Slashdot Mirror


Verisign Develops Token for Age Verification

FirstTimeCaller writes "A Reuters article is reporting that Verisign in conjunction with an unnamed children's safety group, will release a USB token that can be plugged into a PC to verify the age and gender of a person participating in online chat rooms. According to the article, the token will be available free to students in a handful of schools this fall. School administrators will provide a list of students, with their ages and genders, and VeriSign will encode that information onto the tokens."

37 of 417 comments (clear)

  1. If it's just to verify "age and gender" . . . by acceleriter · · Score: 4, Insightful

    . . . why is there a "list of students" involved? And seriously, do they not know these tokens are lent? Either this is an insidious attempt at a pilot of some sort of "internet ID" or a completely dumb idea.

    --

    CEE5210S The signal SIGHUP was received.

    1. Re:If it's just to verify "age and gender" . . . by MemRaven · · Score: 4, Insightful
      Really? It seems like an ideal way to pose in a "safe" chat room. You just borrow/steal/abscond-with/buy the token from someone who matches the profile that you want to emulate (i.e. you steal it from your 6 year old neice, or just take it when she's not looking and replace it before she can misplace it).

      If we've learned nothing else from social attacks, it's that a misplaced sense of security can actually be worse than a lack of security at all. If you think that authentication is working, you're less on your guard (and more trusting) that you would be if you thought that it definitely wasn't working. If the system is that easy to foul up, it's thus worse than no authentication at all.

      Now if it was 2 or 3 factor authentication (i.e. in order for the token to work you have to do a fingerprint and PIN check) then it's a different story. If it's just a dongle, it's pretty worthless.

    2. Re:If it's just to verify "age and gender" . . . by zoeblade · · Score: 4, Insightful

      Either this is an insidious attempt at a pilot of some sort of "internet ID" or a completely dumb idea.

      More than likely, it's both.

    3. Re:If it's just to verify "age and gender" . . . by aonaran · · Score: 4, Interesting

      The point I was trying to make (I realize it didn't come across very clearly) is that they are doing this all wrong. They should only have to provide a count of how many keys of each type they need and V provides them with X keys for 6 yearold males, etc. But it sounds more like they are taking the other approach and using a key with a unique id that links to a database of name age and gender.

      The former would do what they seem to want without giving out unnecessary amounts of data to verisign, but the latter is VERY dangerous indeed.

      What's to stop this unique ID from being used to collect all kinds of data on the children? who controlls the servers that do the authentication? if it's the school it's not so big a deal if it's some other org (especially Verisign) I'd be very wary of it's use.

  2. Right... by The+One+KEA · · Score: 4, Insightful

    Who's going to run the betting pool on how many minutes it takes someone to crack the keys and modify the information?

    Better yet, how many kids will lose their tokens?

    Not to mention the possibility of the breaching of the privacy of minors.

    On paper this sounds like a good way to protect children, but somehow I think the execution of the idea is not going to be as easy as Verisign and Co. think it might be.

    --
    SCREW THE ADS! http://adblock.mozdev.org/ Proud user of teh Fox of Fire - Registered Linux User #289618
    1. Re:Right... by jrod2027 · · Score: 5, Insightful

      Or how about how long will it take for some pedeophile to get ahold of one of these tokens?
      Instead of relying on children to take their word of how old they claim to be, the kids could be fooled by a false sense of security with these IDs.

      Peodophile: I'm an 11 y/o kid honest... see my Verisign token proves it.
      Kid: Wow, you're right. Want to go hang out?

    2. Re:Right... by Maestro4k · · Score: 4, Informative
      • Better yet, how many kids will lose their tokens?
      Not at the same time of course, but I'd bet at least 50%. I work for a school system and just yesterday we had about 8 kids get on the wrong buses and another 5 or so who were new bus riders and didn't know where they lived exactly. If they can't remember things as important as which bus they ride and house they live in we certainly can't expect them to keep track of a small USB token.
      • Not to mention the possibility of the breaching of the privacy of minors.
      That's the first thing I thought of myself. I work with the bus routing software and when I need to send copies of my databases to the company who makes it to debug a problem I have to make a copy and go through and change all the names to John Doe. I also can't send the whole file since the addresses can't be masked for debugging purposes. How sending an entire list of your kids with names, age and gender to Verisign can be legal is beyond me. AFAIK that would require signed consent from every single parent/guardian for every kid.
      • On paper this sounds like a good way to protect children, but somehow I think the execution of the idea is not going to be as easy as Verisign and Co. think it might be.
      Well there's the beauty of it from Verisign's standpoint. They don't have to worry about the execution, they just provide the tokens and authorization servers. The school systems get to sort out the mess from lost/stolen keys and what not. It'll just end up overwhelming the poor staff with more paperwork and problems than they already have to deal with.
    3. Re:Right... by Delirium+Tremens · · Score: 4, Informative
      Who's going to run the betting pool on how many minutes it takes someone to crack the keys and modify the information?
      Please go ahead. Here is their public key:
      30 82 01 0a 02 82 01 01 00 dd 84 d4 b9 b4 f9 a7
      d8 f3 04 78 9c de 3d dc 6c 13 16 d9 7a dd 24 51
      66 c0 c7 26 59 0d ac 06 08 c2 94 d1 33 1f f0 83
      35 1f 6e 1b c8 de aa 6e 15 4e 54 27 ef c4 6d 1a
      ec 0b e3 0e f0 44 a5 57 c7 40 58 1e a3 47 1f 71
      ec 60 f6 6d 94 c8 18 39 ed fe 42 18 56 df e4 4c
      49 10 78 4e 01 76 35 63 12 36 dd 66 bc 01 04 36
      a3 55 68 d5 a2 36 09 ac ab 21 26 54 06 ad 3f ca
      14 e0 ac ca ad 06 1d 95 e2 f8 9d f1 e0 60 ff c2
      7f 75 2b 4c cc da fe 87 99 21 ea ba fe 3e 54 d7
      d2 59 78 db 3c 6e cf a0 13 00 1a b8 27 a1 e4 be
      67 96 ca a0 c5 b3 9c dd c9 75 9e eb 30 9a 5f a3
      cd d9 ae 78 19 3f 23 e9 5c db 29 bd ad 55 c8 1b
      54 8c 63 f6 e8 a6 ea c7 37 12 5c a3 29 1e 02 d9
      db 1f 3b b4 d7 0f 56 47 81 15 04 4a af 83 27 d1
      c5 58 88 c1 dd f6 aa a7 a3 18 da 68 aa 6d 11 51
      e1 bf 65 6b 9f 96 76 d1 3d 02 03 01 00 01
      Since I am a nice guy, I'll give you the first two hints to get you started. They use RSA. And their key length is 2048.
      Now, you can try to brute-force RSA to find their private key...

      See you back when Quantum Computers are sold at Wallmart :)

  3. Re:Credit card ? by Paleomacus · · Score: 5, Informative

    Well when I was 15(in 1996) I was able to get a debit card that could be used for 'adult' verification. Doesn't seem like a very good system to me.

  4. Re:Credit card ? by acceleriter · · Score: 5, Informative
    This is about making sure you're a kid, not that you're an adult. The theory is that it'll keep the pedophiles, who won't have the "I'm a kid" token, out of the elementary school "chat rooms."

    Besides the "problem" of pedophiles in "chat rooms" being completely overblown, this is probably just the precursor of some sort of infrastructure to eliminate anonymous browsing. And who wouldn't like a piece of selling a token for $20/year to anyone who wants to get any information from the Internet in 10 years?

    --

    CEE5210S The signal SIGHUP was received.

  5. Sending it to colleges? by P-Frank · · Score: 5, Funny

    Excellent! I figure by about noon tomorrow I'll download a patch that "officially" makes me a 16 year old girl.

  6. Man, a 13 year old could make a big profit by scythian · · Score: 5, Insightful

    Selling his or her token to some freak on ebay!

    --
    terpmotors.com
  7. Just what little tommy needs! by palad1 · · Score: 5, Insightful

    A personal x509.3 certificate and a crypto key.

    So when he's 21 he won't complain when the barcode on his forearm will be used to 'strenghten e-vote security'.

    Train them while they are still young, the older they get, the harder for you to teach them new tricks...

    Oh, wait, this only works with pkcs#11-enabled chat applications? I guess IRC will have to be outlawed then. You don't want untagged pedophile commies subverting little Tommy on IRC now, do you?

  8. Re:Oh noes! by Anonymous Coward · · Score: 5, Funny
    Baby, before I put my hot love stick into you, please insert your USB stick into my PocketPC for age verification.

    ~~~

  9. My rights as an anonymous online individual by mr.+mulder · · Score: 4, Interesting

    So, not only are students going to be forced to carry yet another form of ID, but they'll also have to give a third-party company (Verisign in this case) detailed personal information.

    What about student's rights - they have the right to enter chat rooms, etc.

    I can envision the next step - restricting web sites based upon age, then it will be restricting web pages based upon being a student, finally, just restricting overall.

    Luckily, we won't have to worry about this being a wide-spread problem - the system is too flawed to go very far; however, I feel for those that WILL be made to use it.

    Bottom line is that NOBODY should HAVE to use this system - somehow it should infringe upon their right to freedom of assembly. Albeit, a *virtual* assembly, it's an assembly!

  10. Re:Credit card ? by ninthwave · · Score: 5, Insightful

    And what kid wouldn't trade there cheap token for a chat room that they see as stupid to some grimy adult for something else?

    --
    I was thinking of the immortal words of Socrates, who said: "I drank what?" - Chris Knight (Val Kilmer)- Real Genius
  11. Re:Credit card ? by jmcmunn · · Score: 5, Insightful


    Yeah, because we all know that none of the pedophiles out there have kids of their own who might leave this key plugged in, or laying on the desk for dad/mom to use?

    This is dumb, this does about as much good as the pages before porn sites telling people to not enter if they are not 18. Big deal, a USB key that tells someone I am young. It'll be 2 days maximum until some geek gets ahold of one and then you can buy them online for $25 +S/H.

  12. www.isafe.org by way2trivial · · Score: 4, Informative

    see their site... they are the makers of the device

    --
    every day http://en.wikipedia.org/wiki/Special:Random
  13. Gender? by LordK2002 · · Score: 4, Insightful
    What on Earth has gender got to do with child safety?

    Clearly in some cases it might be necessary or desirable to prove your age, but unless the chatroom is supposed to be an online matchmaking service I fail to see what the presence of a Y chromosome has to do with anything.

    1. Re:Gender? by grahamm · · Score: 4, Insightful

      Maybe some areas might be gender specific. For example girls might find it easier to discuss things like the the changes to their bodies which happen at puberty if there are only other females present. The tokens could be used to only allows girls of the appropriate age (plus specific vetted adult female advisors) in the chatroom.

    2. Re:Gender? by figa · · Score: 4, Insightful
      How are advertisers going to narrowcast effectively if they don't know the gender of the kid? These keys are going to be a boon to target marketers. They'll be able to get the age, gender, school district, and past browsing history easily, and with a little cross-referencing, ethnicity and family income.

      Foucault would probably point out that technologies of control have always been inflicted on children first, always for their safety and well being. Verisign's obvious goal in this is to breed a generation of Internet users that are accustomed to using an ID with a computer. While this generation comes of age, Verisign will probably partner with Microsoft and legislators to make Verisign-issued IDs mandatory start a computer, first for children, then for the rest of us. It's not that far-fetched, and it ties in well with DRM.

      As for girls (or boys, for that matter) discussing their private lives online, a less cynical and profit/control motivated educator would explain that you just don't discuss those things online. Kids should understand that they are publishing when they're writing in a chat room, whether it's run by the school or Mattel, and anything you say can be stored, copied, and republished outside of the context you wrote it in. These keys would obviously not keep a malicious child from copying sensitive text from a gender "locked" discussion board, complete with IDs, and text messaging it to the rest of the class.

    3. Re:Gender? by jandrese · · Score: 4, Insightful

      Better yet, they shouldn't talk about that at all. I mean it's just gross, right? I don't know what all of those special interest chat groups (not cybersex people, cmon!) are for. I mean isn't this the sort of thing that is never spoken of? If people start getting too much information they might get ideas, and ideas aren't good for keeping people in line.

      One of the biggest strengths of the internet is the ability to discuss issues anonymously that you may be too embarrassed to discuss with your friends and family--friends and family who would be of no help anyway since they know just as much as you.

      --

      I read the internet for the articles.
  14. Re:Credit card ? by acceleriter · · Score: 4, Interesting

    I agree it's a dumb idea--but I think it's really a segue into some companies requiring these tokens for everyone who wants to do business with them. The Federal government, for example, has been trying to figure out for years a practial way to give each citizen a public key to be able to, for example, apply for Social Security benefits or file a FEMA claim online. But since the easiest place to put a public key, a National ID card, spawns (rightfully) mention of the Book of Revelation happens every time it's mentioned, USB keys could be an alternative.

    --

    CEE5210S The signal SIGHUP was received.

  15. Re:Credit card ? by oolon · · Score: 4, Informative

    I recon a pedophile would be able to buy a token off a kid of a small ammount of money, if you were 12 and someone offered you 200 bucks for a silly bit of plastic someone gave you... I think there would be many takers.

    The problem with all these ID shemes is aways tying the token to the right person until computers have mandated biometic id readers this is never going to work with remote computers.

    Personally I think the best solution if for parents to take an interest in what their children are up to rather than seeing the internet as a why to keep them quiet. Someone will aways slip though the net, the best way for children to be kept safe is education, they need to know people lie, cheat, steal, and there are bad people in the world who would not think twice about killing someone else.

    James

  16. Re:Credit card ? by russint · · Score: 4, Interesting

    Well, I can't get a credit card at all (20 years old) due to bad credit.

    Not a very good system.

    --
    ^^
  17. Re:Credit card ? by clifyt · · Score: 4, Insightful

    And now they are giving these things to much younger kids. Its a good way of giving allowance to kids without giving them cash that the bigger kids can steal -- or if they loose it, it can be canceled and the money protected....err...in theory because debits don't carry the same protection credit cards do, but most banks will try to give you close to the same.

    Beyond that, when I run a credit card, my business doesn't get to know if its a debit card or not. When I'm on the road, I use my business's debit card that doesn't look anything like the cheesy consumer debits that go out of their way to let the person swiping it know its not a real credit card regardless of the visa logo. For instance, while in North Carolina a few weeks ago, I handed over my personal debit card to rent a car -- rejected. I then give then the business one, accepted -- same bank -- same type of card -- different look.

    I'm convinced that the card companies don't tell anyone if its debit or credit and they have just compiled lists of acceptable CC Prefixes.

    So no, having a credit card these days means nothing because of as the parent indicated -- debit cards are everywhere and anyone can get them.

  18. Of course they give it away to the kids, its value by CFD339 · · Score: 4, Interesting

    is to adults. You can't prove you are an adult and thus entitled to something more by NOT having one of these.

    The goal to Verisign is obvious -- once they are widespread, you try to get first libraries and then other places to require the use of the "KEY" to use the system to prove your age. As an adult, you'd "need" one, and thus have to pay for it.

    Also, its a good first step toward a "universal" (as if) public key. Ideally, imagine something like the Post Office being able to assign a public/private key to you. That's what everyone wanted with these keychain java keyring things talked about in the 90's.

    Personally, I hate seeing verisign being given this contract, but I'm not sure someone shouldn't have it.

    I'd like to see a U.N. sponsored standard, with countries and or businesses able to register as registrars. The SSL key distribution system we have now works pretty well (if overly expensive).

    At a minimum, that same system applied to people as apposed to web server names would go a long way.

    Yes, I know all the usual issues apply -- how do you prove its YOU with the key, etc. Lots of discussion on that (which is off topic) and other things. Privacy? What about additional private certificate keys? Well, why not all those things.

    Personal ID should have a data component for public key.

    --
    The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln
  19. Re:Get lost Veribad. by goldspider · · Score: 4, Funny

    Use of Tired Cliches: Check!
    Arrogance: Check!
    Rightious Indignity: Check!
    Teen Angst: Check!
    Hip-Sounding Paranoia: Check!
    Rebellion Against "The Man": Check!

    Thank you for verifying your age. You are indeed a teenager as you claim.

    -Verisign

    --
    "Ask not what your country can do for you." --John F. Kennedy
  20. Re:Nothing is perfect! by Paleomacus · · Score: 5, Insightful

    We're not looking for flawless. It just seems that this system is completely broken.

    It's really not better than nothing at all. The illusion of safety can be more dangerous than being wary of threat.

  21. Re:Nothing is perfect! by jackb_guppy · · Score: 4, Interesting

    This is NOT a step in protecting anything.

    1) For a child to be protected, they MUST have the fob.

    2) They must use it on presribed machines with the right software.

    3) Some big brother is watching out for them.

    What this really is a step to personally "brand" everyone. Just like RFID in clothes or under the skin or the tatoos of Germany.

    Further you can only be "safe", if you are willing to "pay" for it, including tracking every one of your habits on net.

  22. COPPA anyone? by YrWrstNtmr · · Score: 4, Insightful
    Children's Online Privacy protection Act of 1998

    It's not the school administrators information to give away. This information must go through the parent.

  23. Re:Credit card ? by RWerp · · Score: 4, Interesting

    Besides the "problem" of pedophiles in "chat rooms" being completely overblown

    You're right. Most pedophiles attack children they know: their own, their family's children or their neighours.

    --
    "Long run is a misleading guide to current affairs. In the long run we are all dead." (John Maynard Keynes)
  24. There's already a device that protects children. by Jack_Frost · · Score: 4, Insightful

    I think they're called "Parents."

  25. Re:Credit card ? by Lumpy · · Score: 4, Informative

    The theory is that it'll keep the pedophiles, who won't have the "I'm a kid" token, out of the elementary school "chat rooms."

    it will take exactly 3 seconds for these toatart appearing on the black market and sold to those sicko's.

    as for the "pedophile problem in chat rooms" being overblown... My daughter hang's on a couple of websites/chatrooms that are pure kid, and LITTLE kid related. while sitting there with her i nthe chat forum a sick-asshat that was asking her age, started asking her if she knew what a blow-job was, and asking other questions that made it obvious he was an adult.

    This is on the fricking NeoPets website. a site geared for little kids about a little kids toy.

    sorry, it is a big problem and most parents do not monitor their child's net access closely which makes it an even BIGGER problem.

    when I have to explain to her that posing a photo of herself on the net for her friends to see is a really bad idea, things are certianly not "overblown".

    --
    Do not look at laser with remaining good eye.
  26. Re:Credit card ? by jadenyk · · Score: 4, Interesting
    So someone with bad credit shouldn't be considered an adult? That's pretty bad.

    Also, what about people that don't feel comfortable giving out their credit card information for age verification purposes? I don't want my credit card information all over the web.

  27. Re:Credit card ? by BenEnglishAtHome · · Score: 5, Interesting
    How is it overblown are there only a few dozen kids abducted / molested a year instead of hundreds so it is no big deal?

    Exactly.

    Freedom has a price. The freedom to travel freely, however you want to, means that a few thousand people a year will die in car accidents. The freedom to speak your mind means that somewhere, sometime, some folks are going to abuse that freedom and incite a riot during which people die. The freedom to keep and bear arms means that some people will be wrongfully shot.

    You can't have the good without the bad.

    So, yeah, it's not exactly no big deal that only a few dozen kids get hurt a year, but that's certainly nowhere near enough justification to sanction any mechanism that may be even a precursor (as has been pointed out in other postings) to restraining the electronic means of exercising our right to freedom of speech and association.

  28. Re:Credit vs. Debit by mikeswi · · Score: 4, Informative

    "c) Using a credit card improves your credit rating. This is why I pay for everything by credit card, then pay off my bill in full every billing cycle."

    Actually, while that is good for your credit, paying it off slower (not in full) looks much better. You're paying the bill (good) but you're also making the lender more money (better), so your credit score goes up further than if you pay the whole thing at once.

    Same as a bank loan. It looks better to pay it off according to the schedule than to jump the gun and pay the whole thing off early.

    Of course, if your credit is already excellent, there's no need to worry with all that. If you're trying to rebuild bad credit, then slower is better.