.
A VPN encrypts data as a part of securing tunnels, but it's not a hard requirement there either. As long as two computers can communicate over private IP address ranges on a WAN, it's a VPN. The Private in VPN indicates the scope of the network, not whether any data within is immediately accessible.
See also: "Private" and "Public" IP address ranges.
>does the ISP have access to the information that's being accessed via the proxy?
The ISP providing internet to the proxy server will know what the proxy server requests and receives.
>It was my understanding that proxies tending to mask where a request came from but does nothing significant with the data between it and the requester.
Correct. Again, whether the data a proxy server receives and forwards was encrypted is tangential to the task of forwarding data.
First, system that forwards traffic behind its own IP address is called proxy if it works on application level, and NAT if it works on IP level. So we have socks proxy, but home router with NAT.
Second, VPN is just a fancy name for an overlay network over WAN. Overlay network is overlay network even if it only contains two nodes - your host and a remote router providing internet access.
I do not have direct experience with these VPN services, but i would guess they work on IP level and not on application level. So they are just ISPs providing service through overlay network (VPN) instead of access network or physical network.
Just google "VPN" or "How do I access Pornhub in Alabama?" All of the results refer to "VPNs" as I was using the term.
Yes, and that is exactly why Morality in Media (the right-wing, evangelical group behind these laws) has been proposing them. Their goal is to outlaw pornography (and other "immoral" content) on the internet by making it so difficult to access or provide legally that nobody will bother.
> I'm sure most kids can figure out how to use a VPN better than adults.
You're making the mistake of assuming their goal is to prevent kids from being able to access pornography. It is not. Their goal is to make it so financially impractical to run any service that publishes (or allows people to publish) pornography, LGBTQ content, or anything that they deem "immoral" that nobody even tries. And it's working: many services which used to allow that content before 2017 no longer do, and it is much, much more expensive (and difficult) for the remaining folks to find platforms or hosting providers to continue to do so.
I'm referring to one of several groups that is behind a specific campaign in the US. That doesn't mean that there aren't other efforts to curtail this in other countries or globally.
As mentioned elsewhere, there's a law that's about to go into effect in the UK which is actually way broader and draconian than any that has been passed anywhere in the US. There are more in other countries too.
> There would still exist a huge pornography industry globally, particularly within the EU, that would serve the US even if these groups achieved every goal.
And yet, when Tumblr and Imgur and Reddit[0] banned pornography, no EU-based competitor emerged to take their place.
[0] Reddit's ban wasn't a total ban, but it was enough to effectively shut down many groups (which was the goal).
> These bills didn’t originate from some evangelical PAC or conservative think tank. Their actual origin was, ironically, The Howard Stern Show. [0]
While it seems like everyone has overwhelmingly sided against free speech advocates (ACLU) and porn sites, there are some interesting points about access/addiction. I'm less impressed if it's purely evangelical driven (at least now), but I'm sympathetic to arguments about access for minors (or their ability to post under-age content). I don't have the answer.
[0] https://www.politico.com/news/magazine/2023/08/08/age-law-on...
As someone who's been following this for over a decade, I can assure you it is, in fact, what I expect.
That article is absolute nonsense, which you can tell by the fact that it claims the clock starts in 2021, when these bills have actually been introduced multiple times before then.
Furthermore, the article contradicts its own narrative, first claiming that a Howard Stern spot "started" it, then admitting two paragraphs later that the legislator was inspired by that radio show to contact... an anti-porn lobbyist that she had already known about for years. That's a really... interesting definition of "origin" that they're using.
I don't follow your point about contradiction.
How is contacting a single-issue ally (who's on the opposite end of the political spectrum at that -- and not a "GOP Think Tank" or "evangelical") changing the origin? The person she reached out to is a pro-abortion, radical feminist. That is strengthening the article's key conclusion by a lot. It's a surprising turn for an origin story.
[0] https://en.wikipedia.org/wiki/Age_verification_system#United...
Sure, they're major culprits but let's not let the left get off the hook entirely on promoting moralizing censorship of porn too. There are segments of it, especially those in certain feminist camps that hate pornography with a victorian near-evangelical level of scorn and they have a loud voice of their own under different flags and reasoning.
Meanwhile the organised and well-funded evangelicals and right-wingers ignore the constant stream of SA and CP convictions among youth pastors and other supposed moral authorities.
The stats don't necessarily prove that religious states consume more porn, but porn is an existential problem for evangelicals in a way that it isn't for most progressives.
The culture of over-reaction to danger that has taken over the political domain is creating a nanny state where it's impossible to avoid crosssing red lines and doing something wrong. It's paralyzing society by instilling inaction as the only safe path.
Parents give their kids access to guns and we all know how that ends. If we can't hold parents accountable for their children's violence, I seriously doubt we can do anything about parents failing to parent their kids on this topic.
What are we going to do? throw the single mom with 2 jobs and 5 kids in jail because she didn't pay $20/mo for parental controls on her kids devices?
If she wants to have children out of wedlock or with a man who are not financially capable of being a provider, then she and her children should bear the consequences of that, not everyone else who know has to have government take over the internet and mandates identity disclosures for perusing adult content.
Kids that discovered porn at an early age will not understand how to process it properly and this will impact their relationships in the future. It is their future partners that suffer along with the kids and family.
If the kid is living with single-income grandma, b/c parents passed. Do we throw grandma in jail for not blocking the content properly?
Unless you never let your child near any slightly older child with a phone, you as a parent cannot individually control this.
> The culture of over-reaction to danger
Which is it? Is it that parents haven't protected their children enough, or that children don't need protection from watching pornography?
...are you implying kids are having group jerkoff / porn sessions? Seems like a pretty absurd claim.
Also, on your second point, you seem to be almost strawmanning -- I see no claim from the person you're replying to that they think kids need more protection.
They're stating that parents are actively giving their kids devices, and have a lot of tools to restrict usage of those devices. Whether they literally limit physical access, oversee use, or install filtering software, there's a lot that can be done to restrict access in an authoritarian manner to those kids, and exclusively within the household without having to affect and restrict the overwhelming majority of society: grown adults.
(I also personally believe education is more important than any sort of restriction, and am always against censorship or surveillance policies in general. I definitely agree with them on but I'm trying to mostly restrict my post to what that person almost definitely had in mind, rather than soapboxing my own views).
> ...are you implying kids are having group jerkoff / porn sessions? Seems like a pretty absurd claim.
Pre-internet, there was a fairly common trope of a kid discovering a dirty magazine, often hidden in the home by an older sibling, and showing it to their friends. Nothing actually happening, they were just sharing the images. GP seemed to just be suggesting that updated for the internet age.
Just anything. Beheading videos. Whatever. I can't imagine anyone not realising this is a virtual certainty for some older kids to show younger kids.
> I see no claim from the person you're replying to that they think kids need more protection.
They called it "danger".
> there's a lot that can be done to restrict access in an authoritarian manner to those kids
But not to their kids' friends' older siblings. If you're not talking about that then I don't think you're particularly replying to my comment.
> I also personally believe education is more important than any sort of restriction, and am always against censorship or surveillance policies in general.
I think in this case this fights against the idea that some concepts or experiences are not appropriate for certain ages, and some of them are not currently curatable by parents in a way that they always have been throughout history.
You have to not let your child near any older child with a non-child-safe phone. This is the parents' responsibility.
Does this really even work? The law isn't "if the user's ip address appears to be from this state, then you must require id".
Properly enforcing georestrictions like this costs money and destroys businesses, but that is kinda the point.
2/ request GPS location from the device.
3/ request WiFi location from the device.
4/ require billing address to be out of state. (States collect sales tax based on billing address, not where the service or product is bought. So I think this is fair.)
1/ if the company can’t meet the regulations, it can’t exist.
2/ if there is wiggle room of “as long as you tried your best, then it’s ok”, then requesting gps location, nearby wifi nodes, and banning traffic from data centers, then that would be better.
Slightly aside, if you filter like this for any reason it is safer to check that the request is NOT coming from some other location – that way your main failure mode is accidentally screening someone in a state you don't need to, not accidentally letting someone in that you could face legal action for, though this is a harder check to make.
The blocked people that use VPNs may well appear to be coming from a non-US location too which probably makes the denial slightly safer.
I wonder why trusted third parties haven't sprung up around this very concept to the degree of OIDC (it's almost everywhere), you could have companies that allow uniquely identifying people, without having to manage or even get their PII directly.
Service wants to check age or whether user is banned --> they are redirected to some-identity-platform.com where they can deal with any ID documents and other PII --> some-identity-platform.com gives back a token and a UUID, so all the service really needs is a JSON object with the UUID and whether user is of age (if that was in scope).
That service can also let the user granularly choose what information to return: just the UUID, whether they're of age, or specific data like where they're located, actual PII if needed (e.g. auth with govt. site) etc., the UUIDs could also be service specific, so they cannot be cross referenced across different sites in case of leaks.
Things a bit like that exist, for example here's a few random ones:
https://www.jumio.com/
https://aws.amazon.com/rekognition/identity-verification/
https://www.veriff.com/
https://www.yoti.com/
https://ondato.com/
Assuming services play nice. What if they start sharing UUIDs amongst each other, for example for advertising purposes?
Worse what is stopping companies from creating both service and verifier? Nothing, as Amazon already has both. I do not trust them not to abuse this.
And even if in theory all companies do the respect my privacy. I am one government away, from seeing a law passed, that makes it mandatory to report all UUIDs to the government. The potential for tracking is off the charts.
Right now it takes forever to trace everything. You can realistically only do it for a select targets. If you implement this UUID system, suddenly it becomes much easier to trace everyone's actions.
The problem is that, at least at the moment, simply obtaining a credential like this has a huge chilling effect. You need to mail stuff into some crummy company chosen by the government, which then processes it and takes time. That company might be breached, which identifies you as "a person who is specifically interested in accessing adult content." Many of these problems can theoretically be fixed, but fixing them would have to be the goal of the authorities -- and I suspect it is not.
Or at more risk, a person interested in trans content.
That may mean users identifying themselves, which seems dangerous. (It should not at all be dangerous, but it is.) All you need is some phobic government official to sue or investigate you, for any reason they can come up with, and demand all your records as part of their lawsuit/investigation.
Perhaps there's a way to do age verification while minimizing privacy risks? For example, verify their age, give them their credentials, then delete the PII? I don't know if that would suffice if your age verification practices were challenged.
(Talk to an expert.)