Thread by @fraser_again

A prime example of the #internet missing a functional “identity layer”

In this case, resulting in a toothless policy publicised on #internetsafetyday

🧵👇

https://twitter.com/BBCNews/status/1490930351484686336

1/ A previous version of this was proposed in 2019 and subsequently dropped as unworkable.

theguardian.com/culture/2019/o…

2/ Little has changed since then and if this statement in the BBC article is true, then these measures will likely be meaningless.

3/ As the article rightly points out, performing these checks thoroughly will create huge honeypots of data with potentially colossal privacy risks.

Anyone remember the Ashley Madison hack?

wired.com/2015/08/happen…

4/ With sites more at risk of breaching personal data if they get this wrong, how many are realistically going to go beyond checking the country of the user’s IP address and then enforce some minor ID check if the user falls within the UK?

5/ This is a potential opportunity for selective disclosure, where an individual can choose what to share with whom.

6/ Without #SSI, this leaks more privacy than it protects as the identity provider can see where the identity is being used…

A bit like this:

7/ It’s more likely that they’ll use the same strategy that many websites used when GDPR came in. Simply block any user from the EU.



wired.co.uk/article/gdpr-c…

8/ Unfortunately, this approach is vulnerable to a very simple workarounds… VPNs such as NordVPN, surfshark, etc

9/ According to GWI, 24% of schoolchildren have used a VPN in the past month, so any site geofencing, will immediately be circumvented here.

blog.gwi.com/chart-of-the-d…

10/ As someone who first used VPNs aged 13 to get around school restrictions on online games, this low number genuinely surprises me. It’s possibly an upshot of content being easier to access than when I grew up where torrenting ruled.

11/ Sadly this is nothing more than publicity-seeking fluff with very little chance of making any impact (whether you agree with it or not).