My name is Jess. I build and manage servers for both work and fun. I also occasionally make music.

  • 1 Post
  • 238 Comments
Joined 1 year ago
cake
Cake day: December 3rd, 2024

help-circle











  • Clearly, no-one involved in making these laws has ever heard of OAuth. Not every single site needs to manage your identity / credentials. The government already has this info, they can be the identity provider and use OAuth to grant access to age-gated resources without giving any personal data to the platform. Someone mentioned id.me, and I’m pretty sure that’s how that platform works, though they’re a private entity if I understand their site correctly.

    I know most politicians are comically tech-illiterate, but it’s so frustrating to see them constantly implement terrible solutions to already solved problems without asking a single expert who knows how this shit works.

    That being said, California passed a bill with a not perfect, but better approach. User age is configured on the OS level when a user account is set up, and then it will tell platforms what age category the user belongs to, and nothing more:

    (a) An operating system provider shall do all of the following:

    (1) Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store.

    (2) Provide a developer who has requested a signal with respect to a particular user with a digital signal via a reasonably consistent real-time application programming interface that identifies, at a minimum, which of the following categories pertains to the user:

    (A) Under 13 years of age.

    (B) At least 13 years of age and under 16 years of age.

    © At least 16 years of age and under 18 years of age.

    (D) At least 18 years of age.

    (3) Send only the minimum amount of information necessary to comply with this title and shall not share the digital signal information with a third party for a purpose not required by this title.

    I think iOS already does this, actually.